www.farfeshplus.online Open in urlscan Pro
185.18.205.182 Public Scan

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 d7433132a7c6595c9aab2dc2272e7060.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA60-P1
x-amz-rid: PTNH92Y0X8FJWTC0KH04
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.farfeshplus.online
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: odoxnWS47XANEbQtgQs2J3pqCM3fGSpqZRViXzpAeuwSzndL5W8hcw==

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
468 B 479ms
39ms XHR
text/javascript 13.32.119.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&pid=M2ThXpQ4WlpzF&cb=1&ws=1600x1200&v=23.1108.2350&t=2000&slots=%5B%7B%22sd%22%3A%22farfeshplus.online_728x90_sticky_display_bottom_stiky-bottom%22%2C%22s%22%3A%5B%22728x90%22%5D%7D%5D&pubid=66ef05f7-ad53-48f6-873a-ac7543370392&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.119.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ns31533567.ip-162-19-138.eu

Software

Server /

Resource Hash

89b4aa9e9bf8516c2ab7b5134f65d47b02071637259a14c9f60dccc207e05ce4

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 d7433132a7c6595c9aab2dc2272e7060.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA60-P1
x-amz-rid: 8KF00HT194CM7BVV914W
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.farfeshplus.online
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: gj07swdnRUPS4w-w_UrFtGDZQuHqLFmqR8o4bIT1-5t4ykvIReUMRw==

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
482 B 17ms
17ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://live.demand.supply/e/e.js?r=farfeshplus.online_auto_interstitial_desktop&sn=1&ific=true&e=iar2&dsReferer=ZmFyZmVzaHBsdXMub25saW5lL0ZQNjYuYXNw

Requested by

Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.22.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-nf-request-id: 01HEQ1MZJBXHMY5B8H1HQ8BKGW
date: Wed, 29 Nov 2023 05:47:47 GMT
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1650803
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "4de2110991f3807e8b4a19c48c14f2d1-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 82d88ed2cab8368c-FRA

GET
H2 200 ob.js Show response
cdn-ima.33across.com/ 11 KB
5 KB 56ms
17ms Script
application/javascript 172.64.152.89
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-ima.33across.com/ob.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.152.89 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6cfe89b284e6a2100a86b8d6b0e52b76b85cc62622a40d63e929f328d883a6a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 30 Oct 2023 20:31:13 GMT
server: cloudflare
age: 349503
etag: W/"65401291-2b7d"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=259200
cf-ray: 82d88ed5ae094d5e-FRA
expires: Sat, 02 Dec 2023 05:47:47 GMT

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 76ms
8ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 14 Nov 2023 21:28:00 GMT
content-encoding: gzip
age: 1239587
x-guploader-uploadid: ABPtcPosiWJMTi6DpSufSORNQNukYiP051dDMboge2ChLaAOCj32gcVycc6YGc4ZmCsMil6S048JGg_x_bo6NsyokUiiiqWjYCfy
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Wed, 13 Nov 2024 21:28:00 GMT

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 42 KB
13 KB 66ms
31ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a1a256244f073b9ed474c52d16f8b7d0ed5d92ca4129042d6ee150817671bcd9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 27 Oct 2023 06:43:26 GMT
server: nginx
etag: W/"653b5c0e-a9a7"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Thu, 30 Nov 2023 05:47:47 GMT

GET
H2 200 connectId-gpt.js Show response
connectid.analytics.yahoo.com/ 9 KB
9 KB 59ms
11ms Script
application/javascript 2600:9000:223c:f400:10:dd8:5e40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://connectid.analytics.yahoo.com/connectId-gpt.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223c:f400:10:dd8:5e40:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

c7f6468c8ac1542980b2d5f637fa933d7d00d2c6ff6690e34505d2aed0c0e23a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:30:08 GMT
via: 1.1 6faa38f38a1fee24a829fec7c748876c.cloudfront.net (CloudFront)
content-security-policy: default-src 'self'
x-amz-cf-pop: FRA56-P2
age: 1060
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 8730
x-amz-expiration: expiry-date="Tue, 17 Oct 2028 00:00:00 GMT", rule-id="webapp-standard-lifecycle"
last-modified: Tue, 17 Oct 2023 13:17:45 GMT
server: AmazonS3
etag: "c46e30de24d0f12167e302e9e32ff4a5"
content-type: application/javascript
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: 1HgeyCFyb1aBk9gxsuG5G9B1nFhxj8d5RcBZee5BMCe72xCSjVg26A==

GET
H2 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
1 KB 37ms
14ms Script
application/javascript 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 14927
x-jsd-version: master
content-encoding: br
x-cache: HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230025-FRA
x-jsd-version-type: branch
server: cloudflare
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J894Ph3a73sXheXQTPuUf%2FkexIlRzw0TAy5Q836zDpEXRD8kfGl%2BZ9ieZi3PUUsszILOPs1V7cVYnOTAVPIr9rxNMqKOrwp72ekVIu8%2F6riuGzHXyvTAgxIcAb38jtm8PlMb%2Bxg89%2BxCnEWLQIo%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 82d88ed59e2f2c5a-FRA

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 152 KB
33 KB 27ms
27ms Script
text/javascript 2606:4700:10::ac43:266a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:266a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d050c56b76cb2dae10e3eadd8e8f5e83594db0916d25946bec2f662f69dd776d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 28 Nov 2023 11:19:25 GMT
server: cloudflare
x-amz-request-id: VF0K1FN7KR7ZCCA2
age: 3419
etag: W/"d12fc51ceb66081fc72dabad6e4e0ded"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 82d88ed5a8a29b82-FRA
x-amz-id-2: dr6oJ8UZH6gxgPjsXBxrxBIx6Zp7MkR+d8Xk38cJxE7BlmdtmDakYA5d7D+sYXqzg9fp4ksqnsYnhZfeegZrtg==

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
1 KB 67ms
27ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: b04a268fbd6ac543dcd653b1c529871767a5b78cb2a2f40e54bcb0bfe2daa154

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
via: 1.1 google, 1.1 google
last-modified: Thu, 03 Aug 2023 03:28:51 GMT
server: Google Frontend
etag: fc4e6bfe266081c4873c6f08c8298e5c
content-type: text/javascript; charset=utf-8
x-cloud-trace-context: 0bc030ed4ae604b0a5c3efd3ab64b476
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1207

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 3 KB
3 KB 52ms
9ms Script
text/javascript 2600:9000:2250:a600:a:e047:753:a221
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:a600:a:e047:753:a221 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 72e960baa80ec819264a604f2f8a8e5c21f81b785ebc17595211ad170d8b1bdc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: KP_OVZMS6roEW_XJdOd.KnSEmM8GWiP3
Date: Tue, 28 Nov 2023 10:03:28 GMT
Via: 1.1 f884e2c0a4bd6c75faee34aade3f091e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: FRA60-P2
Age: 71060
x-amz-server-side-encryption: AES256
X-Cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
Connection: keep-alive
Content-Length: 2776
Last-Modified: Thu, 19 Oct 2023 06:40:11 GMT
Server: AmazonS3
ETag: "a3a9a9ee8e72db69d54e805f0586c651"
Content-Type: text/javascript
Accept-Ranges: bytes
X-Amz-Cf-Id: 0C_sg2COBx8qiACUlQIJgqUt_3InlFKzSPocyH-9RWO67Hxr5CBymA==

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 39 KB
12 KB 13ms
13ms Script
text/javascript 65.9.66.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-68.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e885badff253144e188588b5657e13cfa1135d4cd682053c9cca02b83baf1ef2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 07:38:20 GMT
content-encoding: gzip
via: 1.1 b3dc72c60418e8887de31f772538f118.cloudfront.net (CloudFront)
last-modified: Wed, 06 Sep 2023 15:56:57 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
age: 79768
x-amz-server-side-encryption: AES256
etag: W/"e073e71ed7a44e6f9cdd72904fda5940"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: public, max-age=86400
x-amz-cf-id: S0kTov7UTLtEHxrIG16guNuHpAhOHhk9zVrF-hAXYmabNrTMA5F5ug==

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
660 B 640ms
640ms Fetch
text/plain 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=923086590804078&correlator=2251348508017642&eid=31079527&output=ldjh&gdfp_req=1&vrg=202311150101&ptt=17&impl=fif&iu_parts=44890869%3A14363285%2Cca-pub-3831894559014614-tag%2C89c66f27-4524-469b-acd8-7ae73c577f25&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1x1&ifi=2&sfv=1-0-40&ists=1&fas=8&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701236867005&lmt=1701236867&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=false&a3p=EhgKCXlhaG9vLmNvbRi7__nMwTFIAFICCGQSHAoNY3J3ZGNudHJsLm5ldBi7__nMwTFIAFICCGQSGwoMMzNhY3Jvc3MuY29tGLv_-czBMUgAUgIIZBIZCgpwdWJjaWQub3JnGLv_-czBMUgAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRi7__nMwTFIAFICCGQSFwoIcnRiaG91c2UYu__5zMExSABSAghkEhQKBW9wZW54GLv_-czBMUgAUgIIZBIZCgp1aWRhcGkuY29tGLv_-czBMUgAUgIIZBIbCgxpZDUtc3luYy5jb20Yu__5zMExSABSAghk&dlt=1701236866536&idt=404&prev_scp=ti%3D28b1299c-1e08-4457-bdf2-4ca258e10f1c%26interstitials-bid%3D17%26bid-p%3Dgoogle%26bsc%3D95&cust_params=amznbid%3D1%26amznp%3D1&adks=1954765611&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e807123fe0de050fb220d8d636a4ad92d4f563968299e8fbc3ac78c0c9ba1b30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 629
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.farfeshplus.online
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 9BE2 6 KB
3 KB 414ms
26ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:47 GMT
expires: Thu, 28 Nov 2024 05:47:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads.js Show response
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/ 39 KB
13 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl_page_level_ads.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2428653048a13d41cc7aedcb47c0a8398d77a4d4a1cc3f999f9695d5e6d3d528

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 22:59:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24473
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13736
x-xss-protection: 0
server: cafe
etag: 9658267497644244280
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
timing-allow-origin: *
expires: Wed, 27 Nov 2024 22:59:54 GMT

GET
H3 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 150 KB
52 KB 399ms
399ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

992487927a8e9e6f833e507e48e93aaa0f418c5aac8c243238b7d0514c01d3ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52796
x-xss-protection: 0
server: cafe
etag: 11486266491787864567
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:47 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4E2A 732 B
534 B 709ms
705ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=600&slotname=7260452004&adk=1988084761&adf=54630664&pi=t.ma~as.7260452004&w=120&lmt=1701236867&format=120x600&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867038&bpp=1&bdt=502&idt=1&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=7668197056731&frm=20&pv=2&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CenEr%7C&abl=CS&pfx=0&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&fsb=1&dtd=4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

31f6b305628e52e380896707de8827069c2cd8172559efaa6c471049e3ae581e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 361
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:47 GMT
expires: Wed, 29 Nov 2023 05:47:47 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 52F1 732 B
535 B 855ms
852ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1231661633440980&output=html&h=600&slotname=3827245123&adk=203976336&adf=1056458448&pi=t.ma~as.3827245123&w=120&lmt=1701236867&format=120x600&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867044&bpp=1&bdt=508&idt=0&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CenEr%7C&abl=CS&pfx=0&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&fsb=1&dtd=2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

12a2c5cba659fcdeb1f289dda41e1ae5cd6d0b95235ac9d3bd14f7f9e77cc8d5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 362
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:47 GMT
expires: Wed, 29 Nov 2023 05:47:47 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 419D 26 KB
12 KB 734ms
731ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1231661633440980&output=html&h=600&slotname=8400035594&adk=833794805&adf=1602281170&pi=t.ma~as.8400035594&w=160&lmt=1701236867&format=160x600&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867047&bpp=1&bdt=511&idt=0&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CenEr%7C&abl=CS&pfx=0&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&fsb=1&dtd=2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c067798a31b168f295f38961524b57a5372be57022b274608df3d259291c5f36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 11689
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:47 GMT
expires: Wed, 29 Nov 2023 05:47:47 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 243 KB
84 KB 381ms
381ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-9NTBGJYJES&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-192956646-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f0617a7cf6bdeb3f6203d012da16f4962a26b08daf60aea7ff15c714a6b82f37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 85967
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 29 Nov 2023 05:47:47 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 52ms
14ms Script
text/javascript 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-192956646-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 29 Nov 2023 03:49:38 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 7089
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Wed, 29 Nov 2023 05:49:38 GMT

POST
H2 204 collect
region1.google-analytics.com/g/ 0
260 B 50ms
16ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-DNX5KLEBSB&gtm=45je3b81v874724234&_p=1701236867020&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=2062919147.1701236867&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ngs=1&_s=1&sid=1701236867&sct=1&seg=0&dl=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&dt=Farfeshplus.online%20%7C%20%D9%85%D9%88%D9%82%D8%B9%20%D9%81%D8%B1%D9%81%D8%B4%20-%20%D8%B4%D8%A7%D9%87%D8%AF%20%D9%85%D8%AC%D8%A7%D9%86%D9%8A%20%D8%A3%D8%AD%D8%AF%D8%AB%20%D9%85%D8%B3%D9%84%D8%B3%D9%84%D8%A7%D8%AA%20%D8%B1%D9%85%D8%B6%D8%A7%D9%86%202023&en=page_view&_fv=1&_ss=1&_ee=1&tfd=1917
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-DNX5KLEBSB
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.farfeshplus.online
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2595 23 KB
11 KB 913ms
913ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1231661633440980&output=html&h=600&slotname=2065248459&adk=1530395088&adf=4061442901&pi=t.ma~as.2065248459&w=300&lmt=1701236867&format=300x600&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867069&bpp=1&bdt=533&idt=1&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=0&ady=0&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaE%7C&abl=CA&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&fsb=1&dtd=3

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bd302203f033be1cc4b81725d97a8de682062befc60aea6b59bb9d8edff88747

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 10652
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:47 GMT
expires: Wed, 29 Nov 2023 05:47:47 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 35ms
8ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

a50fd1391476cf45afd791075a49337bbce06f086697f2b107ace1a2d031e236

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 29 Nov 2023 05:47:47 GMT
content-md5: gRUm6hCftDGmesVX7YevTg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1686
reporting-endpoints
x-fb-debug: ttyAJoAbb0wCsPm+PhqP6k4lXtcKkvqEzaDqwBPspDFa1EcBWhxvU8iddG9P0qCAFYJH9LRroO8yTdeek6bk/A==
x-fb-content-md5: bb0928123bdcbdd7654997c2cd33e255
cross-origin-opener-policy: same-origin-allow-popups
etag: "d264aa03a1c6a26b5911c34e1bfe90d5"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:50:15 GMT

GET
H/1.1 200
OK recangelorange.png
www.farfeshplus.online/images/ 1002 B
1 KB 413ms
64ms Image
image/png 185.18.205.182
INTERHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.farfeshplus.online/images/recangelorange.png
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.18.205.182 Rehovot, Israel, ASN61102 (INTERHOST, IL),
Reverse DNS: 182.205.interhost.co.il
Software: /
Resource Hash: 66bdbc6f334ad5094c875459d3a9b88c52f2f065759d45f0d5c8d0262d327ddf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/FP66.asp
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:47 GMT
Last-Modified: Wed, 04 Oct 2017 17:12:10 GMT
X-Cacheable: YES
Age: 61112
ETag: "65ef4eea333dd31:0"
X-Cache: HIT
Content-Type: image/png
cache-control: max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 1002

GET
H/1.1 200
OK spacer.gif
www.farfeshplus.online/images/ 47 B
352 B 412ms
63ms Image
image/gif 185.18.205.182
INTERHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.farfeshplus.online/images/spacer.gif
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.18.205.182 Rehovot, Israel, ASN61102 (INTERHOST, IL),
Reverse DNS: 182.205.interhost.co.il
Software: /
Resource Hash: 414065eb8bccfeced9386a863dba180b1ab3153b18395b3bd4e855e0ee860f4e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/FP66.asp
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:47 GMT
Last-Modified: Wed, 31 Mar 2021 10:07:53 GMT
X-Cacheable: YES
Age: 58511
ETag: "affecbb61526d71:0"
X-Cache: HIT
Content-Type: image/gif
cache-control: max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 47

GET
H/1.1 200
OK farfeshplusmasterBR.jpg
www.farfeshplus.online/images/ 4 KB
4 KB 411ms
62ms Image
image/jpeg 185.18.205.182
INTERHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.farfeshplus.online/images/farfeshplusmasterBR.jpg
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/s.farfesh/Css/CssClear1.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.18.205.182 Rehovot, Israel, ASN61102 (INTERHOST, IL),
Reverse DNS: 182.205.interhost.co.il
Software: /
Resource Hash: ac7b85c89057a31981b2af0d754be1b67ab4af30d0d0b99e3088ea38562e2f38

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/s.farfesh/Css/CssClear1.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:47 GMT
Last-Modified: Thu, 05 Oct 2017 06:29:33 GMT
X-Cacheable: YES
Age: 60431
ETag: "ca42b54ea33dd31:0"
X-Cache: HIT
Content-Type: image/jpeg
cache-control: max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 3887

GET
H/1.1 200
OK farfeshplasmasterlogo215x54.new.jpg
www.farfeshplus.online/images/ 8 KB
8 KB 414ms
65ms Image
image/jpeg 185.18.205.182
INTERHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.farfeshplus.online/images/farfeshplasmasterlogo215x54.new.jpg
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/s.farfesh/Css/CssClear1.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.18.205.182 Rehovot, Israel, ASN61102 (INTERHOST, IL),
Reverse DNS: 182.205.interhost.co.il
Software: /
Resource Hash: 8a4ff76232f9c5b9a8829282a44f96a88ad7c45f64ac597228805b1e8e6074ef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/s.farfesh/Css/CssClear1.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:47 GMT
Last-Modified: Sat, 25 Nov 2017 14:02:31 GMT
X-Cacheable: YES
Age: 60431
ETag: "a910839f665d31:0"
X-Cache: MISS
Content-Type: image/jpeg
cache-control: max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 8143

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9A6C 102 KB
38 KB 2463ms
2463ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1701236867&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867074&bpp=3&bdt=538&idt=3&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7668197056731&frm=20&pv=2&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&fsb=1&dtd=4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

16b3fec1c4ab8867926452c94612767c603305e599980bef49bba30d2ec2af9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 38921
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:49 GMT
expires: Wed, 29 Nov 2023 05:47:49 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK backgroundF373x212.png
www.farfeshplus.online/images/ 8 KB
8 KB 467ms
63ms Image
image/png 185.18.205.182
INTERHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.farfeshplus.online/images/backgroundF373x212.png
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.18.205.182 Rehovot, Israel, ASN61102 (INTERHOST, IL),
Reverse DNS: 182.205.interhost.co.il
Software: /
Resource Hash: 13b3d907e5f12196acef4a97be670c4c1f23b8167d03e85d25a8493f0311ee5b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/FP66.asp
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:47 GMT
Last-Modified: Sat, 25 Nov 2017 14:24:14 GMT
X-Cacheable: YES
Age: 58241
ETag: "2e262312f965d31:0"
X-Cache: HIT
Content-Type: image/png
cache-control: max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 8232

GET
H/1.1 200
OK search1.jpg
www.farfeshplus.online/images/ 2 KB
2 KB 468ms
64ms Image
image/jpeg 185.18.205.182
INTERHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.farfeshplus.online/images/search1.jpg
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/s.farfesh/Css/CssClear1.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.18.205.182 Rehovot, Israel, ASN61102 (INTERHOST, IL),
Reverse DNS: 182.205.interhost.co.il
Software: /
Resource Hash: fa40f4a8ee08b163e5c78cd66b81799e23cb9a95ee661c1218a11fc6f3d02431

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/s.farfesh/Css/CssClear1.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:47 GMT
Last-Modified: Sat, 14 Oct 2017 15:06:45 GMT
X-Cacheable: YES
Age: 57907
ETag: "c9f9f7cfe44d31:0"
X-Cache: HIT
Content-Type: image/jpeg
cache-control: max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 1641

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame AAB1 23 KB
10 KB 1008ms
1008ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

424884d8c1f2166b8876496ae3d824d44d6bec9b81dda6f2b6de11755957e07c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 10562
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:48 GMT
expires: Wed, 29 Nov 2023 05:47:48 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9794 23 KB
10 KB 911ms
911ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3759532572&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867093&bpp=2&bdt=556&idt=2&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=9&uci=a!9&btvi=1&fsb=1&dtd=5

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

32a331449599db32107e1ad33ee0d2c8ce11545f621bdca9b83766d2d1689490

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 10496
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:48 GMT
expires: Wed, 29 Nov 2023 05:47:48 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK 2027.jpg
www.farfeshplus.online/ramadanimages/ 18 KB
18 KB 131ms
130ms Image
image/jpeg 185.18.205.182
INTERHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.farfeshplus.online/ramadanimages/2027.jpg
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.18.205.182 Rehovot, Israel, ASN61102 (INTERHOST, IL),
Reverse DNS: 182.205.interhost.co.il
Software: /
Resource Hash: 6724650cab7036ecab187c9a7a47c3e77f80f0732a71bfcb7ef7eed98de9455b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/FP66.asp
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:48 GMT
Last-Modified: Sun, 15 Oct 2023 08:27:14 GMT
X-Cacheable: YES
Age: 61136
ETag: "6467ca6641ffd91:0"
X-Cache: HIT
Content-Type: image/jpeg
cache-control: max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 17969

GET
H/1.1 200
OK orang_back2.jpg
www.farfeshplus.online/images/ 403 B
709 B 66ms
64ms Image
image/jpeg 185.18.205.182
INTERHOST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.farfeshplus.online/images/orang_back2.jpg
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.18.205.182 Rehovot, Israel, ASN61102 (INTERHOST, IL),
Reverse DNS: 182.205.interhost.co.il
Software: /
Resource Hash: e1ef7800360b198e12835c27f1b5c5f7c331f6110c9488266b9d3a138943f37b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/FP66.asp
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:48 GMT
Last-Modified: Mon, 02 Oct 2017 06:56:39 GMT
X-Cacheable: YES
Age: 1517
ETag: "89f580984b3bd31:0"
X-Cache: HIT
Content-Type: image/jpeg
cache-control: max-age=604800
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 403

GET
H/1.1 404
Not Found thesansarabic-plain-webfont.woff2
www.farfeshplus.online/fontsNew/ 0
0 374ms
63ms Font
text/html 185.18.205.182
INTERHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://www.farfeshplus.online/fontsNew/thesansarabic-plain-webfont.woff2
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/fontsNew/fonts.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.18.205.182 Rehovot, Israel, ASN61102 (INTERHOST, IL),
Reverse DNS: 182.205.interhost.co.il
Software: /
Resource Hash

Request headers

Referer: https://www.farfeshplus.online/fontsNew/fonts.css
Origin: https://www.farfeshplus.online
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:47 GMT
X-Cacheable: YES
age: 0
X-Cache: HIT
Content-Type: text/html; charset=utf-8
cache-control: max-age=300
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7355

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame BC94 116 KB
41 KB 630ms
629ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=544333611&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1701236867&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867111&bpp=6&bdt=575&idt=6&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=2350&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&btvi=2&fsb=1&dtd=9

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7bf55a4170ee9ce58e5d69c98f948050c941ea0fc65c54cf871a11a80b875e1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 41848
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:47 GMT
expires: Wed, 29 Nov 2023 05:47:47 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 747E 118 KB
40 KB 821ms
821ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1231661633440980&output=html&h=280&slotname=9134183485&adk=3378407940&adf=2021203405&pi=t.ma~as.9134183485&w=336&lmt=1701236867&format=336x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867126&bpp=4&bdt=590&idt=4&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=556&ady=3115&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=3&fsb=1&dtd=6

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f2a6cbafff97b252134592deaaa97565a590da2a45d0b3022efa5993b32d4698

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 40949
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:47 GMT
expires: Wed, 29 Nov 2023 05:47:47 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4336 26 KB
12 KB 814ms
814ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=250&slotname=2097210043&adk=239546933&adf=744370384&pi=t.ma~as.2097210043&w=300&lmt=1701236867&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867134&bpp=1&bdt=598&idt=1&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=574&ady=3880&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=12&uci=a!c&btvi=4&fsb=1&dtd=3

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8c0e44652983c0efa93e61e5e762784ce77709983eb8613ee492f9d3a90aa1c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 11710
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:47 GMT
expires: Wed, 29 Nov 2023 05:47:47 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 7548 26 KB
12 KB 619ms
618ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=250&slotname=6076681977&adk=2278793534&adf=954853469&pi=t.ma~as.6076681977&w=300&lmt=1701236867&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867142&bpp=1&bdt=605&idt=1&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280%2C300x250&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=574&ady=4615&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=5&fsb=1&dtd=4

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6d2307b494f2de331fa6594a861e34b952438e3ea31ab3fa726139d98d9862cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 11714
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:47 GMT
expires: Wed, 29 Nov 2023 05:47:47 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

HEAD
H3 200 e.js Show response
live.demand.supply/x/ 0
481 B 319ms
319ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://live.demand.supply/x/e.js?ce=fs&dsReferer=ZmFyZmVzaHBsdXMub25saW5lL0ZQNjYuYXNw

Requested by

Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.22.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-nf-request-id: 01HEWEAPYCGWM89QJZW1APK8QB
date: Wed, 29 Nov 2023 05:47:47 GMT
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1572019
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "901b70ae40b5b064aef6259e869a717e-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 82d88ed55c94368c-FRA

HEAD
H3 200 e.js Show response
live.demand.supply/x/ 0
481 B 240ms
240ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://live.demand.supply/x/e.js?ce=um&dsReferer=ZmFyZmVzaHBsdXMub25saW5lL0ZQNjYuYXNw

Requested by

Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.22.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-nf-request-id: 01HEWEAPYCGWM89QJZW1APK8QB
date: Wed, 29 Nov 2023 05:47:47 GMT
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1572019
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "901b70ae40b5b064aef6259e869a717e-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 82d88ed55c96368c-FRA

HEAD
H3 200 e.js Show response
live.demand.supply/x/ 0
483 B 240ms
240ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://live.demand.supply/x/e.js?ce=od&pp=BODY&dsReferer=ZmFyZmVzaHBsdXMub25saW5lL0ZQNjYuYXNw

Requested by

Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.22.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-nf-request-id: 01HEWEAPYCGWM89QJZW1APK8QB
date: Wed, 29 Nov 2023 05:47:47 GMT
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1572019
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "901b70ae40b5b064aef6259e869a717e-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 82d88ed55c98368c-FRA

GET
H3 200 farfeshplus.online_fluid_lb_farfesh728x90 Show response
live.demand.supply/cp/ 29 B
372 B 368ms
368ms XHR
text/plain 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://live.demand.supply/cp/farfeshplus.online_fluid_lb_farfesh728x90?mlcu=null&mlos=wi&mlbr=ch&mlla=en&dsReferer=ZmFyZmVzaHBsdXMub25saW5lL0ZQNjYuYXNw
Requested by: Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.22.0.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 480485d28cc09550e084a2d1a256ade64024dba86021189e514009b51565e633

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/plain;charset=UTF-8
access-control-allow-origin: *
cache-control: private,max-age=3600
cf-ray: 82d88ed55c99368c-FRA
alt-svc: h3=":443"; ma=86400
content-length: 29

GET
H2 200 farfeshplus.online_728x90_sticky_display_bottom_new-sticky-right Show response
api.demand.supply/v17-21-0/a/ 415 B
746 B 347ms
98ms XHR
application/json 2606:4700::6810:8616
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.demand.supply/v17-21-0/a/farfeshplus.online_728x90_sticky_display_bottom_new-sticky-right?&dsReferer=ZmFyZmVzaHBsdXMub25saW5lL0ZQNjYuYXNw
Requested by: Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.22.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:8616 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d51dfd88b196b19bc43d22af7ef6aab129384127bbedde07503475745896729e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 1440
etag: W/"19f-ODwJGcBjNy2YBa941MvsLJEzD/8"
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=3600, s-maxage=7200, stale-while-revalidate=3600, stale-if-error=84600
cf-ray: 82d88ed58ab12c6a-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 826 B
424 B 361ms
360ms Fetch
text/plain 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=923086590804078&correlator=3661043927629597&eid=31079527&output=ldjh&gdfp_req=1&vrg=202311150101&ptt=17&impl=fif&iu_parts=44890869%3A14363285%2Cca-pub-3831894559014614-tag%2C25e86c56-693c-4807-bebb-f4ded0808196&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1x1&ifi=16&sfv=1-0-40&ists=1&fas=1&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1701236867401&lmt=1701236867&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=true&a3p=EhgKCXlhaG9vLmNvbRi7__nMwTFIAFICCGQSHAoNY3J3ZGNudHJsLm5ldBi7__nMwTFIAFICCGQSGwoMMzNhY3Jvc3MuY29tGLv_-czBMUgAUgIIZBIZCgpwdWJjaWQub3JnGLv_-czBMUgAUgIIZBIdCg5lc3AuY3JpdGVvLmNvbRi7__nMwTFIAFICCGQSFwoIcnRiaG91c2UYu__5zMExSABSAghkEhQKBW9wZW54GLv_-czBMUgAUgIIZBIZCgp1aWRhcGkuY29tGLv_-czBMUgAUgIIZBIbCgxpZDUtc3luYy5jb20Yu__5zMExSABSAghk&dlt=1701236866536&idt=404&prev_scp=ti%3D28b1299c-1e08-4457-bdf2-4ca258e10f1c%26interstitials-bid%3D1.2%26bid-p%3Dgoogle%26rfi%3D30%26stt%3Dbhs%26bsc%3D95&cust_params=amznbid%3D1%26amznp%3D1&adks=2911312443&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3714b9b269d266c4aa338d3b87ded359cb9c507fb73136feb6bdc4352327d0e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 393
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.farfeshplus.online
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 404
Not Found thesansarabic-plain-webfont.woff
www.farfeshplus.online/fontsNew/ 0
0 109ms
62ms Font
text/html 185.18.205.182
INTERHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://www.farfeshplus.online/fontsNew/thesansarabic-plain-webfont.woff
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/fontsNew/fonts.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.18.205.182 Rehovot, Israel, ASN61102 (INTERHOST, IL),
Reverse DNS: 182.205.interhost.co.il
Software: /
Resource Hash

Request headers

Referer: https://www.farfeshplus.online/fontsNew/fonts.css
Origin: https://www.farfeshplus.online
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:47 GMT
X-Cacheable: YES
age: 0
X-Cache: HIT
Content-Type: text/html; charset=utf-8
cache-control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7353

POST
H2 204 collect
region1.google-analytics.com/g/ 0
55 B 16ms
16ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-9NTBGJYJES&gtm=45je3b81v890621808&_p=1701236867020&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=2062919147.1701236867&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AAAI&_s=1&sid=1701236867&sct=1&seg=0&dl=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&dt=Farfeshplus.online%20%7C%20%D9%85%D9%88%D9%82%D8%B9%20%D9%81%D8%B1%D9%81%D8%B4%20-%20%D8%B4%D8%A7%D9%87%D8%AF%20%D9%85%D8%AC%D8%A7%D9%86%D9%8A%20%D8%A3%D8%AD%D8%AF%D8%AB%20%D9%85%D8%B3%D9%84%D8%B3%D9%84%D8%A7%D8%AA%20%D8%B1%D9%85%D8%B6%D8%A7%D9%86%202023&en=page_view&_fv=1&_ss=1&tfd=2378
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-9NTBGJYJES&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.farfeshplus.online
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 increment Show response
id5-sync.com/api/esp/ 0
238 B 62ms
15ms XHR
text/plain 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.farfeshplus.online/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.farfeshplus.online
date: Wed, 29 Nov 2023 05:47:46 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 hadron.json Show response
id.hadron.ad.gt/v1/ 103 B
295 B 108ms
107ms XHR
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=575&sync=0&domain=www.farfeshplus.online&url=https://www.farfeshplus.online/FP66.asp
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ref=&_it=amazon&partner_id=575
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b022877ed906c4a53b7074ac57b294563d7ac3ca2f076ef27f593b355e7f72a9

Request headers

Referer: https://www.farfeshplus.online/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-methods: HEAD,GET,POST,PUT,DELETE,OPTIONS
content-type: application/json
access-control-allow-origin: *
cache-control: private,max-age=30
access-control-allow-credentials: true
debug: NON-OPTIONS
access-control-allow-headers: authorization
cf-ray: 82d88ed72c3a65c4-FRA

OPTIONS
H2 200 hadron.json
id.hadron.ad.gt/v1/ Frame 0
0 142ms
108ms Preflight
application/json 2606:4700:10::ac43:17ea
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://id.hadron.ad.gt/v1/hadron.json?_it=amazon&partner_id=575&sync=0&domain=www.farfeshplus.online&url=https://www.farfeshplus.online/FP66.asp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:17ea , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://www.farfeshplus.online
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-origin: *
allow: POST, OPTIONS, GET
cache-control: max-age=31536000 public, no-transform
cf-cache-status: DYNAMIC
cf-ray: 82d88ed67b6c65c4-FRA
content-length: 0
content-type: application/json
date: Wed, 29 Nov 2023 05:47:47 GMT
debug: OPTIONS block
expires: Thu, 28 Nov 2024 05:47:47 GMT
server: cloudflare

GET
H2 200 fed Show response
ups.analytics.yahoo.com/ups/58813/ 2 B
218 B 52ms
10ms XHR
application/json 3.71.149.231
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ups.analytics.yahoo.com/ups/58813/fed?gpp_sid=-1&v=1&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp

Requested by

Host: connectid.analytics.yahoo.com
URL: https://connectid.analytics.yahoo.com/connectId-gpt.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-71-149-231.eu-central-1.compute.amazonaws.com

Software

ATS/9.1.10.87 /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.87
age: 0
vary: Origin
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
access-control-allow-origin: https://www.farfeshplus.online
content-type: application/json
access-control-allow-credentials: true

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
466 B 39ms
38ms XHR
text/javascript 13.32.119.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&pid=M2ThXpQ4WlpzF&cb=2&ws=1600x1200&v=23.1108.2350&t=2000&slots=%5B%7B%22sd%22%3A%22farfeshplus.online_728x90_sticky_display_bottom_new-sticky-right%22%2C%22s%22%3A%5B%22160x600%22%5D%7D%5D&pubid=66ef05f7-ad53-48f6-873a-ac7543370392&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.119.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

5d7c7d25a0da74c0dd466120c3c09bd94cb982fc66ebc4a78675339f37323bf5

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 d7433132a7c6595c9aab2dc2272e7060.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA60-P1
x-amz-rid: FC82NZZKHY7PFXJ30G12
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.farfeshplus.online
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: NlszPOpobr9akH4H5rz2L2_SuMs_Q5qtagC5bB3Z_lB251hDLA7eXw==

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
339 B 117ms
33ms XHR
application/json 54.216.79.244
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16576/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.216.79.244 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-216-79-244.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 90d1afee33cc057fb1b00cc4d6eb6e0a303a3913819168d865ac6f730f0c3fbc

Request headers

Referer: https://www.farfeshplus.online/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://www.farfeshplus.online
cache-control: no-cache
x-server: 10.45.7.100
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame CA92 15 KB
6 KB 71ms
15ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.farfeshplus.online

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

08106c7bf341e3850ac42fe1844e6a66013f726e6927a91c2b965a6861c97121

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:47 GMT
server: Kestrel
server-processing-duration-in-ticks: 354846
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
483 B 17ms
16ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://live.demand.supply/e/e.js?r=farfeshplus.online_fluid_lb_farfesh728x90&pdc=0.1759437382221222&ucv=null&e=tcp&dsReferer=ZmFyZmVzaHBsdXMub25saW5lL0ZQNjYuYXNw

Requested by

Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.22.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-nf-request-id: 01HEQ1MZJBXHMY5B8H1HQ8BKGW
date: Wed, 29 Nov 2023 05:47:47 GMT
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1650803
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "4de2110991f3807e8b4a19c48c14f2d1-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 82d88ed6edc0368c-FRA

GET
H2 200 bid Show response
aax.amazon-adsystem.com/e/dtb/ 23 B
466 B 50ms
50ms XHR
text/javascript 13.32.119.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&pid=M2ThXpQ4WlpzF&cb=3&ws=1600x1200&v=23.1108.2350&t=2000&slots=%5B%7B%22sd%22%3A%22farfeshplus.online_fluid_lb_farfesh728x90%22%2C%22s%22%3A%5B%22728x90%22%5D%7D%5D&pubid=66ef05f7-ad53-48f6-873a-ac7543370392&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.119.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Server /

Resource Hash

1c4777fe3a673a05492e27d08032cc91c23ac5389897c9235b09b8b0f5a74db3

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 d7433132a7c6595c9aab2dc2272e7060.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA60-P1
x-amz-rid: SN1MW9D874Y05RZ0NTA5
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.farfeshplus.online
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: NS5f-QHInSIf2KBxIVolfF41We8Uf5APJrmU1jyGiObGPCHzM_RhMg==

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
340 B 64ms
32ms XHR
application/json 54.216.79.244
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.216.79.244 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-216-79-244.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: f6d6514d242cb31c66d9d65f551909e68133ea3af403c8fcf1d91adb5cd88b19

Request headers

Referer: https://www.farfeshplus.online/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://www.farfeshplus.online
cache-control: no-cache
x-server: 10.45.11.89
access-control-allow-credentials: true
content-length: 60
expires: 0

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&rid=esp&cc=1

85 B
204 B

115ms
115ms

Fetch
application/json

34.120.135.53
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&rid=esp&cc=1
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp
Protocol: H2
Server: 34.120.135.53 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 53.135.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: 896d2d13e4fc7c0fce4af0b915212cd6e2379b257de0b25038a55aa1cfde2ba4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-5jn/g+qNlyyEeLqGX4ZP1AhFaYE"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.farfeshplus.online
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Wed, 29 Nov 2023 05:47:47 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://www.farfeshplus.online
location: /esp?url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H/1.1 200
OK thesansarabic-plain-webfont.ttf
www.farfeshplus.online/fontsNew/ 50 KB
50 KB 145ms
64ms Font
application/octet-stream 185.18.205.182
INTERHOST

General

Check archive.org

Show headers Download Go to

Full URL: https://www.farfeshplus.online/fontsNew/thesansarabic-plain-webfont.ttf
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/fontsNew/fonts.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.18.205.182 Rehovot, Israel, ASN61102 (INTERHOST, IL),
Reverse DNS: 182.205.interhost.co.il
Software: /
Resource Hash: 29284b45a7fc45684d9643d2da72c9010f383f7cb63a82c783913719b266e0d2

Request headers

Referer: https://www.farfeshplus.online/fontsNew/fonts.css
Origin: https://www.farfeshplus.online
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:47 GMT
Last-Modified: Mon, 02 Oct 2017 07:12:27 GMT
X-Cacheable: YES
age: 0
ETag: "d5e299cd4d3bd31:0"
X-Cache: HIT
Content-Type: application/octet-stream
cache-control: max-age=300
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 51232

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
483 B 22ms
22ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://live.demand.supply/e/e.js?r=farfeshplus.online_728x90_sticky_display_bottom_new-sticky-right&e=oc&dsReferer=ZmFyZmVzaHBsdXMub25saW5lL0ZQNjYuYXNw

Requested by

Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.22.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-nf-request-id: 01HEQ1MZJBXHMY5B8H1HQ8BKGW
date: Wed, 29 Nov 2023 05:47:47 GMT
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1650803
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "4de2110991f3807e8b4a19c48c14f2d1-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 82d88ed6fde5368c-FRA

GET
H3 200 all.js Show response
connect.facebook.net/en_US/ 299 KB
84 KB 17ms
9ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js?hash=ab1ad291233049a6d43fa4989ac691b5

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f7bc2c9d1d8c7f2fae034ebfc5683a6867ab7d6615f11951957fe128b1746a15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.farfeshplus.online/
Origin: https://www.farfeshplus.online
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Wed, 29 Nov 2023 05:47:47 GMT
content-md5: uIGDL0c4vrgMENM5c9Co8w==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 86308
reporting-endpoints
x-fb-debug: Id8ZsFPKJDWRWLjbb7vkzKbRVdeT0TeWWqzZdUQAQYcFy5hULB2eDuy0KDozmxIHtlobUGOmvJtvFGOUFu1RIA==
x-fb-content-md5: a2d170f96ba638605ab297a733f44bc6
cross-origin-opener-policy: same-origin-allow-popups
etag: "d883d7009d39cac59862a4934c78ed63"
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
origin-agent-cluster: ?0
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
priority: u=3,i
expires: Thu, 28 Nov 2024 03:58:55 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
212 B 22ms
22ms XHR
text/plain 2a00:1450:4001:82b::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1295869862&t=pageview&_s=1&dl=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ul=en-us&de=windows-1256&dt=Farfeshplus.online%20%7C%20%D9%85%D9%88%D9%82%D8%B9%20%D9%81%D8%B1%D9%81%D8%B4%20-%20%D8%B4%D8%A7%D9%87%D8%AF%20%D9%85%D8%AC%D8%A7%D9%86%D9%8A%20%D8%A3%D8%AD%D8%AF%D8%AB%20%D9%85%D8%B3%D9%84%D8%B3%D9%84%D8%A7%D8%AA%20%D8%B1%D9%85%D8%B6%D8%A7%D9%86%202023&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAUABAAAAACAAI~&jid=1539540434&gjid=1705235793&cid=2062919147.1701236867&tid=UA-192956646-1&_gid=421679979.1701236868&_r=1&gtm=457e3b81&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&jsscut=1&z=541752796

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.farfeshplus.online/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.farfeshplus.online
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
480 B 96ms
96ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://live.demand.supply/e/e.js?r=farfeshplus.online_auto_interstitial_desktop&e=nai&dsReferer=ZmFyZmVzaHBsdXMub25saW5lL0ZQNjYuYXNw

Requested by

Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.22.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-nf-request-id: 01HEQ1MZJBXHMY5B8H1HQ8BKGW
date: Wed, 29 Nov 2023 05:47:47 GMT
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1650803
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "4de2110991f3807e8b4a19c48c14f2d1-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 82d88ed71e0e368c-FRA

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
482 B 14ms
14ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://live.demand.supply/e/e.js?r=farfeshplus.online_auto_interstitial_desktop&sn=2&ific=false&e=iar2&dsReferer=ZmFyZmVzaHBsdXMub25saW5lL0ZQNjYuYXNw

Requested by

Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.22.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-nf-request-id: 01HEQ1MZJBXHMY5B8H1HQ8BKGW
date: Wed, 29 Nov 2023 05:47:47 GMT
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1650803
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "4de2110991f3807e8b4a19c48c14f2d1-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 82d88ed71e10368c-FRA

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 978 B
515 B 644ms
644ms Fetch
text/plain 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=923086590804078&correlator=241779526791470&eid=31079527&output=ldjh&gdfp_req=1&vrg=202311150101&ptt=17&impl=fif&iu_parts=44890869%3A14363285%2Cca-pub-3831894559014614-tag%2C46e9fa33-432d-4708-8bf3-791194c8569b&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1x1&ifi=17&sfv=1-0-40&ists=1&fas=8&eri=1&sc=1&cookie=ID%3D4fd2546216ab5681%3AT%3D1701236867%3ART%3D1701236867%3AS%3DALNI_MYspusffGBmigty4ekYI0v6OCBf5A&gpic=UID%3D00000cfcfba028b2%3AT%3D1701236867%3ART%3D1701236867%3AS%3DALNI_Ma-RvA1LcMV9F0IlAD-QLngBgV0jw&abxe=1&dt=1701236867689&lmt=1701236867&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYu__5zMExSABSAghkEhsKDDMzYWNyb3NzLmNvbRi7__nMwTFIAFICCGQSGQoKcHViY2lkLm9yZxi1g_rMwTFIAFICCGoSGAoJeWFob28uY29tGO2D-szBMUgAUgIIbxIdCg5lc3AuY3JpdGVvLmNvbRi7__nMwTFIAFICCGQSFwoIcnRiaG91c2UY2YT6zMExSABSAghqEhQKBW9wZW54GLv_-czBMUgAUgIIZBIZCgp1aWRhcGkuY29tGLv_-czBMUgAUgIIZBIbCgxpZDUtc3luYy5jb20Yz4T6zMExSABSAghq&dlt=1701236866536&idt=404&prev_scp=ti%3D28b1299c-1e08-4457-bdf2-4ca258e10f1c%26interstitials-bid%3D7%26bid-p%3Dgoogle%26bsc%3D95&adks=3517198607&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c7eec3020480d3e47a1ac0fb7d8df315274ce9674ee15b8022249f93693262a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 483
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.farfeshplus.online
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 26 KB
12 KB 363ms
362ms Fetch
text/plain 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=923086590804078&correlator=1628895396017687&eid=31079527&output=ldjh&gdfp_req=1&vrg=202311150101&ptt=17&impl=fif&iu_parts=44890869%3A14363285%2Cca-pub-3831894559014614-tag%2C541835a7-9a87-4665-a160-6979361d59fe&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=760x100%7C600x100%7C728x90&ifi=18&sfv=1-0-40&eri=1&sc=1&cookie=ID%3D4fd2546216ab5681%3AT%3D1701236867%3ART%3D1701236867%3AS%3DALNI_MYspusffGBmigty4ekYI0v6OCBf5A&gpic=UID%3D00000cfcfba028b2%3AT%3D1701236867%3ART%3D1701236867%3AS%3DALNI_Ma-RvA1LcMV9F0IlAD-QLngBgV0jw&abxe=1&dt=1701236867720&lmt=1701236867&adxs=420&adys=1876&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&vis=1&psz=760x-1&msz=760x-1&fws=4&ohw=1600&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYu__5zMExSABSAghkEhsKDDMzYWNyb3NzLmNvbRi7__nMwTFIAFICCGQSGQoKcHViY2lkLm9yZxi1g_rMwTFIAFICCGoSGAoJeWFob28uY29tGO2D-szBMUgAUgIIbxIdCg5lc3AuY3JpdGVvLmNvbRi7__nMwTFIAFICCGQSFwoIcnRiaG91c2UY2YT6zMExSABSAghqEhQKBW9wZW54GLv_-czBMUgAUgIIZBIZCgp1aWRhcGkuY29tGLv_-czBMUgAUgIIZBIbCgxpZDUtc3luYy5jb20Yz4T6zMExSABSAghq&dlt=1701236866536&idt=404&prev_scp=ti%3D28b1299c-1e08-4457-bdf2-4ca258e10f1c%26chrand%3Dy%26pof%3D0%26bid%3D0.1%26bid-p%3Dgoogle%26bsc%3D95&adks=2943580809&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4feca66daaecb58e4831c9c1ffff19fc0bdc85c4fda93b9553d81b3722e0fc69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12688
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.farfeshplus.online
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 status
www.facebook.com/x/oauth/ 0
0 61ms
37ms Fetch
text/plain 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?client_id=382287608570983&input_token&origin=1&redirect_uri=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&sdk=joey&wants_cookie_data=false

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=ab1ad291233049a6d43fa4989ac691b5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
date: Wed, 29 Nov 2023 05:47:47 GMT
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown"
pragma: no-cache
x-fb-debug: SblXvOWQQ1Nb+4Hv5xbna9l1Bzm67ca6SFp6iHOyQ/ekizAgvQd4M1RZiiY5qE2Ok2pkJbwGHeqqAcRLSj9W3w==
fb-s: unknown
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.farfeshplus.online
origin-agent-cluster: ?0
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(self), geolocation=(self), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), payment=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), usb=(), window-management=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

sid Show response
mug.criteo.com/ Frame CA92
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=farfeshplus.online&sn=ChromeSyncframe&so=0&topUrl=www.farfeshplus.online&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=f8vSF3xVNEsvYnpxYzNybDlEdUlUWXdEazJZc0tkZzZ6aFJBY0hGL3JhMm1aRHVtaCtNblRjOTBaU0JTRWRYZDZJQnF4R0RNZExUSkY4c0RISkRZbGRNTE5GL2x5Y0RBV05na0FpbEpVZHpKa05PYkZxeTZHZzYwaUhKMl...

473 B
679 B

15ms
14ms

Fetch
application/json

2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=f8vSF3xVNEsvYnpxYzNybDlEdUlUWXdEazJZc0tkZzZ6aFJBY0hGL3JhMm1aRHVtaCtNblRjOTBaU0JTRWRYZDZJQnF4R0RNZExUSkY4c0RISkRZbGRNTE5GL2x5Y0RBV05na0FpbEpVZHpKa05PYkZxeTZHZzYwaUhKMlhIajZ0TWZYbFBjRzlwMEo0bnFreWpESnhPbkdQeGtqMmF6T2Y0Z25hUzRMcjJVM0YvQTVHNHRKaStKbm9zTjEzNzM1dVVYTXhZaTZnNUYvYWlOVVVLVWV0RkdiZjBIMExybVNaWjVBMU81RHE0ZWRDKys3QXpzdFA3ZTd3Qk9nS1N0WEM1cFlxNFIzQThWdCtEcy9iYll3cHFRY2RFSGtjWnUzelZTdEUwNGd1TSt0aU53MD18&cppv=2

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

cef82e34421f7ad32dfaf5bc64a56f6a85e09a09822030ca03b902d8487d5f85

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1079286
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=f8vSF3xVNEsvYnpxYzNybDlEdUlUWXdEazJZc0tkZzZ6aFJBY0hGL3JhMm1aRHVtaCtNblRjOTBaU0JTRWRYZDZJQnF4R0RNZExUSkY4c0RISkRZbGRNTE5GL2x5Y0RBV05na0FpbEpVZHpKa05PYkZxeTZHZzYwaUhKMlhIajZ0TWZYbFBjRzlwMEo0bnFreWpESnhPbkdQeGtqMmF6T2Y0Z25hUzRMcjJVM0YvQTVHNHRKaStKbm9zTjEzNzM1dVVYTXhZaTZnNUYvYWlOVVVLVWV0RkdiZjBIMExybVNaWjVBMU81RHE0ZWRDKys3QXpzdFA3ZTd3Qk9nS1N0WEM1cFlxNFIzQThWdCtEcy9iYll3cHFRY2RFSGtjWnUzelZTdEUwNGd1TSt0aU53MD18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 241164
content-length: 0
expires: 0

GET
H2 200 5686647303429821299
tpc.googlesyndication.com/daca_images/simgad/ Frame BC94 121 KB
121 KB 69ms
33ms Image
image/jpeg 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/5686647303429821299

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=544333611&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1701236867&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867111&bpp=6&bdt=575&idt=6&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=2350&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&btvi=2&fsb=1&dtd=9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee84019ae0ae0d4941dbfc81004eec7b2d95a1049b95d53efd00b33eae39d20d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 10:39:13 GMT
x-content-type-options: nosniff
age: 500914
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 123790
x-xss-protection: 0
last-modified: Thu, 23 Nov 2023 10:32:21 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 22 Nov 2024 10:39:13 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7548 42 B
63 B 47ms
46ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CvGejBguZno3TVzr_sdv3GewASeZK3OsyxrVv95v9zTaydhP_fyfsdaDOaVcFGyg4eT7RefWsaf3gfbr-NkbTcCyd9MyP2RXuQ9311p5lR3w6GD2g

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=250&slotname=6076681977&adk=2278793534&adf=954853469&pi=t.ma~as.6076681977&w=300&lmt=1701236867&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867142&bpp=1&bdt=605&idt=1&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280%2C300x250&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=574&ady=4615&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=5&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7548 0
20 B 48ms
47ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=2048597919789156240&x=1&ct=77

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 7548 89 KB
31 KB 102ms
102ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:47 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 7548 3 KB
1 KB 39ms
29ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33130
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 20:35:37 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 7548 20 KB
8 KB 39ms
15ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48628
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:19 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7548 202 KB
64 KB 74ms
47ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:47 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame BC94 23 KB
9 KB 54ms
31ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33130
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9282
x-xss-protection: 0
server: cafe
etag: 14645652906762492339
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 20:35:37 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 27E7 143 B
166 B 15ms
14ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=544333611&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1701236867&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867111&bpp=6&bdt=575&idt=6&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=2350&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=10&uci=a!a&btvi=2&fsb=1&dtd=9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1590
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:21:17 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 redir.html Show response
p4-ej5vigytwddxq-k5zxzg5fqs2bhtts-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame E776 247 B
869 B 87ms
22ms Document
text/html 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-ej5vigytwddxq-k5zxzg5fqs2bhtts-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f3.1e100.net

Software

sffe /

Resource Hash

12b1695d2c861288f28bd150081b8d55be8c6af37688dbd6b5b2843d4a4ed8c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 203
content-security-policy-report-only: script-src 'nonce-DsFgPRLJ0m0u5Mp5OGMtNg' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:47 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
last-modified: Tue, 14 Nov 2023 14:08:00 GMT
pragma: no-cache
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame BC94 3 KB
1 KB 52ms
30ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33130
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 20:35:37 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame BC94 20 KB
9 KB 35ms
13ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48628
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:19 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame BC94 202 KB
64 KB 65ms
28ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:47 GMT

GET
H2 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame BC94 36 KB
15 KB 45ms
24ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a3e5c486ca9cab98b690f2f3fcc83c73141a667293c8a8236bb1e376313f0e36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:55:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46357
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14803
x-xss-protection: 0
server: cafe
etag: 12205605038930952422
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:55:10 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 31 KB
13 KB 363ms
362ms Fetch
text/plain 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=923086590804078&correlator=1044798592783188&eid=31079527&output=ldjh&gdfp_req=1&vrg=202311150101&ptt=17&impl=fif&iu_parts=44890869%3A14363285%2Cca-pub-3831894559014614-tag%2C322c17c0-f1ab-4001-886a-fc27d8971184&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1x1&ifi=19&sfv=1-0-40&ists=1&fas=1&eri=1&sc=1&cookie=ID%3Dd80efb7760618cdb%3AT%3D1701236867%3ART%3D1701236867%3AS%3DALNI_MZMZdoZOee6fLeQS8LWsrk5hrwaEQ&gpic=UID%3D00000cfcfb10a3af%3AT%3D1701236867%3ART%3D1701236867%3AS%3DALNI_MZdflLV7akRuvLV9YwGZNPrAlsUqw&abxe=1&dt=1701236867784&lmt=1701236867&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYu__5zMExSABSAghkEhsKDDMzYWNyb3NzLmNvbRi7__nMwTFIAFICCGQSGQoKcHViY2lkLm9yZxi1g_rMwTFIAFICCGoSGAoJeWFob28uY29tGO2D-szBMUgAUgIIbxIdCg5lc3AuY3JpdGVvLmNvbRi7__nMwTFIAFICCGQSFwoIcnRiaG91c2UY2YT6zMExSABSAghqEhQKBW9wZW54GLv_-czBMUgAUgIIZBIZCgp1aWRhcGkuY29tGLv_-czBMUgAUgIIZBIbCgxpZDUtc3luYy5jb20Yz4T6zMExSABSAghq&dlt=1701236866536&idt=404&prev_scp=ti%3D28b1299c-1e08-4457-bdf2-4ca258e10f1c%26interstitials-bid%3D0.3%26bid-p%3Dgoogle%26rfi%3D30%26stt%3Dbhs%26bsc%3D95&adks=3444336792&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3cd52c9390fe3581397ebb2d1b3866c0e5662e6fe76716807a8ec096f5108d21

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13236
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.farfeshplus.online
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 5745 624 B
246 B 58ms
57ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxilm7vGATAB&v=APEucNX0W607sDCd_o5wFdxpGJ-UPq3me_e7OzlmSfchEjk8u1VFa_LYM1fdbSniVMUqrCAt0_nMfVMJZ-er6TH2wkg_wuW87uRvWpV670OdSzgkg00qMm6UxNG-EjqaMcYjyH-_5z9gTkwzdqq-MQ8Q1OjIZ55PleHBgPxIBPpi12WwG_1bfRg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=250&slotname=6076681977&adk=2278793534&adf=954853469&pi=t.ma~as.6076681977&w=300&lmt=1701236867&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867142&bpp=1&bdt=605&idt=1&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280%2C300x250&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=574&ady=4615&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=5&fsb=1&dtd=4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:47 GMT
expires: Wed, 29 Nov 2023 05:47:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 419D 42 B
63 B 50ms
50ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Bikes-kUsB7GdV2VZ5ea7Gn1P8aTuvf8dNlT5Hx5COFuTp6-5miBAGPIsNYlmwfcMzGXzTJ4xAt6PGf5oGtqdUnPy-cNjLNOTJovtmcfQpfzk69S0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1231661633440980&output=html&h=600&slotname=8400035594&adk=833794805&adf=1602281170&pi=t.ma~as.8400035594&w=160&lmt=1701236867&format=160x600&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867047&bpp=1&bdt=511&idt=0&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CenEr%7C&abl=CS&pfx=0&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&fsb=1&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 419D 0
20 B 52ms
51ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=17494896701144227927&x=1&ct=77

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 419D 89 KB
31 KB 121ms
121ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:47 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 419D 3 KB
1 KB 39ms
38ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33130
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 20:35:37 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 419D 20 KB
8 KB 47ms
46ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48628
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:19 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 419D 202 KB
64 KB 67ms
66ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:47 GMT

GET
H2 200 575 Show response
a.ad.gt/api/v1/u/matches/ 12 KB
4 KB 63ms
17ms Script
application/javascript 2606:4700:10::6816:445
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://a.ad.gt/api/v1/u/matches/575?_it=amazon
Requested by: Host: cdn.hadronid.net
URL: https://cdn.hadronid.net/hadron.js?url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ref=&_it=amazon&partner_id=575
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:445 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8d8d30cf66eea8121b1fe6d245adbe02d876882098b7d95e1d87f0b29284cfdd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:47 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Wed, 29 Nov 2023 05:42:56 GMT
server: cloudflare
age: 291
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=14400
cross-origin-resource-policy: cross-origin
cf-ray: 82d88ed829b24d6e-FRA

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame FDC5 624 B
246 B 57ms
57ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxiknLvGATAB&v=APEucNWf4iXhvRFKTqgzRlQcKOaTGyRlSV2moyfxQxhCa97W2sk31ChAyg8tjnX31xJUKzedI7ecBUGLdUa6gn16A8-XYGW5-8bALnuQZh5lnSF0RMfYuIsE7ISawLSy504biku46E-MPy58iUqLRTQxcQhEZf5iAnFmAwL7kb3uh6a6U9j17Q8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1231661633440980&output=html&h=600&slotname=8400035594&adk=833794805&adf=1602281170&pi=t.ma~as.8400035594&w=160&lmt=1701236867&format=160x600&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867047&bpp=1&bdt=511&idt=0&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CenEr%7C&abl=CS&pfx=0&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&fsb=1&dtd=2
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:47 GMT
expires: Wed, 29 Nov 2023 05:47:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 27E7
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

26ms
25ms

Document
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:47 GMT
expires: Wed, 29 Nov 2023 05:47:47 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:47 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 collect
region1.google-analytics.com/g/ 0
55 B 18ms
18ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-DNX5KLEBSB&gtm=45je3b81v874724234&_p=1701236867020&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=2062919147.1701236867&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEA&ngs=1&_s=2&sid=1701236867&sct=1&seg=0&dl=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&dt=Farfeshplus.online%20%7C%20%D9%85%D9%88%D9%82%D8%B9%20%D9%81%D8%B1%D9%81%D8%B4%20-%20%D8%B4%D8%A7%D9%87%D8%AF%20%D9%85%D8%AC%D8%A7%D9%86%D9%8A%20%D8%A3%D8%AD%D8%AF%D8%AB%20%D9%85%D8%B3%D9%84%D8%B3%D9%84%D8%A7%D8%AA%20%D8%B1%D9%85%D8%B6%D8%A7%D9%86%202023&en=scroll&epn.percent_scrolled=90&_et=15&tfd=2683
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-DNX5KLEBSB
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.farfeshplus.online
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame BC94 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3a1e35c1b5c50f6e0ea92adf6c4de19cdf01b3243e54e71f5f0076c71a547817

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 5745
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENrkOjpRy9nOKk_mlUk7YLU&google_cver=1

43 B
739 B

26ms
25ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENrkOjpRy9nOKk_mlUk7YLU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxilm7vGATAB&v=APEucNX0W607sDCd_o5wFdxpGJ-UPq3me_e7OzlmSfchEjk8u1VFa_LYM1fdbSniVMUqrCAt0_nMfVMJZ-er6TH2wkg_wuW87uRvWpV670OdSzgkg00qMm6UxNG-EjqaMcYjyH-_5z9gTkwzdqq-MQ8Q1OjIZ55PleHBgPxIBPpi12WwG_1bfRg
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cxv%2Bt05SyXbOod1R7h81F%2FlsIbyKZKJwzpDhWiaHrYexfe2IpJOgbTFdn4orVwzWVo4hrddjCrWXPqNFCe1SnMoUHR%2F7k%2FtCgkYbZOEsDD3MUv9vfx%2ByanOJartjPJMqA17r7cMXVEe%2BLg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82d88ed8aebc1917-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENrkOjpRy9nOKk_mlUk7YLU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 5745
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZWbQgxrhAdvYahmWZn9RwwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPpA9FZPclXYOvjzS9LTNEM&google_cver=1

43 B
735 B

20ms
19ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPpA9FZPclXYOvjzS9LTNEM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxilm7vGATAB&v=APEucNX0W607sDCd_o5wFdxpGJ-UPq3me_e7OzlmSfchEjk8u1VFa_LYM1fdbSniVMUqrCAt0_nMfVMJZ-er6TH2wkg_wuW87uRvWpV670OdSzgkg00qMm6UxNG-EjqaMcYjyH-_5z9gTkwzdqq-MQ8Q1OjIZ55PleHBgPxIBPpi12WwG_1bfRg
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mPqWNA2rKI0zCqRCCbrgglqpeOwfrPwDqBbtjvs0n9tDhbQJyNCMujXLZ1pI7A%2FzznMXhgdJ35xRlBZC48YAbxyPazTywi1PPmKXyNAoaQXn1kqkpbQUakXRh9yvDZQOaJPyBaFU6ga%2Bxg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82d88ed8df121917-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPpA9FZPclXYOvjzS9LTNEM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 5745
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEGtTsVVAeJLsOaVH9okIKlM&google_cver=1

43 B
840 B

16ms
15ms

Image
image/gif

185.89.210.141
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEGtTsVVAeJLsOaVH9okIKlM&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxilm7vGATAB&v=APEucNX0W607sDCd_o5wFdxpGJ-UPq3me_e7OzlmSfchEjk8u1VFa_LYM1fdbSniVMUqrCAt0_nMfVMJZ-er6TH2wkg_wuW87uRvWpV670OdSzgkg00qMm6UxNG-EjqaMcYjyH-_5z9gTkwzdqq-MQ8Q1OjIZ55PleHBgPxIBPpi12WwG_1bfRg

Protocol

Server

185.89.210.141 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
an-x-request-uuid: 618d08c4-b46c-419d-a4f3-725f3ddef4c5
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 37.58.58.248; 37.58.58.248; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEGtTsVVAeJLsOaVH9okIKlM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 5745
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMzNDI0ODQxODI2NTcwODgyOA%3D%3D

170 B
233 B

27ms
27ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMzNDI0ODQxODI2NTcwODgyOA%3D%3D

Requested by

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
an-x-request-uuid: 572757e2-6630-4216-9523-736f34ff2668
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMzNDI0ODQxODI2NTcwODgyOA%3D%3D
x-proxy-origin: 37.58.58.248; 37.58.58.248; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 iframe.html Show response
p4-ej5vigytwddxq-k5zxzg5fqs2bhtts-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame E776 5 KB
2 KB 25ms
25ms Document
text/html 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-ej5vigytwddxq-k5zxzg5fqs2bhtts-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html

Requested by

Host: p4-ej5vigytwddxq-k5zxzg5fqs2bhtts-if-v6exp3-v4.metric.gstatic.com
URL: https://p4-ej5vigytwddxq-k5zxzg5fqs2bhtts-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f3.1e100.net

Software

sffe /

Resource Hash

bfed2108898eb47819ce2b11d030bb6b2a27a3806cccdda48f8e9055c5ac31c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://p4-ej5vigytwddxq-k5zxzg5fqs2bhtts-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 1986
content-security-policy-report-only: script-src 'nonce--FEW5Ss2k-MCCae7k0mNSw' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:47 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
last-modified: Tue, 14 Nov 2023 14:08:00 GMT
pragma: no-cache
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame FDC5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPpA9FZPclXYOvjzS9LTNEM&google_cver=1

43 B
773 B

21ms
21ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPpA9FZPclXYOvjzS9LTNEM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxiknLvGATAB&v=APEucNWf4iXhvRFKTqgzRlQcKOaTGyRlSV2moyfxQxhCa97W2sk31ChAyg8tjnX31xJUKzedI7ecBUGLdUa6gn16A8-XYGW5-8bALnuQZh5lnSF0RMfYuIsE7ISawLSy504biku46E-MPy58iUqLRTQxcQhEZf5iAnFmAwL7kb3uh6a6U9j17Q8
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CxsSgJtoNwhY27F3aT3%2BymqB1Pf9EEeQZIJ%2FkspDNuQCLGndlXlFPG6gd4AXTO7Uwr43Yqaej%2B5nT9m3p5UC98OYisxXRHpITP47eV%2FbYDEtffhojTqk6R3DOBfpQLCHQ21deBYmHKfxfQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82d88ed8aebd1917-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPpA9FZPclXYOvjzS9LTNEM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame FDC5
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZWbQgxrhAdvYahmWZn9RwwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPpA9FZPclXYOvjzS9LTNEM&google_cver=1

43 B
737 B

23ms
22ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPpA9FZPclXYOvjzS9LTNEM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxiknLvGATAB&v=APEucNWf4iXhvRFKTqgzRlQcKOaTGyRlSV2moyfxQxhCa97W2sk31ChAyg8tjnX31xJUKzedI7ecBUGLdUa6gn16A8-XYGW5-8bALnuQZh5lnSF0RMfYuIsE7ISawLSy504biku46E-MPy58iUqLRTQxcQhEZf5iAnFmAwL7kb3uh6a6U9j17Q8
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QQ8TjhFMFj95WGA3ghT%2Btqx9oXsOiRYehhndG2dNJPXfD7zDMWVsJyvX8Mr%2FfWYktYjDoJSRqmTIj3LauQG97GSMQXqR%2FAreoaU87dRU9Qws4Pvvts49BFzfIEtFWyVLs%2FL8Ijgs2gaMGA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82d88ed8cf051917-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPpA9FZPclXYOvjzS9LTNEM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame FDC5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESECjdwfFgMTSKWlu0lsTzXUs&google_cver=1

43 B
837 B

14ms
14ms

Image
image/gif

185.89.210.141
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESECjdwfFgMTSKWlu0lsTzXUs&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxiknLvGATAB&v=APEucNWf4iXhvRFKTqgzRlQcKOaTGyRlSV2moyfxQxhCa97W2sk31ChAyg8tjnX31xJUKzedI7ecBUGLdUa6gn16A8-XYGW5-8bALnuQZh5lnSF0RMfYuIsE7ISawLSy504biku46E-MPy58iUqLRTQxcQhEZf5iAnFmAwL7kb3uh6a6U9j17Q8

Protocol

Server

185.89.210.141 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
an-x-request-uuid: 2a0fa55f-8853-4c16-bb7d-a3599a124918
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 37.58.58.248; 37.58.58.248; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESECjdwfFgMTSKWlu0lsTzXUs&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame FDC5
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODU3OTIyMjI5MTQ0MDY2NTc5NQ%3D%3D

170 B
244 B

25ms
25ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODU3OTIyMjI5MTQ0MDY2NTc5NQ%3D%3D

Requested by

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
an-x-request-uuid: 2ec447e5-e694-4e8d-987e-821bdf7eed6c
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODU3OTIyMjI5MTQ0MDY2NTc5NQ%3D%3D
x-proxy-origin: 37.58.58.248; 37.58.58.248; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7548 0
20 B 47ms
47ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=5698630274856&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7548 0
20 B 48ms
48ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=5698630274856&version=m202309260101&ct=77&x=1&cor=2048597919789156400

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 7548 20 KB
14 KB 49ms
48ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ATkqf0fwUYLXig0oCy4bKfBr6c5bPIukc1rmPrz2h9UCbq6RCp9_8mQNtwTxZlpc7rdidYeul4snSf2gvgQXFywmG6Dbx_P4fyMnH98Qfh4NOObVpwKXWHmQirkqsixJFZDFdf0O1si4VkWDg8woGVNhgmUHvYsx8JhgSRmyqN7CXsm4k&cry=1&dbm_d=AKAmf-DGLb0ix4OxdgeATc2o3wtaYLC_noeX5GTUc1mkHKpFlCmc7r7wsI21gyLadyag_WGpgJsrhlvbBNYqhfMElY55VWCOd-n7YundUOO_7HxSzV96K44Awd6eCYlPpq5udBxtiKHH-wUZzXE9IIh880gmSCh0vSIottSuHremkt4PgNPIBp_8Amu3PB5tjtTJCB0i-QBzSsQPTxWVCgvi1qi_5SQiplc2fHiuJb2hoSs-xunwpSVe_B37pnDC-5d0dzlhy9_FKxFVF7-XH5vM8Nppm5jkzN_47OCuYNlajR4Ivljk5olE0p5dVkW3FbsXeq6KFoxkPgTDFKwKPPm1tOL_Z2KhkMDMule4XQemucMJpcqoPhxlvllNUjJOXnHqG7mYLpgWzDmu3fR09mog8i-lpDkadLjv1CGvG88T2BL5bjESLcK8-rmOq-J4WyvR2EjOtzBhExY7ZIfMQwsJA1aySKBHcufol-QsTok8WxnFLObwWTO7lT9OBUrj0ZWkPo17SFX7r9_4ic7KmIVqdY0a5WMt9ny85QWRBwW9bLvx4JSx-bAOExxiLlrCF07v_nTHgsZycuN9_-MjCSJAp_LKilIA5jvEVkTWW9wiO1kJYm2w74iY54CwQedyq1dTjb9aWF3bJxip9dXrQWSDK6_mBLs3k7BVFCBd6eb-OVH1QE0z8UhMQvNSDUQR1vD-Dx4kRFL9Y0LPY40kQqUQMehVDRgndfRMZQGaYdPbF36PIUn8F0P7v7LMosBXsn5fRXCfmfEWWUaiTlhV3hAVg-v-CUhxOgkKSr6NBFlRtnHnmBsU9I5CS8fBNzGZxiewa96MciN8HfZkS8PXo2LjyEEINHkfAtArHYFHZ4mf_Dtc8l2VDsTqr9J6ygx9yQdDtcEERUCa6LHpmtukq9l2Fs1W2N2etFUYm8V6GF94LddqFbYGA3vQ46cBDbzjYpexZA6WR3n9UfevlSrsGdw3rpfjL5FQknHwFDN4iD8M71li1xAn4kARKCIHEpnJVaIpl08mGPW-rPsFZVE0bc9VjSiXcuQPJn1BRXhCnC04CxomaA2dhcV7n57MgnFxARPB40s0OtO8gSgJYqSUvndpBlqmljQK3Rs6GjsH7BdmB9jKzQlMRVE-Kx65sutY0U8URkBRFqWqPWt80PBsrysDGbfN51SR767v9XKQJf9SGJ8-IO6Prj2dOBHOqyuTzRWb4bl4AemKegfQ6dW3TuPFcVsd2bYt4goBFhL3FZT8LGf_umGFmnqAFThTqp8Ai5zN1sSWdsXggz_qqQqDR5NCjjx7fKWt2-p2z6CwV5iINYAhqzJow4fZaJi5F6qmLfN03noPV2i3mWHQp75Oue-9smSZ9AVeGfIGQKHVRRRHCBZRNmQtyjaNSihfQHUkJjFVVhl1t24-V_mdr_u2w5X6wpZ6z-Y5ksFHwbSUkO-qzxaV_h4Bgb4lNHWZAM4z9j7cMgv9Z8sm1SD8VmxYwP4C2Dm3BQIHIbq0JChnHI3YnaIIi_piz-F0EXyBVuEXDEytRsrapj_nm0uml6eWvKi4i-rKEPNyWOeIe-WNHrXEThBWISx7eaJMQR3Inp-jhfW1FDSJMYHKRO80XVTRpNKlO0TigdVNTlLs73tdecpjYtRn41mzWaRZBCVxkRHAq_W6F4qgpJ2rm7mAwasMM-PFUn5iCdDksiuO1AxJiYVDHMN8PucVO8vu4cP6CGvUXOjvVGfVgTUaRFsSMLbnDlTNchksUYpZFHmWq9yg9o8JeHsS2gPV9ejN1IZlxTSNacISCOwyReIxf5Am4Pqb8nw4XvGcvMtDPsvk5wZWxugKolIuHYOwS33uZDa-qjjPJAB6u1guQaESOF_h0j4nxs1Tt0aOURA_5BbH26NH-JQKwDvsmWeLAnhGndbuWr6Q3TbgHNq6cE54IC_maPhoOabOEG7c-tauxMyzn3raTfxI71mUEFxWFNBlVijwmnHvmd3Y8Th8V_An7hwTkfGKNHo1POcZNtKWjEzMvFxDW-ToGgQhnLq2YQDcZJNpRl_rLHLrv6s32BtMEnU8YNRkymiHZUJB_HwlZmaKMcfgDCzuWK2TC8rmbuVTx3NFrdS_pFNXvvriX7PHmlwCWOZ1miFzgKuOESpuvpl_r082VwZQOauxeQIaUcux-GY6_mUZ8Nhvje_Nm4TRE-S4cOQlHGY6EunoX19o0ABk9rLtbyBTiX-pzjoXTjpdtFu35WXVbjGu4zh5kjBCFCpH60fkZx_3PICgBeCGq_uzZgGa8Mt-3eFwg5TG-UUSOx7dPF7Ibns2sdlqz7BTcKpXpJVvrNUCKrs6nYBDoeEnPw-B7RskmGnfFHB7-eTfUfmvsV-_nwi9EEkAYKdAgM5sBJgR6Rjqfl0_SAmF1hHbBHIS30qhQL-Pw5JFwUB_qcH-CuisaOGgkoctKQpbcQQ_REF0kL65QhzR9J-eYOTL6GIWxlo-nyVRNKq0SduAKjjn1o1Wxq-uleaXN04Rc1k02QsfGBRbA2dDasIN5CcmTFxda9dk42oVu-5Gib1yEKYBZp1aWPBbssKvHo6EHB0X0NCkCSKB4GyQJtCYi6ZGNCCmVWYXqh4SQXjLKwDH0-JY-c7t4kUdYd1HZ-gOgStQWNsWy87ZAU3jqzboy3004mwKgiiOuyb4EpM55Ypcl4Kb7PXw21xHCRogni9jzNN9b4wEsoQpyiBRiljoHQtJFgBXaLVAssmjvWIJrxMjk-N2ituARQQ79WpHRty56lsS3k0SLDAmDhqvR9-WbDRf7sP-EqAm-KiVtm4aswM0jkEyqm_OWOFkG_DfEJ_d93U1W6ZPGhW_HcKLwjpthHUznnvmB8bD9WkKqpdhmAleP5MnBF6bXDi--mRMa19OJLK9yW3uwvHTMtw2vSkHT1OvN4Cuut9SwOimz2vIp4nT8C45yD6upW_PudPxhJSwwZ5n5_Ev7NWTjP1lmEhIqODtAofNqmVGI1OqEqxvXe3T-11Mb8Hh6D-f6m32f4ASz6ObE_lYEkfesx55Vf1jYpxfdIoZNwsAzVrqh57GodNfAS4-7HEdY0Wr_qmaeZH10pLBEXisSAkna8AF7M02jLRoTsNkRz2W9hV1Z8Ln5tk_gmXQTg0aLjbp9lwHhycrpKkKRAmeVfLhSSBrpRL3Uk9ET_-v8b3KCUE-8ioargy9IA52pOqKuSiNK7pFr6Fjhjpb8-h3m1qeDyjgDzLTDZdBoXSPE5Hr_dsbgK-ZqqwT-McR1dhosXObVVuSUbBxKOxfG_V_ag_rb689wkccGNJz6h3PEeHdzgHQK27aeCtHYqLpwtOSgE-THPpdbZvMXf_vK6DbVpuW5El4SsiHPDamdRWOyVWN2GA6OB7QKZoqB31DN9AXgwtTDZA4Kz6XrB2en25ZId8EOATojc63OOIMm6wM_aI7npz-yv-Otqu70n9ewO2OYCXWv661uwm6L7tIOUe9fg-z8P2F2a60I0GFctNycmlix-LktvGeR-XnkmRKbp7QnRureLaPePR-JtcClEFUAK02psAxIeMUSZ0VfEckqPmGqwwwXkxKUZo5t16T_ws7bqrYq9GRkNIYVwcLjOWYY1PmOEnuju8963_mu3yEGLKAmOgsh3E8EUdrSXq0enfAiy7O-L5tuenYByxmsuRMZTwwAfs542_N5AUah1gzXhE3F3sjer2nZRD9pPinorGosatIlxZ38Thd8SjmPIvsf3ncv6TF9IGD5wtGep3yyGkPFwfh8JN3mxVTywPIxHKSw-GilAfuUeNQiyycZgSoeiy6Zq0ooAqkPX1ystFr660QzOsKIkbSna3C9HME2DMYL0K59LdnPeNjiFlR7W75qPyzJyNqSbuK2K3eufp7gwgpkA295YoWhXOvYXoeMQB2OQJL47rqJ0iywyq39k2o56Nk5DSq2DoSQig1cWZ9xHeeR_AeQOxrDmcBI08RoVchOCPdrw0O9BMt_4vuWCGHVrEEpbGZX-fXRBcXS-71PJMeiZCSzAHtM2HnpwE7VVr_hUdHzkjiig1KRTVlNXeekxwzA0q2pJmSjgIdGyto1m3xMwVDP9aAY_tSkqTPjVfEOpA1E5joE0KVnJgasSzQgsyjloXNU0AKYI0EFNPEM4H765RvxO2DYm2gOZQRuQl5-a-9Xb-1QcoEkPFQ0zxBO453BkI5nVIgWNkQWwAXcbkGItEZK2aAGST1hV7S3KzUvE06viP6_vqjimrACTXdbicoBpjtfzwMlHb6rrVm3vGDt9akclUMoqCxlppcw0Cx1JOhCRdryiBciKpHoclmEvmxym3CB68-GbiPIm6E7buhLHkk0O2vnuE&cid=CAQSTwDICaaNcjn0n3jHFnr0VQrDo48k8IVpqqof3XtNcrQYBN0vQobM4a8Ep0HSQGnR6JMZY1IN5yW9T-i1LHrY9Mp-dQhAdUFXpGrCEG4PnGQYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=2048597919789156400&adk=4188270525&idt=110&cac=0&dtd=9

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4eaa4bbe622dc997ec1ac2d8303de460159bedb5272e760bb99f242d48a221a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=250&slotname=6076681977&adk=2278793534&adf=954853469&pi=t.ma~as.6076681977&w=300&lmt=1701236867&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867142&bpp=1&bdt=605&idt=1&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280%2C300x250&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=574&ady=4615&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=5&fsb=1&dtd=4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14087
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame BC94
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CnRy0g9BmZd3eGuamx_APxZSngALb696_dNbI5Mn9Eb_hHhABIODi2VZglaKmgrAHoAGHg7_3A8gBAqgDAcgDyQSqBJwCT9B8sGLJdgSvKbBgbbpc4HiROFXnT_V8664ImnfoGufQ6akHbIb...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2216444364757715136018%22,%22debug_reporting%22:true,%22destination%22:%22https://lightinthebox.com%22,%22event_report_windo...

0
0

161ms
91ms

Fetch
text/css

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2216444364757715136018%22,%22debug_reporting%22:true,%22destination%22:%22https://lightinthebox.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%221055900039%22],%224%22:[%2211-29%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2211851636737579791425%22}&andc=true

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"16444364757715136018","debug_reporting":true,"destination":"https://lightinthebox.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["1055900039"],"4":["11-29"],"6":["true"]},"priority":"500","source_event_id":"11851636737579791425"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 29 Nov 2023 05:47:48 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 29 Nov 2023 05:47:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"16444364757715136018","debug_reporting":true,"destination":"https://lightinthebox.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["1055900039"],"4":["11-29"],"6":["true"]},"priority":"500","source_event_id":"11851636737579791425"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 419D 0
20 B 57ms
57ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6610561621107&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 419D 0
20 B 57ms
56ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6610561621107&version=m202309260101&ct=77&x=1&cor=17494896701144228000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 419D 20 KB
14 KB 189ms
189ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CEIo2VNwyaq0Zaj6bdIHkPKLshfLrcGwOr1Rae7uEEx7VG6MJkIkl2ghpp4Lvii7Xi17RrE0ajv0MSZahw5HW7bOpmwayK8IyqB7rOGdK3DhIu0pauMoij1ILGfXgsy-XjVnI7sFcTQItwaUc7GLU22fxFEE0fFiDwwfQv041-ujnlbww&cry=1&dbm_d=AKAmf-AIoeP7BDko74cAtM52j3XGnLxRcDkTLx8dF8TiKh3AmtJIEoYF-DRyUscHoU7UjdO6eiikLfPkerPDOGUPE_Fstbyy-7Lv2eybssw3jxrMWzpZh_JGRMExaWXoLrR6-h0xQGokzdOicGCljidUTGUBK-cez3BonHLD-4lRUFBHDgYU7pB0cS8n8RlRvhxPHSgRdmgtJ3I3PK59lZ57t_u2u0vdhMKmarWHVdiAd0G1gNOi92g8YvegvL01ZmTI6HF36Z10MJm2RloR8z4OqwHQKMTPe75NMNLlLVxKV-tyW9Bm4qRljJ4NRzTaFlDmF7Xp901n41zjXhFMDyN3wbjjevzF-Rv2X5JpsoRHtXHORbzIwgiGN8_yr2jvyfBfL6vdJbQjpVU8Q9flLRzZpRTJxYHBCgkTHHy-hNhyVCd3eSKvmm24cJd-KfKcc-yMoXdzYMtKWfKOW01rPZLVZUAcZ4wGF_LcEC5lWDld9fWv63BFT7YgmZN8R8lnXp0W-nr36CEB4p9N0yultzHuuulyMWStWsEEY3EbtO_syJy1OoRT-pOhXbkaCuV3jbxVXo6HdiRtVJyS-VnGEnu8OPvXlB6vMkTI7Aco0zxKoONzoEgA91oj004IDqSv92JtX8h730K8pMi7ZBM4tfQTxREJqBnYgEyRttEQvpxb0HQqyy71-18wVF6DBeWEzBh3fASGrlngRLY1czCef14Rl5Dx_x7D2WY9x190B1vEcVGq2L5vG-3iroBNNSYGiJlqpRW_flgl3jNs0_OhAZdQT8Uds_5U1uXtxEh4Z5ZZQoPWG3TwRT8pNgBZNX-fKPnPAYlwXwBCwlIkfri6CTVri-XALWL_3uViVoWmnM7EUR96XRnWXuuIKGMXfgL4ehpSqLNJOA3vou8P0Vf1aBQ0Ox0hq8hb5N19erPSt2Hw4yTr81dBSNp80ESO99OCtWNw61cSx06HTo_1_0GNkxKjiya9z_KFeAjXynOTENDEEi4bgUIWCAD5nvbn0PnVWwt-RP9HfhjXNrzJiqiC6ul1hRF8NSxKZQTLxuQvBzGoYyQ8caSkYgefrq3SNTd7RlOYWpCK3vv64MtSqOYiWAJ9eLQej-n0UjCgppbO_2h1jE4CHgFv4slYGaznjlBztPI4p3baqwyBdUpzMHp2c0YD6Q0t2ZDqFS70toKF1i1Rw_uX5vY8GwivtZ-ldgDrPF3musQkdHFDiD9Xp7WtNbkMfww1nb74R-r_c6wj5JrACXFsD2-K9L8LRkJBjY7Pc6bGEgCNjFwbcKHiCFbrM8v7vl3vrGQlVe10qSoOuFX8ihZ2e2B_XtHhNMze3ifr7QMEfEci8IGKIBsGeFX1so4oXPP9AqGsqTIxdkHTY2hN2C9f8VLck1VSuAzquYCke45YSEgi597zUyb69B-Zrg6Lie47AIoY6gjEU7x_3VllRklgLeO5lZl4fSd9JS_c_3-m7MT_kMSMfQO6kKNnHRwPS94JChBHjB2U7LIj9mmhrOv_WCOBjseCkJ1ayD_xDxoJnFvROY2rLsBjkcMKCqu-YOTZDzhw0SCPsNhkjND0dLeS9_tKsqUN_YF_VRToksLPeQ6kU_IMTohor1HkjPmKYgwFwNmVyvXJ2Gb0SpmVgbiZvrsL0BJ2ZJ-nB6kwWYnZUDTssGdmS4PnZloZZsHFoKlq2mrTPQllhWGMwqaIa01FeIJvC92jCCSfrx2GA8MnbmQYtwnWJTAzJBsqiy1xyI2KuOk47hJn-IGdsrzKmvZoTNw5e1FFg-0uG6hFqMZ-_NIq-Ya4ASEtvBHGO0rAgEn48ok-PTAvtxmO0ui2PQnhJbItu8tUZqM0CBCs8DPzWHnBSBUFfcXN-B1oqgprXiv3ZS03AFnRQqZn0DQISzFBZVV5RLETvR_bLBN-LbylCt-pv6ZpEozJxpp4X1wVvxqE8ibDqz8KmBeSQqf8rDqJWLOivd3I3ER48geR8fW9chsEBDGBCMusIgcvURDl01FEil1HD4MKdBFXeoyfQq-D3a3KQfhnUd77ACBSakCRg2OjyhZBIjLLYInYv9bHuQeXzhlb76Y2XOLUL1LGaU9xxWAVlOUA4my-kxPegAbIRoRrJgKjR5IGtkWF2afbFe31-CzVBVo6sA0jyv-JuAY0eY-QThzV2TVjApqWhf42wcZmtjKFRH9ap-trsB17jvNjm3RIL9jnAVTncgHR2mDy3U0rkFkfU2MA3oyb3pItXaUlien3vmImkPR_r3XeaSQuwmykxHx4BcGJlNnovAx0GH3yPf4BD9bHKHN2gu-egmFnPNfyMWeAuo33lm_NuzTVjnSOCCxRIr_qSpIKLL2Ya6nCO5Md6Zz8Oph35vPmRHQ9kLsBZVZfozC1OEuU_11LDVshytPnkqOQ6q-DAuzC50BK-ORCkFq-0_zymDJ7568EWbS_C9HX5_zGSvQfTWn9vIgOmuDlRgyd851P4RQsVeCFTN1QjLN3wI30Tu2plr3nQnYQiM2EaifDyX8IJdxtWsYTHpZpF625gyi87npXAS3FXIg2WOOSxOCxKeVeND3GC3ri0KYw0zdpCA-F-J49l0lYLJx6lijcrYhVnTcfcaE4qxsprMQxa-9gx3DVzFvMtmNmqfjVZFhiOTr5-T24G6zJVbCaA_-B8XZuvW1ZzNin7zHvqPbhn_j1v_OxnDTbKUQI4C8leAxO3oujMA8d0JQOfhUvOGVwcFYaMEvOqnSfm-usSm0i5zEC8s1TIBoPwAVG5tC4MRKFcmUWRTqHzZPpTdW3BvjRFrSNA7MV7CZI4wXslnIJC4wSxAv_ZDWXyJvFe96SaD40-rm78eFjxzWu3-kDKFj2hUfGbrep6BWh89jQzITrTbRyc2LYxvp81qqi-axpTwyap4VvlPyrrMEcirDUbWgQs2xl1W99PESGumKEQF8ybjDpHaOx_Yh8WLa4kzmCgy5hGbXq3g_A-Wjnwz0w2aL8pm18rw12EGVIvNcSmlXDWag2OVIMOXxeWmCS-6t8wFENk2zHwcU_Gbxug0MrAgkRblPylkkE7epsicUvnHh114T4eLYbZwxyqtVvRw_E3mOI5sLra2rQbUHcgrHAvmJsPQgloCILuaNGjUW9-xRzqfBNS6Zk8kGbokERuaJ0oFkWDmidRo-GX9wQHE1VhI2zukbEXd8FPmXk9cF-BgY3gMRx-lWBjEdxnBeRR-fljaaAK9nV4-LvLD-t76lOlRLLWlZjYZHrVHUye8J6Fig2QNyFjrAQNHLK2OYwNZJnlWxq78Rd5jEG69o7-aqKfsgRrNLNOCoUrTp9J0K0YWSGCiLMIwslOSgpL8QeW7Oy3lMg8ym4hU3txPuHfrTh3Ee-aWNZxr--VfHud5RxrLAznpMwKa-BL5jMJEypnKVQP2PuipbF6oXtArTEYq8euP5-7uKGN6cp6xQDr3rvoU9xAEOKuvopn1hC0v6kM184JzOfRvtrYMuVBfSfmCN_2SwmlvzHSit9PSKCpv1srED6i4LzRcH42yOIsz1B0NgAWX25DB7-_rkhd8j3noQjNcOALG-N-6oOMl6C0i8VI9FKVKYXeVe-ZEEZWP8vWTFdQjJrM80EeAmlzQalw-X0hBFFVaePY0RNSFbPWStZASXi2NvfahcW4j8srL1dBDeTGZRzfMRLxbsbi4deKHGbv0lCqZ27IZvQse5E41B6lp_8hqiGaT3rp2P6KeRcYIzXA7KsyBQ2W3THJVCins_6_KZUZYGXVBTstNqj35gaG8x8Z-w8YjinYvqX6RLqZo3HflRyMIOeFBIPk7WzDkjPI2l16Vamb_r-THsrAHfsBHI35VqgwUI9P8qqEa1hNy0iVJjZ0r-8EdKWJwo-optSirsZlTBkZMR_oLiGzqnIUhzpgNyho0IhUERSLvHE_ZFeJLPNYsO9wnconqhIeUPXXD2C6CnJyG3PG5Z2XQN_mbW33NHyinlx1DWC6GMB9FDck0YSjqhRVgOoRAFR5I3qVLjPi73bxHv1mUQkcgxuZGcjDuVATkqRIphGmvz-Nxq3uK2pgt0pOJxiWXjU422jSoAbN35awOUgc7FFp6m0EM51Rlq1b72xO8xxGf_fiP6Oc0PJPjps5QPtM5Ym_TGqKG57k8rl3IlT4MVKW4CoNUyEZVzagdfzTdhnmiK5TwzCsHL0tLVynjDxb269zSNgWjKIRgARqiv100SOClgMpFigIypUrijBlOm5MuKh_QvGP2VOr-2bLp9woRiFdH49jvXEcuBB23NhzpopngW7hNCdbKPTURaVoVTjAhCE&cid=CAQSTwDICaaNzGwRpEKSPaJhad8pIKp1BKb9gwOTGT4GSae_kc92uq5sOMzFvft7lc_3X4ZhUymjzAZ2UX00G0EUN-i6uBLJllbOz42Jdb_DU6YYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=17494896701144228000&adk=2228999115&idt=132&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f3bf485a0a67e597d9ec2fd98fdfd42c25bff8de2844e89ecd1c6c6fa907282a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1231661633440980&output=html&h=600&slotname=8400035594&adk=833794805&adf=1602281170&pi=t.ma~as.8400035594&w=160&lmt=1701236867&format=160x600&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867047&bpp=1&bdt=511&idt=0&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CenEr%7C&abl=CS&pfx=0&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&fsb=1&dtd=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:47 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4336 42 B
63 B 51ms
51ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AHz9idh-E0ayoEY3eL9JYYehCq-30XaOLXpPDe3iEGvdXOTNuzzNsBIufKufGcMe1M8-cHhTDI5TOAm_1z51KLmGFc5wc3jnk7pv3ohcYq3qVkH-0

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=250&slotname=2097210043&adk=239546933&adf=744370384&pi=t.ma~as.2097210043&w=300&lmt=1701236867&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867134&bpp=1&bdt=598&idt=1&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=574&ady=3880&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=12&uci=a!c&btvi=4&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4336 0
20 B 53ms
52ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=4575565311474138827&x=1&ct=77

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 4336 89 KB
31 KB 78ms
78ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 4336 3 KB
1 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33131
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 20:35:37 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 4336 20 KB
8 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48628
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:19 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4336 202 KB
64 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 747E 6 KB
1 KB 75ms
23ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1231661633440980&output=html&h=280&slotname=9134183485&adk=3378407940&adf=2021203405&pi=t.ma~as.9134183485&w=336&lmt=1701236867&format=336x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867126&bpp=4&bdt=590&idt=4&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=556&ady=3115&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=11&uci=a!b&btvi=3&fsb=1&dtd=6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

9a4eb2c9445287c34cb0a9ed5cc673460362483f0855bc91f8230dfa46a955e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 04:27:47 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 747E 2 KB
822 B 15ms
15ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 70712
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 10:09:15 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame 747E 23 KB
9 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33131
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9282
x-xss-protection: 0
server: cafe
etag: 14645652906762492339
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 20:35:37 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 747E 3 KB
1 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33131
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 20:35:37 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 747E 20 KB
8 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48628
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:19 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 747E 202 KB
64 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H2 200 a6de5423b7c632060e8f86136bd5d27a.js Show response
www.gstatic.com/mysidia/ Frame 747E 37 KB
16 KB 50ms
13ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a6de5423b7c632060e8f86136bd5d27a.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0c21f21f7b1658ed6ab5c0461020a21d62f9e0a7cd7cf3d9e6ef61a2c481f31e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 10:09:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70713
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15478
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 14:10:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 26 Feb 2024 10:09:15 GMT

GET
H3 200 Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js Show response
pagead2.googlesyndication.com/bg/ Frame 84C6 38 KB
15 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61fe41cde1b6df00f34e5a9795741e926e8861b8e80d396ff799d48bacda5300

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 17:34:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 389576
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14900
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 23 Nov 2024 17:34:51 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0088 624 B
245 B 55ms
53ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxilm7vGATAB&v=APEucNWMtwf5W7SugzLxb5xm-gVW2eYkSYEMo1F1d80HzUI3Cn8aPrTGT5iGvQDGXR7qTb_gdZdbjWBlDLhiAXxsbotZiV8at09V-E9c9aQcrDhBvGn9gvomseQXidKtITDBcnHg3v0pNtsBG4bzkeFCHRI7djF8I40lPNGTM9pUni00V4849pw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=250&slotname=2097210043&adk=239546933&adf=744370384&pi=t.ma~as.2097210043&w=300&lmt=1701236867&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867134&bpp=1&bdt=598&idt=1&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=574&ady=3880&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=12&uci=a!c&btvi=4&fsb=1&dtd=3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:48 GMT
expires: Wed, 29 Nov 2023 05:47:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 7548 41 KB
14 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-ATkqf0fwUYLXig0oCy4bKfBr6c5bPIukc1rmPrz2h9UCbq6RCp9_8mQNtwTxZlpc7rdidYeul4snSf2gvgQXFywmG6Dbx_P4fyMnH98Qfh4NOObVpwKXWHmQirkqsixJFZDFdf0O1si4VkWDg8woGVNhgmUHvYsx8JhgSRmyqN7CXsm4k&cry=1&dbm_d=AKAmf-DGLb0ix4OxdgeATc2o3wtaYLC_noeX5GTUc1mkHKpFlCmc7r7wsI21gyLadyag_WGpgJsrhlvbBNYqhfMElY55VWCOd-n7YundUOO_7HxSzV96K44Awd6eCYlPpq5udBxtiKHH-wUZzXE9IIh880gmSCh0vSIottSuHremkt4PgNPIBp_8Amu3PB5tjtTJCB0i-QBzSsQPTxWVCgvi1qi_5SQiplc2fHiuJb2hoSs-xunwpSVe_B37pnDC-5d0dzlhy9_FKxFVF7-XH5vM8Nppm5jkzN_47OCuYNlajR4Ivljk5olE0p5dVkW3FbsXeq6KFoxkPgTDFKwKPPm1tOL_Z2KhkMDMule4XQemucMJpcqoPhxlvllNUjJOXnHqG7mYLpgWzDmu3fR09mog8i-lpDkadLjv1CGvG88T2BL5bjESLcK8-rmOq-J4WyvR2EjOtzBhExY7ZIfMQwsJA1aySKBHcufol-QsTok8WxnFLObwWTO7lT9OBUrj0ZWkPo17SFX7r9_4ic7KmIVqdY0a5WMt9ny85QWRBwW9bLvx4JSx-bAOExxiLlrCF07v_nTHgsZycuN9_-MjCSJAp_LKilIA5jvEVkTWW9wiO1kJYm2w74iY54CwQedyq1dTjb9aWF3bJxip9dXrQWSDK6_mBLs3k7BVFCBd6eb-OVH1QE0z8UhMQvNSDUQR1vD-Dx4kRFL9Y0LPY40kQqUQMehVDRgndfRMZQGaYdPbF36PIUn8F0P7v7LMosBXsn5fRXCfmfEWWUaiTlhV3hAVg-v-CUhxOgkKSr6NBFlRtnHnmBsU9I5CS8fBNzGZxiewa96MciN8HfZkS8PXo2LjyEEINHkfAtArHYFHZ4mf_Dtc8l2VDsTqr9J6ygx9yQdDtcEERUCa6LHpmtukq9l2Fs1W2N2etFUYm8V6GF94LddqFbYGA3vQ46cBDbzjYpexZA6WR3n9UfevlSrsGdw3rpfjL5FQknHwFDN4iD8M71li1xAn4kARKCIHEpnJVaIpl08mGPW-rPsFZVE0bc9VjSiXcuQPJn1BRXhCnC04CxomaA2dhcV7n57MgnFxARPB40s0OtO8gSgJYqSUvndpBlqmljQK3Rs6GjsH7BdmB9jKzQlMRVE-Kx65sutY0U8URkBRFqWqPWt80PBsrysDGbfN51SR767v9XKQJf9SGJ8-IO6Prj2dOBHOqyuTzRWb4bl4AemKegfQ6dW3TuPFcVsd2bYt4goBFhL3FZT8LGf_umGFmnqAFThTqp8Ai5zN1sSWdsXggz_qqQqDR5NCjjx7fKWt2-p2z6CwV5iINYAhqzJow4fZaJi5F6qmLfN03noPV2i3mWHQp75Oue-9smSZ9AVeGfIGQKHVRRRHCBZRNmQtyjaNSihfQHUkJjFVVhl1t24-V_mdr_u2w5X6wpZ6z-Y5ksFHwbSUkO-qzxaV_h4Bgb4lNHWZAM4z9j7cMgv9Z8sm1SD8VmxYwP4C2Dm3BQIHIbq0JChnHI3YnaIIi_piz-F0EXyBVuEXDEytRsrapj_nm0uml6eWvKi4i-rKEPNyWOeIe-WNHrXEThBWISx7eaJMQR3Inp-jhfW1FDSJMYHKRO80XVTRpNKlO0TigdVNTlLs73tdecpjYtRn41mzWaRZBCVxkRHAq_W6F4qgpJ2rm7mAwasMM-PFUn5iCdDksiuO1AxJiYVDHMN8PucVO8vu4cP6CGvUXOjvVGfVgTUaRFsSMLbnDlTNchksUYpZFHmWq9yg9o8JeHsS2gPV9ejN1IZlxTSNacISCOwyReIxf5Am4Pqb8nw4XvGcvMtDPsvk5wZWxugKolIuHYOwS33uZDa-qjjPJAB6u1guQaESOF_h0j4nxs1Tt0aOURA_5BbH26NH-JQKwDvsmWeLAnhGndbuWr6Q3TbgHNq6cE54IC_maPhoOabOEG7c-tauxMyzn3raTfxI71mUEFxWFNBlVijwmnHvmd3Y8Th8V_An7hwTkfGKNHo1POcZNtKWjEzMvFxDW-ToGgQhnLq2YQDcZJNpRl_rLHLrv6s32BtMEnU8YNRkymiHZUJB_HwlZmaKMcfgDCzuWK2TC8rmbuVTx3NFrdS_pFNXvvriX7PHmlwCWOZ1miFzgKuOESpuvpl_r082VwZQOauxeQIaUcux-GY6_mUZ8Nhvje_Nm4TRE-S4cOQlHGY6EunoX19o0ABk9rLtbyBTiX-pzjoXTjpdtFu35WXVbjGu4zh5kjBCFCpH60fkZx_3PICgBeCGq_uzZgGa8Mt-3eFwg5TG-UUSOx7dPF7Ibns2sdlqz7BTcKpXpJVvrNUCKrs6nYBDoeEnPw-B7RskmGnfFHB7-eTfUfmvsV-_nwi9EEkAYKdAgM5sBJgR6Rjqfl0_SAmF1hHbBHIS30qhQL-Pw5JFwUB_qcH-CuisaOGgkoctKQpbcQQ_REF0kL65QhzR9J-eYOTL6GIWxlo-nyVRNKq0SduAKjjn1o1Wxq-uleaXN04Rc1k02QsfGBRbA2dDasIN5CcmTFxda9dk42oVu-5Gib1yEKYBZp1aWPBbssKvHo6EHB0X0NCkCSKB4GyQJtCYi6ZGNCCmVWYXqh4SQXjLKwDH0-JY-c7t4kUdYd1HZ-gOgStQWNsWy87ZAU3jqzboy3004mwKgiiOuyb4EpM55Ypcl4Kb7PXw21xHCRogni9jzNN9b4wEsoQpyiBRiljoHQtJFgBXaLVAssmjvWIJrxMjk-N2ituARQQ79WpHRty56lsS3k0SLDAmDhqvR9-WbDRf7sP-EqAm-KiVtm4aswM0jkEyqm_OWOFkG_DfEJ_d93U1W6ZPGhW_HcKLwjpthHUznnvmB8bD9WkKqpdhmAleP5MnBF6bXDi--mRMa19OJLK9yW3uwvHTMtw2vSkHT1OvN4Cuut9SwOimz2vIp4nT8C45yD6upW_PudPxhJSwwZ5n5_Ev7NWTjP1lmEhIqODtAofNqmVGI1OqEqxvXe3T-11Mb8Hh6D-f6m32f4ASz6ObE_lYEkfesx55Vf1jYpxfdIoZNwsAzVrqh57GodNfAS4-7HEdY0Wr_qmaeZH10pLBEXisSAkna8AF7M02jLRoTsNkRz2W9hV1Z8Ln5tk_gmXQTg0aLjbp9lwHhycrpKkKRAmeVfLhSSBrpRL3Uk9ET_-v8b3KCUE-8ioargy9IA52pOqKuSiNK7pFr6Fjhjpb8-h3m1qeDyjgDzLTDZdBoXSPE5Hr_dsbgK-ZqqwT-McR1dhosXObVVuSUbBxKOxfG_V_ag_rb689wkccGNJz6h3PEeHdzgHQK27aeCtHYqLpwtOSgE-THPpdbZvMXf_vK6DbVpuW5El4SsiHPDamdRWOyVWN2GA6OB7QKZoqB31DN9AXgwtTDZA4Kz6XrB2en25ZId8EOATojc63OOIMm6wM_aI7npz-yv-Otqu70n9ewO2OYCXWv661uwm6L7tIOUe9fg-z8P2F2a60I0GFctNycmlix-LktvGeR-XnkmRKbp7QnRureLaPePR-JtcClEFUAK02psAxIeMUSZ0VfEckqPmGqwwwXkxKUZo5t16T_ws7bqrYq9GRkNIYVwcLjOWYY1PmOEnuju8963_mu3yEGLKAmOgsh3E8EUdrSXq0enfAiy7O-L5tuenYByxmsuRMZTwwAfs542_N5AUah1gzXhE3F3sjer2nZRD9pPinorGosatIlxZ38Thd8SjmPIvsf3ncv6TF9IGD5wtGep3yyGkPFwfh8JN3mxVTywPIxHKSw-GilAfuUeNQiyycZgSoeiy6Zq0ooAqkPX1ystFr660QzOsKIkbSna3C9HME2DMYL0K59LdnPeNjiFlR7W75qPyzJyNqSbuK2K3eufp7gwgpkA295YoWhXOvYXoeMQB2OQJL47rqJ0iywyq39k2o56Nk5DSq2DoSQig1cWZ9xHeeR_AeQOxrDmcBI08RoVchOCPdrw0O9BMt_4vuWCGHVrEEpbGZX-fXRBcXS-71PJMeiZCSzAHtM2HnpwE7VVr_hUdHzkjiig1KRTVlNXeekxwzA0q2pJmSjgIdGyto1m3xMwVDP9aAY_tSkqTPjVfEOpA1E5joE0KVnJgasSzQgsyjloXNU0AKYI0EFNPEM4H765RvxO2DYm2gOZQRuQl5-a-9Xb-1QcoEkPFQ0zxBO453BkI5nVIgWNkQWwAXcbkGItEZK2aAGST1hV7S3KzUvE06viP6_vqjimrACTXdbicoBpjtfzwMlHb6rrVm3vGDt9akclUMoqCxlppcw0Cx1JOhCRdryiBciKpHoclmEvmxym3CB68-GbiPIm6E7buhLHkk0O2vnuE&cid=CAQSTwDICaaNcjn0n3jHFnr0VQrDo48k8IVpqqof3XtNcrQYBN0vQobM4a8Ep0HSQGnR6JMZY1IN5yW9T-i1LHrY9Mp-dQhAdUFXpGrCEG4PnGQYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=2048597919789156400&adk=4188270525&idt=110&cac=0&dtd=9

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 307826
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 16:17:22 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTIzNjg2Nzk0NjI2MAogIHNlcnZlcl9pcDogMTc1ODc4NDgxCiAgcHJvY2Vzc19pZDogNDAzNTc0MzMxCn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDExODY4OTQz...
ad.doubleclick.net/ddm/activity/ Frame 7548 0
940 B 113ms
69ms Image
image/png 142.250.184.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTIzNjg2Nzk0NjI2MAogIHNlcnZlcl9pcDogMTc1ODc4NDgxCiAgcHJvY2Vzc19pZDogNDAzNTc0MzMxCn0KZmxvb2RsaWdodF9jb25maWdfaWQ6IDExODY4OTQzCmFkdmVydGlzZXJfZG9tYWluOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0Igp4ZmFfYXR0cmlidXRpb25faW50ZXJhY3Rpb25fdHlwZTogVklFVwppbXByZXNzaW9uX3ByaW9yaXR5OiAwCmltcHJlc3Npb25fZXhwaXJ5X2luX2RheXM6IDMwCmV2ZW50X2ltcHJlc3Npb25faWQ6IDEzNzEyNjc1MzEyODY3OTcyOTgyCmRlYnVnX2tleTogMjI1MTA0MDIzMjgzNzcyNjI3OAppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QUk9EVUNUX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9JTlRFUkFDVElPTl9EQVRFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIjIwMjMtMTEtMjkiCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0ZMT09ETElHSFRfQ09ORklHX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxMTg2ODk0MwogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9DT1JFX1BMQVRGT1JNX1NFUlZJQ0UKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBVEZPUk1fVFlQRQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMAogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9RVUVSWV9DT1VOVFJZCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIHN0cmluZ192YWx1ZTogIlVTIgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9QTEFDRU1FTlRfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMzMjIzMTM3OQogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQURWRVJUSVNFUl9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogODc4MjQzNjk2CiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19MSU5FX0lURU1fSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDE2NjU5OTUwMTQxCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0RWM19DUkVBVElWRV9JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogNDE2MjA2MjQ1CiAgfQp9CmFyY2hldHlwZV9pZDogMTIKYXJjaGV0eXBlX2lkOiAxMwphcmNoZXR5cGVfaWQ6IDE0CmFyY2hldHlwZV9pZDogMTUKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL3JlZGludGVsbGlnZW5jZS5uZXQiCmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9hZC1zcnYubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8va2xpY2std2VsdC5kZSIKaW1wcmVzc2lvbl9ldmVudF9yZXBvcnRpbmdfd2luZG93X2RheXM6IDQKYnJvd3Nlcl9hdHRyaWJ1dGlvbl9hcGlfcmVxdWVzdF9wcm9jZXNzaW5nX2JpdHM6IDczODE5NzUwNAo

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0xdcef201938bdf00c0000000000000000","13":"0x944de669759348fb0000000000000000","14":"0x4e7a6bb37d31b1150000000000000000","15":"0x629dc17643ccfaf10000000000000000"},"debug_key":"2251040232837726278","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"8":["11868943"]},"priority":"0","source_event_id":"13712675312867972982"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame FE9D 0
177 B 80ms
21ms Document
text/html 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Wed, 29 Nov 2023 05:47:48 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2595 42 B
63 B 50ms
49ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A9i6ajXvmcuQ6lDl-yiyVqLTkF7fZzxWWdMB1eMqwTwqgBMSWvSZImIlh0ocVpIx5yvKsdxQADUJ1947xPsg4D8Hx61F3DA4wkYZdR2DdAnXDMaGQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1231661633440980&output=html&h=600&slotname=2065248459&adk=1530395088&adf=4061442901&pi=t.ma~as.2065248459&w=300&lmt=1701236867&format=300x600&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867069&bpp=1&bdt=533&idt=1&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=0&ady=0&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaE%7C&abl=CA&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2595 0
20 B 49ms
48ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=5370459519191871038&x=1&ct=76

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 2595 89 KB
31 KB 118ms
117ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cf940bd2489897434455528323cf66c4e3aecd5eea963f1d99d96acd452d6dd4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31498
x-xss-protection: 0
server: cafe
etag: 4296746511219988724
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H2

200

skeleton.gif
static.adsafeprotected.com/ Frame 2595
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/1676726/76430579/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_dspID=3&ias_campId=1014760199&ias_pubId=pub-1231661633440980&ias_chanId=1&ias_place...
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_xappb=

43 B
484 B

66ms
14ms

Image
image/gif

2600:9000:26da:9e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_xappb=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1231661633440980&output=html&h=600&slotname=2065248459&adk=1530395088&adf=4061442901&pi=t.ma~as.2065248459&w=300&lmt=1701236867&format=300x600&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867069&bpp=1&bdt=533&idt=1&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=0&ady=0&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaE%7C&abl=CA&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&fsb=1&dtd=3
Protocol: H2
Server: 2600:9000:26da:9e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 21 Jul 2023 04:12:26 GMT
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
via: 1.1 99a7400285d83f528f50f54d665628e2.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P4
age: 11324123
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 43
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
server: AmazonS3
etag: "45cf913e5d9d3c9b2058033056d3dd23"
content-type: image/gif
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: hN8q6CEyaw8LtDe5STEqxQgWnKq1NRXeAID0iVrrwRy76GD4OrxERQ==

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
server: nginx
x-server-name: app02.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&bundleId=&ias_xappb=
cache-control: no-cache
content-length: 0

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 2595 3 KB
1 KB 20ms
16ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33131
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 20:35:37 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 2595 20 KB
8 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48629
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:19 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2595 202 KB
64 KB 36ms
27ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H3 200 2076313506083323656
tpc.googlesyndication.com/simgad/1144290754256996351/ Frame 747E 40 KB
40 KB 20ms
20ms Image
image/jpeg 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/1144290754256996351/2076313506083323656

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18f30ec68fd29513b23f5f6f9fcec264490eb2f768a30a37c34104c8b70840b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sun, 26 Nov 2023 19:26:02 GMT
x-content-type-options: nosniff
age: 210106
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40769
x-xss-protection: 0
last-modified: Mon, 13 Nov 2023 14:21:33 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Mon, 25 Nov 2024 19:26:02 GMT

GET
H3 200 3570889295123759882
tpc.googlesyndication.com/simgad/ Frame 747E 8 KB
8 KB 22ms
22ms Image
image/png 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/3570889295123759882?w=100&h=100&tw=1&q=75

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

addece7e66c89300368ec28cd45deb53eea9a3370121cbf3b7609c3373bb66d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 11:28:36 GMT
x-content-type-options: nosniff
age: 325152
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8117
x-xss-protection: 0
last-modified: Fri, 11 Aug 2023 15:01:15 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 24 Nov 2024 11:28:36 GMT

GET
DATA 200
OK truncated
/ Frame 747E 221 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 613603afe8c5203c59d7f9df1cbac87109df7ffdf245fd20becfa6bd95b92155

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK okg862ss9p0j Show response
hal9000.redintelligence.net/zone/ Frame 7548 12 KB
4 KB 52ms
14ms Script
text/html 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/okg862ss9p0j?subid=&gdpr=&gdpr_consent=&rnd=1701236867457693&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCsG9Bg9BmZd33G8eXgQf8sIWYBuvSwaFpnfHe9MUP8C4QASDg4tlWYJWipoKwB8gBCakC73--9ut6sj6oAwHIA5sEqgSxAk_QX0u35HyF8nPyFkRZLKxnXb337CFuVND8hmWt9pabk1Xrkz8i_BL4VXEUGnGWUh476MbtD38_i_lRRT4kiioNxL6D7kw4LC9y4oB5OmMEujRJ-ky289C1m-wIKOwHm6gH7IoANw-fDryKlzM8P2c7_hHe-EZksASOl5ZINxdQj6caxDyZkf_iUmq3F4Tk4rYe6zFdzD4RUaA-zkHZm4lXpv4TMRLSxmy7GLuRKXNb2SY9uUr8mU0eJmXZvsZUZ66gO003v-h6GaPiVou16KD0fa5lMeNXyRvrI3Dn1XDasIZGyVNpXu8weFUeRMaVl5XkY-YV3jMxD-EV6YCnY0pDGivhWQggFqQCmq6vz_6G4wADlaICFzTpfULYju1RUstJgvIhVWs2UAEWrAOi_Zl5wAS-jurk-QPgBAOIBb3Uiog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WKyjp5nB6IIDgAoBmAsByAsBgAwBogwcKhoKGOS0sQLutbECtbixAuS0sQLutbECu7uxAqoNAkRFsBOH77EV0BMA2BMDiBQC2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNcjn0n3jHFnr0VQrDo48k8IVpqqof3XtNcrQYBN0vQobM4a8Ep0HSQGnR6JMZY1IN5yW9T-i1LHrY9Mp-dQhAdUFXpGrCEG4PnGQYAQ%26sig%3DAOD64_1b8Ub-F787j3PD3UIQSTxPcunc5A%26client%3Dca-pub-8367749956917006%26dbm_c%3DAKAmf-AoPFAYTtP29cnAPAOqNV2y7S4oCewKHNC6uIPQvWzh0BWv34KQMOfl8SkeZPMjwfnbRSzQXBUU8vCKRm64psHej2j-4hUhu1UDc-_Ha2KpFuIe81UZWserYrkDSdchMnm1ZwnlwxelHH2uZ-zh8m6Ns1E1ZGEsVnNEZ9rDwykwKfD1-4M%26cry%3D1%26dbm_d%3DAKAmf-AaJUzdd2v4cXcW2uyxF7qTKRR-3j-y7qcWnbK5KSY-OVVUIoXgeaaqyq_zSh5IF4r4Cx9MzVc_rHirYGrgE3gHHsIwdwUx87M6uUDvtkvUS_ZvySOIT6iFCdaoTaBiRh9mavvAkzLUSpo15ZuLvqIz7ORl4tD54RiNoFb4YTzcoZkKMUTBp1FvodwHgHumd-_T22BkBjqjBHrpQ1QPfPaNi-TYOh5upozI93ezI6fDIxwg65X-hh_mpu_C0HaJ9Ww5B03T05zvzQUWa58ZoKJ-X59iAABTRQImAMx6cgy85BCihb5q0Lkd_EVQcyfnxV5OS3990XlwF640ECw3q7Hg2WcH3Ns7B0jMi7psI5VqVe6SC6jlNxV83BYIlrYq_1Mu87kO-TxqSvzL3j6OWRwNIUVHAlqKuXsjqwexjA_3ZLTxeL0VbdvtGC730e0J8K6MCgv91LF7kORdd8iX2wpdS5W_xrCtwstfIZP_ypKhi1cxhpIpTVSta2gteu_xkxrshih5XJa0rM9gmQe3nYnvjmZUWfEwTbcAgWaQPWEWrBYpJJ-BpbjQMBaTXfw5BNb6g9Dg%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=250&slotname=6076681977&adk=2278793534&adf=954853469&pi=t.ma~as.6076681977&w=300&lmt=1701236867&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867142&bpp=1&bdt=605&idt=1&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280%2C300x250&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=574&ady=4615&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=5&fsb=1&dtd=4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 572de5d400beec1ef51d53485ac1683409c9a9a7912bfe3312e856a1ea6a1dc8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4272
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 84EC 640 B
265 B 60ms
56ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGILInv0BMAE&v=APEucNW7u00kCuOz9laK513KXNNdWZ_MIiTEkI-5aUGHR7WuwglZYGQ5xpwOpevSg4_I2lTIFWheibcM3K5p2o7TH37NmbuXRwQhQm9ynyc5jjztVC2KE8gvpovFQnDGrwIvhOFEiRESlutXL63srlGXekjjqA9FOVDlN1C841ZyyTt-Lx4qWo4

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1231661633440980&output=html&h=600&slotname=2065248459&adk=1530395088&adf=4061442901&pi=t.ma~as.2065248459&w=300&lmt=1701236867&format=300x600&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867069&bpp=1&bdt=533&idt=1&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=0&ady=0&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaE%7C&abl=CA&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&fsb=1&dtd=3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:48 GMT
expires: Wed, 29 Nov 2023 05:47:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9794 42 B
63 B 51ms
48ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CmiJ1VriU9_5UikvHE-FecuCHXnGIk6hDG_f-XNJ3CUiLsDJRfiSFus3238PPHdgwzS_aqc-ELUDndShkAPxl48d02JnXyR-i6yeTAl765U43LZko

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3759532572&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867093&bpp=2&bdt=556&idt=2&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=9&uci=a!9&btvi=1&fsb=1&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9794 0
20 B 50ms
46ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=11031375670977623224&x=1&ct=76

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 9794 89 KB
31 KB 100ms
97ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 9794 3 KB
1 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33131
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 20:35:37 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 9794 20 KB
8 KB 17ms
13ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48629
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:19 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9794 202 KB
64 KB 31ms
31ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame FB8D 640 B
265 B 65ms
64ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYvN7jwAEwAQ&v=APEucNUM3ed5EaR-Y7XZUNM1KS6C1Mm-Eadhb5ZtUy8D0eiOJ7wq9MF_u9-XYbw73IbVyhxXpwI5wzHACiPsOBOsO5dTqMOBtBOjCerQAd2yi4nqCsiN5NpAQg0f3Av0a9WZnLwSY4X4unjEBW2Q-WMSQAUnB7ud0RMuYxKESGtq6zDHne5TyYk

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3759532572&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867093&bpp=2&bdt=556&idt=2&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=9&uci=a!9&btvi=1&fsb=1&dtd=5
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:48 GMT
expires: Wed, 29 Nov 2023 05:47:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 117ms
50ms Preflight
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 29 Nov 2023 05:47:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 747E 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bff07e6322cb821a26d62969540a1b6e9c865e101fed73fc0cab2b4410bddeee

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 0088
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDhAX8AruKdbHTdiAY6O524&google_cver=1

43 B
739 B

25ms
25ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDhAX8AruKdbHTdiAY6O524&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxilm7vGATAB&v=APEucNWMtwf5W7SugzLxb5xm-gVW2eYkSYEMo1F1d80HzUI3Cn8aPrTGT5iGvQDGXR7qTb_gdZdbjWBlDLhiAXxsbotZiV8at09V-E9c9aQcrDhBvGn9gvomseQXidKtITDBcnHg3v0pNtsBG4bzkeFCHRI7djF8I40lPNGTM9pUni00V4849pw
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tGJyAY2%2Fd40dV%2Fwkd2xxwavNOmByzniRgih%2B9gRZM71ODA8a1FcaI8gdFhIgacab6rEirFFT5VLBVLB3Q%2FBytHGDcXpQVDYnPfrSHdzZgEwCqbJHc4D70b9%2FUyTZzr1IBRatA%2FL4UEKpow%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82d88ed9d86d1917-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDhAX8AruKdbHTdiAY6O524&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 0088
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZWbQgxrhAdvYahmWZn9RwwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDhAX8AruKdbHTdiAY6O524&google_cver=1

43 B
738 B

34ms
33ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDhAX8AruKdbHTdiAY6O524&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxilm7vGATAB&v=APEucNWMtwf5W7SugzLxb5xm-gVW2eYkSYEMo1F1d80HzUI3Cn8aPrTGT5iGvQDGXR7qTb_gdZdbjWBlDLhiAXxsbotZiV8at09V-E9c9aQcrDhBvGn9gvomseQXidKtITDBcnHg3v0pNtsBG4bzkeFCHRI7djF8I40lPNGTM9pUni00V4849pw
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4hcFJQC5jpi79mQYvQhsVBfjpGqM4nAo8kvc3ypSSFetcCBQYLHvZLE8Q2i3gQOEfehG8Rdnu%2F6dyq19%2B0HlKE%2BcjaQpa%2B7aBMOyYKxWPiW7tF8LT8eG9xrudo%2FcPnJru0%2Fiujm1zqhwPw%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82d88eda08b01917-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEDhAX8AruKdbHTdiAY6O524&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 0088
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEDbxx8OLm4HiB0CXGY4scM0&google_cver=1

43 B
841 B

14ms
14ms

Image
image/gif

185.89.210.141
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEDbxx8OLm4HiB0CXGY4scM0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxilm7vGATAB&v=APEucNWMtwf5W7SugzLxb5xm-gVW2eYkSYEMo1F1d80HzUI3Cn8aPrTGT5iGvQDGXR7qTb_gdZdbjWBlDLhiAXxsbotZiV8at09V-E9c9aQcrDhBvGn9gvomseQXidKtITDBcnHg3v0pNtsBG4bzkeFCHRI7djF8I40lPNGTM9pUni00V4849pw

Protocol

Server

185.89.210.141 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
an-x-request-uuid: 89d9d0cc-947b-46b0-bc8f-463d21bc8013
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 37.58.58.248; 37.58.58.248; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEDbxx8OLm4HiB0CXGY4scM0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0088
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMzNDI0ODQxODI2NTcwODgyOA%3D%3D

170 B
188 B

34ms
34ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMzNDI0ODQxODI2NTcwODgyOA%3D%3D

Requested by

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
an-x-request-uuid: 252a6b3d-5977-4c68-9a20-7aeb23ccaaf7
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMzNDI0ODQxODI2NTcwODgyOA%3D%3D
x-proxy-origin: 37.58.58.248; 37.58.58.248; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 84EC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENMUrSX-FnQvXe868Rj87p0&google_cver=1

43 B
115 B

21ms
21ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENMUrSX-FnQvXe868Rj87p0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGILInv0BMAE&v=APEucNW7u00kCuOz9laK513KXNNdWZ_MIiTEkI-5aUGHR7WuwglZYGQ5xpwOpevSg4_I2lTIFWheibcM3K5p2o7TH37NmbuXRwQhQm9ynyc5jjztVC2KE8gvpovFQnDGrwIvhOFEiRESlutXL63srlGXekjjqA9FOVDlN1C841ZyyTt-Lx4qWo4
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENMUrSX-FnQvXe868Rj87p0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 84EC 43 B
220 B 38ms
19ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGILInv0BMAE&v=APEucNW7u00kCuOz9laK513KXNNdWZ_MIiTEkI-5aUGHR7WuwglZYGQ5xpwOpevSg4_I2lTIFWheibcM3K5p2o7TH37NmbuXRwQhQm9ynyc5jjztVC2KE8gvpovFQnDGrwIvhOFEiRESlutXL63srlGXekjjqA9FOVDlN1C841ZyyTt-Lx4qWo4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 84EC
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEPnonWqP85AaUUBADn3G4uA&google_cver=1

23 B
165 B

77ms
43ms

Image
image/gif

2.19.85.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEPnonWqP85AaUUBADn3G4uA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGILInv0BMAE&v=APEucNW7u00kCuOz9laK513KXNNdWZ_MIiTEkI-5aUGHR7WuwglZYGQ5xpwOpevSg4_I2lTIFWheibcM3K5p2o7TH37NmbuXRwQhQm9ynyc5jjztVC2KE8gvpovFQnDGrwIvhOFEiRESlutXL63srlGXekjjqA9FOVDlN1C841ZyyTt-Lx4qWo4
Protocol: H2
Server: 2.19.85.30 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-85-30.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Wed, 29 Nov 2023 05:47:48 GMT
pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEPnonWqP85AaUUBADn3G4uA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 84EC 23 B
165 B 113ms
42ms Image
image/gif 2.19.85.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGILInv0BMAE&v=APEucNW7u00kCuOz9laK513KXNNdWZ_MIiTEkI-5aUGHR7WuwglZYGQ5xpwOpevSg4_I2lTIFWheibcM3K5p2o7TH37NmbuXRwQhQm9ynyc5jjztVC2KE8gvpovFQnDGrwIvhOFEiRESlutXL63srlGXekjjqA9FOVDlN1C841ZyyTt-Lx4qWo4
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.85.30 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-85-30.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Wed, 29 Nov 2023 05:47:48 GMT
pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 22E8 38 KB
13 KB 14ms
14ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 307777
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 16:18:11 GMT
expires: Sun, 24 Nov 2024 16:18:11 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame AAB1 42 B
63 B 59ms
58ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AuC_eKqvGIwV0MBKJN2spq96DL8TM82aUKWJB6ls9tDDspBC2-lTtT1koN0StT6xXuEMu7v4-lbprZNXV4lH0ZvB1jLo-owRlAfGsOWocrMrAKgZE

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AAB1 0
20 B 59ms
59ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=15891318497451885513&x=1&ct=76

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame AAB1 89 KB
31 KB 108ms
108ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame AAB1 3 KB
1 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33131
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 20:35:37 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame AAB1 20 KB
8 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48629
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:19 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame AAB1 202 KB
64 KB 43ms
43ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame FB8D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENMUrSX-FnQvXe868Rj87p0&google_cver=1

43 B
107 B

31ms
30ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENMUrSX-FnQvXe868Rj87p0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYvN7jwAEwAQ&v=APEucNUM3ed5EaR-Y7XZUNM1KS6C1Mm-Eadhb5ZtUy8D0eiOJ7wq9MF_u9-XYbw73IbVyhxXpwI5wzHACiPsOBOsO5dTqMOBtBOjCerQAd2yi4nqCsiN5NpAQg0f3Av0a9WZnLwSY4X4unjEBW2Q-WMSQAUnB7ud0RMuYxKESGtq6zDHne5TyYk
Protocol: H2
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESENMUrSX-FnQvXe868Rj87p0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame FB8D 43 B
112 B 26ms
22ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYvN7jwAEwAQ&v=APEucNUM3ed5EaR-Y7XZUNM1KS6C1Mm-Eadhb5ZtUy8D0eiOJ7wq9MF_u9-XYbw73IbVyhxXpwI5wzHACiPsOBOsO5dTqMOBtBOjCerQAd2yi4nqCsiN5NpAQg0f3Av0a9WZnLwSY4X4unjEBW2Q-WMSQAUnB7ud0RMuYxKESGtq6zDHne5TyYk
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame FB8D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEPnonWqP85AaUUBADn3G4uA&google_cver=1

23 B
165 B

59ms
41ms

Image
image/gif

2.19.85.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEPnonWqP85AaUUBADn3G4uA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYvN7jwAEwAQ&v=APEucNUM3ed5EaR-Y7XZUNM1KS6C1Mm-Eadhb5ZtUy8D0eiOJ7wq9MF_u9-XYbw73IbVyhxXpwI5wzHACiPsOBOsO5dTqMOBtBOjCerQAd2yi4nqCsiN5NpAQg0f3Av0a9WZnLwSY4X4unjEBW2Q-WMSQAUnB7ud0RMuYxKESGtq6zDHne5TyYk
Protocol: H2
Server: 2.19.85.30 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-85-30.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Wed, 29 Nov 2023 05:47:48 GMT
pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEPnonWqP85AaUUBADn3G4uA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame FB8D 23 B
165 B 89ms
43ms Image
image/gif 2.19.85.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYvN7jwAEwAQ&v=APEucNUM3ed5EaR-Y7XZUNM1KS6C1Mm-Eadhb5ZtUy8D0eiOJ7wq9MF_u9-XYbw73IbVyhxXpwI5wzHACiPsOBOsO5dTqMOBtBOjCerQAd2yi4nqCsiN5NpAQg0f3Av0a9WZnLwSY4X4unjEBW2Q-WMSQAUnB7ud0RMuYxKESGtq6zDHne5TyYk
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.85.30 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-85-30.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Wed, 29 Nov 2023 05:47:48 GMT
pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET
H/1.1

200
OK

request.php Show response
hal900024.redintelligence.net/ Frame 7548
Redirect Chain

https://hal900024.redintelligence.net/request.php?zone=okg862ss9p0j&nw=20&renderingType=javascript&namespace=a5074b6f4b&subid=&uid=75992506730cd7c1&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900024.redintelligence.net/request.php?zone=okg862ss9p0j&nw=20&renderingType=javascript&namespace=a5074b6f4b&subid=&uid=75992506730cd7c1&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

170ms
117ms

Script
application/x-javascript

138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900024.redintelligence.net/request.php?zone=okg862ss9p0j&nw=20&renderingType=javascript&namespace=a5074b6f4b&subid=&uid=75992506730cd7c1&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCsG9Bg9BmZd33G8eXgQf8sIWYBuvSwaFpnfHe9MUP8C4QASDg4tlWYJWipoKwB8gBCakC73--9ut6sj6oAwHIA5sEqgSxAk_QX0u35HyF8nPyFkRZLKxnXb337CFuVND8hmWt9pabk1Xrkz8i_BL4VXEUGnGWUh476MbtD38_i_lRRT4kiioNxL6D7kw4LC9y4oB5OmMEujRJ-ky289C1m-wIKOwHm6gH7IoANw-fDryKlzM8P2c7_hHe-EZksASOl5ZINxdQj6caxDyZkf_iUmq3F4Tk4rYe6zFdzD4RUaA-zkHZm4lXpv4TMRLSxmy7GLuRKXNb2SY9uUr8mU0eJmXZvsZUZ66gO003v-h6GaPiVou16KD0fa5lMeNXyRvrI3Dn1XDasIZGyVNpXu8weFUeRMaVl5XkY-YV3jMxD-EV6YCnY0pDGivhWQggFqQCmq6vz_6G4wADlaICFzTpfULYju1RUstJgvIhVWs2UAEWrAOi_Zl5wAS-jurk-QPgBAOIBb3Uiog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WKyjp5nB6IIDgAoBmAsByAsBgAwBogwcKhoKGOS0sQLutbECtbixAuS0sQLutbECu7uxAqoNAkRFsBOH77EV0BMA2BMDiBQC2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNcjn0n3jHFnr0VQrDo48k8IVpqqof3XtNcrQYBN0vQobM4a8Ep0HSQGnR6JMZY1IN5yW9T-i1LHrY9Mp-dQhAdUFXpGrCEG4PnGQYAQ%26sig%3DAOD64_1b8Ub-F787j3PD3UIQSTxPcunc5A%26client%3Dca-pub-8367749956917006%26dbm_c%3DAKAmf-AoPFAYTtP29cnAPAOqNV2y7S4oCewKHNC6uIPQvWzh0BWv34KQMOfl8SkeZPMjwfnbRSzQXBUU8vCKRm64psHej2j-4hUhu1UDc-_Ha2KpFuIe81UZWserYrkDSdchMnm1ZwnlwxelHH2uZ-zh8m6Ns1E1ZGEsVnNEZ9rDwykwKfD1-4M%26cry%3D1%26dbm_d%3DAKAmf-AaJUzdd2v4cXcW2uyxF7qTKRR-3j-y7qcWnbK5KSY-OVVUIoXgeaaqyq_zSh5IF4r4Cx9MzVc_rHirYGrgE3gHHsIwdwUx87M6uUDvtkvUS_ZvySOIT6iFCdaoTaBiRh9mavvAkzLUSpo15ZuLvqIz7ORl4tD54RiNoFb4YTzcoZkKMUTBp1FvodwHgHumd-_T22BkBjqjBHrpQ1QPfPaNi-TYOh5upozI93ezI6fDIxwg65X-hh_mpu_C0HaJ9Ww5B03T05zvzQUWa58ZoKJ-X59iAABTRQImAMx6cgy85BCihb5q0Lkd_EVQcyfnxV5OS3990XlwF640ECw3q7Hg2WcH3Ns7B0jMi7psI5VqVe6SC6jlNxV83BYIlrYq_1Mu87kO-TxqSvzL3j6OWRwNIUVHAlqKuXsjqwexjA_3ZLTxeL0VbdvtGC730e0J8K6MCgv91LF7kORdd8iX2wpdS5W_xrCtwstfIZP_ypKhi1cxhpIpTVSta2gteu_xkxrshih5XJa0rM9gmQe3nYnvjmZUWfEwTbcAgWaQPWEWrBYpJJ-BpbjQMBaTXfw5BNb6g9Dg%26adurl%3D&documentReferer=https%3A%2F%2Fwww.farfeshplus.online%2F&ancestorOrigins=https%3A%2F%2Fwww.farfeshplus.online&random=672956445738&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=250&slotname=6076681977&adk=2278793534&adf=954853469&pi=t.ma~as.6076681977&w=300&lmt=1701236867&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867142&bpp=1&bdt=605&idt=1&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280%2C300x250&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=574&ady=4615&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=5&fsb=1&dtd=4
Protocol: HTTP/1.1
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 88fd9feb1991ad94474fd5df7e619285bad532c0894e9288e1aba5d52bbb890a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 29 Nov 2023 05:47:48 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 57853200014847804444544012523024
Connection: close
Content-Length: 1333
Expires: Wed, 29 Nov 2023 05:47:48 +0100

Redirect headers

Pragma: no-cache
Date: Wed, 29 Nov 2023 05:47:48 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=okg862ss9p0j&nw=20&renderingType=javascript&namespace=a5074b6f4b&subid=&uid=75992506730cd7c1&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCsG9Bg9BmZd33G8eXgQf8sIWYBuvSwaFpnfHe9MUP8C4QASDg4tlWYJWipoKwB8gBCakC73--9ut6sj6oAwHIA5sEqgSxAk_QX0u35HyF8nPyFkRZLKxnXb337CFuVND8hmWt9pabk1Xrkz8i_BL4VXEUGnGWUh476MbtD38_i_lRRT4kiioNxL6D7kw4LC9y4oB5OmMEujRJ-ky289C1m-wIKOwHm6gH7IoANw-fDryKlzM8P2c7_hHe-EZksASOl5ZINxdQj6caxDyZkf_iUmq3F4Tk4rYe6zFdzD4RUaA-zkHZm4lXpv4TMRLSxmy7GLuRKXNb2SY9uUr8mU0eJmXZvsZUZ66gO003v-h6GaPiVou16KD0fa5lMeNXyRvrI3Dn1XDasIZGyVNpXu8weFUeRMaVl5XkY-YV3jMxD-EV6YCnY0pDGivhWQggFqQCmq6vz_6G4wADlaICFzTpfULYju1RUstJgvIhVWs2UAEWrAOi_Zl5wAS-jurk-QPgBAOIBb3Uiog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WKyjp5nB6IIDgAoBmAsByAsBgAwBogwcKhoKGOS0sQLutbECtbixAuS0sQLutbECu7uxAqoNAkRFsBOH77EV0BMA2BMDiBQC2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNcjn0n3jHFnr0VQrDo48k8IVpqqof3XtNcrQYBN0vQobM4a8Ep0HSQGnR6JMZY1IN5yW9T-i1LHrY9Mp-dQhAdUFXpGrCEG4PnGQYAQ%26sig%3DAOD64_1b8Ub-F787j3PD3UIQSTxPcunc5A%26client%3Dca-pub-8367749956917006%26dbm_c%3DAKAmf-AoPFAYTtP29cnAPAOqNV2y7S4oCewKHNC6uIPQvWzh0BWv34KQMOfl8SkeZPMjwfnbRSzQXBUU8vCKRm64psHej2j-4hUhu1UDc-_Ha2KpFuIe81UZWserYrkDSdchMnm1ZwnlwxelHH2uZ-zh8m6Ns1E1ZGEsVnNEZ9rDwykwKfD1-4M%26cry%3D1%26dbm_d%3DAKAmf-AaJUzdd2v4cXcW2uyxF7qTKRR-3j-y7qcWnbK5KSY-OVVUIoXgeaaqyq_zSh5IF4r4Cx9MzVc_rHirYGrgE3gHHsIwdwUx87M6uUDvtkvUS_ZvySOIT6iFCdaoTaBiRh9mavvAkzLUSpo15ZuLvqIz7ORl4tD54RiNoFb4YTzcoZkKMUTBp1FvodwHgHumd-_T22BkBjqjBHrpQ1QPfPaNi-TYOh5upozI93ezI6fDIxwg65X-hh_mpu_C0HaJ9Ww5B03T05zvzQUWa58ZoKJ-X59iAABTRQImAMx6cgy85BCihb5q0Lkd_EVQcyfnxV5OS3990XlwF640ECw3q7Hg2WcH3Ns7B0jMi7psI5VqVe6SC6jlNxV83BYIlrYq_1Mu87kO-TxqSvzL3j6OWRwNIUVHAlqKuXsjqwexjA_3ZLTxeL0VbdvtGC730e0J8K6MCgv91LF7kORdd8iX2wpdS5W_xrCtwstfIZP_ypKhi1cxhpIpTVSta2gteu_xkxrshih5XJa0rM9gmQe3nYnvjmZUWfEwTbcAgWaQPWEWrBYpJJ-BpbjQMBaTXfw5BNb6g9Dg%26adurl%3D&documentReferer=https%3A%2F%2Fwww.farfeshplus.online%2F&ancestorOrigins=https%3A%2F%2Fwww.farfeshplus.online&random=672956445738&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Wed, 29 Nov 2023 05:47:48 +0100

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4336 0
20 B 67ms
67ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8008031553738&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4336 0
20 B 68ms
68ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8008031553738&version=m202309260101&ct=77&x=1&cor=4575565311474138600

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 4336 20 KB
14 KB 197ms
196ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BtMTSsi9dyTEBS7IfIca2A4_0icYt8YLngwBQL7DXH7k7KB2WP4lU27VGdtkli8ROPpDmC7XX5X522O2lWRkgthBHigCoqdIQc1-z9BfF82oFGJMjulhLfRlySf-7dqd8EmUChsNknThRNoK5v01dMsuERlO_NU2TMT309lndkQn8xOxk&cry=1&dbm_d=AKAmf-CN1s4ZEDq4Oil2YyYCTqYJt-HmcEWdwedvnU_aedokHrDJCi7TdQ7LSHAANarXGmaJPfIomOCsTnWYrwG8219PBGAb7uN_1es6iigIcNyAe91ulK9CcKtn22nQTheYKrmpwmP3zBGd8cM4R_iiD5bhmpJPOzMuXwk1oaH0iH6azeRxAfecJS4mNRVJlwtNVZX_FR4fhMl3q2ec2ybrO-Sok8nvPyObysEAtgOXSfrxuPJ-DAWv33WB9FYJ-gI520Cr4udASe_pfkDlMknt50qKZYbDzQHxyIjMkX1KYYrss--MFVYIKogpfIumGrde2wfMCSMohRP9a37w7I8VFz-HHslMHzwYBKYgPMgbgN3Yq51W5vVxuu2Jil233IMNRdXzlv7y4vMdVGyO8Z7JWSEtLt9w1GNKtXpm88s_PFHmo9kbzNGHwbb3eK8y86r1Vrlt3xxZQ0vA-W_hQ6haNTBB7j-eY6WdQ6uq2PPydzMDRzno8Z9Ly3aEhx30DHn91GL8nEsISa1f1gdwPS52OoTeRFEnqBqHYUamxmPpDKU8a_J-b_E3c1H3luniiqDU-0-PxmbIXXadETEbjNdmv8ntAoz1-BshQMXgU1GMaffmCubJFJOxUryLxtUHON9pgSuB57N_3I760EKhhPhlpxy_wQtavluUtP5KJ0aYYeGrrqzTCoveYRq28zpjIcRgCViayK8fgrC3dCRDadeILEWv7nICV5MKYJPF4ttudLCEnP3_c52z-9u5c-6mHE59Q23_6cdtpwimzxRikct2wd17P8-pT-ZBW0CAhnq4iqoozQrX3gLf4pUxtIy_46aSZuGXA2GLsGeMuPN5XdmnmaBF6yHKKnnevHf7WwUQFWwoFWv53wYdF1T17PYPAlzH3G-HGwANn0PUiFPoZzlldw2KfmKalbq3ffwWbXX4JQ_juDoAQeNVWpgoRTPfrvtnKfueFu_i_WsPaySt029t3ymxLjdZIBjhBdOOVG3pFMW45ThTMj9uAhndRA3OYuACraibBbRmYCK1j3V6QeqRftsftSpNg_5LfZkYFKCSzn5Vby5GRA-g09K6j2wo5laE6mYScBjlzqoNBgps_IQdF9mkdtNIXJV3x9KmPziDpocZXR4Eyg8kAu38SYNgMpsrWBaVzV8n_3nt_-QkrO1ycVXN59zRYA-U5pmIMq8NTgGGFlRIS5lqLpLNXFUIxczun3Kj-gIjAiNBz6SGNwMJ4BoeNvKcic1uylXOjQYUfOhZXzf3D_RDZDibVtH1uVrsUNBe1oH3K1iPEzQDdf-nLfQJi0NSNr0178MJvbYe2PkBiapjAqwuCejS5jFFbCdAST5G01Z27wkz1RAkrwNvmimVq3VeVboiDdVrVP3_LEpL1JFGQ7JM2G3YHvUeGS32jj-f_YCZrQjGyBCWjmRg_N3DH8eiTe747ybq6u_I6Ri4I-_zBNaoFDhuHGIdNiU8Ey_-rTdh1IBqsQAK4FA7Ovf99EX_8zvDyjJKzl31T8IxcCOlEd1UTL-z8vETskX5XvvT431XrnR-DhqypYmihBRnrnFOBirtCGFxE9xJJwcc-Oc7g5Huk_pZcvVTdmS7Wst6Az232M7IQ-94IZM0r1XPRF-RVo9I8E_QkWrQaNzKzg0K0BSvmetNAHk3A4jEBbeGOdDuQ1IbjkUZVR7HQuqi5tq9oCdO9loTimM2RXA4NrnrQ1uD-susLSN0pO8h7LQoS-2Cp9V-1w8h-_11khcMdu95JWWUKYMXpTq6SuzXW8SC9J8ll7inW9vhCPPHaYym50mTaM2bGYA__xAwRwDBaJSrsFPG8MACTFSvHWNz4WurrbtSWNdJ_t53nEekbmE3xbUgNVmT4R14QQEU3W7PvfQe9oasr3bP8W5BsJF7cpVCb_kGQ3GfAsOaO4HeHum0Eqst36Tr9L1P_lXy3ZHRd314BWP9bBWLtvTrtcfSgr3PRMCcQMuNe8bsqMfebLyO6w8zLGPJtpxsPdK-AZOKCmsRn4S7u8AMFK8M_qkQnCOuKk3ZAT2Xg9-fx_2fK5JsNMazzX0i6gl2-R0rqEpDTNenjHgvuyhHZ0DfijUt8X4qNo52wFUYFHE6iLo8AqjjLjGLKtk8A2L7kB_wXwFiVDk2czi8F7RgmItRN6ysJJvY7Cye7idLd4XmnExJDvkwHmHVwcyx5x8SBUtER0U-nLB18Hz5ris22ewRJcgOtAsLZNhF19PjjuUDVfbmDc3HZBAaql812vImG69GvHWwTqoQSlT5w_wKvI7MeAcwzGAR7qdDzIPT1sObxcDN-415H8DRgfvM75-kTPcV-4KN4V7y988Cqj6pUY96Jg0DDwdEFcVuAJu9EhHMERXLagPPFnsCkKHWhr5168qYcvQ9LuLHh3a7ha1lhJC-XueEhIqAZDIXOQRDGpv7teN5Vxv41aVK5vHsrrXm0mj-vwMnqs4u7ONSCU2sHQY2NvmyEi-fxm9VO3QSadK8uaINM8JnyK04VHIV4VF4ga4pf0LRLvPcEGlqR-f2lkpmsLRQ8AUE_RRCLnXrop6EpnMjc1prAZweJwBz1tmnaLdDUz8CSdEDGfy_u6h5g1cNIu7Z0tM5-3TPBJrqYLXRGw3i950SHK_NLdkUYqA2XbwDfuOZDA4lbLJsFqt_vS2uWAhULAL6gSvpDjAGxLA2JD_rA4LoNs25FA4ySZe4zIUVzrwmRLI10HZxGzgDb99gxSzhK9HGdlKip-9wWW7EkaOUvdDON-yUTEZaRyj4alEhmaUCJuOk38SdsCBket9RvFc5HdQZHnrEozacm4qXTx08mlrCldPn0ov2NV1y2KWXlzkUuquBSZkYZN3ecsWWuX_VA8D0zA5tUCRVvHrc6FQOOUnIzOsw0-MKbdNkAccyizYw_X48togz4ocuk8L_DArbTuvqCJ_9aajGPzmYDU8ejSkDJMryxHZDNaAJgEGf0vkbQyp_3pfQlSGRW4BtkWoWZMOQ4eP17dsdYLgW_NtMqCvjY8rPTdIsLY4-0kS4Q6R_BYJV7b7EKKj4orLYM1KYpRAwQvSeUfYXvStxEYks-XEP-KlSly7QJdi5QvHIsnlXtWr1gb8DyOrgJ3MlO3KLT6II0GYj8dW8kr9RnwNBtZ5RpvZHq-_mMaVXBWj6WSgg8JxNOWVrSCM15EaEjE9_XAXOEphw9me0TvPO8owR84_5sKPMxhEDaxJ_SGW4u5IvG4VGoI5Gzb8f4iddUsQDMCCS57l4FRGfCtxQiQbTncKdNGLOqC04SEBtxhWzRMRZ3TuVk5AxyX3OlqRr9WJZufzHoTRnP3VLtSvLU6UrCl8PFhYyLjGy7PFGB6M54RmTWp6FbVl9sNK0ODN3_WcLcNdcK-aCzEw1mlrMv-EJ6UvKx6KmDWlsFJl7ZaysT-y7pcFsYRl5AAzRWBWkzO3hQtBChFLwdAAzIg0Rsms9GnQEPL7nfWgKqzPWQIINUKKjsrVaQMJjxTCMv6jEhsRmC8rV3q4nfiajtEjEVLCBCE0CHhHLFspVZMPnVX6TVESCsDMfeEuNU2akS4UPl3sGlp_CA-iXc6LCq98QtN0pXlU2yJB9rEbfGVFbgsif5Qwa0ZY-WcxKXpjYqjQKPDlWqsWE-mwUGfObFmVqX_C_19yX8AHmmG7P4pHFl6W4jaUCS-3BFmtlvBhPqu0MdOPCvvNuh8VS3B_tBBYRoDsVQD2Di2YeHnobFMogQVtdThPRst3iJBz_xqL8jRBVh_BRPjJHF4_facrXr_sc1LkAywXwZ9bi8lEw7eu1qVUrQGyO8mMDpiZI1WNyP5IYPMcwTfaAYOXfYdNZDrs7P2nihzuS3etEjbj0PCmvEAU1pUfHJAxvIgOEiIOAS1NUC8yxFabdYJZFfMl-jMc3lBCft8Mvh4imJ0bBcvYE3DspfVuIIcXvHDd4oCo7vrqZu6oW_OJChd3SL7JaIod-1tv9ltq2tMeGx_YdMV8uJ5jJj8tawPLKhX9gQAXIr_j2H5OEQSF7WCxc1S12O2o6qBUGfWuv9r5jFIwAoRnDVrrrzGzj1tpIEekGS97X13TYATTP6Z14zPyCnPpA-phN8VsogYwh1gi4kg5kBHHdhqtEwuFx31KHHF-m86hE2ULFb19dLEnacgQGKQc1b9mAXVWz3QP2ro6zGVqLPdNkxw0lqT5KoUkda0jp6mMsZmWzfooxztDp3xGGpMJnsc3Vi80PHY8LHVB4QehzqgpW63SJccZp8SLtIKapb0xa3Achj2FXiEWnQF0dP3JGkU6VZ9fMnWSyePiNGmAdxJZr6EVwDYUoTOYwGA&cid=CAQSTgDICaaNBqtFjf9o_aiGpclcqcl6_-Gb7HYQeyMVZ4YI36Ls14oCe2toDLsFFqdrWeVAcYp70Ckc6_L1FNV-WZRIz08u69DHDZjr8z83ZhgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=4575565311474138600&adk=1033480531&idt=86&cac=0&dtd=15

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

50d60b7b06de0aa2f83c9454450bd3ba32f91bd624dfb06bf6824e0ca68c3263

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=250&slotname=2097210043&adk=239546933&adf=744370384&pi=t.ma~as.2097210043&w=300&lmt=1701236867&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867134&bpp=1&bdt=598&idt=1&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=574&ady=3880&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=12&uci=a!c&btvi=4&fsb=1&dtd=3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14060
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 3FD1 6 KB
3 KB 33ms
32ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:47 GMT
expires: Thu, 28 Nov 2024 05:47:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
484 B 107ms
107ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://live.demand.supply/e/e.js?gl=0.1&b=2&r=farfeshplus.online_fluid_lb_farfesh728x90&sy=ed9ddb4c-c9e4-4291-8087-180349e2679c&ts=95&cd=2&pud=192&pus=c&pue=1580&pid=21&pis=c&pie=1601&ppd=142&pps=a&ppe=1722&pcl=2044&ttc=2503&tti=3018&ttif=0&lca=1722&lcak=ppe&lct=1722&lctk=ppe&mlbr=ch&mlos=wi&mlla=en&mlco=us&mldo=www.farfeshplus.online&mlre=undefined&mlin=0&mlsi=760x100&mlbw=4g&mlcs=NaN&mltp=28b1299c-1e08-4457-bdf2-4ca258e10f1c&e=lm&dsReferer=ZmFyZmVzaHBsdXMub25saW5lL0ZQNjYuYXNw

Requested by

Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.22.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-nf-request-id: 01HEQ1MZJBXHMY5B8H1HQ8BKGW
date: Wed, 29 Nov 2023 05:47:48 GMT
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1650804
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "4de2110991f3807e8b4a19c48c14f2d1-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 82d88eda188e368c-FRA

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame FE4C 624 B
242 B 53ms
52ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGNCDtv8BMAE&v=APEucNWaNyNNDF5DEmG_4Uml6pJ9rB5HZRs3EdiAYevIoyvVUWLPXByW30kzsjA4p0aHXx9ZpU4qWp1Qbw6__k2EQcwh8zKuiuiTdTmtkJ4IFNpJbGQzEyg2LYEUw_BeAbXgL3dY9JuGs4PvVlxQ6wEXJMHJdoC-8VUoXN-62KCM2MHlm9WIcu4

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 747E 15 KB
16 KB 62ms
14ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 13:37:09 GMT
x-content-type-options: nosniff
age: 317439
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 13:37:09 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 747E 15 KB
16 KB 71ms
24ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 16:39:21 GMT
x-content-type-options: nosniff
age: 392907
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 23 Nov 2024 16:39:21 GMT

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 747E 15 KB
15 KB 83ms
37ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A300%2C400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 15:22:55 GMT
x-content-type-options: nosniff
age: 397493
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 23 Nov 2024 15:22:55 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9794 0
20 B 63ms
63ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8420645232971&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9794 0
20 B 63ms
63ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8420645232971&version=m202309260101&ct=76&x=1&cor=11031375670977624000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9794 105 KB
40 KB 86ms
85ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CSa9d6j8NdQHOLKswAfHz6CaPYlsXFgIKFZy5JV0AlnlwwcVKZ_Fc46FuP_KK1qFgYq72tY1e969b6LAv-2cbAmpejKokyaS2WiF9e5eoEnk8pMHv9RZo5Z4zm2zQ7-epLBWQ910ezGZm-qkUMmL70kwKbf6rJIxDtvCY67jJsh1dMI9E&dbm_d=AKAmf-AFwanKep3BwPZfEJrhCBl-tE2j4KG2ECXjCx0NBC2brRmNfn9rrCtRuEjvcktiQREirqjaas-dDSEmxwIjVaxtSVidDZEgHYymb86SAeb2fy2me-buiPO2yUszZwIj9uRf85sIzXaMujGkqFaitMDPAcq_orwER8cYbmHDxfi1kzQcHcMBXgEUxVbFOQ8iyq7XB3JHuV2Oxbqx2gXr89VKX3Y3sHdZfqU7mdivRAkWJmptBMKlXBhdJFW5Fhn4KUhRjayVVEOsJCXlTLQrdy88VXZGTY5r0NVhC2zToi-mVjdqdUSkDTtqXB5TNY0HGV5Pw-I4cNwjQUXPGXiMeiDNB7jSuM_1mLUJMSarMkvR13jTlAHjw3n8j8sNa_bwZDYNFGxQIZX-2KeDt7QAlDZccIDUyEcKlU5b5byZXcmMj9dBAngmVEiAvNQbNEWREBTVfMktV9Y5qcJ497wQY82fks_T0PwC5Ga2IeCx6f3oC5RY5uzkkre4V-sK6h4uAxqrjoOhpsKrN1hBMcCnKnylQ8SKgWZB6STetbk-igAgRS7IHuiCk_s7lpGciovj-Ns8XaziMoijLpItYpSHAU5BYMox8nFSQSHxw35kgoiS8_ka5Et1Xs_VHwQ5FMA8z3QtuB9YM5vquIJEVfQmZ8QHWYrAAFUAuylGC9e2nJNrMT8rEY_N14zy0-064v7rxO2-EREsQFyDW1CtjZTYfjNKU-T1qAQb8MlnwrMxZRVSbHgkdiIiJVybeqDOSFnSqs2hldy8sducH0NzM0NZo8yU2ZIoHtXCQaWIxuMKrrICIXrtUiiMBCgLiK1X5WI-Hv4bZtihyqKyP3ME1zWd4NDkuv43Fq_P1uFkd4nGeIUz17rA5ztQ4eAmT4GMkKBSnYXWApi1zTHFruVnoMOzehxUiiAV3tfHKjsDQmEZpjp9VVdrh48nUYydEcJlag5E-kTZYc_InqaZXGsB8lgrglIpP1TinYlguZ91B39ICVHCaw4flm-AAqata2N445gZ9pgrqLzdXvEBsqZqt5irl9OREENaFmJTbnlYrq9G0kXNj3qB2JJlbBS7J1rhwzorser_J1kHVPGe-b0_ufNLgA4XR-y8aUBx-66NcNW1vQ73f_JyUrQRL6Gk-rSsF4-tSS0Nb55vy7OX1zBCHvdWprnebmRRhzqE4dVrRXAgfOxuHaqd2iRo3WM_mLrXF9ZLNGDcuqSdiB6CUcZARLbCpTH7A9VV2DygOMasIkSNegsp2mc0-2d4t94Xq3RxnjUfF1Tg4GyVf-kU0QnP35LRixKfNaUP3yEwimjMZ7jZ8zIbOgUPgbR-s5PR_Jp0SfVpSXXA8C3vKQNUts0nfIXu81X6rD8VlZoWJbRycwAMcxYHSSwS2sihWJ8pV96VVoNy_OS8XvLcWf_HauKEHURiwPfmHLfcoPHVNACK7pVTPGo5gE0CfTAeKo8QPgLHMl0JRS2Wng5hingLa5JPAS-VKTOk0h-dQcgpLFZ8oVEw05s8rS1Z3uS_vVWtwHMuRyXTZb8Y6GgIHXzKtApL253Hp0U3dozpRp5YMnRf_R8bUj9donJnBH5JL5eF55WSnDD0QbbRb01xS9e72kcVzU35ejZn9jwPpzuUH3kPB6Wo8Vxyc_4Q7oWLPoQUE5iNHFZNJ63iAN76ZSvXf5BlNSQ2n21VrJnQJARv2qWyc-zDA4FZqqRZBPjYtmT3m_uGPMvapi1gwvck6gCpHwGFOE4rEGeEQUGmn4VE6cLf1QhB-IsDotch75BtL-ajKSYrmhb11eLuGPM-EgW67zOhxGecXlnfyRAgzN6SKeCoq-ttKz3GG6lf7t7QaILQNhGb1MOrqfCfEMpx7yfmc5cZDWA-ePUUji_YupNfbddGoprwkht2tVS_KSc3oMuWWnCb1ybtIq8tA0TjnO-mYylxGxGRfh5xeljW30LDRzecQMHaClwflwPvClqLwAClXOutTov5bZa6B7rUz_jt8BMB7H8Ma4iXvBtUKDO550hYn1BcLFvxwCVlgz1GvZRitJsvftWMSbXV3JKmwVaQyomOyDhH-pjU1hoaqRZ9iR_a5SlwXq3eZZSnzf9WAtj-TkECyzZaqRTUO2VJXSw_u0_TQuqOK3TWhwqCD65Gf0s28NjSCKaAO8323Kjdiwp6c8qgMS5Lj9OjSGQm7Iw7AiicuL7iKLOWFiLCjb9hOMPXCcZYx3pgV65QBzHmquxThRSy6zfF63RB0M262gZkF4Hr_7xJHKL0IUs5QTE-JEj3swB7ldL1Yds08GbSZVdgO35WBWI4r33rwgOJAsBiHKGD4NvrJ9jR8MDifuHmYH2EaYsKBtl8c6U0qA9SvdTidieLtY2OiVW4ytNOck5eK9_678PMOy8uukkyu_WwFXVi_cXiyO0ZeYzQHJJo3aNpRJMB4ndpZY-8JiD3rGCP_HquiS-endGKJsS6K9HXVxl22oFUJvlvgS7yzpJr0hUFngDMMqSSZD6E1K87D2fm7LqwFIcSShj6-kB3UKdI2PJCilg5dqO2r43u1vrEJ0_zWABZpDYNkyvXNEFksZdHzHFKLUB0yh4sOC0sXesqPCcUwocCl6e-IkqwDRtL8r1GOoH5ZlkkratcqNJNscLqz_pgYEcxrysA6clYiuk75LFN8uumkqc65Dv3fSHlrBVs8EMT-m3BonR-XZrkJZRxsKSk5jWesuzKkftkG-jxsC0RLO4pzjsL8d-FDHFTkZygQUV0OfA6-6umjcpGqRfGMcUDBLMtZrNTp-czcjWDLqMepYhRN4xcaXKanvsyDXDse1QivxmPcIDRFaM-Gq3Xq3T90lV1WW-mqdYF3ZNEUpk3NZoWOuh62HWC0gX7e_mf0ho4eIY1SHtMaXdDYM3boMCZWtgK7ZNq1J3QEtFDDXkgSlzz8Jo1g-BFGi_fCPd5Ep0bzuXIaLSHv_g_D8MoMkdd1EFTLUnWZLS0lkRduLYcYPQZhPwFxqkH8edADkHhG4uFy5rDY2Yp9dNQV_HJvdDO6AQlipStf_ak-YSgFwe3o8cD_mepHMR65On15u4McJ02YkO9iwuQv5pw0n5eeW3zjRyXsgE7SQiMZC0d8CZfzSZbCFuuA58XiSmp5CiL9ewN20L9_XpHtJ7uSdYcguvAsgeB2XA5JGYUbMTEQ6IZNratFwunj6pCzuKDXfnTW0YbFdOApJpnUPZ9zv0x4l5Z0_Qgh47gqK9f-0-UVTjZwZ2SlDzwUnGeh8zMG0DR-bXsw4o2eaR67PCwQ_MR5UMF5402nHj8QQ8AH-QmIYixRp0uqtksWzaa5wG4wuVmL_kWxsAR-zp6GzNwmZ5FsznUvPSJUeOZU1EcOrjrqKCQUXSQZMzK68tgY1-gT7YnrQNcHLQ_4N4FvUn0H9N3QNJdvxLGSsMa-CNzkOCLsl5fbc-Kk4aS6ouwy78yp9UNdlDTWTGdbOxW1FUyxPED6UntnDlbSyM-yBoq56GiHCJahPn4HpCTbsHVljXchzhR6WGni0fzY8UTCvWNN-1XfZ6-_b3xWxXr6ZwQGA981bMo0U5YywIiDQ6lCEx0Yn_fvDWsv2qEPQ74duU-oAaLSmcbSYV7hR9wRdwjgw-xt5EeoLKreXbVyMHoU7e0Gjq_o6gBvceGeqX6yaAFN9zV8BcqFv8rq1JVmGuJ5oQz9Yfy17MnwN4wg3XeZik7bo2wf1sK0Rt7c7nNRooFGsuoB5Ig5gZzOARTq0x_gnB07yV-Dnu6TzI9h95t5G7a6M62rECVhNlZlSsyIDFvX_tAgYAteUDcSESvHRDPNPnUGkLQFf06SApAMSMg157UMSPdCff_6xuW7s6rJf_APPhkRyNLLr4-IUzP7YyE239ftIsQ9FJ1MRubLd3Zh4OxWDWuRdODT_Z1pvT-CTPmVQzcdqsioCzo8qM11seoh-eQZuSmOwX5UNbae0uMxJsRRLj2anMd2qtS7pQZaLIDSu6DtMA26FA9H3fancIWzgd65z3KcF_qXfvRsohjFV0a4eRQko7mM0JMsb-TfJ8mCwlm8ZyoAAfTauk3E72BeeSxjalNRSYTROegNt93sZCIVh8w0VZrCgC6_PGM3pHx&cid=CAQSTgDICaaNZcZaJOvO7MiXAasFdJvjfq6bg4XLbARQ86RpbX1n6q1ZZdwu03gbIEXGXm9t2HaWori8NbfmmvlZfae8RkVAyTPT1qyrGJNUBBgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=11031375670977624000&adk=3944675600&idt=109&cac=0&dtd=6

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4fca0ce182d1287d53ab1991b307f765680994b95dcb3fb4c66d2325dec4001b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3759532572&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867093&bpp=2&bdt=556&idt=2&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=1439&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=9&uci=a!9&btvi=1&fsb=1&dtd=5
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40585
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2595 0
20 B 57ms
57ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6138781310629&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2595 0
20 B 60ms
59ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6138781310629&version=m202309260101&ct=76&x=1&cor=5370459519191871000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 2595 93 KB
39 KB 109ms
108ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CUGQQroB26qi2y7tz_oioAtqUbuzeK9azRuIcQdMByqT6zS2seaGNOTR37JwNHiOebe9-kOrSIyB9P04wg9Z0FVfhPFQKmDeiOcU_AHXVXqFS_pr9qjpmQB_YF54FBNinLDBQJE2VBQONZEOh7vzbPJ5dO0alTmOIgxEJEOhBvh56iM7A&dbm_d=AKAmf-DpxsdBsr-9O1OGGMf_uuiqnV8wkUKLNitjCL2LifZ8iTqs_LH9VWdJDQh9SWblm9iiI5l1yVGFqSu_flaDZtYQXCQ4IaGwKaPGsYQQSk1iUr5OujzNzwHZtJO0j21BNJELZOqoIUQ81sPfb6T4dYSFw864iyG06qyStc3o2LSf0RZQ0DpKJE4z3RflzSWd_sZ9Tj3zfTPmZOwW9emxG1SMomDuWq0kFO7RV0oe3RZslaZl_Uyyeg1mPjg7oTjVmyLKDBWpnW8qbyH2cQSKd171NhlOE2ZAIrCurRUfBxhxbs26W9LrVWQKz2GGD_Eq7cMSiyGws5RqcgwyNXGgrC4ubVUe2qyae_3N7IIgrDDKrwoEUXn4JLGlMQrkMwEYuZ2LYshSwSxduKS07PHPIlAKi4wvEdkwy_wBDdce1ttaUCH8Qe-4TKOwza2Wy6QZJUjE6bhd5uFlHo6d7Jk8bZR_ss2ySV2gvvZvwyCoGhIuGG7k4cEjUIOGO1ieWwJwTQY9jSi5AKCjOaYBg5khmdNBT4mSsZlT61uPUJ9edOjeAzwz7agJ7WwusrvnMDItbk7nBR5Mm3wznSiE9s8fVGWWPCaHYJFZKVpiWUY2YEFcgeJIocr3AqLWDFMAJYnajsbRr9Ij6SKoEB6--CZP6RN7gL6pgICMbMIQCrbW6XPTnx8_m8jISO2KJZLM0oC-4F4Bac9uEQvqF8p-JPDZ6Wl9TNgZkQNpydJPUo00GQBBWV40W35eMZCMNUpHbNPj9xMgl6NuHzzc-WFNFv22f_KmaYyhKHhwc51-2LKPbhDYkOmrfHStQDugr4w8SDdMs1eJrtWWbPNBhoOt_Z_IT7Ti5avr7F8MLI4m1jwv1ZqHedlPVzdsnGtCUZj7GViPY3lXUGyF501a-ZjBGwl6R4B0wj6jhkejFKiBOODufvXyoc3owXd35tgpo02hj1_SiiZpxkYXnqscYTqYQI66CT1YyMjSsjlpC8maJJS79uimzumna_VvPLEZbutMnIAy8O5ZhLC6g7km71fUui-rzV7jVCKi7POKULxh3JzhNJK79IJLbhUlvqylYXeFaB0Kj8ED6IZGdzSkXt_gt8ZNPhw0rKh0CKwf5BV2tZ3f3H6olAsqeAspLyjc0O-uPC1TAtZIb1K7QdRBHgkF6H47S3dbFGTO8g34QJQxMd2N8WlL0Qv-hbAYtOd1gugkIRu5RdgrGpKs-uJ1LbrN3w1vQRzAJdaT-AKQgUwkBZEOGNjMwfcC8URKSXtybajPMkL6XeCSxBtMfbuezhG75wS927TEXeMtT1-Mp-ID-KoDMNlWfQB5niuC8kuL_64cf_g-p6KI2Y30HNhaLtr6w7XFooEKQ2CDB9ry62nLzmLuWvyKMSU_SxZkz30dNoYzE6Cs7RcmxBjy8_-3bIt-JxjoU7D9xmySzhKVe8RiRJUhK8bw9g8k6QeTcgBi8XNORQoricTdWT_j_nO7QfNAhpY1LsDRbB67j5ooEzVNGmKIu4oH6z9sw7ELhr735-g7nWKS440I6yBJB8X8OoUky6iTu9hi0lIQ4ifEhx8gdTwmrAiwMTYrcWwPLkeWvGfn59pd2CkoLa2m1uuGbBqhDc_BlfOmWCom-OgJti_To50DqFnzLBDt4CzHzY72znQQX3XtcfypO56sUIEDYpWpKGOOvsbe9KZqMMQWLc-Eqj42kFDBbb0a0S6_SVFL8Vw_a90uCXehXtjI88t2V_WDq0WSEd_3a_JxHDpVGN9X92svsmlGrlA2gYm6p5flVEqHDJqaOS6-7qXf08gC_7kuTHCkXg6jz036Zfm3-JtFIvBi4EB62xPVBTbRwGeLpVF_XxBJCQpuwCB0jcWzE_4Cf9grLzaJ1Z-_eCeEocGfstdF294CabEcE3GvPKaLDDNXAm0nER_hEMT7NzzwvbijoK05HL3OHRL_cUUMCARjVQ19-cidMx8LoHMGEMshS1ppUlLZvgChKofx20Hnto-Bsaf-rPTCvch1RhZt42IgU4U4XssH9ry3b3QlFVg_w1fn8q8EJBm0Vr3QHp1q6PpSrC5cbcw-2SDt2QDbBNWsYp9AnChGnfaiRnZxi96YPn87o1-l1y2PTI7hXi4gpFjOFcu22iLI4uM5OiJtWkzPkTJn8qjyA-Ox1D8HIUbJNA3rf6xuSf7Rjz2TUJaQ5EUbT6Ocli6VhXk92qwS4GYiwYbIS1m6SalDs9Av31ZG2G7paLP--BsaAf-USAfrgfPzkaUvJjwNZThSfMWoxGhKyFAWcVXb5EiLNYpRq48zQIwXMwwxsjDvFLSWi-nTLNv3Ts2efDqIvxUpaddMyy-Q20Lp8O0_j7rfXo0Q-FjsDoVbHMTyIsIqA3NWQNPYfTVl8K6nT2HLXq30NsvKYpwYaF3g5XhhbZnNSASt8SByfBboBUoBU3SE4iIf06YSeylTAfeDj9Fw3MCC-xnX2Oj2ovvsAKmY0ebrUTPYkZ3nWBX20mzo6X0eotUG40uFQR1c89OV_9EPToWlBN_MturVnuUnSUOmpBgHUzf61XHx8rIjnM_1SprmUjMe8FiUdTvJQ8INEL4qx1RLniQPVBmbi2BgRFU0UT0kw2SbDMijrsXI1OdvHqmYee0aQYZc4eY-_ncFiuYd0ogSf4mSAjnv-QMc3lz1NEf-ti20UQP6jtwrq9QXm3UnDbGZ_wImtJXYPAMc-hhh8_Zu4Qx23nYKBnmdXW1akTI_rVRavuMrV5pwKG0bNyfXVwtGJa2D9r3-rRQjv2ynYv60cc2625XehBQdOdAqKEdxEDpmD2nBaV9n-iUPmfQBYN8CQIPxMmjhboJMVFx-kMgX8qSyVAA57dVV6hqNeoyzkk9vjHz75UJV23EglxwkfzsbIVPT-QeoAZc4m32Xv8Bo4uCXdOEuLPr1igndbNNbqB_YmT8CEYS9ZhKy6Ge4NkHeiEOKs4XLNMClSVQsOe1fZj9UPYgcyiQ4omcHmMWrIG9TDq6sZPV43Jy0JFSN7zw4ST2qrsSaRLlRTz7F0yFF8Dmv1wrVs0CVgbrJHoHFPgoaRG4GhtiwId322AjBw-xNngBTk1GhSGPZvuLScGqoPmCxaDdI5m6FtEYkrgF2pDFEVl5hwzNYIDANuS7frRpvNKxdIHclRQL08Y9likJoD2VAl5cA5hXLrCeEvk3erKEwTrocZFeTsO8aqSVyQbKMra2y5_MfeXQfNu0IDy_l6u_tTWagWFg2oj-gtS7KYhgWVCxcwqE1j1r_KpduW-JUAfP0FsYe67vLh-b1xblH9F7kcLcSMvHozyELCmlbcOX90qT68wao8wZIvmQcJYr3C6iXR-loEwAKjA-yim07jQI2XGw4uoy_oDFxoFu_jAZNUI8BlMfPln75iyYRqVde2jetOPXbgGXOaYW3Y1m-5r8UTEOIkpONolYnaP2ucIti88jmbaw8VSc4lLrCbpwioltnbCRt7EWpZw5Schmf3eGrZYHxfChB_wq7JXLjkpEleLKueI9uin5-NOmPdoApBtlnk5327EPgUC0ACdwzaMN2jXQqr8sGdx3kpCDTk2pgdjYEJmN0Y2pAetptxe_xPDe3R9gzPz6kPKastLDmx7uiyfWJSXubvZKj4Zz_Y4qnpF6XVy6_lmLaoCy_e9sVediHWaijor0Y1SNv7RV-hvv1CAuaeBjFTph2_pwapdWFzb8pJbs3eA-no5WpPtelkWmfA_1rhesvewtwGuHhUIjFjEKcwEE1gQVPHE6W0zxTTkdXXttKUpJcxm0tqo9V5Q4pU0nHYUkXQhOhoRhShnneR7KHx_tW-BGP2Ub7xythj4HX7lePX5rHdmbofLms2pdgFik7bd1CtdWE1QqXgbymU_THWVguxsm4no9xx7bm8CUoRbwMpo49QjZV0eQvI6eDXfmWZSjbw7zKd5QEGUn4Y99L73FswRuSz3F8YfsYQbR_Vy36hL-TbXfBZmoV0eyQT-WScV3qGzSBXu8KSYqrbtEyueX9q6XLkORK7yE&cid=CAQSTwDICaaNyoppWIGMgCGYJx0980g4-TyMTzwpBQdmdBgQgk_LEaJNeLf-eY_0Jc4FO0rniuV0MmO6xTk_lTciMak4eJDo02wtkBwE_F_kDBkYAQ&dc_eid=31079495&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=5370459519191871000&adk=3047537735&idt=126&cac=0&dtd=5

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6d76456906049856b4805f6518cc79e7b9edbad1d8d4a30c572eb068eed38e12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1231661633440980&output=html&h=600&slotname=2065248459&adk=1530395088&adf=4061442901&pi=t.ma~as.2065248459&w=300&lmt=1701236867&format=300x600&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867069&bpp=1&bdt=533&idt=1&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=0&ady=0&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CaE%7C&abl=CA&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&fsb=1&dtd=3
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39588
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 157A 6 KB
3 KB 15ms
14ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:47 GMT
expires: Thu, 28 Nov 2024 05:47:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sda.css
live.demand.supply/css/ 4 KB
2 KB 18ms
17ms Stylesheet
text/css 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://live.demand.supply/css/sda.css

Requested by

Host: client
URL: about:client

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

649af545f5efd2a265363ceeb7fdf9dc6dc8c85dfba4d7d3a538930c3d181b39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-nf-request-id: 01HGBT2QSHKRTSSRN72B94ZTRT
date: Wed, 29 Nov 2023 05:47:48 GMT
strict-transport-security: max-age=31536000
content-encoding: br
cf-cache-status: HIT
cf-bgj: minify
server: cloudflare
age: 33296
etag: W/"505b1404b8e3597f62714f70edb3d993-ssl-df"
vary: Accept-Encoding
content-type: text/css; charset=UTF-8
cache-control: max-age=2592000,immutable,stale-if-error=604800
cf-ray: 82d88eda8ef32c35-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 419D 41 KB
14 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CEIo2VNwyaq0Zaj6bdIHkPKLshfLrcGwOr1Rae7uEEx7VG6MJkIkl2ghpp4Lvii7Xi17RrE0ajv0MSZahw5HW7bOpmwayK8IyqB7rOGdK3DhIu0pauMoij1ILGfXgsy-XjVnI7sFcTQItwaUc7GLU22fxFEE0fFiDwwfQv041-ujnlbww&cry=1&dbm_d=AKAmf-AIoeP7BDko74cAtM52j3XGnLxRcDkTLx8dF8TiKh3AmtJIEoYF-DRyUscHoU7UjdO6eiikLfPkerPDOGUPE_Fstbyy-7Lv2eybssw3jxrMWzpZh_JGRMExaWXoLrR6-h0xQGokzdOicGCljidUTGUBK-cez3BonHLD-4lRUFBHDgYU7pB0cS8n8RlRvhxPHSgRdmgtJ3I3PK59lZ57t_u2u0vdhMKmarWHVdiAd0G1gNOi92g8YvegvL01ZmTI6HF36Z10MJm2RloR8z4OqwHQKMTPe75NMNLlLVxKV-tyW9Bm4qRljJ4NRzTaFlDmF7Xp901n41zjXhFMDyN3wbjjevzF-Rv2X5JpsoRHtXHORbzIwgiGN8_yr2jvyfBfL6vdJbQjpVU8Q9flLRzZpRTJxYHBCgkTHHy-hNhyVCd3eSKvmm24cJd-KfKcc-yMoXdzYMtKWfKOW01rPZLVZUAcZ4wGF_LcEC5lWDld9fWv63BFT7YgmZN8R8lnXp0W-nr36CEB4p9N0yultzHuuulyMWStWsEEY3EbtO_syJy1OoRT-pOhXbkaCuV3jbxVXo6HdiRtVJyS-VnGEnu8OPvXlB6vMkTI7Aco0zxKoONzoEgA91oj004IDqSv92JtX8h730K8pMi7ZBM4tfQTxREJqBnYgEyRttEQvpxb0HQqyy71-18wVF6DBeWEzBh3fASGrlngRLY1czCef14Rl5Dx_x7D2WY9x190B1vEcVGq2L5vG-3iroBNNSYGiJlqpRW_flgl3jNs0_OhAZdQT8Uds_5U1uXtxEh4Z5ZZQoPWG3TwRT8pNgBZNX-fKPnPAYlwXwBCwlIkfri6CTVri-XALWL_3uViVoWmnM7EUR96XRnWXuuIKGMXfgL4ehpSqLNJOA3vou8P0Vf1aBQ0Ox0hq8hb5N19erPSt2Hw4yTr81dBSNp80ESO99OCtWNw61cSx06HTo_1_0GNkxKjiya9z_KFeAjXynOTENDEEi4bgUIWCAD5nvbn0PnVWwt-RP9HfhjXNrzJiqiC6ul1hRF8NSxKZQTLxuQvBzGoYyQ8caSkYgefrq3SNTd7RlOYWpCK3vv64MtSqOYiWAJ9eLQej-n0UjCgppbO_2h1jE4CHgFv4slYGaznjlBztPI4p3baqwyBdUpzMHp2c0YD6Q0t2ZDqFS70toKF1i1Rw_uX5vY8GwivtZ-ldgDrPF3musQkdHFDiD9Xp7WtNbkMfww1nb74R-r_c6wj5JrACXFsD2-K9L8LRkJBjY7Pc6bGEgCNjFwbcKHiCFbrM8v7vl3vrGQlVe10qSoOuFX8ihZ2e2B_XtHhNMze3ifr7QMEfEci8IGKIBsGeFX1so4oXPP9AqGsqTIxdkHTY2hN2C9f8VLck1VSuAzquYCke45YSEgi597zUyb69B-Zrg6Lie47AIoY6gjEU7x_3VllRklgLeO5lZl4fSd9JS_c_3-m7MT_kMSMfQO6kKNnHRwPS94JChBHjB2U7LIj9mmhrOv_WCOBjseCkJ1ayD_xDxoJnFvROY2rLsBjkcMKCqu-YOTZDzhw0SCPsNhkjND0dLeS9_tKsqUN_YF_VRToksLPeQ6kU_IMTohor1HkjPmKYgwFwNmVyvXJ2Gb0SpmVgbiZvrsL0BJ2ZJ-nB6kwWYnZUDTssGdmS4PnZloZZsHFoKlq2mrTPQllhWGMwqaIa01FeIJvC92jCCSfrx2GA8MnbmQYtwnWJTAzJBsqiy1xyI2KuOk47hJn-IGdsrzKmvZoTNw5e1FFg-0uG6hFqMZ-_NIq-Ya4ASEtvBHGO0rAgEn48ok-PTAvtxmO0ui2PQnhJbItu8tUZqM0CBCs8DPzWHnBSBUFfcXN-B1oqgprXiv3ZS03AFnRQqZn0DQISzFBZVV5RLETvR_bLBN-LbylCt-pv6ZpEozJxpp4X1wVvxqE8ibDqz8KmBeSQqf8rDqJWLOivd3I3ER48geR8fW9chsEBDGBCMusIgcvURDl01FEil1HD4MKdBFXeoyfQq-D3a3KQfhnUd77ACBSakCRg2OjyhZBIjLLYInYv9bHuQeXzhlb76Y2XOLUL1LGaU9xxWAVlOUA4my-kxPegAbIRoRrJgKjR5IGtkWF2afbFe31-CzVBVo6sA0jyv-JuAY0eY-QThzV2TVjApqWhf42wcZmtjKFRH9ap-trsB17jvNjm3RIL9jnAVTncgHR2mDy3U0rkFkfU2MA3oyb3pItXaUlien3vmImkPR_r3XeaSQuwmykxHx4BcGJlNnovAx0GH3yPf4BD9bHKHN2gu-egmFnPNfyMWeAuo33lm_NuzTVjnSOCCxRIr_qSpIKLL2Ya6nCO5Md6Zz8Oph35vPmRHQ9kLsBZVZfozC1OEuU_11LDVshytPnkqOQ6q-DAuzC50BK-ORCkFq-0_zymDJ7568EWbS_C9HX5_zGSvQfTWn9vIgOmuDlRgyd851P4RQsVeCFTN1QjLN3wI30Tu2plr3nQnYQiM2EaifDyX8IJdxtWsYTHpZpF625gyi87npXAS3FXIg2WOOSxOCxKeVeND3GC3ri0KYw0zdpCA-F-J49l0lYLJx6lijcrYhVnTcfcaE4qxsprMQxa-9gx3DVzFvMtmNmqfjVZFhiOTr5-T24G6zJVbCaA_-B8XZuvW1ZzNin7zHvqPbhn_j1v_OxnDTbKUQI4C8leAxO3oujMA8d0JQOfhUvOGVwcFYaMEvOqnSfm-usSm0i5zEC8s1TIBoPwAVG5tC4MRKFcmUWRTqHzZPpTdW3BvjRFrSNA7MV7CZI4wXslnIJC4wSxAv_ZDWXyJvFe96SaD40-rm78eFjxzWu3-kDKFj2hUfGbrep6BWh89jQzITrTbRyc2LYxvp81qqi-axpTwyap4VvlPyrrMEcirDUbWgQs2xl1W99PESGumKEQF8ybjDpHaOx_Yh8WLa4kzmCgy5hGbXq3g_A-Wjnwz0w2aL8pm18rw12EGVIvNcSmlXDWag2OVIMOXxeWmCS-6t8wFENk2zHwcU_Gbxug0MrAgkRblPylkkE7epsicUvnHh114T4eLYbZwxyqtVvRw_E3mOI5sLra2rQbUHcgrHAvmJsPQgloCILuaNGjUW9-xRzqfBNS6Zk8kGbokERuaJ0oFkWDmidRo-GX9wQHE1VhI2zukbEXd8FPmXk9cF-BgY3gMRx-lWBjEdxnBeRR-fljaaAK9nV4-LvLD-t76lOlRLLWlZjYZHrVHUye8J6Fig2QNyFjrAQNHLK2OYwNZJnlWxq78Rd5jEG69o7-aqKfsgRrNLNOCoUrTp9J0K0YWSGCiLMIwslOSgpL8QeW7Oy3lMg8ym4hU3txPuHfrTh3Ee-aWNZxr--VfHud5RxrLAznpMwKa-BL5jMJEypnKVQP2PuipbF6oXtArTEYq8euP5-7uKGN6cp6xQDr3rvoU9xAEOKuvopn1hC0v6kM184JzOfRvtrYMuVBfSfmCN_2SwmlvzHSit9PSKCpv1srED6i4LzRcH42yOIsz1B0NgAWX25DB7-_rkhd8j3noQjNcOALG-N-6oOMl6C0i8VI9FKVKYXeVe-ZEEZWP8vWTFdQjJrM80EeAmlzQalw-X0hBFFVaePY0RNSFbPWStZASXi2NvfahcW4j8srL1dBDeTGZRzfMRLxbsbi4deKHGbv0lCqZ27IZvQse5E41B6lp_8hqiGaT3rp2P6KeRcYIzXA7KsyBQ2W3THJVCins_6_KZUZYGXVBTstNqj35gaG8x8Z-w8YjinYvqX6RLqZo3HflRyMIOeFBIPk7WzDkjPI2l16Vamb_r-THsrAHfsBHI35VqgwUI9P8qqEa1hNy0iVJjZ0r-8EdKWJwo-optSirsZlTBkZMR_oLiGzqnIUhzpgNyho0IhUERSLvHE_ZFeJLPNYsO9wnconqhIeUPXXD2C6CnJyG3PG5Z2XQN_mbW33NHyinlx1DWC6GMB9FDck0YSjqhRVgOoRAFR5I3qVLjPi73bxHv1mUQkcgxuZGcjDuVATkqRIphGmvz-Nxq3uK2pgt0pOJxiWXjU422jSoAbN35awOUgc7FFp6m0EM51Rlq1b72xO8xxGf_fiP6Oc0PJPjps5QPtM5Ym_TGqKG57k8rl3IlT4MVKW4CoNUyEZVzagdfzTdhnmiK5TwzCsHL0tLVynjDxb269zSNgWjKIRgARqiv100SOClgMpFigIypUrijBlOm5MuKh_QvGP2VOr-2bLp9woRiFdH49jvXEcuBB23NhzpopngW7hNCdbKPTURaVoVTjAhCE&cid=CAQSTwDICaaNzGwRpEKSPaJhad8pIKp1BKb9gwOTGT4GSae_kc92uq5sOMzFvft7lc_3X4ZhUymjzAZ2UX00G0EUN-i6uBLJllbOz42Jdb_DU6YYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=17494896701144228000&adk=2228999115&idt=132&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 307826
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 16:17:22 GMT

GET
H2 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTIzNjg2Nzk5Nzk5NQogIHNlcnZlcl9pcDogMTI2MDY0NTcyCiAgcHJvY2Vzc19pZDogNjc4ODE3OTQKfQpmbG9vZGxpZ2h0X2NvbmZpZ19pZDogMTE4Njg5NDMK...
ad.doubleclick.net/ddm/activity/ Frame 419D 0
500 B 86ms
84ms Image
image/png 142.250.184.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTIzNjg2Nzk5Nzk5NQogIHNlcnZlcl9pcDogMTI2MDY0NTcyCiAgcHJvY2Vzc19pZDogNjc4ODE3OTQKfQpmbG9vZGxpZ2h0X2NvbmZpZ19pZDogMTE4Njg5NDMKYWR2ZXJ0aXNlcl9kb21haW46ICJodHRwczovL3JlZGludGVsbGlnZW5jZS5uZXQiCnhmYV9hdHRyaWJ1dGlvbl9pbnRlcmFjdGlvbl90eXBlOiBWSUVXCmltcHJlc3Npb25fcHJpb3JpdHk6IDAKaW1wcmVzc2lvbl9leHBpcnlfaW5fZGF5czogMzAKZXZlbnRfaW1wcmVzc2lvbl9pZDogODgzNTY0NzczMzI0NDMzMTQwNwpkZWJ1Z19rZXk6IDExNzgxODE1NTM3NDY5NzI5MDkKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDIzLTExLTI5IgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIzMTUxNDYKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY1OTk1MDE0MQogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIwNjM3MgogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vYWQtc3J2Lm5ldCIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2tsaWNrLXdlbHQuZGUiCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3MzgxOTc1MDQK

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0xdcef201938bdf00c0000000000000000","13":"0x944de669759348fb0000000000000000","14":"0x4e7a6bb37d31b1150000000000000000","15":"0xd837469b533b78230000000000000000"},"debug_key":"1178181553746972909","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"8":["11868943"]},"priority":"0","source_event_id":"8835647733244331407"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame FE4C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENL2HVExWcRzXympGxRatjg&google_cver=1

43 B
738 B

34ms
34ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENL2HVExWcRzXympGxRatjg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGNCDtv8BMAE&v=APEucNWaNyNNDF5DEmG_4Uml6pJ9rB5HZRs3EdiAYevIoyvVUWLPXByW30kzsjA4p0aHXx9ZpU4qWp1Qbw6__k2EQcwh8zKuiuiTdTmtkJ4IFNpJbGQzEyg2LYEUw_BeAbXgL3dY9JuGs4PvVlxQ6wEXJMHJdoC-8VUoXN-62KCM2MHlm9WIcu4
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xT3V%2BjlwF919IVXweB7junpZF7ddeA3H1xAe%2Fy1qVn52kTchkfvbAVt94T19w%2FUmQMYkTi%2BqK6YsLxQxnSHeA2rurDBxJWkLOtywfunwVez0%2BG4VwkrNm9asAGdUfY6%2BoYgc1phNFNzGPQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82d88edaf9dc1917-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENL2HVExWcRzXympGxRatjg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame FE4C
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZWbQgxrhAdvYahmWZn9RwwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENL2HVExWcRzXympGxRatjg&google_cver=1

43 B
734 B

29ms
24ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENL2HVExWcRzXympGxRatjg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGNCDtv8BMAE&v=APEucNWaNyNNDF5DEmG_4Uml6pJ9rB5HZRs3EdiAYevIoyvVUWLPXByW30kzsjA4p0aHXx9ZpU4qWp1Qbw6__k2EQcwh8zKuiuiTdTmtkJ4IFNpJbGQzEyg2LYEUw_BeAbXgL3dY9JuGs4PvVlxQ6wEXJMHJdoC-8VUoXN-62KCM2MHlm9WIcu4
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=e2dOuhEM0AH5JGESgc2dzlxqvq2F1AVkqeEy%2Bfqjc68Tx163HYHtj7wgeSTAdkSwjAHwKBPltp9lJtkZMCB3du99eKxoFk86KX5Zb12aVllLbWei%2FgAQgEUYFUnb13rJVr%2FadvbjAYRmPA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82d88edb3a081917-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESENL2HVExWcRzXympGxRatjg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame FE4C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEF64zBYpzRUIlwKNvStbPqU&google_cver=1

43 B
839 B

20ms
20ms

Image
image/gif

185.89.210.141
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEF64zBYpzRUIlwKNvStbPqU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGNCDtv8BMAE&v=APEucNWaNyNNDF5DEmG_4Uml6pJ9rB5HZRs3EdiAYevIoyvVUWLPXByW30kzsjA4p0aHXx9ZpU4qWp1Qbw6__k2EQcwh8zKuiuiTdTmtkJ4IFNpJbGQzEyg2LYEUw_BeAbXgL3dY9JuGs4PvVlxQ6wEXJMHJdoC-8VUoXN-62KCM2MHlm9WIcu4

Protocol

Server

185.89.210.141 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
an-x-request-uuid: 1aaf0a4c-ba1e-4998-be3a-26b801afd317
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 37.58.58.248; 37.58.58.248; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEF64zBYpzRUIlwKNvStbPqU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FE4C
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMzNDI0ODQxODI2NTcwODgyOA%3D%3D

170 B
188 B

30ms
30ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMzNDI0ODQxODI2NTcwODgyOA%3D%3D

Requested by

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
an-x-request-uuid: 193f18f5-8c6e-433d-b219-fd8a3d640b6a
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMzNDI0ODQxODI2NTcwODgyOA%3D%3D
x-proxy-origin: 37.58.58.248; 37.58.58.248; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK kjmi9fqzw10q Show response
hal9000.redintelligence.net/zone/ Frame 419D 12 KB
4 KB 100ms
15ms Script
text/html 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/kjmi9fqzw10q?subid=&gdpr=&gdpr_consent=&rnd=1701236867499840&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCD5o5g9BmZYDBHqSZn88P4Z6VyAzr0sGhad3z3vTFD_AuEAEg7L-QEWCVoqaCsAfIAQmpAu9_vvbrerI-qAMByAObBKoEsQJP0MmVrQdlApGesqIR1PVJp_8PqB95rsLOMLU3OeEwQQmO7g_UtV5rL1GQRMYA2kV5shISdMuNTtNU1eEmgmgPpKquGSDbvTewuOQeBMvyScG7bFvq_NuTAPvKyxc_ihEJ1wO73QsFCPPDE0BoborkrQm7hpJa6jFdxBc27AkqjQ539B7IsvZDV07Ju8LkxrG8L1ptwguX4wILXF_TC6miIMii7TkYhZCNSXpIb6x6h7mvAHlUyVOIjOdKM_aAMjzRmsGqz9m4hASjSvQKFFFl1NFaEeDYnvJyFUteI0yN9B3JyccIBUyUSd-o1guUq0x_vo1e52zFiVQ7gpoJKYM0Yo9vnJ8ouieMv-BfJNdLu1TGC1FHNPEGyflJYB_GEEzhmRXoVFtJvVPRtpCMTCR7tcAEvo7q5PkD4AQDiAW91IqIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgfMgKqAjoCgEBIvf3BOliC3aWZweiCA4AKAZgLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJERbATh--xFdATANgTA4gUAtgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNzGwRpEKSPaJhad8pIKp1BKb9gwOTGT4GSae_kc92uq5sOMzFvft7lc_3X4ZhUymjzAZ2UX00G0EUN-i6uBLJllbOz42Jdb_DU6YYAQ%26sig%3DAOD64_1G8xh_QY5YE1-uFo6ND-ucNLXnSg%26client%3Dca-pub-1231661633440980%26dbm_c%3DAKAmf-CSpnyx4NnDcrnjk_XlvNe25PJ-BUFLmu9GI3wgA29oyhL86w8g3VggEFcbuQsrFpyA_sapODd8DZ3B8PfC3ITx3yv6v2FqTxhpc8Rm3nDoP1dwCUmcMiWcYjlkpq3w7WVxIgIMY--kDrAUI2bilvCFpWyjjbPxx3jNujug9QeeYHUTS4g%26cry%3D1%26dbm_d%3DAKAmf-DeDLLq0Sl_hGmkYpUcJ2FPGjYQ-_H85XNjYd9-6Oi5BdcfT3tYN8Rc02PJrqewF1DAir606ucY7XQJ7r8K1v3lJexH1J4uryRJPYk7D5do78kmxE8d-3ZhqQdMjdvPfBl1ZQ_0NU5eOlcw03b_MWt4kmHgcfqlkf79hN55sbZb-VDH94zH1VgWBh-cKlED5L0HZIf7jNHuJ9aDJ5uZ_hqab1cLYqxZBWfUU3sdAeUX1UaLOfo2UhaEdZLb5sxtNuGu-EMtJmqW-IPMEiUcxPEsFE4039IIV5c76cnGuLO6hCAD4DV91yLf8jxEXapIm5UyvBglbmNJuXxvCuYnWYFj5EUu1K3mX_4gsMMxPoBWpJyzI_UyfKdhU21J6p8Lg0MITpI_aiPqGxa4DRtutmdDKXesysb-qzcC_t0pptAb_mQArGdciPfgjk4tMeSdPTW6zxBQO2JZGmVNvhS9A5pQLVsWP62i6il4VW4JfDTIgGPrgFT5xmDgr8JB9A2rYPE42kvmoLsNJ9iZqkZ0t4Vu0Q8D-aTnsy8Bj2eEguSi146dqa_X6d-YPC8tyglSF9kYSdbo%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1231661633440980&output=html&h=600&slotname=8400035594&adk=833794805&adf=1602281170&pi=t.ma~as.8400035594&w=160&lmt=1701236867&format=160x600&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867047&bpp=1&bdt=511&idt=0&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CenEr%7C&abl=CS&pfx=0&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&fsb=1&dtd=2
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 9085b6f327b0e414b850952ab57865493d2b1687fef48cf3de2338355eb1bc31

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4267
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 381D 640 B
262 B 76ms
74ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYvN7jwAEwAQ&v=APEucNUwzV8eUojwQY4vdj7o2hpijaETRmHdlkRGcgLu8YiU5R51lWYZ2JMzos_vOEOBBC0m6sZgpcZJTDzZey9fmhJph4JkCQJ8oSbSTwYJ0ltJqfvx3O0W3lSnepVjexrPV9ZbexMsYdR0ChM-zGloOICXfmMVD-rO3a2ejb8tdWYogaOiB8S_OaVM39brHAIlr0v0_DKC

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 3FD1 89 KB
31 KB 95ms
95ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3FD1 42 B
63 B 73ms
72ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CwtlrOI6iJLPpL6tb7bdvDVW04Z3E6bNM9fDmbCKnMS6rS-BuuXJ5g_DFiYs0qR-jkElwz9asLTqD2onvScjYe15cksezt8HN5lbnOiKkMfaxSbM4

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3FD1 0
20 B 74ms
73ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=5654054392329633010&x=1&ct=76

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 3FD1 3 KB
1 KB 33ms
32ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33131
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 20:35:37 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 3FD1 20 KB
8 KB 35ms
33ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48629
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:19 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 3FD1 0
0 54ms
46ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQL_1IbCyEhfLRyrwo1_NKypL3yYRMaBfAAXCfxLEzBZjlaP_NGGoPrAF8M4ZK668NxqcyX1tVbV6O7VgzyKlGJjsF9Ag
Requested by: Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 3FD1 202 KB
64 KB 70ms
69ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 22E8 39 KB
15 KB 35ms
34ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 04:52:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3308
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Nov 2024 04:52:40 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AAB1 0
20 B 66ms
63ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=132917013526&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AAB1 0
20 B 68ms
65ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=132917013526&version=m202309260101&ct=76&x=1&cor=15891318497451885000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame AAB1 110 KB
42 KB 76ms
75ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bf0evek94tTBFZe74kEKBx_Uqq6DESEX3ZZ4PKS0qQAFSAZC4I2T6zsGUk_j75-FzNgRF7yNjrpDijHZbgjLfCYNgFKcApDzdm1LB-QzbCf9x5fOv5gYDkADcexrWiCdMyMtTs3zVFu91O9B73W6vHzwgMANBgzw8Gsejae8gGvBwAasc&dbm_d=AKAmf-BEQc0bMHOQ8cz6azIFQVPyyKp2SshQXYbE4DPO0UYmishRBVHdYwUIVnyElINncs1apq3N4lMljQWQzlPzuItXhsPnspOqGNRmCAFgf9JjD1fG8MmMMd2ebw4qyWtBfu-4X6JnOAHS7O1IYQW_nyx6G6826EnWy_ABMbVyjUaK5sDsxXo4RGVq_PQxoUHS-aQwOgyfhG6WlQT-GGiRGMkHI77i4mLjOkq7TMxJ9_ohLrMROVFlSIK7rXvzP5E3DnOPRJhso1oK2GbqcvzgbNr9b3jkBCIuM-qWISN9shk8WHFxJuzFkPUS49_w8NFL1DmK7OFmxC2QyHXcs2i5wFVkwQdlFjyMb9aLWjA00E-WRaPKWwqix52XDyfNOUrJ6nu1rdVetuxcjjVF3HWt_Nv3czmabC-TGTsGzQtpvBN_o4adzOxys76qnoHu_xjtgLZC0U-FLOJi1RmvUl2oDEHEAHEyMaBKVEfgDLMAxr7Dluo-oX4HlCCePQqvo36ZTF6zVGcwsF1D--dX13vyaCO0yxAfYYq5WCgg_9h73IaEpMnLlPrr8bYPdmxvwYm1Xjq90EH9zMrG6vfzdwLhNUvWWuz2Mqwm7_JOEFXgVJQ4Cd3WVr4SyfHl9M82-mEWFppCbgMzVC-PBNehZVqUHcpIGNcH33MbX_MQxnaAf9TKehRMqQFqXSKHn1RGeGdzL_D9rF_4j_mcDCXIBpqkPLmd-pv36l1UW06S4POTedHlfavMyowfpmHWUyGFx74NnXQvGL6mk8XUtj-u4L912H4I_5MpOY5AT6jifCMrO-y96yguKYorUfRWm27wVhgHh_R1S6iBqEPNHuW_jZd8Fd5vPPKAhETvWSK61hXyKJbfGP6p6VacFZ772SfdGL-zEx15dHBQlVR4uAARgMFsXUHL3mH82eNbcfZwtUkJpnx0l9SICKKlu_oJqvBO-3HPfbhxMBxVT5i4DxZHzQOL4VnsYVmf6lo3WybaZpucaxVsA8HHgej-m0ivCGJmv4dWs_b4c8qAQwgH0jFjuXwC-NzE5ya_6qVnPyY3kb8xrguBpb1-HiyYglyb-CM-bj_mSwWQuTKdGfLIkrsodLCZsTH9JTngBYHW7CHni1YdhHHGMWsHHGhyty59Idm5tMQWz1QjhwS5HVdiQSwtczxdCVbnw8P0CfkRIS7v7ylNUrZiIRaga4xE7Xu6GWXAp_WRF8qeb7qSBDuyAjHxhWJoZZh7JU39m-iTYAXQJPeE7wG3JIk_99tOhLZ4pn3_UKPLKFaKaVchgHJs78ZGGkNVusVQndgWbDeNIxDejZaqzBq6T4fCg57BaqtrfXP41Ou2aQzWBwzDSCjnS8JXQjCxK80KQY8Q-BtKaoMjt1Rkn05empdaHBrecD5QOp3LQwE8qVDVXBne85CYPLR80IxSQK0vCl-lCKza98RNblrxkkcEJJY7jp50sbo8KYsnIixe9PNa4-qlYWcOwoCTDtYBZK83h14bYJubiVLYO9ggTU440hhPUxASvimpcY06zl_w326andBviZIeZMuXCLafRdqH5gmOKD1c84CPwbnEE_4dApVdP-7E9IlSZi6PvE8eATeGRkxwduPtA3doO3NI6yfB4FCppDsoOhyjKGR1G1XrD5Vr42dbwj9S47ILbdkjo2R9OVN_EoOo2DZwr2m9leN16pY_EyWKpMpULmf5qUoQ_ORZf0wZPIRJRDainK5JSZzPzuJRBM5McU-IT1EZit5YUIQso0AnpExUY_y6PWh6kou5ijNVHu-wtqBxvNVy9rNnkf0TmO_ZTeZavhWhKyv72FXudp4SJwK_6SNOn4PhUTIpzop0uDVuEbpL5rzj2yHaz7OvLw__g15uDfKvMG-IRWnjdAym5baOO5NexHa3farISQbpnIq6e9PcupXT4vReswjODIhtwWQUpTnBSTGhkr2ZeSq7zkxbqNtGNK6NjkxysWCRijk_hIF35dEW68UA1rncr9xg05lpVyKNqQK3NYXMkgUqsRducaahLhva6qISG-93Rs7L-eHVT9NoWyVG0lJXP-9UWpdHQd9DmQu6RTWkIXYVKp_mIoeqmb-VGrcSrGUWa9PYnvHLyCxlJcvLwYqT1eaQiFTq3qJDK_oa3LdppJt4f1QxCHbGJvBfCyV3boHtb5ak-3NP0R7L8vXLayNBoHp5TV79INwuFK1hWENFy0vkbkduTlDrQFGIOdsuvXqUeqkK_7BldjTzNkaqcWQiJ2WZtaz2qcxBWJHLWQIDgifcCXg6aAx6ptqPYe_SLp9nEjocUhP4-bey3teJxzksVfqfDFx4vXjk-YJTvzwHSNjMdqkxyG0osuhQV7si7Jha8ScxQlYwjzyMzh602XZYDp2vKwd1mSRAq8fLFXntAogL02VvFIMWzmgQiw_w-i4u6HhfJZuXSM7-p7yLa7fGrZreP1WswQd2wnO8HVHiFOImhPwOw6B4mjdn9hSbD9d0drY6vOIMndfL01S3QmOzY3SIgIaiQ0s-S4qbb-nH_hB5P7oUCvrijxE6X25Jj1WHStu-5ekMI3Vqf2S3QK2cV02CxYWBKcQJuuK8_m2jp5xQ664OSrna8rHEJTJR1tagC_ZLMMthHrRzqajJemjkF6FtiKYxdY9F-wkYKX1GpsEWdT0f0E_rIj3JLGVngX6e8ARQb2JVzcwqep0dXLec6cW4dDaE2CKE8RZxEDZ9GvJXHtTFiriMY1tpNfFzqUckvkZ4sk-uoLQQKZ9jTtRM2c02iGp5crJ-B5y2phAOSSQKeV4y87vBIe96NNRJGj31dpN6G9J705P3O4ieds4iHri_RJihOpTKMxj9DUknorI0-SwaxQDS3R0-2CPaw8zVF1A5aoksOSH9sU-4WMZGh5y3NsqOnPnz1ug5sIOQs0j_rmzXzFRtleGc7Bph8R8sf5BGocDHSgr2dRT2qqqdDR3oimEuTaDT_BKxOC4HiCp5WtNUGShB0Wqvzw-tOo_5M3n6pf5dGoq103-b3WcTRf6k8r6xgwq22hsohyK5EdTnQLfe5xsnl5Gq53kCC-LZzM_jkbCm_1bpLUdxi87UgMSuiRQ5Gh13EJFN-NVZBVMWI8CFHBlnFzfht3es_EcSB8xURYl0O_v-VHfRXyPj6CZdpNIc4IFMzf1WGn8WdbEvQmpLm6i8NRAvzzUhC1lydqRJb9whA6kpDXHJZM2ELnoLjrouJ0S3mSdll0zb6PL7sY821-4gNz-RQML7A60ovzLWv5KGThqFI3uPqxT2O08yr2nqSEMZ6qhbwwNcCU4gdEitGR3JO7qv0Bat-4mckDejYSGjhXeO2M6A0bX0xFJYlhJbWcEjsALw7MjbIUuFTdrA82eSk2kzEQMFlvq5YMs_7_aPRzf3YMlMymaB5A-WdDazyk4QyzOj27wYaMyVwRmSdkfHj_HQKGVQ_wTEkP0y7jNkRkywxTAlFyiHB5CQeIdmjmrEq17jbcvUQvEVAhJiV-QRsKV_szWYpRlz_BTXbApSIWpzYC2v4w7K2Cgwf6FwFvZdWV7KU-XZw21rqr3IIhajG8UYZyTgknrvDQ9pzIWLVdbENR2CmNr-YS2TJw5WRmCTxWyGPZxsev8pTDjPRfu7pYC53HIJbKb8m9mVOfTfUU8bbG2r0AT6kAdwaiORP2DiggRpvqKAlZZ17D8a367_OCFCtr3Rto6q0X6D8zI8IfPWQPtTGZMtdRViJeYoTEVIEddWxMr3qXOD9lQTI1S4u0U7oKLWOPCXQQQsPNC6MifoBfGFTJnTn8Dpd0NnT-RbbcFsCUbJfbhmSMc1TMRMOhiZ4bnEODNQDj7YBV83stiTzg9XU-w4y_8yumiQ_8Lw1zsw6yz4Z8lOqYcg0mYjLTn76B-gr3CvWVB-gmXDGH4A_CQ20ErXr3_V7I46NTIXnozg93d_IlkHFKiRLfpgcsKBQONBybLexWn0y6B1hK8DNolw5qkFVuKVoH2SXBMm-AyOpmg8QUsyFLrEyvBWttYzew66Wu42i-XFYJYct9Du9zHVW-DOQt0r6DyCqRqP_LvxHcLGfRGMSLhO9sChZ1hQyW-EMv0fTtfgIEKi666pOLDx5sLJT-rrJFRVAOyYkuv82sj2cGwpa9yKEsiuNgF8q4kDrdJrU1aUN5iqwj-4VcXYu9iT&cid=CAQSTwDICaaNWPTS8UtjV7cWPVLX7YW6NGS1DxqcgBKo72z7KfkrjJ8YoVB_-RTKVsaEVlIvDPwMz19drAfSXZcstIPeY9sVNOhq3qf3LuKrIycYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=15891318497451885000&adk=2086295851&idt=114&cac=0&dtd=5

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

27efc5a9645bbb943247c9cf291f64f61cf17b849f931f08081a936bc8e9ef3a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42633
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 1 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 95abaca5a5f710cf478b0360960174ac2153a14f8e875794d2dda4df164263ae

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame E5ED 640 B
265 B 68ms
67ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGNSDtv8BMAE&v=APEucNUZK4jSb-L8InNjdVPVziRrCaSQ0h6vjewkzEU7disWT0vRFqkgi78VMIkQKWQliI2LfXO3TUPkV2d2sERIvihjZOvs3aq_7-hP3Jp7m02PBLWLcKurxv6YhePdBGxVbfP8mJqNGKjdq7IV72f8tNQ0savRM30jiALhB6J9EtFryHPwi6XQA4i4x6dNTbaE-dKJdHzY

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:48 GMT
expires: Wed, 29 Nov 2023 05:47:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 9CEC 92 KB
32 KB 112ms
111ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1f40994eab15b92af5183f9acf338e0354771054c65024e0aa679b6506f9eb87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32789
x-xss-protection: 0
server: cafe
etag: 17194431578830737671
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 9CEC 3 KB
1 KB 49ms
49ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33131
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 20:35:37 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 9CEC 20 KB
8 KB 50ms
49ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48629
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:19 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 9CEC 0
0 46ms
46ms Image
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTNVsmfcyq6dAaMA7R4p77G7bDxaCcOBh4MTfbl1YjcIayHBa2ScgaPtj2mIPLsMlad78P5mYUQSnXNYLq5bpzyt0TqpQ
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9CEC 202 KB
64 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9CEC 42 B
63 B 63ms
62ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CtSF8S-hxJqRjdXmelVcDOcxSBNlPxeEnzs-xeeMPm0NvNEK_etRJW8P-qx64LuiWjeZFkXlMIFWAATK3Geu88wRX7NbyFOhzNT4h4u-6oR2R-dcE

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9CEC 0
20 B 62ms
62ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=1058475413627300623&x=1&ct=76

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 747E
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CkkXzg9BmZavZHqbKn88PotC00AX_8c6RdJ35_6j5EfOW6PHcPxABIOy_kBFglaKmgrAHoAGm1tvcKcgBCakC73--9ut6sj6oAwHIA8sEqgSZAk_QGBZ4Zh4c5esUV3umnOxH2pe6MbEMBnc...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2212025226456019287616%22,%22debug_reporting%22:true,%22destination%22:%22https://solaranlagen-magazin.de%22,%22event_report...

0
0

59ms
58ms

Fetch
text/css

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2212025226456019287616%22,%22debug_reporting%22:true,%22destination%22:%22https://solaranlagen-magazin.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2211200293670%22],%224%22:[%2211-29%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%225929897268507515569%22}&andc=true

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"12025226456019287616","debug_reporting":true,"destination":"https://solaranlagen-magazin.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11200293670"],"4":["11-29"],"6":["true"]},"priority":"500","source_event_id":"5929897268507515569"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 29 Nov 2023 05:47:48 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"12025226456019287616","debug_reporting":true,"destination":"https://solaranlagen-magazin.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["11200293670"],"4":["11-29"],"6":["true"]},"priority":"500","source_event_id":"5929897268507515569"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js Show response
pagead2.googlesyndication.com/bg/ Frame 6154 38 KB
15 KB 28ms
28ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61fe41cde1b6df00f34e5a9795741e926e8861b8e80d396ff799d48bacda5300

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 17:34:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 389577
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14900
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 23 Nov 2024 17:34:51 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 0768 38 KB
13 KB 23ms
23ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 307777
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 16:18:11 GMT
expires: Sun, 24 Nov 2024 16:18:11 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311150101/ 160 KB
55 KB 109ms
104ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311150101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d3e3d91c1049ef2c6fe0a210bc08b1a8f094c41687ace751adf3e5135220fefa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55853
x-xss-protection: 0
server: cafe
etag: 13388769084283554526
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H2 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 9794 172 KB
61 KB 53ms
13ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48626
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 16:17:22 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame 9794 11 KB
4 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CSa9d6j8NdQHOLKswAfHz6CaPYlsXFgIKFZy5JV0AlnlwwcVKZ_Fc46FuP_KK1qFgYq72tY1e969b6LAv-2cbAmpejKokyaS2WiF9e5eoEnk8pMHv9RZo5Z4zm2zQ7-epLBWQ910ezGZm-qkUMmL70kwKbf6rJIxDtvCY67jJsh1dMI9E&dbm_d=AKAmf-AFwanKep3BwPZfEJrhCBl-tE2j4KG2ECXjCx0NBC2brRmNfn9rrCtRuEjvcktiQREirqjaas-dDSEmxwIjVaxtSVidDZEgHYymb86SAeb2fy2me-buiPO2yUszZwIj9uRf85sIzXaMujGkqFaitMDPAcq_orwER8cYbmHDxfi1kzQcHcMBXgEUxVbFOQ8iyq7XB3JHuV2Oxbqx2gXr89VKX3Y3sHdZfqU7mdivRAkWJmptBMKlXBhdJFW5Fhn4KUhRjayVVEOsJCXlTLQrdy88VXZGTY5r0NVhC2zToi-mVjdqdUSkDTtqXB5TNY0HGV5Pw-I4cNwjQUXPGXiMeiDNB7jSuM_1mLUJMSarMkvR13jTlAHjw3n8j8sNa_bwZDYNFGxQIZX-2KeDt7QAlDZccIDUyEcKlU5b5byZXcmMj9dBAngmVEiAvNQbNEWREBTVfMktV9Y5qcJ497wQY82fks_T0PwC5Ga2IeCx6f3oC5RY5uzkkre4V-sK6h4uAxqrjoOhpsKrN1hBMcCnKnylQ8SKgWZB6STetbk-igAgRS7IHuiCk_s7lpGciovj-Ns8XaziMoijLpItYpSHAU5BYMox8nFSQSHxw35kgoiS8_ka5Et1Xs_VHwQ5FMA8z3QtuB9YM5vquIJEVfQmZ8QHWYrAAFUAuylGC9e2nJNrMT8rEY_N14zy0-064v7rxO2-EREsQFyDW1CtjZTYfjNKU-T1qAQb8MlnwrMxZRVSbHgkdiIiJVybeqDOSFnSqs2hldy8sducH0NzM0NZo8yU2ZIoHtXCQaWIxuMKrrICIXrtUiiMBCgLiK1X5WI-Hv4bZtihyqKyP3ME1zWd4NDkuv43Fq_P1uFkd4nGeIUz17rA5ztQ4eAmT4GMkKBSnYXWApi1zTHFruVnoMOzehxUiiAV3tfHKjsDQmEZpjp9VVdrh48nUYydEcJlag5E-kTZYc_InqaZXGsB8lgrglIpP1TinYlguZ91B39ICVHCaw4flm-AAqata2N445gZ9pgrqLzdXvEBsqZqt5irl9OREENaFmJTbnlYrq9G0kXNj3qB2JJlbBS7J1rhwzorser_J1kHVPGe-b0_ufNLgA4XR-y8aUBx-66NcNW1vQ73f_JyUrQRL6Gk-rSsF4-tSS0Nb55vy7OX1zBCHvdWprnebmRRhzqE4dVrRXAgfOxuHaqd2iRo3WM_mLrXF9ZLNGDcuqSdiB6CUcZARLbCpTH7A9VV2DygOMasIkSNegsp2mc0-2d4t94Xq3RxnjUfF1Tg4GyVf-kU0QnP35LRixKfNaUP3yEwimjMZ7jZ8zIbOgUPgbR-s5PR_Jp0SfVpSXXA8C3vKQNUts0nfIXu81X6rD8VlZoWJbRycwAMcxYHSSwS2sihWJ8pV96VVoNy_OS8XvLcWf_HauKEHURiwPfmHLfcoPHVNACK7pVTPGo5gE0CfTAeKo8QPgLHMl0JRS2Wng5hingLa5JPAS-VKTOk0h-dQcgpLFZ8oVEw05s8rS1Z3uS_vVWtwHMuRyXTZb8Y6GgIHXzKtApL253Hp0U3dozpRp5YMnRf_R8bUj9donJnBH5JL5eF55WSnDD0QbbRb01xS9e72kcVzU35ejZn9jwPpzuUH3kPB6Wo8Vxyc_4Q7oWLPoQUE5iNHFZNJ63iAN76ZSvXf5BlNSQ2n21VrJnQJARv2qWyc-zDA4FZqqRZBPjYtmT3m_uGPMvapi1gwvck6gCpHwGFOE4rEGeEQUGmn4VE6cLf1QhB-IsDotch75BtL-ajKSYrmhb11eLuGPM-EgW67zOhxGecXlnfyRAgzN6SKeCoq-ttKz3GG6lf7t7QaILQNhGb1MOrqfCfEMpx7yfmc5cZDWA-ePUUji_YupNfbddGoprwkht2tVS_KSc3oMuWWnCb1ybtIq8tA0TjnO-mYylxGxGRfh5xeljW30LDRzecQMHaClwflwPvClqLwAClXOutTov5bZa6B7rUz_jt8BMB7H8Ma4iXvBtUKDO550hYn1BcLFvxwCVlgz1GvZRitJsvftWMSbXV3JKmwVaQyomOyDhH-pjU1hoaqRZ9iR_a5SlwXq3eZZSnzf9WAtj-TkECyzZaqRTUO2VJXSw_u0_TQuqOK3TWhwqCD65Gf0s28NjSCKaAO8323Kjdiwp6c8qgMS5Lj9OjSGQm7Iw7AiicuL7iKLOWFiLCjb9hOMPXCcZYx3pgV65QBzHmquxThRSy6zfF63RB0M262gZkF4Hr_7xJHKL0IUs5QTE-JEj3swB7ldL1Yds08GbSZVdgO35WBWI4r33rwgOJAsBiHKGD4NvrJ9jR8MDifuHmYH2EaYsKBtl8c6U0qA9SvdTidieLtY2OiVW4ytNOck5eK9_678PMOy8uukkyu_WwFXVi_cXiyO0ZeYzQHJJo3aNpRJMB4ndpZY-8JiD3rGCP_HquiS-endGKJsS6K9HXVxl22oFUJvlvgS7yzpJr0hUFngDMMqSSZD6E1K87D2fm7LqwFIcSShj6-kB3UKdI2PJCilg5dqO2r43u1vrEJ0_zWABZpDYNkyvXNEFksZdHzHFKLUB0yh4sOC0sXesqPCcUwocCl6e-IkqwDRtL8r1GOoH5ZlkkratcqNJNscLqz_pgYEcxrysA6clYiuk75LFN8uumkqc65Dv3fSHlrBVs8EMT-m3BonR-XZrkJZRxsKSk5jWesuzKkftkG-jxsC0RLO4pzjsL8d-FDHFTkZygQUV0OfA6-6umjcpGqRfGMcUDBLMtZrNTp-czcjWDLqMepYhRN4xcaXKanvsyDXDse1QivxmPcIDRFaM-Gq3Xq3T90lV1WW-mqdYF3ZNEUpk3NZoWOuh62HWC0gX7e_mf0ho4eIY1SHtMaXdDYM3boMCZWtgK7ZNq1J3QEtFDDXkgSlzz8Jo1g-BFGi_fCPd5Ep0bzuXIaLSHv_g_D8MoMkdd1EFTLUnWZLS0lkRduLYcYPQZhPwFxqkH8edADkHhG4uFy5rDY2Yp9dNQV_HJvdDO6AQlipStf_ak-YSgFwe3o8cD_mepHMR65On15u4McJ02YkO9iwuQv5pw0n5eeW3zjRyXsgE7SQiMZC0d8CZfzSZbCFuuA58XiSmp5CiL9ewN20L9_XpHtJ7uSdYcguvAsgeB2XA5JGYUbMTEQ6IZNratFwunj6pCzuKDXfnTW0YbFdOApJpnUPZ9zv0x4l5Z0_Qgh47gqK9f-0-UVTjZwZ2SlDzwUnGeh8zMG0DR-bXsw4o2eaR67PCwQ_MR5UMF5402nHj8QQ8AH-QmIYixRp0uqtksWzaa5wG4wuVmL_kWxsAR-zp6GzNwmZ5FsznUvPSJUeOZU1EcOrjrqKCQUXSQZMzK68tgY1-gT7YnrQNcHLQ_4N4FvUn0H9N3QNJdvxLGSsMa-CNzkOCLsl5fbc-Kk4aS6ouwy78yp9UNdlDTWTGdbOxW1FUyxPED6UntnDlbSyM-yBoq56GiHCJahPn4HpCTbsHVljXchzhR6WGni0fzY8UTCvWNN-1XfZ6-_b3xWxXr6ZwQGA981bMo0U5YywIiDQ6lCEx0Yn_fvDWsv2qEPQ74duU-oAaLSmcbSYV7hR9wRdwjgw-xt5EeoLKreXbVyMHoU7e0Gjq_o6gBvceGeqX6yaAFN9zV8BcqFv8rq1JVmGuJ5oQz9Yfy17MnwN4wg3XeZik7bo2wf1sK0Rt7c7nNRooFGsuoB5Ig5gZzOARTq0x_gnB07yV-Dnu6TzI9h95t5G7a6M62rECVhNlZlSsyIDFvX_tAgYAteUDcSESvHRDPNPnUGkLQFf06SApAMSMg157UMSPdCff_6xuW7s6rJf_APPhkRyNLLr4-IUzP7YyE239ftIsQ9FJ1MRubLd3Zh4OxWDWuRdODT_Z1pvT-CTPmVQzcdqsioCzo8qM11seoh-eQZuSmOwX5UNbae0uMxJsRRLj2anMd2qtS7pQZaLIDSu6DtMA26FA9H3fancIWzgd65z3KcF_qXfvRsohjFV0a4eRQko7mM0JMsb-TfJ8mCwlm8ZyoAAfTauk3E72BeeSxjalNRSYTROegNt93sZCIVh8w0VZrCgC6_PGM3pHx&cid=CAQSTgDICaaNZcZaJOvO7MiXAasFdJvjfq6bg4XLbARQ86RpbX1n6q1ZZdwu03gbIEXGXm9t2HaWori8NbfmmvlZfae8RkVAyTPT1qyrGJNUBBgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=11031375670977624000&adk=3944675600&idt=109&cac=0&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48626
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:22 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame 9794 31 KB
12 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

610d24f5996131b3ab98f18e05441cc246aa8674c3842df0df2b40b57ac9fd0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48626
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11874
x-xss-protection: 0
server: cafe
etag: 3876053170955424897
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:22 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 9794 41 KB
14 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 307826
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 16:17:22 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 381D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEC60-D4Hf1JE336RGNwUfEg&google_cver=1

43 B
61 B

34ms
34ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEC60-D4Hf1JE336RGNwUfEg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYvN7jwAEwAQ&v=APEucNUwzV8eUojwQY4vdj7o2hpijaETRmHdlkRGcgLu8YiU5R51lWYZ2JMzos_vOEOBBC0m6sZgpcZJTDzZey9fmhJph4JkCQJ8oSbSTwYJ0ltJqfvx3O0W3lSnepVjexrPV9ZbexMsYdR0ChM-zGloOICXfmMVD-rO3a2ejb8tdWYogaOiB8S_OaVM39brHAIlr0v0_DKC
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEC60-D4Hf1JE336RGNwUfEg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cm
us-u.openx.net/w/1.0/ Frame 381D 43 B
75 B 20ms
19ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYvN7jwAEwAQ&v=APEucNUwzV8eUojwQY4vdj7o2hpijaETRmHdlkRGcgLu8YiU5R51lWYZ2JMzos_vOEOBBC0m6sZgpcZJTDzZey9fmhJph4JkCQJ8oSbSTwYJ0ltJqfvx3O0W3lSnepVjexrPV9ZbexMsYdR0ChM-zGloOICXfmMVD-rO3a2ejb8tdWYogaOiB8S_OaVM39brHAIlr0v0_DKC
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 381D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEF94lTU-D8OsNN6Ahdi4L8c&google_cver=1

23 B
165 B

50ms
50ms

Image
image/gif

2.19.85.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEF94lTU-D8OsNN6Ahdi4L8c&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYvN7jwAEwAQ&v=APEucNUwzV8eUojwQY4vdj7o2hpijaETRmHdlkRGcgLu8YiU5R51lWYZ2JMzos_vOEOBBC0m6sZgpcZJTDzZey9fmhJph4JkCQJ8oSbSTwYJ0ltJqfvx3O0W3lSnepVjexrPV9ZbexMsYdR0ChM-zGloOICXfmMVD-rO3a2ejb8tdWYogaOiB8S_OaVM39brHAIlr0v0_DKC
Protocol: H2
Server: 2.19.85.30 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-85-30.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Wed, 29 Nov 2023 05:47:48 GMT
pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEF94lTU-D8OsNN6Ahdi4L8c&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 381D 23 B
165 B 44ms
43ms Image
image/gif 2.19.85.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COGKFRCp6RsYvN7jwAEwAQ&v=APEucNUwzV8eUojwQY4vdj7o2hpijaETRmHdlkRGcgLu8YiU5R51lWYZ2JMzos_vOEOBBC0m6sZgpcZJTDzZey9fmhJph4JkCQJ8oSbSTwYJ0ltJqfvx3O0W3lSnepVjexrPV9ZbexMsYdR0ChM-zGloOICXfmMVD-rO3a2ejb8tdWYogaOiB8S_OaVM39brHAIlr0v0_DKC
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.85.30 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-85-30.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Wed, 29 Nov 2023 05:47:48 GMT
pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame E5ED
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEC60-D4Hf1JE336RGNwUfEg&google_cver=1

43 B
61 B

37ms
37ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEC60-D4Hf1JE336RGNwUfEg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGNSDtv8BMAE&v=APEucNUZK4jSb-L8InNjdVPVziRrCaSQ0h6vjewkzEU7disWT0vRFqkgi78VMIkQKWQliI2LfXO3TUPkV2d2sERIvihjZOvs3aq_7-hP3Jp7m02PBLWLcKurxv6YhePdBGxVbfP8mJqNGKjdq7IV72f8tNQ0savRM30jiALhB6J9EtFryHPwi6XQA4i4x6dNTbaE-dKJdHzY
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEC60-D4Hf1JE336RGNwUfEg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cm
us-u.openx.net/w/1.0/ Frame E5ED 43 B
75 B 24ms
23ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGNSDtv8BMAE&v=APEucNUZK4jSb-L8InNjdVPVziRrCaSQ0h6vjewkzEU7disWT0vRFqkgi78VMIkQKWQliI2LfXO3TUPkV2d2sERIvihjZOvs3aq_7-hP3Jp7m02PBLWLcKurxv6YhePdBGxVbfP8mJqNGKjdq7IV72f8tNQ0savRM30jiALhB6J9EtFryHPwi6XQA4i4x6dNTbaE-dKJdHzY
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame E5ED
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEF94lTU-D8OsNN6Ahdi4L8c&google_cver=1

23 B
165 B

33ms
32ms

Image
image/gif

2.19.85.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEF94lTU-D8OsNN6Ahdi4L8c&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGNSDtv8BMAE&v=APEucNUZK4jSb-L8InNjdVPVziRrCaSQ0h6vjewkzEU7disWT0vRFqkgi78VMIkQKWQliI2LfXO3TUPkV2d2sERIvihjZOvs3aq_7-hP3Jp7m02PBLWLcKurxv6YhePdBGxVbfP8mJqNGKjdq7IV72f8tNQ0savRM30jiALhB6J9EtFryHPwi6XQA4i4x6dNTbaE-dKJdHzY
Protocol: H2
Server: 2.19.85.30 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-85-30.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Wed, 29 Nov 2023 05:47:48 GMT
pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEF94lTU-D8OsNN6Ahdi4L8c&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame E5ED 23 B
165 B 38ms
38ms Image
image/gif 2.19.85.30
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLSETBC6jZEBGNSDtv8BMAE&v=APEucNUZK4jSb-L8InNjdVPVziRrCaSQ0h6vjewkzEU7disWT0vRFqkgi78VMIkQKWQliI2LfXO3TUPkV2d2sERIvihjZOvs3aq_7-hP3Jp7m02PBLWLcKurxv6YhePdBGxVbfP8mJqNGKjdq7IV72f8tNQ0savRM30jiALhB6J9EtFryHPwi6XQA4i4x6dNTbaE-dKJdHzY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.85.30 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-85-30.deploy.static.akamaitechnologies.com
Software: pekko-http/1.0.0 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

expires: Wed, 29 Nov 2023 05:47:48 GMT
pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
cache-control: max-age=0, no-cache, no-store
server: pekko-http/1.0.0
content-length: 23
content-type: image/gif

GET
DATA 200
OK truncated
/ Frame 9794 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8267871310b13ff2c2c2d4110f29ca780c672b133fb2a0ef87a002940d993101

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 2595 111 KB
39 KB 29ms
28ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 07:40:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79640
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 07:40:28 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame 2595 11 KB
4 KB 29ms
28ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CUGQQroB26qi2y7tz_oioAtqUbuzeK9azRuIcQdMByqT6zS2seaGNOTR37JwNHiOebe9-kOrSIyB9P04wg9Z0FVfhPFQKmDeiOcU_AHXVXqFS_pr9qjpmQB_YF54FBNinLDBQJE2VBQONZEOh7vzbPJ5dO0alTmOIgxEJEOhBvh56iM7A&dbm_d=AKAmf-DpxsdBsr-9O1OGGMf_uuiqnV8wkUKLNitjCL2LifZ8iTqs_LH9VWdJDQh9SWblm9iiI5l1yVGFqSu_flaDZtYQXCQ4IaGwKaPGsYQQSk1iUr5OujzNzwHZtJO0j21BNJELZOqoIUQ81sPfb6T4dYSFw864iyG06qyStc3o2LSf0RZQ0DpKJE4z3RflzSWd_sZ9Tj3zfTPmZOwW9emxG1SMomDuWq0kFO7RV0oe3RZslaZl_Uyyeg1mPjg7oTjVmyLKDBWpnW8qbyH2cQSKd171NhlOE2ZAIrCurRUfBxhxbs26W9LrVWQKz2GGD_Eq7cMSiyGws5RqcgwyNXGgrC4ubVUe2qyae_3N7IIgrDDKrwoEUXn4JLGlMQrkMwEYuZ2LYshSwSxduKS07PHPIlAKi4wvEdkwy_wBDdce1ttaUCH8Qe-4TKOwza2Wy6QZJUjE6bhd5uFlHo6d7Jk8bZR_ss2ySV2gvvZvwyCoGhIuGG7k4cEjUIOGO1ieWwJwTQY9jSi5AKCjOaYBg5khmdNBT4mSsZlT61uPUJ9edOjeAzwz7agJ7WwusrvnMDItbk7nBR5Mm3wznSiE9s8fVGWWPCaHYJFZKVpiWUY2YEFcgeJIocr3AqLWDFMAJYnajsbRr9Ij6SKoEB6--CZP6RN7gL6pgICMbMIQCrbW6XPTnx8_m8jISO2KJZLM0oC-4F4Bac9uEQvqF8p-JPDZ6Wl9TNgZkQNpydJPUo00GQBBWV40W35eMZCMNUpHbNPj9xMgl6NuHzzc-WFNFv22f_KmaYyhKHhwc51-2LKPbhDYkOmrfHStQDugr4w8SDdMs1eJrtWWbPNBhoOt_Z_IT7Ti5avr7F8MLI4m1jwv1ZqHedlPVzdsnGtCUZj7GViPY3lXUGyF501a-ZjBGwl6R4B0wj6jhkejFKiBOODufvXyoc3owXd35tgpo02hj1_SiiZpxkYXnqscYTqYQI66CT1YyMjSsjlpC8maJJS79uimzumna_VvPLEZbutMnIAy8O5ZhLC6g7km71fUui-rzV7jVCKi7POKULxh3JzhNJK79IJLbhUlvqylYXeFaB0Kj8ED6IZGdzSkXt_gt8ZNPhw0rKh0CKwf5BV2tZ3f3H6olAsqeAspLyjc0O-uPC1TAtZIb1K7QdRBHgkF6H47S3dbFGTO8g34QJQxMd2N8WlL0Qv-hbAYtOd1gugkIRu5RdgrGpKs-uJ1LbrN3w1vQRzAJdaT-AKQgUwkBZEOGNjMwfcC8URKSXtybajPMkL6XeCSxBtMfbuezhG75wS927TEXeMtT1-Mp-ID-KoDMNlWfQB5niuC8kuL_64cf_g-p6KI2Y30HNhaLtr6w7XFooEKQ2CDB9ry62nLzmLuWvyKMSU_SxZkz30dNoYzE6Cs7RcmxBjy8_-3bIt-JxjoU7D9xmySzhKVe8RiRJUhK8bw9g8k6QeTcgBi8XNORQoricTdWT_j_nO7QfNAhpY1LsDRbB67j5ooEzVNGmKIu4oH6z9sw7ELhr735-g7nWKS440I6yBJB8X8OoUky6iTu9hi0lIQ4ifEhx8gdTwmrAiwMTYrcWwPLkeWvGfn59pd2CkoLa2m1uuGbBqhDc_BlfOmWCom-OgJti_To50DqFnzLBDt4CzHzY72znQQX3XtcfypO56sUIEDYpWpKGOOvsbe9KZqMMQWLc-Eqj42kFDBbb0a0S6_SVFL8Vw_a90uCXehXtjI88t2V_WDq0WSEd_3a_JxHDpVGN9X92svsmlGrlA2gYm6p5flVEqHDJqaOS6-7qXf08gC_7kuTHCkXg6jz036Zfm3-JtFIvBi4EB62xPVBTbRwGeLpVF_XxBJCQpuwCB0jcWzE_4Cf9grLzaJ1Z-_eCeEocGfstdF294CabEcE3GvPKaLDDNXAm0nER_hEMT7NzzwvbijoK05HL3OHRL_cUUMCARjVQ19-cidMx8LoHMGEMshS1ppUlLZvgChKofx20Hnto-Bsaf-rPTCvch1RhZt42IgU4U4XssH9ry3b3QlFVg_w1fn8q8EJBm0Vr3QHp1q6PpSrC5cbcw-2SDt2QDbBNWsYp9AnChGnfaiRnZxi96YPn87o1-l1y2PTI7hXi4gpFjOFcu22iLI4uM5OiJtWkzPkTJn8qjyA-Ox1D8HIUbJNA3rf6xuSf7Rjz2TUJaQ5EUbT6Ocli6VhXk92qwS4GYiwYbIS1m6SalDs9Av31ZG2G7paLP--BsaAf-USAfrgfPzkaUvJjwNZThSfMWoxGhKyFAWcVXb5EiLNYpRq48zQIwXMwwxsjDvFLSWi-nTLNv3Ts2efDqIvxUpaddMyy-Q20Lp8O0_j7rfXo0Q-FjsDoVbHMTyIsIqA3NWQNPYfTVl8K6nT2HLXq30NsvKYpwYaF3g5XhhbZnNSASt8SByfBboBUoBU3SE4iIf06YSeylTAfeDj9Fw3MCC-xnX2Oj2ovvsAKmY0ebrUTPYkZ3nWBX20mzo6X0eotUG40uFQR1c89OV_9EPToWlBN_MturVnuUnSUOmpBgHUzf61XHx8rIjnM_1SprmUjMe8FiUdTvJQ8INEL4qx1RLniQPVBmbi2BgRFU0UT0kw2SbDMijrsXI1OdvHqmYee0aQYZc4eY-_ncFiuYd0ogSf4mSAjnv-QMc3lz1NEf-ti20UQP6jtwrq9QXm3UnDbGZ_wImtJXYPAMc-hhh8_Zu4Qx23nYKBnmdXW1akTI_rVRavuMrV5pwKG0bNyfXVwtGJa2D9r3-rRQjv2ynYv60cc2625XehBQdOdAqKEdxEDpmD2nBaV9n-iUPmfQBYN8CQIPxMmjhboJMVFx-kMgX8qSyVAA57dVV6hqNeoyzkk9vjHz75UJV23EglxwkfzsbIVPT-QeoAZc4m32Xv8Bo4uCXdOEuLPr1igndbNNbqB_YmT8CEYS9ZhKy6Ge4NkHeiEOKs4XLNMClSVQsOe1fZj9UPYgcyiQ4omcHmMWrIG9TDq6sZPV43Jy0JFSN7zw4ST2qrsSaRLlRTz7F0yFF8Dmv1wrVs0CVgbrJHoHFPgoaRG4GhtiwId322AjBw-xNngBTk1GhSGPZvuLScGqoPmCxaDdI5m6FtEYkrgF2pDFEVl5hwzNYIDANuS7frRpvNKxdIHclRQL08Y9likJoD2VAl5cA5hXLrCeEvk3erKEwTrocZFeTsO8aqSVyQbKMra2y5_MfeXQfNu0IDy_l6u_tTWagWFg2oj-gtS7KYhgWVCxcwqE1j1r_KpduW-JUAfP0FsYe67vLh-b1xblH9F7kcLcSMvHozyELCmlbcOX90qT68wao8wZIvmQcJYr3C6iXR-loEwAKjA-yim07jQI2XGw4uoy_oDFxoFu_jAZNUI8BlMfPln75iyYRqVde2jetOPXbgGXOaYW3Y1m-5r8UTEOIkpONolYnaP2ucIti88jmbaw8VSc4lLrCbpwioltnbCRt7EWpZw5Schmf3eGrZYHxfChB_wq7JXLjkpEleLKueI9uin5-NOmPdoApBtlnk5327EPgUC0ACdwzaMN2jXQqr8sGdx3kpCDTk2pgdjYEJmN0Y2pAetptxe_xPDe3R9gzPz6kPKastLDmx7uiyfWJSXubvZKj4Zz_Y4qnpF6XVy6_lmLaoCy_e9sVediHWaijor0Y1SNv7RV-hvv1CAuaeBjFTph2_pwapdWFzb8pJbs3eA-no5WpPtelkWmfA_1rhesvewtwGuHhUIjFjEKcwEE1gQVPHE6W0zxTTkdXXttKUpJcxm0tqo9V5Q4pU0nHYUkXQhOhoRhShnneR7KHx_tW-BGP2Ub7xythj4HX7lePX5rHdmbofLms2pdgFik7bd1CtdWE1QqXgbymU_THWVguxsm4no9xx7bm8CUoRbwMpo49QjZV0eQvI6eDXfmWZSjbw7zKd5QEGUn4Y99L73FswRuSz3F8YfsYQbR_Vy36hL-TbXfBZmoV0eyQT-WScV3qGzSBXu8KSYqrbtEyueX9q6XLkORK7yE&cid=CAQSTwDICaaNyoppWIGMgCGYJx0980g4-TyMTzwpBQdmdBgQgk_LEaJNeLf-eY_0Jc4FO0rniuV0MmO6xTk_lTciMak4eJDo02wtkBwE_F_kDBkYAQ&dc_eid=31079495&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=5370459519191871000&adk=3047537735&idt=126&cac=0&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48626
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:22 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame 2595 31 KB
12 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

610d24f5996131b3ab98f18e05441cc246aa8674c3842df0df2b40b57ac9fd0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48626
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11874
x-xss-protection: 0
server: cafe
etag: 3876053170955424897
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:22 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 2595 41 KB
14 KB 29ms
29ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 307826
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 16:17:22 GMT

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 52ms
52ms Preflight
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 29 Nov 2023 05:47:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
483 B 29ms
29ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://live.demand.supply/e/e.js?r=farfeshplus.online_auto_interstitial_desktop&e=nai&dsReferer=ZmFyZmVzaHBsdXMub25saW5lL0ZQNjYuYXNw

Requested by

Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.22.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-nf-request-id: 01HEQ1MZJBXHMY5B8H1HQ8BKGW
date: Wed, 29 Nov 2023 05:47:48 GMT
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1650804
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "4de2110991f3807e8b4a19c48c14f2d1-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 82d88edbc9b1368c-FRA

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
482 B 29ms
29ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://live.demand.supply/e/e.js?r=farfeshplus.online_auto_interstitial_desktop&sn=3&ific=false&e=iar2&dsReferer=ZmFyZmVzaHBsdXMub25saW5lL0ZQNjYuYXNw

Requested by

Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.22.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-nf-request-id: 01HEQ1MZJBXHMY5B8H1HQ8BKGW
date: Wed, 29 Nov 2023 05:47:48 GMT
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1650804
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "4de2110991f3807e8b4a19c48c14f2d1-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 82d88edbc9b5368c-FRA

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 178 KB
51 KB 598ms
596ms Fetch
text/plain 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=923086590804078&correlator=4416544854332387&eid=31079527&output=ldjh&gdfp_req=1&vrg=202311150101&ptt=17&impl=fif&iu_parts=44890869%3A14363285%2Cca-pub-3831894559014614-tag%2Ca5520160-301d-47df-9863-5f4d53a6f95d&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=1x1&ifi=20&sfv=1-0-40&ists=1&fas=8&eri=1&sc=1&cookie=ID%3Dadef844a9b8d7bed%3AT%3D1701236867%3ART%3D1701236867%3AS%3DALNI_MbXaOZi5W5tj09IF4EQz96zu8VdnA&gpic=UID%3D00000cfcfae2ecd1%3AT%3D1701236867%3ART%3D1701236867%3AS%3DALNI_MYVd3bSwMkj5OEzUTLNu6qGwscwgw&abxe=1&dt=1701236868437&lmt=1701236868&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=-1&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&u_tz=60&dmc=8&bc=31&nvt=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&vis=1&psz=0x-1&msz=0x-1&fws=2&ohw=0&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYu__5zMExSABSAghkEhsKDDMzYWNyb3NzLmNvbRi7__nMwTFIAFICCGQSGQoKcHViY2lkLm9yZxi1g_rMwTFIAFICCGoSGAoJeWFob28uY29tGO2D-szBMUgAUgIIbxIdCg5lc3AuY3JpdGVvLmNvbRi7__nMwTFIAFICCGQSFwoIcnRiaG91c2UY2YT6zMExSABSAghqEj4KBW9wZW54EixleUpwSWpvaVYzQkxPVzVUU0VwU0wwOHlia2RwY1dWWFoxQlBVVDA5SW4wPRihh_rMwTFIABIZCgp1aWRhcGkuY29tGLv_-czBMUgAUgIIZBIbCgxpZDUtc3luYy5jb20Yz4T6zMExSABSAghq&dlt=1701236866536&idt=404&prev_scp=ti%3D28b1299c-1e08-4457-bdf2-4ca258e10f1c%26interstitials-bid%3D0.2%26bid-p%3Dgoogle%26bsc%3D95&adks=2742040516&frm=20

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ea23a2d8c80c618acfdf01e83431049ea3f9aa4441eda2c08b9f2ff6ff250b38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:49 GMT
content-encoding: br
x-content-type-options: nosniff
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52443
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.farfeshplus.online
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 4336 41 KB
14 KB 29ms
28ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BtMTSsi9dyTEBS7IfIca2A4_0icYt8YLngwBQL7DXH7k7KB2WP4lU27VGdtkli8ROPpDmC7XX5X522O2lWRkgthBHigCoqdIQc1-z9BfF82oFGJMjulhLfRlySf-7dqd8EmUChsNknThRNoK5v01dMsuERlO_NU2TMT309lndkQn8xOxk&cry=1&dbm_d=AKAmf-CN1s4ZEDq4Oil2YyYCTqYJt-HmcEWdwedvnU_aedokHrDJCi7TdQ7LSHAANarXGmaJPfIomOCsTnWYrwG8219PBGAb7uN_1es6iigIcNyAe91ulK9CcKtn22nQTheYKrmpwmP3zBGd8cM4R_iiD5bhmpJPOzMuXwk1oaH0iH6azeRxAfecJS4mNRVJlwtNVZX_FR4fhMl3q2ec2ybrO-Sok8nvPyObysEAtgOXSfrxuPJ-DAWv33WB9FYJ-gI520Cr4udASe_pfkDlMknt50qKZYbDzQHxyIjMkX1KYYrss--MFVYIKogpfIumGrde2wfMCSMohRP9a37w7I8VFz-HHslMHzwYBKYgPMgbgN3Yq51W5vVxuu2Jil233IMNRdXzlv7y4vMdVGyO8Z7JWSEtLt9w1GNKtXpm88s_PFHmo9kbzNGHwbb3eK8y86r1Vrlt3xxZQ0vA-W_hQ6haNTBB7j-eY6WdQ6uq2PPydzMDRzno8Z9Ly3aEhx30DHn91GL8nEsISa1f1gdwPS52OoTeRFEnqBqHYUamxmPpDKU8a_J-b_E3c1H3luniiqDU-0-PxmbIXXadETEbjNdmv8ntAoz1-BshQMXgU1GMaffmCubJFJOxUryLxtUHON9pgSuB57N_3I760EKhhPhlpxy_wQtavluUtP5KJ0aYYeGrrqzTCoveYRq28zpjIcRgCViayK8fgrC3dCRDadeILEWv7nICV5MKYJPF4ttudLCEnP3_c52z-9u5c-6mHE59Q23_6cdtpwimzxRikct2wd17P8-pT-ZBW0CAhnq4iqoozQrX3gLf4pUxtIy_46aSZuGXA2GLsGeMuPN5XdmnmaBF6yHKKnnevHf7WwUQFWwoFWv53wYdF1T17PYPAlzH3G-HGwANn0PUiFPoZzlldw2KfmKalbq3ffwWbXX4JQ_juDoAQeNVWpgoRTPfrvtnKfueFu_i_WsPaySt029t3ymxLjdZIBjhBdOOVG3pFMW45ThTMj9uAhndRA3OYuACraibBbRmYCK1j3V6QeqRftsftSpNg_5LfZkYFKCSzn5Vby5GRA-g09K6j2wo5laE6mYScBjlzqoNBgps_IQdF9mkdtNIXJV3x9KmPziDpocZXR4Eyg8kAu38SYNgMpsrWBaVzV8n_3nt_-QkrO1ycVXN59zRYA-U5pmIMq8NTgGGFlRIS5lqLpLNXFUIxczun3Kj-gIjAiNBz6SGNwMJ4BoeNvKcic1uylXOjQYUfOhZXzf3D_RDZDibVtH1uVrsUNBe1oH3K1iPEzQDdf-nLfQJi0NSNr0178MJvbYe2PkBiapjAqwuCejS5jFFbCdAST5G01Z27wkz1RAkrwNvmimVq3VeVboiDdVrVP3_LEpL1JFGQ7JM2G3YHvUeGS32jj-f_YCZrQjGyBCWjmRg_N3DH8eiTe747ybq6u_I6Ri4I-_zBNaoFDhuHGIdNiU8Ey_-rTdh1IBqsQAK4FA7Ovf99EX_8zvDyjJKzl31T8IxcCOlEd1UTL-z8vETskX5XvvT431XrnR-DhqypYmihBRnrnFOBirtCGFxE9xJJwcc-Oc7g5Huk_pZcvVTdmS7Wst6Az232M7IQ-94IZM0r1XPRF-RVo9I8E_QkWrQaNzKzg0K0BSvmetNAHk3A4jEBbeGOdDuQ1IbjkUZVR7HQuqi5tq9oCdO9loTimM2RXA4NrnrQ1uD-susLSN0pO8h7LQoS-2Cp9V-1w8h-_11khcMdu95JWWUKYMXpTq6SuzXW8SC9J8ll7inW9vhCPPHaYym50mTaM2bGYA__xAwRwDBaJSrsFPG8MACTFSvHWNz4WurrbtSWNdJ_t53nEekbmE3xbUgNVmT4R14QQEU3W7PvfQe9oasr3bP8W5BsJF7cpVCb_kGQ3GfAsOaO4HeHum0Eqst36Tr9L1P_lXy3ZHRd314BWP9bBWLtvTrtcfSgr3PRMCcQMuNe8bsqMfebLyO6w8zLGPJtpxsPdK-AZOKCmsRn4S7u8AMFK8M_qkQnCOuKk3ZAT2Xg9-fx_2fK5JsNMazzX0i6gl2-R0rqEpDTNenjHgvuyhHZ0DfijUt8X4qNo52wFUYFHE6iLo8AqjjLjGLKtk8A2L7kB_wXwFiVDk2czi8F7RgmItRN6ysJJvY7Cye7idLd4XmnExJDvkwHmHVwcyx5x8SBUtER0U-nLB18Hz5ris22ewRJcgOtAsLZNhF19PjjuUDVfbmDc3HZBAaql812vImG69GvHWwTqoQSlT5w_wKvI7MeAcwzGAR7qdDzIPT1sObxcDN-415H8DRgfvM75-kTPcV-4KN4V7y988Cqj6pUY96Jg0DDwdEFcVuAJu9EhHMERXLagPPFnsCkKHWhr5168qYcvQ9LuLHh3a7ha1lhJC-XueEhIqAZDIXOQRDGpv7teN5Vxv41aVK5vHsrrXm0mj-vwMnqs4u7ONSCU2sHQY2NvmyEi-fxm9VO3QSadK8uaINM8JnyK04VHIV4VF4ga4pf0LRLvPcEGlqR-f2lkpmsLRQ8AUE_RRCLnXrop6EpnMjc1prAZweJwBz1tmnaLdDUz8CSdEDGfy_u6h5g1cNIu7Z0tM5-3TPBJrqYLXRGw3i950SHK_NLdkUYqA2XbwDfuOZDA4lbLJsFqt_vS2uWAhULAL6gSvpDjAGxLA2JD_rA4LoNs25FA4ySZe4zIUVzrwmRLI10HZxGzgDb99gxSzhK9HGdlKip-9wWW7EkaOUvdDON-yUTEZaRyj4alEhmaUCJuOk38SdsCBket9RvFc5HdQZHnrEozacm4qXTx08mlrCldPn0ov2NV1y2KWXlzkUuquBSZkYZN3ecsWWuX_VA8D0zA5tUCRVvHrc6FQOOUnIzOsw0-MKbdNkAccyizYw_X48togz4ocuk8L_DArbTuvqCJ_9aajGPzmYDU8ejSkDJMryxHZDNaAJgEGf0vkbQyp_3pfQlSGRW4BtkWoWZMOQ4eP17dsdYLgW_NtMqCvjY8rPTdIsLY4-0kS4Q6R_BYJV7b7EKKj4orLYM1KYpRAwQvSeUfYXvStxEYks-XEP-KlSly7QJdi5QvHIsnlXtWr1gb8DyOrgJ3MlO3KLT6II0GYj8dW8kr9RnwNBtZ5RpvZHq-_mMaVXBWj6WSgg8JxNOWVrSCM15EaEjE9_XAXOEphw9me0TvPO8owR84_5sKPMxhEDaxJ_SGW4u5IvG4VGoI5Gzb8f4iddUsQDMCCS57l4FRGfCtxQiQbTncKdNGLOqC04SEBtxhWzRMRZ3TuVk5AxyX3OlqRr9WJZufzHoTRnP3VLtSvLU6UrCl8PFhYyLjGy7PFGB6M54RmTWp6FbVl9sNK0ODN3_WcLcNdcK-aCzEw1mlrMv-EJ6UvKx6KmDWlsFJl7ZaysT-y7pcFsYRl5AAzRWBWkzO3hQtBChFLwdAAzIg0Rsms9GnQEPL7nfWgKqzPWQIINUKKjsrVaQMJjxTCMv6jEhsRmC8rV3q4nfiajtEjEVLCBCE0CHhHLFspVZMPnVX6TVESCsDMfeEuNU2akS4UPl3sGlp_CA-iXc6LCq98QtN0pXlU2yJB9rEbfGVFbgsif5Qwa0ZY-WcxKXpjYqjQKPDlWqsWE-mwUGfObFmVqX_C_19yX8AHmmG7P4pHFl6W4jaUCS-3BFmtlvBhPqu0MdOPCvvNuh8VS3B_tBBYRoDsVQD2Di2YeHnobFMogQVtdThPRst3iJBz_xqL8jRBVh_BRPjJHF4_facrXr_sc1LkAywXwZ9bi8lEw7eu1qVUrQGyO8mMDpiZI1WNyP5IYPMcwTfaAYOXfYdNZDrs7P2nihzuS3etEjbj0PCmvEAU1pUfHJAxvIgOEiIOAS1NUC8yxFabdYJZFfMl-jMc3lBCft8Mvh4imJ0bBcvYE3DspfVuIIcXvHDd4oCo7vrqZu6oW_OJChd3SL7JaIod-1tv9ltq2tMeGx_YdMV8uJ5jJj8tawPLKhX9gQAXIr_j2H5OEQSF7WCxc1S12O2o6qBUGfWuv9r5jFIwAoRnDVrrrzGzj1tpIEekGS97X13TYATTP6Z14zPyCnPpA-phN8VsogYwh1gi4kg5kBHHdhqtEwuFx31KHHF-m86hE2ULFb19dLEnacgQGKQc1b9mAXVWz3QP2ro6zGVqLPdNkxw0lqT5KoUkda0jp6mMsZmWzfooxztDp3xGGpMJnsc3Vi80PHY8LHVB4QehzqgpW63SJccZp8SLtIKapb0xa3Achj2FXiEWnQF0dP3JGkU6VZ9fMnWSyePiNGmAdxJZr6EVwDYUoTOYwGA&cid=CAQSTgDICaaNBqtFjf9o_aiGpclcqcl6_-Gb7HYQeyMVZ4YI36Ls14oCe2toDLsFFqdrWeVAcYp70Ckc6_L1FNV-WZRIz08u69DHDZjr8z83ZhgB&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=4575565311474138600&adk=1033480531&idt=86&cac=0&dtd=15

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 307826
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 16:17:22 GMT

GET
H3 200 attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTIzNjg2ODE3NjY4MAogIHNlcnZlcl9pcDogMTcxNDc1NDEwCiAgcHJvY2Vzc19pZDogMzE3MTYxNTAwNwp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0...
ad.doubleclick.net/ddm/activity/ Frame 4336 0
22 B 51ms
51ms Image
image/png 142.250.184.198
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ad.doubleclick.net/ddm/activity/attribution_src_register;crd=cXVlcnlfZXZlbnRfaWQgewogIHRpbWVfdXNlYzogMTcwMTIzNjg2ODE3NjY4MAogIHNlcnZlcl9pcDogMTcxNDc1NDEwCiAgcHJvY2Vzc19pZDogMzE3MTYxNTAwNwp9CmZsb29kbGlnaHRfY29uZmlnX2lkOiAxMTg2ODk0MwphZHZlcnRpc2VyX2RvbWFpbjogImh0dHBzOi8vcmVkaW50ZWxsaWdlbmNlLm5ldCIKeGZhX2F0dHJpYnV0aW9uX2ludGVyYWN0aW9uX3R5cGU6IFZJRVcKaW1wcmVzc2lvbl9wcmlvcml0eTogMAppbXByZXNzaW9uX2V4cGlyeV9pbl9kYXlzOiAzMApldmVudF9pbXByZXNzaW9uX2lkOiAxMDE1MzAwMDg2OTY0NDc5ODU5CmRlYnVnX2tleTogMTQ4NDI4NjA2NDc0NDU1MTM1MTUKaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUFJPRFVDVF9UWVBFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAyCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX0lOVEVSQUNUSU9OX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fSU5URVJBQ1RJT05fREFURQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICIyMDIzLTExLTI5IgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9GTE9PRExJR0hUX0NPTkZJR19JRAogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBpbnQ2NF92YWx1ZTogMTE4Njg5NDMKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fQ09SRV9QTEFURk9STV9TRVJWSUNFCiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAwCiAgfQp9CmltcHJlc3Npb25fbWVhc3VyZW1lbnRfZGltZW5zaW9uc19kYXRhIHsKICBtZWFzdXJlbWVudF9kaW1lbnNpb246IElNUFJFU1NJT05fRElNRU5TSU9OX1BMQVRGT1JNX1RZUEUKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDAKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUVVFUllfQ09VTlRSWQogIG1lYXN1cmVtZW50X2RpbWVuc2lvbl92YWx1ZSB7CiAgICBzdHJpbmdfdmFsdWU6ICJVUyIKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fUExBQ0VNRU5UX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAzMzIyMzEzNzkKICB9Cn0KaW1wcmVzc2lvbl9tZWFzdXJlbWVudF9kaW1lbnNpb25zX2RhdGEgewogIG1lYXN1cmVtZW50X2RpbWVuc2lvbjogSU1QUkVTU0lPTl9ESU1FTlNJT05fRFYzX0FEVkVSVElTRVJfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDg3ODI0MzY5NgogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfTElORV9JVEVNX0lECiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uX3ZhbHVlIHsKICAgIGludDY0X3ZhbHVlOiAxNjY1OTk1MDE0MQogIH0KfQppbXByZXNzaW9uX21lYXN1cmVtZW50X2RpbWVuc2lvbnNfZGF0YSB7CiAgbWVhc3VyZW1lbnRfZGltZW5zaW9uOiBJTVBSRVNTSU9OX0RJTUVOU0lPTl9EVjNfQ1JFQVRJVkVfSUQKICBtZWFzdXJlbWVudF9kaW1lbnNpb25fdmFsdWUgewogICAgaW50NjRfdmFsdWU6IDQxNjIwNjI0NQogIH0KfQphcmNoZXR5cGVfaWQ6IDEyCmFyY2hldHlwZV9pZDogMTMKYXJjaGV0eXBlX2lkOiAxNAphcmNoZXR5cGVfaWQ6IDE1CmFkdmVydGlzZXJfY29udmVyc2lvbl9kb21haW5zOiAiaHR0cHM6Ly9yZWRpbnRlbGxpZ2VuY2UubmV0IgphZHZlcnRpc2VyX2NvbnZlcnNpb25fZG9tYWluczogImh0dHBzOi8vYWQtc3J2Lm5ldCIKYWR2ZXJ0aXNlcl9jb252ZXJzaW9uX2RvbWFpbnM6ICJodHRwczovL2tsaWNrLXdlbHQuZGUiCmltcHJlc3Npb25fZXZlbnRfcmVwb3J0aW5nX3dpbmRvd19kYXlzOiA0CmJyb3dzZXJfYXR0cmlidXRpb25fYXBpX3JlcXVlc3RfcHJvY2Vzc2luZ19iaXRzOiA3MzgxOTc1MDQK

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"aggregation_keys":{"12":"0xdcef201938bdf00c0000000000000000","13":"0x944de669759348fb0000000000000000","14":"0x4e7a6bb37d31b1150000000000000000","15":"0x629dc17643ccfaf10000000000000000"},"debug_key":"14842860647445513515","debug_reporting":true,"destination":"https://redintelligence.net","event_report_window":"345600","expiry":"2592000","filter_data":{"14":[],"8":["11868943"]},"priority":"0","source_event_id":"1015300086964479859"}
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: image/png
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1854208/76774665/ Frame AAB1 46 KB
12 KB 41ms
40ms Script
application/javascript 63.34.117.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1854208/76774665/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1014933263&ias_pubId=pub-6266313190087173&ias_chanId=1&ias_placementId=20808097378&bidurl=https://www.farfeshplus.online/FP66.asp&ias_dealId=&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0gJFAwKguqwihDmI5OoV4cH
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.34.117.188 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-63-34-117-188.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 2eab29598eedddbc8e87a9d3f256c76ec9ee293619988c553316acb2b563ab05

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame AAB1 111 KB
39 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 07:40:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79640
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 07:40:28 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame AAB1 11 KB
4 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bf0evek94tTBFZe74kEKBx_Uqq6DESEX3ZZ4PKS0qQAFSAZC4I2T6zsGUk_j75-FzNgRF7yNjrpDijHZbgjLfCYNgFKcApDzdm1LB-QzbCf9x5fOv5gYDkADcexrWiCdMyMtTs3zVFu91O9B73W6vHzwgMANBgzw8Gsejae8gGvBwAasc&dbm_d=AKAmf-BEQc0bMHOQ8cz6azIFQVPyyKp2SshQXYbE4DPO0UYmishRBVHdYwUIVnyElINncs1apq3N4lMljQWQzlPzuItXhsPnspOqGNRmCAFgf9JjD1fG8MmMMd2ebw4qyWtBfu-4X6JnOAHS7O1IYQW_nyx6G6826EnWy_ABMbVyjUaK5sDsxXo4RGVq_PQxoUHS-aQwOgyfhG6WlQT-GGiRGMkHI77i4mLjOkq7TMxJ9_ohLrMROVFlSIK7rXvzP5E3DnOPRJhso1oK2GbqcvzgbNr9b3jkBCIuM-qWISN9shk8WHFxJuzFkPUS49_w8NFL1DmK7OFmxC2QyHXcs2i5wFVkwQdlFjyMb9aLWjA00E-WRaPKWwqix52XDyfNOUrJ6nu1rdVetuxcjjVF3HWt_Nv3czmabC-TGTsGzQtpvBN_o4adzOxys76qnoHu_xjtgLZC0U-FLOJi1RmvUl2oDEHEAHEyMaBKVEfgDLMAxr7Dluo-oX4HlCCePQqvo36ZTF6zVGcwsF1D--dX13vyaCO0yxAfYYq5WCgg_9h73IaEpMnLlPrr8bYPdmxvwYm1Xjq90EH9zMrG6vfzdwLhNUvWWuz2Mqwm7_JOEFXgVJQ4Cd3WVr4SyfHl9M82-mEWFppCbgMzVC-PBNehZVqUHcpIGNcH33MbX_MQxnaAf9TKehRMqQFqXSKHn1RGeGdzL_D9rF_4j_mcDCXIBpqkPLmd-pv36l1UW06S4POTedHlfavMyowfpmHWUyGFx74NnXQvGL6mk8XUtj-u4L912H4I_5MpOY5AT6jifCMrO-y96yguKYorUfRWm27wVhgHh_R1S6iBqEPNHuW_jZd8Fd5vPPKAhETvWSK61hXyKJbfGP6p6VacFZ772SfdGL-zEx15dHBQlVR4uAARgMFsXUHL3mH82eNbcfZwtUkJpnx0l9SICKKlu_oJqvBO-3HPfbhxMBxVT5i4DxZHzQOL4VnsYVmf6lo3WybaZpucaxVsA8HHgej-m0ivCGJmv4dWs_b4c8qAQwgH0jFjuXwC-NzE5ya_6qVnPyY3kb8xrguBpb1-HiyYglyb-CM-bj_mSwWQuTKdGfLIkrsodLCZsTH9JTngBYHW7CHni1YdhHHGMWsHHGhyty59Idm5tMQWz1QjhwS5HVdiQSwtczxdCVbnw8P0CfkRIS7v7ylNUrZiIRaga4xE7Xu6GWXAp_WRF8qeb7qSBDuyAjHxhWJoZZh7JU39m-iTYAXQJPeE7wG3JIk_99tOhLZ4pn3_UKPLKFaKaVchgHJs78ZGGkNVusVQndgWbDeNIxDejZaqzBq6T4fCg57BaqtrfXP41Ou2aQzWBwzDSCjnS8JXQjCxK80KQY8Q-BtKaoMjt1Rkn05empdaHBrecD5QOp3LQwE8qVDVXBne85CYPLR80IxSQK0vCl-lCKza98RNblrxkkcEJJY7jp50sbo8KYsnIixe9PNa4-qlYWcOwoCTDtYBZK83h14bYJubiVLYO9ggTU440hhPUxASvimpcY06zl_w326andBviZIeZMuXCLafRdqH5gmOKD1c84CPwbnEE_4dApVdP-7E9IlSZi6PvE8eATeGRkxwduPtA3doO3NI6yfB4FCppDsoOhyjKGR1G1XrD5Vr42dbwj9S47ILbdkjo2R9OVN_EoOo2DZwr2m9leN16pY_EyWKpMpULmf5qUoQ_ORZf0wZPIRJRDainK5JSZzPzuJRBM5McU-IT1EZit5YUIQso0AnpExUY_y6PWh6kou5ijNVHu-wtqBxvNVy9rNnkf0TmO_ZTeZavhWhKyv72FXudp4SJwK_6SNOn4PhUTIpzop0uDVuEbpL5rzj2yHaz7OvLw__g15uDfKvMG-IRWnjdAym5baOO5NexHa3farISQbpnIq6e9PcupXT4vReswjODIhtwWQUpTnBSTGhkr2ZeSq7zkxbqNtGNK6NjkxysWCRijk_hIF35dEW68UA1rncr9xg05lpVyKNqQK3NYXMkgUqsRducaahLhva6qISG-93Rs7L-eHVT9NoWyVG0lJXP-9UWpdHQd9DmQu6RTWkIXYVKp_mIoeqmb-VGrcSrGUWa9PYnvHLyCxlJcvLwYqT1eaQiFTq3qJDK_oa3LdppJt4f1QxCHbGJvBfCyV3boHtb5ak-3NP0R7L8vXLayNBoHp5TV79INwuFK1hWENFy0vkbkduTlDrQFGIOdsuvXqUeqkK_7BldjTzNkaqcWQiJ2WZtaz2qcxBWJHLWQIDgifcCXg6aAx6ptqPYe_SLp9nEjocUhP4-bey3teJxzksVfqfDFx4vXjk-YJTvzwHSNjMdqkxyG0osuhQV7si7Jha8ScxQlYwjzyMzh602XZYDp2vKwd1mSRAq8fLFXntAogL02VvFIMWzmgQiw_w-i4u6HhfJZuXSM7-p7yLa7fGrZreP1WswQd2wnO8HVHiFOImhPwOw6B4mjdn9hSbD9d0drY6vOIMndfL01S3QmOzY3SIgIaiQ0s-S4qbb-nH_hB5P7oUCvrijxE6X25Jj1WHStu-5ekMI3Vqf2S3QK2cV02CxYWBKcQJuuK8_m2jp5xQ664OSrna8rHEJTJR1tagC_ZLMMthHrRzqajJemjkF6FtiKYxdY9F-wkYKX1GpsEWdT0f0E_rIj3JLGVngX6e8ARQb2JVzcwqep0dXLec6cW4dDaE2CKE8RZxEDZ9GvJXHtTFiriMY1tpNfFzqUckvkZ4sk-uoLQQKZ9jTtRM2c02iGp5crJ-B5y2phAOSSQKeV4y87vBIe96NNRJGj31dpN6G9J705P3O4ieds4iHri_RJihOpTKMxj9DUknorI0-SwaxQDS3R0-2CPaw8zVF1A5aoksOSH9sU-4WMZGh5y3NsqOnPnz1ug5sIOQs0j_rmzXzFRtleGc7Bph8R8sf5BGocDHSgr2dRT2qqqdDR3oimEuTaDT_BKxOC4HiCp5WtNUGShB0Wqvzw-tOo_5M3n6pf5dGoq103-b3WcTRf6k8r6xgwq22hsohyK5EdTnQLfe5xsnl5Gq53kCC-LZzM_jkbCm_1bpLUdxi87UgMSuiRQ5Gh13EJFN-NVZBVMWI8CFHBlnFzfht3es_EcSB8xURYl0O_v-VHfRXyPj6CZdpNIc4IFMzf1WGn8WdbEvQmpLm6i8NRAvzzUhC1lydqRJb9whA6kpDXHJZM2ELnoLjrouJ0S3mSdll0zb6PL7sY821-4gNz-RQML7A60ovzLWv5KGThqFI3uPqxT2O08yr2nqSEMZ6qhbwwNcCU4gdEitGR3JO7qv0Bat-4mckDejYSGjhXeO2M6A0bX0xFJYlhJbWcEjsALw7MjbIUuFTdrA82eSk2kzEQMFlvq5YMs_7_aPRzf3YMlMymaB5A-WdDazyk4QyzOj27wYaMyVwRmSdkfHj_HQKGVQ_wTEkP0y7jNkRkywxTAlFyiHB5CQeIdmjmrEq17jbcvUQvEVAhJiV-QRsKV_szWYpRlz_BTXbApSIWpzYC2v4w7K2Cgwf6FwFvZdWV7KU-XZw21rqr3IIhajG8UYZyTgknrvDQ9pzIWLVdbENR2CmNr-YS2TJw5WRmCTxWyGPZxsev8pTDjPRfu7pYC53HIJbKb8m9mVOfTfUU8bbG2r0AT6kAdwaiORP2DiggRpvqKAlZZ17D8a367_OCFCtr3Rto6q0X6D8zI8IfPWQPtTGZMtdRViJeYoTEVIEddWxMr3qXOD9lQTI1S4u0U7oKLWOPCXQQQsPNC6MifoBfGFTJnTn8Dpd0NnT-RbbcFsCUbJfbhmSMc1TMRMOhiZ4bnEODNQDj7YBV83stiTzg9XU-w4y_8yumiQ_8Lw1zsw6yz4Z8lOqYcg0mYjLTn76B-gr3CvWVB-gmXDGH4A_CQ20ErXr3_V7I46NTIXnozg93d_IlkHFKiRLfpgcsKBQONBybLexWn0y6B1hK8DNolw5qkFVuKVoH2SXBMm-AyOpmg8QUsyFLrEyvBWttYzew66Wu42i-XFYJYct9Du9zHVW-DOQt0r6DyCqRqP_LvxHcLGfRGMSLhO9sChZ1hQyW-EMv0fTtfgIEKi666pOLDx5sLJT-rrJFRVAOyYkuv82sj2cGwpa9yKEsiuNgF8q4kDrdJrU1aUN5iqwj-4VcXYu9iT&cid=CAQSTwDICaaNWPTS8UtjV7cWPVLX7YW6NGS1DxqcgBKo72z7KfkrjJ8YoVB_-RTKVsaEVlIvDPwMz19drAfSXZcstIPeY9sVNOhq3qf3LuKrIycYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=15891318497451885000&adk=2086295851&idt=114&cac=0&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48626
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:22 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame AAB1 31 KB
12 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

610d24f5996131b3ab98f18e05441cc246aa8674c3842df0df2b40b57ac9fd0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48626
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11874
x-xss-protection: 0
server: cafe
etag: 3876053170955424897
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:22 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame AAB1 41 KB
14 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 307826
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 16:17:22 GMT

GET
H/1.1 200
OK request.php Show response
hal90004.redintelligence.net/ Frame 419D 2 KB
1 KB 127ms
82ms Script
application/x-javascript 138.201.63.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90004.redintelligence.net/request.php?zone=kjmi9fqzw10q&nw=20&renderingType=javascript&namespace=9c4327427d&subid=&uid=f72b82034090e059&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCD5o5g9BmZYDBHqSZn88P4Z6VyAzr0sGhad3z3vTFD_AuEAEg7L-QEWCVoqaCsAfIAQmpAu9_vvbrerI-qAMByAObBKoEsQJP0MmVrQdlApGesqIR1PVJp_8PqB95rsLOMLU3OeEwQQmO7g_UtV5rL1GQRMYA2kV5shISdMuNTtNU1eEmgmgPpKquGSDbvTewuOQeBMvyScG7bFvq_NuTAPvKyxc_ihEJ1wO73QsFCPPDE0BoborkrQm7hpJa6jFdxBc27AkqjQ539B7IsvZDV07Ju8LkxrG8L1ptwguX4wILXF_TC6miIMii7TkYhZCNSXpIb6x6h7mvAHlUyVOIjOdKM_aAMjzRmsGqz9m4hASjSvQKFFFl1NFaEeDYnvJyFUteI0yN9B3JyccIBUyUSd-o1guUq0x_vo1e52zFiVQ7gpoJKYM0Yo9vnJ8ouieMv-BfJNdLu1TGC1FHNPEGyflJYB_GEEzhmRXoVFtJvVPRtpCMTCR7tcAEvo7q5PkD4AQDiAW91IqIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgfMgKqAjoCgEBIvf3BOliC3aWZweiCA4AKAZgLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJERbATh--xFdATANgTA4gUAtgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNzGwRpEKSPaJhad8pIKp1BKb9gwOTGT4GSae_kc92uq5sOMzFvft7lc_3X4ZhUymjzAZ2UX00G0EUN-i6uBLJllbOz42Jdb_DU6YYAQ%26sig%3DAOD64_1G8xh_QY5YE1-uFo6ND-ucNLXnSg%26client%3Dca-pub-1231661633440980%26dbm_c%3DAKAmf-CSpnyx4NnDcrnjk_XlvNe25PJ-BUFLmu9GI3wgA29oyhL86w8g3VggEFcbuQsrFpyA_sapODd8DZ3B8PfC3ITx3yv6v2FqTxhpc8Rm3nDoP1dwCUmcMiWcYjlkpq3w7WVxIgIMY--kDrAUI2bilvCFpWyjjbPxx3jNujug9QeeYHUTS4g%26cry%3D1%26dbm_d%3DAKAmf-DeDLLq0Sl_hGmkYpUcJ2FPGjYQ-_H85XNjYd9-6Oi5BdcfT3tYN8Rc02PJrqewF1DAir606ucY7XQJ7r8K1v3lJexH1J4uryRJPYk7D5do78kmxE8d-3ZhqQdMjdvPfBl1ZQ_0NU5eOlcw03b_MWt4kmHgcfqlkf79hN55sbZb-VDH94zH1VgWBh-cKlED5L0HZIf7jNHuJ9aDJ5uZ_hqab1cLYqxZBWfUU3sdAeUX1UaLOfo2UhaEdZLb5sxtNuGu-EMtJmqW-IPMEiUcxPEsFE4039IIV5c76cnGuLO6hCAD4DV91yLf8jxEXapIm5UyvBglbmNJuXxvCuYnWYFj5EUu1K3mX_4gsMMxPoBWpJyzI_UyfKdhU21J6p8Lg0MITpI_aiPqGxa4DRtutmdDKXesysb-qzcC_t0pptAb_mQArGdciPfgjk4tMeSdPTW6zxBQO2JZGmVNvhS9A5pQLVsWP62i6il4VW4JfDTIgGPrgFT5xmDgr8JB9A2rYPE42kvmoLsNJ9iZqkZ0t4Vu0Q8D-aTnsy8Bj2eEguSi146dqa_X6d-YPC8tyglSF9kYSdbo%26adurl%3D&documentReferer=https%3A%2F%2Fwww.farfeshplus.online%2F&ancestorOrigins=https%3A%2F%2Fwww.farfeshplus.online&random=7572262290643&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/kjmi9fqzw10q?subid=&gdpr=&gdpr_consent=&rnd=1701236867499840&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCD5o5g9BmZYDBHqSZn88P4Z6VyAzr0sGhad3z3vTFD_AuEAEg7L-QEWCVoqaCsAfIAQmpAu9_vvbrerI-qAMByAObBKoEsQJP0MmVrQdlApGesqIR1PVJp_8PqB95rsLOMLU3OeEwQQmO7g_UtV5rL1GQRMYA2kV5shISdMuNTtNU1eEmgmgPpKquGSDbvTewuOQeBMvyScG7bFvq_NuTAPvKyxc_ihEJ1wO73QsFCPPDE0BoborkrQm7hpJa6jFdxBc27AkqjQ539B7IsvZDV07Ju8LkxrG8L1ptwguX4wILXF_TC6miIMii7TkYhZCNSXpIb6x6h7mvAHlUyVOIjOdKM_aAMjzRmsGqz9m4hASjSvQKFFFl1NFaEeDYnvJyFUteI0yN9B3JyccIBUyUSd-o1guUq0x_vo1e52zFiVQ7gpoJKYM0Yo9vnJ8ouieMv-BfJNdLu1TGC1FHNPEGyflJYB_GEEzhmRXoVFtJvVPRtpCMTCR7tcAEvo7q5PkD4AQDiAW91IqIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgfMgKqAjoCgEBIvf3BOliC3aWZweiCA4AKAZgLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJERbATh--xFdATANgTA4gUAtgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNzGwRpEKSPaJhad8pIKp1BKb9gwOTGT4GSae_kc92uq5sOMzFvft7lc_3X4ZhUymjzAZ2UX00G0EUN-i6uBLJllbOz42Jdb_DU6YYAQ%26sig%3DAOD64_1G8xh_QY5YE1-uFo6ND-ucNLXnSg%26client%3Dca-pub-1231661633440980%26dbm_c%3DAKAmf-CSpnyx4NnDcrnjk_XlvNe25PJ-BUFLmu9GI3wgA29oyhL86w8g3VggEFcbuQsrFpyA_sapODd8DZ3B8PfC3ITx3yv6v2FqTxhpc8Rm3nDoP1dwCUmcMiWcYjlkpq3w7WVxIgIMY--kDrAUI2bilvCFpWyjjbPxx3jNujug9QeeYHUTS4g%26cry%3D1%26dbm_d%3DAKAmf-DeDLLq0Sl_hGmkYpUcJ2FPGjYQ-_H85XNjYd9-6Oi5BdcfT3tYN8Rc02PJrqewF1DAir606ucY7XQJ7r8K1v3lJexH1J4uryRJPYk7D5do78kmxE8d-3ZhqQdMjdvPfBl1ZQ_0NU5eOlcw03b_MWt4kmHgcfqlkf79hN55sbZb-VDH94zH1VgWBh-cKlED5L0HZIf7jNHuJ9aDJ5uZ_hqab1cLYqxZBWfUU3sdAeUX1UaLOfo2UhaEdZLb5sxtNuGu-EMtJmqW-IPMEiUcxPEsFE4039IIV5c76cnGuLO6hCAD4DV91yLf8jxEXapIm5UyvBglbmNJuXxvCuYnWYFj5EUu1K3mX_4gsMMxPoBWpJyzI_UyfKdhU21J6p8Lg0MITpI_aiPqGxa4DRtutmdDKXesysb-qzcC_t0pptAb_mQArGdciPfgjk4tMeSdPTW6zxBQO2JZGmVNvhS9A5pQLVsWP62i6il4VW4JfDTIgGPrgFT5xmDgr8JB9A2rYPE42kvmoLsNJ9iZqkZ0t4Vu0Q8D-aTnsy8Bj2eEguSi146dqa_X6d-YPC8tyglSF9kYSdbo%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.116 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: afb1b3065c946207bf3f48670eda7bbdb1ac39a7619d0d47125877c6eeff12dc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 29 Nov 2023 05:47:48 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 91751600011821804444546012523004
Connection: close
Content-Length: 839
Expires: Wed, 29 Nov 2023 05:47:48 +0100

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3FD1 0
20 B 53ms
52ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6830518573591&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3FD1 0
20 B 53ms
51ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6830518573591&version=m202309260101&ct=76&x=1&cor=5654054392329633000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 3FD1 103 KB
40 KB 74ms
72ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BwUDvW04ao9BJPwKgPB89MBFOh2C0vfTNVvQ90gKVhTg6wrBUTiSgM8zy1yExyRQVTquN6pea7iKR4naQeM3wcif2k9gDd539EtriFSsrs28zIQGxNhe88SqiJgBMgBhbTgUUlrFoCu3y3MEStRRefI98JKzvfFFrZ7R5qHOviSbYIV2k&dbm_d=AKAmf-DWQA1_h2t0Sk2aWCyRNachUAIILpRgNA0-jk0tQZ3hK9avP-3eDcIt5Pu7HNVN_g_QcJqVbjO7C2FPClBMydXdvu6ihWXQN2-GqZvjOGkjfIsjCtTflWcV_FQlxgMXX7_OE8rxNycBpewfnZM6atLHI9rcLDDHAweH_HXjk-dMBVgPy5knFc0APE-PRfDikCa2rz0nlTFy2GvW3-MedTgB3u6oiQgY7cn8zgoBNnt7l6EAN7AuUdBbtfryi79rsuE0oxs9oTkmGiJlVYC0vB8wTlft7DY9rTB6QjU4BJkTP1kfLZaAUFFxgB-XPaxeBP9xlCIhx9idI2kMzWG4d-kAOxoGq8udSs-nNGUmgYMxfoixAikyZUhjyZCFBPC4-vX7XsPo0ybyWY2YlcYg6VhjswUK2ID_6-eie5Fd5Vo7uZajbA6GVjBQeycq7Kj_is7o41GpLceOpZBOgxuB8OaUV5KwnPhyF699_Kbkw7POGF9jcgCGJFSS6eF8DZqnZP2Mu93VCAPyNCRVAw3gyG9AtA7o6707pFfDVlrnuigifmGW4xvJdG_LH2WoW_pL-4DJanDlU-RRfGevi4gpWo_T3fqhRtItC4jr_3ezebrlTLfpoAHTKnLQf0rrUQeIVUhjcUqmJddolK3gSolwmUEGbJ1QITgJda5-uu9x6QcC26JEgTkNQLrv79xL6TOUR_iN0tE0NOnGY0Y5QTsyRYwDVmj8hj_utpJbN1gTOJ7jftgJ1V_dBI5d7nJhx4E4SwUZW04GfnTyfZNNP4CnFeKr8bsrHIYUM7TSEGxDa6fUuXw_FL3DRGNaXmv9woThwhlqMy2Vrr3nuOmTyf3gvmmtbHYJpJ890FdNzodHr248zIr_i-FNKfibW033zPF8-FZxXRuRdivrcFJPXOA9rsL2PJWBuZdjeL3cdeQUwhoh-EAyUk4SErH8twv6QM2AwcXWZJtD2PiamiaLrQzEiz9arZn5XIYXJp2urWllwYUMIAIs3TVsBYUcbRjaC0Rn06RHjYtpnXkVolYn6P5WtaA1We6vuqVn35E5v5sMptBf5PkqqIQjn4_Vk5vZ39etvFo_N2psd4MFfWOYIOcoXsbhI1YaTNGFb2gN9NP0b509tBcPTOARz10RM1UTvOQvCk4v4bcQa_KpeZRm-Kc6XEMROJtuybKkMFXpTLgfMiy0l8RlE4LjpoYU1qTKHOviVD0abNKh5ObLPp6vLHMntflWZuMYQgQ3sXuYx1SQLRXN9pVKDxX2HIe-9OcoQtxoDP03jLzUGNK9ObjeKu0jf4RgP55upWE5PnUv8Vr6aH4HR558h655zS0GZoz6n0w7fDlOZSyRL0v2cCb86PqdQIqhZbQu_mWZVhri36YwNgllQjFr33fyx6YTMHE3uhm_NfCw6vnoR16ReTvUk-T0nIYMbC6VnN13CvrFDPNXuffTmwTEWr7LpjO65O7jS0R1FaoeBrn_cXis7S7aV_rGR7qXbWdE5RwlprYgkMgK_LkenQrGj8zJpsrXbE1jQUm6RCl-1DxQ9n4da2BryhLZgWE6fCQMFS-aTWlUKQOGLtzFkZ1ezzqlx0Ojx3OGWqQS2q2boyK9X6cK4PsLp48ieajA7P7NKfcrQxrsqDvxjfgjjzhTlLdViKzFedENgs5YfF_BSUx0NEF4Qd8rVxpxCajJXCX4JmBw4NGp2C5fGXQeBflIbDxYRz9NxbxxbKHyJMToxJxYhT4X0MfXLYUxAULPfdUtNlXyGiWzRG8lK14er5vyzz8DREWpuzq3XqjJPnxubd7neupHtNOW1mu4wlMyh1J0oJJN1N2spsyTNkgKvUkSxpyEt0-7l5W-0BCv1_EXg_hCfe-Fdgm2gFF0M_j1AtVR2asDtnndpZOtPvIx9yrTxE9dixgS2yhVDIlIgXXlwrybVwaZJ2OgY0AzMe7LWrEfIb1MVqLnU7SaqVoWKPA8VRZMZ8GZStoL39R_wgjgZ09b2-ihk9ZkBLW3kf48pDmFCXP2aoBWUEdiPLNddWGOeWp9FUnJK8--IQGOrE6pgHU9dX_JoeTvnwnwbI41McCRGAojgyVNgvk5MZ_j2Er7LTLPJEfC1KLkt2T8m6p0gqVnYoQyQ_5RcN9uBs6Ph0zNbVNMCxhExTZnVjT80qdywjZmThcQvaNVJ_YiVA_nZkA6_fL0yKs8d5fXLLOVpYHZwkMZDHD5_kEVHisOISSYH1613kmAkfx710B86A4lnHUL41nPSfR1qynRpQo9GGcmwTJ1N4o210GF2UE8CucOZBe1XxsZ-miC2Jqn0MQLUReuH24W14FIDlxCykkc8FgyXDLbiHAL1wivBD6wGWR9pYcotW95p5XdtPed1VlHx46zHj3NuWCA5kOtceHWD_oXhXCDXgekWGOOJlCkJLIN8dw38ikWPbmf2kcIS61_ppDsD9QnZfZc9vWpPIGJJcdATxOlA2aFIznyPBEd3Wx2fTE9UVgb35tHTLsHi_lQttPeBoE7_PEuiZj0E0mwxniu02UDmcaicB0PswfPwFqr1vp11hKFM1NEAi43joFG0hK9pka-jElWlDcWtp7taUIQFNv-5Jb1xGV6E9zE5Xzh3cwYE6v4IEkILt3cRtlCmd1uceTBa6s3T49cFQ4KJbtiXUWRXn1tSqMn7rDnJoxgap8HNOLJjFqhj0CB063qxP_KcEC6B-OuR1b8cehYwMfmLT0BDquL9KrPI_igD_nu22vsjp_sUbmVxNrMqeV0GUKsg8E9jZBeFfE6HeBYp5gw8BYQ1esj2I1lIec9_Tp2UMfgyIVpnLiW8WofM3FTMvIiSPTBwzGUfXpw01_Ant4x3m5Zs8YekS6H_Am6_-LnzfmMv8NgcKXF6eAmxUoDSjvXeC3iMJtd4_C5LhlfzJ9kJUbonnXyrCt8Wt8hVQLGfNDsxAnoCloSffk7L1o9DUM53h2WyxqD3M42z7kqZfjDZlRhLWMZrw7eyh6mW-dpYlK1zVKxMQ5qrlqaPQmfOoG6Ynwupu3FYrLIEAQz0YXfMPah37qWpZ7wNGvdcfDYj32N1n1-WUevtu69PpDLv6eLLPDcs1z71iqCdyAqmCg--OSoS-PF4ZP9HpMkSVHUxIIWCVXrnJbeaIOqwKlvkVkxI1cT55niRAzvoooIJd1r8PC2hlDdgHYT2hpws1xL8hWg-IOebYubTcm8sDSFIXACuB2nU3EoM88jqd_PPB0l4A0U34n_nlzN-ioUfPrcj7ZpvHDS2B9zzrL4zADVPA1unbMGzuYYKHfaYLlUJOM55MyucBJSh8xon3CXUV4XW50uz4N4ay7V5Mo1wYGXCJw9ZHOt7Q97ZFk4rn4YGThEuK-jeCksM2iRtWVQkhtssyHfJwI67Btak4uhNkKMobrJ0sGuqF8kouiGOFo-ItwM940ddPvaxZ8WI0llpO1dv36RPvbZby7h2MCNGV0_NO5PyUjueriot47W1H73o3Asz7pC5BlsGGJdaGdgh_cXGHq2QW8cb522S-RqEYiFOKX9OjV7RCyU3KxenwVmQe7AiDM6J9M85P8I5G6FuKDjoCXRtFEEdTIb-mDoH8tISmbXtlE_f_wOrFSbcQxuBard2n2UrdRcqcJBlHcrMWDT2L4xOZnWYW_dHKxQOu0oG2iVzYivOpqicTW6zd6HNd2LCWI6lsXcXWbBReEhIiwe6B0US1AlnSuEO_JY9mmIQjqh65o2Xtardk6z_JW1fMZsj2MKu8upBZOU-WmrsqnMnJu6Jb1XQX70dpJY4wProBf4TeyLYJDicOhc2duc8PgD0Qtzd_BI64ybrsGqgJsktKobChwEOMCf4PWFlqllUB8Q1fC4MQvJm_OCY8dKloU2QvtXSx-toHzRFfEsbbS5j9AyGC6pcq27U6d_RUq7g08SY3zp_ceK2WB3B61-CRZjsyzVa_JZpGgqaNm9i9_EPMxCnEAJgigwnAa6J3nhO_nKXazWx3ZFu7cCX8g8TcnKiFw5RAQxxlKTOwMvtWBMsggHloP1XfqjXnJ3Am5QW7H1mEehCIIllwVGrVIym5l9-LDUg10XKD1KL7L1idUACXTMXFo9Jdclm9BkZyTPEob-u3UpMicBxMzjurhLUkXZkE41R1cZrOu-l3ukq2uR4-A7wSRwQNPRw4X4lu2uoKrE-R3h8q6QmgH3wKkDRuOHgL_r-QM8NmnivSzyOlNsCLu2r2wk4bbYgNqZX0pKhp5FFKjQmi7AgR6d2GaUJmIlNw&cid=CAQSOwDICaaN4zafh785hupinmtYT29XCHuiTgW9gkra2SE3XY30lK_OKyJ1-wnNNlIgHBDs537C0N5L6OhOGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=5654054392329633000&adk=792902355&idt=98&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b8e88bf4b815333521516dbd36c0d92005089bb42fa64a954854ba7b1521d925

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40710
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 2595 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 90b145501e480d10a6fa1372bc7d2317eb029a92334b8e48a6601dcf00bf3235

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK okg862ss9p0j Show response
hal9000.redintelligence.net/zone/ Frame 4336 12 KB
4 KB 39ms
14ms Script
text/html 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/okg862ss9p0j?subid=&gdpr=&gdpr_consent=&rnd=1701236867504300&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC6Upeg9BmZezjHquJ5LcPx6udgAzr0sGhaZ3x3vTFD_AuEAEgrYmDJmCVoqaCsAfIAQmpAm7843OJd7I-qAMByAObBKoEqwJP0I5oVuLM5N5ZJtlfQy7XaY7u3uIhgdMNyMSnIRaTr_2S-4Zaui_fOCxaY-22qKS2tQdnB6SmJT5F8kYVY5JXW3EnrbenAFVIgyAOp65ebgtOb9joxWpRnlYErwME9lVg2ijBao99XCX9mBvKEStNzOdNA1K0YxXm6xgWn6uvRorLbMQgD8bVElyl9QLBveuvvqQ-AVr907-0sSJFmPOmb5JPMpdCVM5QqCcEz-DeOEsBMGOARkAv7XFpvyv1ESGX1gSb3rPpqbhqMpYeuvHCj4uLR99YcFwbVexAKOxkuoVdt1H-Gj4Zy6eSxmIV2kYUvq01-g4bx80fbLr6h_tySUfvtDDJnDVAcnRd_5UG8AKw68wA23CWDFJFzT_JHQoaVwOJYyARqR0YD8AEvo7q5PkD4AQDiAW91IqIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgfMgKqAjoCgEBIvf3BOlj47qWZweiCA4AKAZgLAcgLAYAMAaIMGCoWChTktLEC7rWxArW4sQLktLEC7rWxAqoNAkRFsBOH77EV0BMA2BMDiBQC2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNBqtFjf9o_aiGpclcqcl6_-Gb7HYQeyMVZ4YI36Ls14oCe2toDLsFFqdrWeVAcYp70Ckc6_L1FNV-WZRIz08u69DHDZjr8z83ZhgB%26sig%3DAOD64_3pRUVJtP2W3B2X0aPFZbH6FciU-g%26client%3Dca-pub-6266313190087173%26dbm_c%3DAKAmf-Dm3DofRcrnyM-ebdbNELqEShHotGdZLs5WyygOvgWkAAPZBhlb55TQ5iR2XpfT3JPBplD-4TGB5sH4i73B4mgY_qWgeqobYStECC5Yb1DLN0Ejwp4cJ94zPGkYKVTGvjKkFd8cV8SryeC5IRfb1lw1flo89z0i4qkZ44CehVyt5PMENiU%26cry%3D1%26dbm_d%3DAKAmf-AhS0wC7lIlT1PmbvXmrZ13LEvg1p--cmMLj2luN098xHuFdBJfUqlSGVYC1z7bOv9wSX-tUrlQ5jVVI9GJvHDeCzMTLKtcp84QUxIaIuUX1IDlXqSJ4RvokPOWs8PffzndMl1UFJecWANq48iKpsXbqFCO3Ym2yu4GXPThPWs74OQ5aAusfcXZo8XaQooM1zz1NkSGs-jr0VaK0LtQ3w8QwM4zB-il6XGNV-wr5IXCcAIosbaxP1Q7Zk1_dBdHS2hqBhnpJv9-8fLgipAMSAq9470QabX6VKTTRwi7aoXF4k79c1xchgcQIKO0oI4bNXeN_ZYKMEfLr02EDXXWSbc1UeAIOh4KVbe8K7x7iDK6SLjqF27frsBB2unO6CYMjV9xP1GUiuuBWPcsRuVmUMrH9kKb_mtJV_JWVNBKEiFZZK2EsJde8NO9yrU6KnZp8u8C4mxa6x-U53Sx-O1a9xtmxGT45fBiyRX3xo47zNxDYfF-caPvcHotjowTzYAdKz_XlRBDRr37gNvUBl-yMj5Asdx13gBVfHiDrgKvU0D4rhAM_DQi7CgDVSsMPp9RhRgi1Wvn%26adurl%3D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=250&slotname=2097210043&adk=239546933&adf=744370384&pi=t.ma~as.2097210043&w=300&lmt=1701236867&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867134&bpp=1&bdt=598&idt=1&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=574&ady=3880&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CleEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=12&uci=a!c&btvi=4&fsb=1&dtd=3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 59ae1ae9c020c0412fef0a4b080dc2c25c7842dc5952c9a18dfdcb8aa5206bf6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4258
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ Frame AAB1 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 630bc54d5764db55d8de22191801b26b94cc561a99e5e1eb116bf639a61252b8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9CEC 0
20 B 48ms
48ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=5635424550005&version=m202311060101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9CEC 0
20 B 46ms
46ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=5635424550005&version=m202311060101&ct=76&x=1&cor=1058475413627300600

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9CEC 111 KB
42 KB 71ms
70ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CS8obkcmyUPTfvQY9mFBBZQY6jZXyiNgTyTyaxw7murwyC5c66LGwDRZXog72Hm-UtrIo90547IsRKQMjm-mMft_lMgxABw6jhgah6BFTHj0I1WNbxFDaREZEIMpVZGCE9YOv0xxNYn1oo1pbgY3sXM4Wdz3cHTHJWxtKFsi9W1BpOE18&dbm_d=AKAmf-C2cZ6esuS9a_IYEY4jRTx5cpiTb21C1bjddyTxa919e3qwN1F3udtDs-yRlTBje4X9QnlsBC_Htd2yKqZcNWIUMzWMoqxtB1MT00XH_0g9no0QWePCyxV9bkWRJ4-2TywA-gTKN8MX9EWq7EYzKfA663Ml1GlORxsigTMjTXak1Eah73WsL-JY-3ZhU61wFsvVmPe3JVVWzt47vFBb8sX0jcAXDTr0wuC9ootN52c1o4TrcpPoVzJLegboq79dxJucLG3FG5G9F_zrkQvEsg0RGBWVzg_y5h2by5-F84ZLcEf1XSu8grSx5bnxh7k9dLHnO1WsywXXa24UnLgD_yduh5Fwqqpp3_goTtbRuGpa-fv_nfvN0Wpby7C8twzoXiMRiXBOTMbYGy9gcA1oKRpxzEYjYclOZSWXUEi9U1Ab6jDBBMm9AvSOAFWNhpuYRhRNnabvxOKPi_Oyiy-1xrOV45O_EUmKz9298rGhyZTYPTBsMIghnWGBzM4Khk6qQNOLGHyZxCG2S66h3Lin1kkaWSroqA2IRL7WMZPhwGf588SlyP1GVKcPaIZ3paw7P5dLzkHsQmeGG40d6_SoJFgyfPBySDNVaOdi9oOdAr_9Eet1TBIzDsI92VFveQhSMAaV932n9ek7YZEJaur8rXF7AWyFHTtuFAF1gGRagTHWIffTs_Iw8IhyVA_02gMUIB_fIcQxm9HG4YXE-Y3SACmz7BGi6rhvjL3md5uN_oj4mgz4tMOGKkewGPPikGiw8tWrouVniRMFDVcIAJiyUfu9Tr49UMmK008p1RNSEV61oTH6DG6yHA65SRui4UdHLdHhWsZW8lFo9mldfxCwrY_RAAI62WvD9j71ZY6oWRYHKUPmdC3sLQsS1J65qIx8k4NXA30amxHPO_XSXsvDwTUDo31LqOxuElPDnH4hwcQ8EAryj_iSuYtk2OCv8uD35prgCSXpsln5qacJofq8DJYoH7J2pxm69npyh_xm7JmIteJUXx5JNWg7k7ToDgE589XqSmTaQlWWwNGE0qPM3dhUM2_XQ5uxkCAAefgHV0FxvnDXySrqLtZ7hE2tpylDYH-lmLfpC62GSVMuLL1_ga5mgxQ7g95NkU_Q-7fxRYQ2TgHBe7SV-Lh9H3neNsGa7QSO3zLQ1vuH39DTHU2WTK_yOknEhPMNeTqnCnv8Ssg7GgVHNcQXR-XvG4ziJwJLElKq955Iu3uqRC-BZ60trXMol93rpjHcDdJkLdOWisMXpgcEE-S9SSWEIPyU3Rn6ATxBg8qUbgWXcL50_AT8toSqVaW-DWIYAJeSvG40mAKbHcbKrI5aCOluuQN9D4ITG_KDi1o7fqxkIm8edx57jXfuEbJGPfGo30KAfK-7iMqo9IannMbnJwLW-5zkewPXHcDNgoCJJ-62XIiQJdzc94lIb5WfgdQoN0mK93sQl-DHpVFvOVBp3TZjOO-ADVMPd2EdO1ggsyCAYyxXU5GAqcGbYh6cO1f-cHMyHRPq467-Jhm3SJufJ05a4mPlpAugfvK6GFQ9Jj5G4DvQyt0GIN6100ZhEM-SkQzJjuY7T9AML-r2MMbOdwcvjQaOoeC8lFFcU5NpOfOhrcMcQSDRr4jF659EfEyp4Zh8O-iNhQ3goKisCNIJauQyC5rRO_Pmf0RC8L2fEtuobY8HOjCFnY-96FaP6h_scEbMqv_4SVvbq-Wigsog6XH8R28siqpnpaaUKkiCEx6ly2XRnt4F93N1w8vAq9ckfvMXDAN0dV-UFZCCnkS38BL4UeUHFNZwVxR7O2ALq5bvBasrRrM9bLAC-xKo3Jq5jbfy9tKbx_oenSmiPcr4tag8p2KYAQRDPX-6H54hTWeRfi3VJxYQYX8UuiVMIvqv08vnSdoqoJZy7s53zjDkrbrRHX-h7H44NU96NXrpSCY7Piuuy6Nt_GrKrYoW6Hy4SAw9L4Fq5Cf4pV-rrvqf2Q767F3jxekH3gx1rEURvm3Z4k82zjil6VYHl5YGy4OlaWjim018vaTJPmuPUZZgeSJhV9NNQRluHHvEWekoOyALRuEOxkotlyodOhiUfG5iSMWQxrteECQBgkcg8RAHJXdeJPMDr46BI2uDcWS82KKe44Vfq1IgQgtVoXmgdZPjWTnsFQNQBgSWjvEpi8EqPwDVlLOkecpK5n9l0hitOCLFWZPTPdR7O8LfmJYhCGI7i6dDNIKkiDcLAg2XJF-peCb9QLtbJPxhOjsetueaq8fmlJnPr3dDAHiLpkaVf7P9Bdm_0kvuXiAah9EZ9Qi952RBAnNbLuKwvtjDD9Nb7gkE78GKVBQlCfS1L19Cskz2wtj7rT6KdRRB4AvkpjwNXsMyUmTELI5Xlr_QeMT16G3MSP6Fw8qfWcdI7-y1IBnWh4Q3n0M5wt8uqI8_IL9pI7G50TAajeh0AttglQ2OKN3ChwT_HJ2wDsfkD0I_yTVx36PHZMO9_z0Pn315V5bUCmCIJjZ0E7ZuVJcYdg8dRGDwqaeU1HdGrlOTVYewl1f-XToAWaohFn8_utD0rp3I8s-YgQPOsYm8DFmvbkr2LMBf1JuZoBCS8kR57yAHFk-jJdQ0oE7Hx_jYoXV8HRkST1qv8gHcKiUHPTRpGeApzN9_dZi_KjpQYDovSCfDIGDdGE0ON8WUq0RnnNX_Z6j9B_JRxYp0SYvcr9D0p5xuECXVu6kkhcZywtOGVZNLT0sM-4lLBlwwAU0sAHmtyOk6YFI7TrPrelp3pF82tCy9pDC4NTapP6V5fMUwXUL6CG1G5fcYWObg_bMJrWuMrw7ESmMpTN5AWBA3Yp5Y8M7rgNbUDOqa8fR3fODSQD2ooyoO_649q__49fQJ2DDX_RRWQU-ntyvbG5jZvthcf7OR_d8FlsOU5puafUnsDjP2ILIaFSEZwnlUHa-JT9MAcKoMEN5R0vgmT4IHIQz2m1AjdolpyBvow2XXSoqNvISoyyZyDwqcWeCNqSYGtRGaKQ65wPOxNUpBCPp_C7bxcCa6FYbKj9kAYYwlQC5z-HOJK2BCvq8z2JANdRuwP2EMauxBvhHnGqf61kNjy9b9lerBHk7Y5TdIJio9NFgdW5JA5OEHCgyA0Qab7uC6bUKinCrDYgLnAoHbytsp5v4oTiuKAg1na2Da1-xTJXdUSZwSRVhI4Cnwb2U0OqbOJ8cKmTQKTJr4jgg1H3iAejk81-3lcM72FIxz390sYD8knzAEzI9Q47xuJK6BSN9skKj8YqwsrO3CdOAj23Wu_pz_W5NCj8O9e4J15RElfh7w0Ri-OhNbIwECrL_xw7Eni9TkRn7p5gZkEcGXyoD0DCLPKqxp5uJ6GHGe1pNG7z24obzJyNlaWmgmiLF9nhbXrHJzBnDH_6ow2i-jqSNaB2Gi-YEtSc4bmFcbQObBpr1CbUi_8XHvxYcQSp5c_ojNHFTTJKuXmK0TueuSyGIJ7PbJMK7VjLv8v_bSwAJZiRXrP4eX081P8lJp329gF0wpg5_Qg-vzeoxrtB5if0Wqha1SW9O-vb5IFHhp-mnO278Qk8--uDUqwyyHqYGdGZmFJrnZpsiVenmzSocWDE3aGcI09THBvltU5klZUb2e9YQky_m9G2VViH3uGay0Iw8zFIjHo7v_gWTaK9M78sMwsfKD-m4P1z7HQ85VpHg60QufaOFeP_4tW6Dtu4mxvDRuI_sMtUesLO7fBjfY61xXj-DDEDhnvnmZHpRcBKK-no235_ZBjGtk1fbhkA4ant2EiPYjlsKgkqeUDMIKo24zSTMrvZURuHZpeH2QasqbtXT4q264ljdn5PLG9SPXbxNzh--o34cY_sbyN0ohH1XY3WgzH1HP23e6WmqAj9bwO85KJ3Yavzu6E-uKjK_5ud8--BtD5Nf4sDJaVcKSqYUUD40KTbqeHsvu2Ro1xTnPzHrtLXhv8eduUcZx6KDmf5I7IqQ-XTRfcCLFA_DgAMu27lrDyrvbNegocEj0GVyjqlhP7HjZGE9ySZvO0pk_aNPLfKx-11WZSC_VKBTzxSS05gwB1bUjJag_XM8lCbwY6uebptpdaUu5_a51sG2jK5na5_zKsqt-IMKdFl1WBZ2IHRYM0tBpy2oOZWJ6mxXH6sPVoPzMpBE0L18b0b1fz3Oh7SQpv2eN6zFR9vR2SjxjwDVr1S-3L9amcqIHNUZe8WSMqstbrGEULCW0-rVun8w1YOhI49LTvDY9jY7IlcIqF67hlzpRTxnGULJ12auvGY3tp1j0HHaMqVkeYToSnELLllJkcjGDzsnnb-3URKSoQiY-oqpJFOt7s_mPNSvt3tfoWLH24rC7NoQphp7jEvEr7kJ-utem0c6sczf7CLrx0pdXY3Ey&cid=CAQSPADICaaNxBmaA6FrJ3mbz3xDGp2PTRiPMDx5Jh_Qf6lnz9b7V02RJhhJrq4YfemoS9ACPNx5dbn07vluXRgB&dc_eid=31079496&dv3_ver=m202311060101&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=1058475413627300600&adk=3430571818&idt=118&cac=0&dtd=5

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

95b353710446d889ee26e5a251e496c839ff051b03ad3a3e1e50a0c03358235b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43107
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame BFAA
Redirect Chain

https://pv.medialead.de/trck/epv/89f7480c0afa0150827cf163f8728151?subid=57853200014847804444544012523024&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=FCAFEED7E361667AB6C39756DB56E118&dt_subid1=6566d0846daf20926684b5d7&dt_subid2=&actionid=56481&produktid=&bannerID=FYRSTDisplay&dt_url=

0
609 B

64ms
29ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=FCAFEED7E361667AB6C39756DB56E118&dt_subid1=6566d0846daf20926684b5d7&dt_subid2=&actionid=56481&produktid=&bannerID=FYRSTDisplay&dt_url=

Requested by

Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request.php?zone=okg862ss9p0j&nw=20&renderingType=javascript&namespace=a5074b6f4b&subid=&uid=75992506730cd7c1&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCsG9Bg9BmZd33G8eXgQf8sIWYBuvSwaFpnfHe9MUP8C4QASDg4tlWYJWipoKwB8gBCakC73--9ut6sj6oAwHIA5sEqgSxAk_QX0u35HyF8nPyFkRZLKxnXb337CFuVND8hmWt9pabk1Xrkz8i_BL4VXEUGnGWUh476MbtD38_i_lRRT4kiioNxL6D7kw4LC9y4oB5OmMEujRJ-ky289C1m-wIKOwHm6gH7IoANw-fDryKlzM8P2c7_hHe-EZksASOl5ZINxdQj6caxDyZkf_iUmq3F4Tk4rYe6zFdzD4RUaA-zkHZm4lXpv4TMRLSxmy7GLuRKXNb2SY9uUr8mU0eJmXZvsZUZ66gO003v-h6GaPiVou16KD0fa5lMeNXyRvrI3Dn1XDasIZGyVNpXu8weFUeRMaVl5XkY-YV3jMxD-EV6YCnY0pDGivhWQggFqQCmq6vz_6G4wADlaICFzTpfULYju1RUstJgvIhVWs2UAEWrAOi_Zl5wAS-jurk-QPgBAOIBb3Uiog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WKyjp5nB6IIDgAoBmAsByAsBgAwBogwcKhoKGOS0sQLutbECtbixAuS0sQLutbECu7uxAqoNAkRFsBOH77EV0BMA2BMDiBQC2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNcjn0n3jHFnr0VQrDo48k8IVpqqof3XtNcrQYBN0vQobM4a8Ep0HSQGnR6JMZY1IN5yW9T-i1LHrY9Mp-dQhAdUFXpGrCEG4PnGQYAQ%26sig%3DAOD64_1b8Ub-F787j3PD3UIQSTxPcunc5A%26client%3Dca-pub-8367749956917006%26dbm_c%3DAKAmf-AoPFAYTtP29cnAPAOqNV2y7S4oCewKHNC6uIPQvWzh0BWv34KQMOfl8SkeZPMjwfnbRSzQXBUU8vCKRm64psHej2j-4hUhu1UDc-_Ha2KpFuIe81UZWserYrkDSdchMnm1ZwnlwxelHH2uZ-zh8m6Ns1E1ZGEsVnNEZ9rDwykwKfD1-4M%26cry%3D1%26dbm_d%3DAKAmf-AaJUzdd2v4cXcW2uyxF7qTKRR-3j-y7qcWnbK5KSY-OVVUIoXgeaaqyq_zSh5IF4r4Cx9MzVc_rHirYGrgE3gHHsIwdwUx87M6uUDvtkvUS_ZvySOIT6iFCdaoTaBiRh9mavvAkzLUSpo15ZuLvqIz7ORl4tD54RiNoFb4YTzcoZkKMUTBp1FvodwHgHumd-_T22BkBjqjBHrpQ1QPfPaNi-TYOh5upozI93ezI6fDIxwg65X-hh_mpu_C0HaJ9Ww5B03T05zvzQUWa58ZoKJ-X59iAABTRQImAMx6cgy85BCihb5q0Lkd_EVQcyfnxV5OS3990XlwF640ECw3q7Hg2WcH3Ns7B0jMi7psI5VqVe6SC6jlNxV83BYIlrYq_1Mu87kO-TxqSvzL3j6OWRwNIUVHAlqKuXsjqwexjA_3ZLTxeL0VbdvtGC730e0J8K6MCgv91LF7kORdd8iX2wpdS5W_xrCtwstfIZP_ypKhi1cxhpIpTVSta2gteu_xkxrshih5XJa0rM9gmQe3nYnvjmZUWfEwTbcAgWaQPWEWrBYpJJ-BpbjQMBaTXfw5BNb6g9Dg%26adurl%3D&documentReferer=https%3A%2F%2Fwww.farfeshplus.online%2F&ancestorOrigins=https%3A%2F%2Fwww.farfeshplus.online&random=672956445738&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 29 Nov 2023 05:47:48 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Wed, 29 Nov 2023 06:47:48 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"25200521800103636","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript
date: Wed, 29 Nov 2023 05:47:48 GMT
host: pv.medialead.de
keep-alive: timeout=20
location: https://pb.media01.eu/view.aspx?trackid=FCAFEED7E361667AB6C39756DB56E118&dt_subid1=6566d0846daf20926684b5d7&dt_subid2=&actionid=56481&produktid=&bannerID=FYRSTDisplay&dt_url=
proxy-host: pv.medialead.de
server: nginx/1.17.5
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40028
x-iplb-request-id: 253A3AF8:8346_91EFC182:01BB_6566D084_8D0527A:1A429

GET
H2 200 / Show response
adv.office-partner.de/ Frame 9C1B 930 B
924 B 42ms
7ms Document
text/html 2a0b:4d07:102::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request.php?zone=okg862ss9p0j&nw=20&renderingType=javascript&namespace=a5074b6f4b&subid=&uid=75992506730cd7c1&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCsG9Bg9BmZd33G8eXgQf8sIWYBuvSwaFpnfHe9MUP8C4QASDg4tlWYJWipoKwB8gBCakC73--9ut6sj6oAwHIA5sEqgSxAk_QX0u35HyF8nPyFkRZLKxnXb337CFuVND8hmWt9pabk1Xrkz8i_BL4VXEUGnGWUh476MbtD38_i_lRRT4kiioNxL6D7kw4LC9y4oB5OmMEujRJ-ky289C1m-wIKOwHm6gH7IoANw-fDryKlzM8P2c7_hHe-EZksASOl5ZINxdQj6caxDyZkf_iUmq3F4Tk4rYe6zFdzD4RUaA-zkHZm4lXpv4TMRLSxmy7GLuRKXNb2SY9uUr8mU0eJmXZvsZUZ66gO003v-h6GaPiVou16KD0fa5lMeNXyRvrI3Dn1XDasIZGyVNpXu8weFUeRMaVl5XkY-YV3jMxD-EV6YCnY0pDGivhWQggFqQCmq6vz_6G4wADlaICFzTpfULYju1RUstJgvIhVWs2UAEWrAOi_Zl5wAS-jurk-QPgBAOIBb3Uiog-kAYBoAZNgAesrfWfA6gH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WKyjp5nB6IIDgAoBmAsByAsBgAwBogwcKhoKGOS0sQLutbECtbixAuS0sQLutbECu7uxAqoNAkRFsBOH77EV0BMA2BMDiBQC2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNcjn0n3jHFnr0VQrDo48k8IVpqqof3XtNcrQYBN0vQobM4a8Ep0HSQGnR6JMZY1IN5yW9T-i1LHrY9Mp-dQhAdUFXpGrCEG4PnGQYAQ%26sig%3DAOD64_1b8Ub-F787j3PD3UIQSTxPcunc5A%26client%3Dca-pub-8367749956917006%26dbm_c%3DAKAmf-AoPFAYTtP29cnAPAOqNV2y7S4oCewKHNC6uIPQvWzh0BWv34KQMOfl8SkeZPMjwfnbRSzQXBUU8vCKRm64psHej2j-4hUhu1UDc-_Ha2KpFuIe81UZWserYrkDSdchMnm1ZwnlwxelHH2uZ-zh8m6Ns1E1ZGEsVnNEZ9rDwykwKfD1-4M%26cry%3D1%26dbm_d%3DAKAmf-AaJUzdd2v4cXcW2uyxF7qTKRR-3j-y7qcWnbK5KSY-OVVUIoXgeaaqyq_zSh5IF4r4Cx9MzVc_rHirYGrgE3gHHsIwdwUx87M6uUDvtkvUS_ZvySOIT6iFCdaoTaBiRh9mavvAkzLUSpo15ZuLvqIz7ORl4tD54RiNoFb4YTzcoZkKMUTBp1FvodwHgHumd-_T22BkBjqjBHrpQ1QPfPaNi-TYOh5upozI93ezI6fDIxwg65X-hh_mpu_C0HaJ9Ww5B03T05zvzQUWa58ZoKJ-X59iAABTRQImAMx6cgy85BCihb5q0Lkd_EVQcyfnxV5OS3990XlwF640ECw3q7Hg2WcH3Ns7B0jMi7psI5VqVe6SC6jlNxV83BYIlrYq_1Mu87kO-TxqSvzL3j6OWRwNIUVHAlqKuXsjqwexjA_3ZLTxeL0VbdvtGC730e0J8K6MCgv91LF7kORdd8iX2wpdS5W_xrCtwstfIZP_ypKhi1cxhpIpTVSta2gteu_xkxrshih5XJa0rM9gmQe3nYnvjmZUWfEwTbcAgWaQPWEWrBYpJJ-BpbjQMBaTXfw5BNb6g9Dg%26adurl%3D&documentReferer=https%3A%2F%2Fwww.farfeshplus.online%2F&ancestorOrigins=https%3A%2F%2Fwww.farfeshplus.online&random=672956445738&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Wed, 29 Nov 2023 05:47:48 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Wed, 06 Dec 2023 05:47:48 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: defr

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 596D
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=57853200014847804444544012523024&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=57853200014847804444544012523024&actionid=879111&produktid=ratenkredit&dt_url=

0
178 B

52ms
29ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=57853200014847804444544012523024&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 29 Nov 2023 05:47:48 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Wed, 29 Nov 2023 06:47:48 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

access-control-allow-credentials: true
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
content-length: 0
content-type: application/javascript
date: Wed, 29 Nov 2023 05:47:48 GMT
host: pv.medialead.de
keep-alive: timeout=20
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=57853200014847804444544012523024&actionid=879111&produktid=ratenkredit&dt_url=
proxy-host: pv.medialead.de
server: nginx/1.17.5
strict-transport-security: max-age=15768000
vary: Origin
x-iplb-instance: 40027
x-iplb-request-id: 253A3AF8:8334_91EFC182:01BB_6566D084_8C4F045:1E87B

GET
H2 200 link.html Show response
track.webgains.com/ Frame 7548 2 KB
2 KB 144ms
74ms Script
text/html 3.11.123.127
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=57853200014847804444544012523024&nw=1
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.11.123.127 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-11-123-127.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: bf3981564595046d05555420cc92e52e7ea470fefb63f7cd9315fbdd41f5f341

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
last-modified: Wed, 29 Nov 2023 05:47:48 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Wed, 29 Nov 2023 05:48:48 GMT

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 7548
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=57853200014847804444544012523024&t=htlp&gdpr=1&consent=1&gdpr_consent=
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=57853200014847804444544012523024&actionid=879111&produktid=ratenkredit&dt_url=

0
202 B

23ms
23ms

Script
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=57853200014847804444544012523024&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Protocol

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
content-length: 0
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 29 Nov 2023 06:47:49 GMT
server: Microsoft-IIS/10.0
access-control-allow-methods: GET,POST
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

date: Wed, 29 Nov 2023 05:47:48 GMT
strict-transport-security: max-age=15768000
x-iplb-instance: 40027
content-length: 0
proxy-host: pv.medialead.de
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: 253A3AF8:8356_91EFC182:01BB_6566D084_8C52200:1E878
vary: Origin
content-type: application/javascript
access-control-allow-origin: *
location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=57853200014847804444544012523024&actionid=879111&produktid=ratenkredit&dt_url=
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20

GET
H/1.1 200
OK e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/eview/ Frame 7548 43 B
666 B 155ms
86ms Image
image/gif 145.239.193.130
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pv.medialead.de/trck/eview/e99aace94e6e58733936cdd965d03e75?subid=57853200014847804444544012523024&t=htlp&gdpr=1&consent=1&gdpr_consent=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

145.239.193.130 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

nginx/1.17.5 /

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
strict-transport-security: max-age=15768000
attribution-reporting-register-source: {"source_event_id":"17200521800103984","destination":"https://trck.easy-m.de","expiry":5184000,"filter_data":{}}
server: nginx/1.17.5
host: pv.medialead.de
x-iplb-request-id: 253A3AF8:8342_91EFC182:01BB_6566D084_8C4F046:1E87B
x-iplb-instance: 40027
vary: Origin
content-type: image/gif
access-control-allow-origin: *
access-control-expose-headers: X-Request-ID
access-control-allow-credentials: true
keep-alive: timeout=20
content-length: 43
proxy-host: pv.medialead.de

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 0768 39 KB
15 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 04:52:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3308
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Nov 2024 04:52:40 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/7683192671021942909/ Frame 69A0 671 B
437 B 96ms
24ms Document
text/html 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=LGiGKR6JLe&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d39d9ea438d324f737b2157a05e09297eaca7530c078d66025d070e2ef9d7596

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 409
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:48 GMT
expires: Thu, 28 Nov 2024 05:47:48 GMT
last-modified: Fri, 01 Sep 2023 16:27:20 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9794 0
0 126ms
60ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvJURQ4D4bEpko_RmSpNgtddAHNu9FWX39Mu4H37CGi3RfLmQWmLbD5lKe-U4SH9OMKL9XZNs_yFBTWJAmO_-yQw8yiZLdLIAUWuuPA0cFHz5ctFk-tZAj95OMb8XMD1OsoYbOPbswbf834AeiaA6UyaOx7nrKcD_LqHXAUzK78GdfMHTZkuut_YKnqpmS5its7bhFTFvL67f39klrhxDIie8PmFhM6kHRBmU1_1sfSAl8KeSS28aSJnREAWWIcxI4cSdMeglXecC-rwUM_4-PPL8nr3fjPQD5juUbBRcbIhCeNYhIGdT5JA3f80V3TL4H2YJ0fqbbWTsOHgU35fuah_9pRTZxdNrWjLl3TfT54HT1dpTa_64EYBgLFb2rN27ZGgIeXJbg_m23agjbWXiJopWo6kD-lydzapHSH3GJn1YRtjH0LYp2L_NbJv-5bSudNbKwnlPdur-648RsS6XKKjbmAtQXlVwaQHwGehMfl2ZIRv-gpeNqjnKscnjZBxFsxfn2h7w4-s0_joar-hTGrKz1oZ20ur49sHg8BCw392wsKlOiy6E50MWfpmIjif4fvt06Z1uAymHXbMIlIFLG9as2nqE-SLYqViGhlUQxAL4FNGOdLjfGTaDn0WCbrNn69GsJo4FncrhT0NrGsHjxERUvCD2Nxsj2Z-MsXEbbpUaMBvVaaycOgFFfI16K_HRSRAZQYv2-I8DlETqXkJa-uatDvuBY4RDKqENBrZyMcjSbaJBLKf2zq1dauxj9MRI7oOYTWjxn7qm5q1YHbHrbF5RE-uEfihC4bBP40heMxjwtVPgYFeghgVeyiPyDg_Hn7rVoTI5YKx1fw9d9ooRNlu5JfoDC8Yncg634N2145WKWw-Z5PUnPdZg1XfVF4TVNzXPjkYCSeh3v1BQWRihhP7ntpx3U7zyCWu1I3op5sgXaGC4eIFku8nDEwbVS0Vs6glLTXGkcXiSzcTv7I6SAaGXNVLN5reoq1oTxmsR4-4H4Hr7M6_pTmPF188ZVtX_UWh_65mC9mWtEbsZBpxaQM68hU91nHxqQbxfC69bFCTNDBP9yHaS8DBiZOHzaVhBPd-wgE3QfGdRGPXbTyV9OxcZOSA5PMT-V5_dKPOf-J_Ce5zJkIpOHwnFUiuN2JYqBkq1Zz6loBZwNmMqM8GsvPNQOW1AEfW7qlvefrMqtdAyxvOwOknc6r-2XmYId_uLWoVmBS6RpMK6hELOOfWvP_dpE-aZOKdIlwje1HwBCl7BMH1sUk7QKniptCE6Xy9qE2VaQAlG0vkEIyvdoM7Y9BV3xn-8BsQPnVKoHJdUBw67aUR4Ml6rwBCNYEW_5dLh10R1sloSxCQdDMqHADeCAgDmafRZlgghaCEipcYL5IztKOyy9kHLyw6DZUrpXZbqcHCK3ZSwXS-tdEFs5hgEPfe5Twvcms7scmqWkYZzAq-_tjnhJz31KTsBRBF75NX_1qBfK4Ndhz9OUUU0NiRw&sai=AMfl-YSrsmdIBupYUOHMaX-BRpREw5z2Wrh__CKY41EzI2Ibqmp02-LVJNk1s7XO1aCXPrEUNH8BH8o8yiRwegTIhNIXarFI1ZEQ3xWnY1dk93YHNl3FKCOU0TJLe2lPRAghxzaHZzER9JOyoU05J2x0s1PwfcWOCk6-ecTb-pYbKB20OHAHJ1qMmyb6F_tC8gxBHWXnHcrlpCset3_SAPOQXYoHdye2Cms4eFbrY5F_gCtn_TEw60fY9E_wfC77zQT_7BYMAVkDisZFbGVDME9XcKgOG8mS7HVqniemGA&sig=Cg0ArKJSzEUeA9SI810jEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=239&cbvp=1&cstd=231&cisv=r20231109.16141&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns31533570.ip-162-19-138.eu

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
282 B 74ms
16ms Fetch
application/json 162.19.138.119
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.119 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

4d4a5e85a3510a18be5bc1fca1b14e0edefeb77fa19c7f684a3883207098c495

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-origin: https://www.farfeshplus.online
date: Wed, 29 Nov 2023 05:47:47 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/ Frame 0197 9 KB
4 KB 16ms
16ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

623c81b092a6116d4d60ff89b14803818efb0b9aebf6e4e2c50241e802f6e016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 32251
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4118
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 28 Nov 2023 20:50:17 GMT
etag: 16674218716276178799
expires: Tue, 12 Dec 2023 20:50:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/ Frame 3B38 9 KB
4 KB 20ms
19ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

623c81b092a6116d4d60ff89b14803818efb0b9aebf6e4e2c50241e802f6e016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 32251
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4118
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 28 Nov 2023 20:50:17 GMT
etag: 16674218716276178799
expires: Tue, 12 Dec 2023 20:50:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 3FD1 172 KB
60 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
Origin: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48626
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 61485
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:43:57 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 16:17:22 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame 3FD1 11 KB
4 KB 29ms
28ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BwUDvW04ao9BJPwKgPB89MBFOh2C0vfTNVvQ90gKVhTg6wrBUTiSgM8zy1yExyRQVTquN6pea7iKR4naQeM3wcif2k9gDd539EtriFSsrs28zIQGxNhe88SqiJgBMgBhbTgUUlrFoCu3y3MEStRRefI98JKzvfFFrZ7R5qHOviSbYIV2k&dbm_d=AKAmf-DWQA1_h2t0Sk2aWCyRNachUAIILpRgNA0-jk0tQZ3hK9avP-3eDcIt5Pu7HNVN_g_QcJqVbjO7C2FPClBMydXdvu6ihWXQN2-GqZvjOGkjfIsjCtTflWcV_FQlxgMXX7_OE8rxNycBpewfnZM6atLHI9rcLDDHAweH_HXjk-dMBVgPy5knFc0APE-PRfDikCa2rz0nlTFy2GvW3-MedTgB3u6oiQgY7cn8zgoBNnt7l6EAN7AuUdBbtfryi79rsuE0oxs9oTkmGiJlVYC0vB8wTlft7DY9rTB6QjU4BJkTP1kfLZaAUFFxgB-XPaxeBP9xlCIhx9idI2kMzWG4d-kAOxoGq8udSs-nNGUmgYMxfoixAikyZUhjyZCFBPC4-vX7XsPo0ybyWY2YlcYg6VhjswUK2ID_6-eie5Fd5Vo7uZajbA6GVjBQeycq7Kj_is7o41GpLceOpZBOgxuB8OaUV5KwnPhyF699_Kbkw7POGF9jcgCGJFSS6eF8DZqnZP2Mu93VCAPyNCRVAw3gyG9AtA7o6707pFfDVlrnuigifmGW4xvJdG_LH2WoW_pL-4DJanDlU-RRfGevi4gpWo_T3fqhRtItC4jr_3ezebrlTLfpoAHTKnLQf0rrUQeIVUhjcUqmJddolK3gSolwmUEGbJ1QITgJda5-uu9x6QcC26JEgTkNQLrv79xL6TOUR_iN0tE0NOnGY0Y5QTsyRYwDVmj8hj_utpJbN1gTOJ7jftgJ1V_dBI5d7nJhx4E4SwUZW04GfnTyfZNNP4CnFeKr8bsrHIYUM7TSEGxDa6fUuXw_FL3DRGNaXmv9woThwhlqMy2Vrr3nuOmTyf3gvmmtbHYJpJ890FdNzodHr248zIr_i-FNKfibW033zPF8-FZxXRuRdivrcFJPXOA9rsL2PJWBuZdjeL3cdeQUwhoh-EAyUk4SErH8twv6QM2AwcXWZJtD2PiamiaLrQzEiz9arZn5XIYXJp2urWllwYUMIAIs3TVsBYUcbRjaC0Rn06RHjYtpnXkVolYn6P5WtaA1We6vuqVn35E5v5sMptBf5PkqqIQjn4_Vk5vZ39etvFo_N2psd4MFfWOYIOcoXsbhI1YaTNGFb2gN9NP0b509tBcPTOARz10RM1UTvOQvCk4v4bcQa_KpeZRm-Kc6XEMROJtuybKkMFXpTLgfMiy0l8RlE4LjpoYU1qTKHOviVD0abNKh5ObLPp6vLHMntflWZuMYQgQ3sXuYx1SQLRXN9pVKDxX2HIe-9OcoQtxoDP03jLzUGNK9ObjeKu0jf4RgP55upWE5PnUv8Vr6aH4HR558h655zS0GZoz6n0w7fDlOZSyRL0v2cCb86PqdQIqhZbQu_mWZVhri36YwNgllQjFr33fyx6YTMHE3uhm_NfCw6vnoR16ReTvUk-T0nIYMbC6VnN13CvrFDPNXuffTmwTEWr7LpjO65O7jS0R1FaoeBrn_cXis7S7aV_rGR7qXbWdE5RwlprYgkMgK_LkenQrGj8zJpsrXbE1jQUm6RCl-1DxQ9n4da2BryhLZgWE6fCQMFS-aTWlUKQOGLtzFkZ1ezzqlx0Ojx3OGWqQS2q2boyK9X6cK4PsLp48ieajA7P7NKfcrQxrsqDvxjfgjjzhTlLdViKzFedENgs5YfF_BSUx0NEF4Qd8rVxpxCajJXCX4JmBw4NGp2C5fGXQeBflIbDxYRz9NxbxxbKHyJMToxJxYhT4X0MfXLYUxAULPfdUtNlXyGiWzRG8lK14er5vyzz8DREWpuzq3XqjJPnxubd7neupHtNOW1mu4wlMyh1J0oJJN1N2spsyTNkgKvUkSxpyEt0-7l5W-0BCv1_EXg_hCfe-Fdgm2gFF0M_j1AtVR2asDtnndpZOtPvIx9yrTxE9dixgS2yhVDIlIgXXlwrybVwaZJ2OgY0AzMe7LWrEfIb1MVqLnU7SaqVoWKPA8VRZMZ8GZStoL39R_wgjgZ09b2-ihk9ZkBLW3kf48pDmFCXP2aoBWUEdiPLNddWGOeWp9FUnJK8--IQGOrE6pgHU9dX_JoeTvnwnwbI41McCRGAojgyVNgvk5MZ_j2Er7LTLPJEfC1KLkt2T8m6p0gqVnYoQyQ_5RcN9uBs6Ph0zNbVNMCxhExTZnVjT80qdywjZmThcQvaNVJ_YiVA_nZkA6_fL0yKs8d5fXLLOVpYHZwkMZDHD5_kEVHisOISSYH1613kmAkfx710B86A4lnHUL41nPSfR1qynRpQo9GGcmwTJ1N4o210GF2UE8CucOZBe1XxsZ-miC2Jqn0MQLUReuH24W14FIDlxCykkc8FgyXDLbiHAL1wivBD6wGWR9pYcotW95p5XdtPed1VlHx46zHj3NuWCA5kOtceHWD_oXhXCDXgekWGOOJlCkJLIN8dw38ikWPbmf2kcIS61_ppDsD9QnZfZc9vWpPIGJJcdATxOlA2aFIznyPBEd3Wx2fTE9UVgb35tHTLsHi_lQttPeBoE7_PEuiZj0E0mwxniu02UDmcaicB0PswfPwFqr1vp11hKFM1NEAi43joFG0hK9pka-jElWlDcWtp7taUIQFNv-5Jb1xGV6E9zE5Xzh3cwYE6v4IEkILt3cRtlCmd1uceTBa6s3T49cFQ4KJbtiXUWRXn1tSqMn7rDnJoxgap8HNOLJjFqhj0CB063qxP_KcEC6B-OuR1b8cehYwMfmLT0BDquL9KrPI_igD_nu22vsjp_sUbmVxNrMqeV0GUKsg8E9jZBeFfE6HeBYp5gw8BYQ1esj2I1lIec9_Tp2UMfgyIVpnLiW8WofM3FTMvIiSPTBwzGUfXpw01_Ant4x3m5Zs8YekS6H_Am6_-LnzfmMv8NgcKXF6eAmxUoDSjvXeC3iMJtd4_C5LhlfzJ9kJUbonnXyrCt8Wt8hVQLGfNDsxAnoCloSffk7L1o9DUM53h2WyxqD3M42z7kqZfjDZlRhLWMZrw7eyh6mW-dpYlK1zVKxMQ5qrlqaPQmfOoG6Ynwupu3FYrLIEAQz0YXfMPah37qWpZ7wNGvdcfDYj32N1n1-WUevtu69PpDLv6eLLPDcs1z71iqCdyAqmCg--OSoS-PF4ZP9HpMkSVHUxIIWCVXrnJbeaIOqwKlvkVkxI1cT55niRAzvoooIJd1r8PC2hlDdgHYT2hpws1xL8hWg-IOebYubTcm8sDSFIXACuB2nU3EoM88jqd_PPB0l4A0U34n_nlzN-ioUfPrcj7ZpvHDS2B9zzrL4zADVPA1unbMGzuYYKHfaYLlUJOM55MyucBJSh8xon3CXUV4XW50uz4N4ay7V5Mo1wYGXCJw9ZHOt7Q97ZFk4rn4YGThEuK-jeCksM2iRtWVQkhtssyHfJwI67Btak4uhNkKMobrJ0sGuqF8kouiGOFo-ItwM940ddPvaxZ8WI0llpO1dv36RPvbZby7h2MCNGV0_NO5PyUjueriot47W1H73o3Asz7pC5BlsGGJdaGdgh_cXGHq2QW8cb522S-RqEYiFOKX9OjV7RCyU3KxenwVmQe7AiDM6J9M85P8I5G6FuKDjoCXRtFEEdTIb-mDoH8tISmbXtlE_f_wOrFSbcQxuBard2n2UrdRcqcJBlHcrMWDT2L4xOZnWYW_dHKxQOu0oG2iVzYivOpqicTW6zd6HNd2LCWI6lsXcXWbBReEhIiwe6B0US1AlnSuEO_JY9mmIQjqh65o2Xtardk6z_JW1fMZsj2MKu8upBZOU-WmrsqnMnJu6Jb1XQX70dpJY4wProBf4TeyLYJDicOhc2duc8PgD0Qtzd_BI64ybrsGqgJsktKobChwEOMCf4PWFlqllUB8Q1fC4MQvJm_OCY8dKloU2QvtXSx-toHzRFfEsbbS5j9AyGC6pcq27U6d_RUq7g08SY3zp_ceK2WB3B61-CRZjsyzVa_JZpGgqaNm9i9_EPMxCnEAJgigwnAa6J3nhO_nKXazWx3ZFu7cCX8g8TcnKiFw5RAQxxlKTOwMvtWBMsggHloP1XfqjXnJ3Am5QW7H1mEehCIIllwVGrVIym5l9-LDUg10XKD1KL7L1idUACXTMXFo9Jdclm9BkZyTPEob-u3UpMicBxMzjurhLUkXZkE41R1cZrOu-l3ukq2uR4-A7wSRwQNPRw4X4lu2uoKrE-R3h8q6QmgH3wKkDRuOHgL_r-QM8NmnivSzyOlNsCLu2r2wk4bbYgNqZX0pKhp5FFKjQmi7AgR6d2GaUJmIlNw&cid=CAQSOwDICaaN4zafh785hupinmtYT29XCHuiTgW9gkra2SE3XY30lK_OKyJ1-wnNNlIgHBDs537C0N5L6OhOGAE&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=5654054392329633000&adk=792902355&idt=98&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48626
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:22 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame 3FD1 31 KB
12 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

610d24f5996131b3ab98f18e05441cc246aa8674c3842df0df2b40b57ac9fd0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48626
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11874
x-xss-protection: 0
server: cafe
etag: 3876053170955424897
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:22 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 3FD1 41 KB
14 KB 28ms
28ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 307826
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 16:17:22 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 6CBF 38 KB
13 KB 26ms
26ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 307777
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 16:18:11 GMT
expires: Sun, 24 Nov 2024 16:18:11 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/6137497824312366086/ Frame 575A 15 KB
5 KB 41ms
19ms Document
text/html 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6137497824312366086/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdd99147d181315c95267ed12bcf1291812dcc5b1966357d7b65d758bec02b1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 163902
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 4933
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 08:16:06 GMT
expires: Tue, 26 Nov 2024 08:16:06 GMT
last-modified: Wed, 08 Nov 2023 13:36:26 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2595 0
0 84ms
61ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvcvsUYvI3R7qNYRaCPjCqHz9oMnUDeDcOhT3URZFQCv3dAY6HCqhM3wp4jR4P8g1dODxtvTXVQ1rNJZZPa2WUqaRmls_PU4KrafywjFAEXo2lybWOY_pqJ8dkhi6AQWJOEWZ7xvMKuD3gPfX3g434WQYwuAPhRVa4wUXia8R6L85x-n4EgFImoGiSxUIzkjVpt52UsSEsAWZxpE01N7R6PyFYltJzAVPLHR7AvPMnwGeoDxSEHqaU518JSDH9gK0gjb5sRMwoEC6O-Z0_bEfSwruyo-Xq4Lf_BxKwpVi_Yi-Iv51nZqUVjcyk7fpOJJKVycmA5Qqojemd30RXgcqggd_uTx9sy6Nr54h6gb0_1gO9JcmyFKXWON3fyyn5rb0KLzVREsgf0k-lpObpv_EvS3y3c1oG9fePYNVLHE_WgL6CD69KtjkHomnMm-G1VwCoWMJAlxhbQpZ_l-mEhc4-CdcsH0usId16jyerdUrjIPh8zCCq9OZ-crMpW5PN0MmV8qTA1_nK23AQb1FKJM5xjIlE7brDcEbYU64TSf6RiGB9-MBqnet1SpNCpZYXxDHeAI2CutoB9sgoLMEf_YwJAaoEF1CKbjGDytF0tZhnWloJ2U-s9I8lgZGAkRlxrnVrBDeZabJ17Jk4kamO4qWv2s-kMLZgBqNLMMMB-JFNJNXSBe8wUt6IyG052mMjf5M8VrDRJHwr8zpR7oN2DlH4SqSts8u97sY0QLMV5D7_rcZvassP10IP_0gp72-mFSSmprneu_cKrKFs-mqzHlVLVmWGI090UNfJrXGc5OP9JGXAOceaNZHKXNa1triZYxXt7xBhEG7p_XyxkVS8-dkgYVvh5j2hc7i2EP0AXqT3dDIiXvdfLdeeOo3elQVhqUk9jxj7TwWhJGsImT-nCoi8yATGyIzDJ2v_FdEu4mkbfWB7hfzfUPM094cMFOFhGQ-XK15txjFVTGlDuAefCFQzFBCjqducyKwFE9TNq8oepKEkp-gje9jfhBdTq2nuZGgJeVhyZVhxA9uFVeqGfRcLzQ4GroHr0xv_PglFTC3AN6wb_3Wp-WONCfYz0sJXEzvdjxKf3qcR82Ck66AoQ9PRm1kBSc6y1e2pAa1WnASyMWlYJfkTAVpGjXHTaGkpIvBCsnCvuSIbLhELqUjs51uxIWd2Pjn7i_J2yB4zc7Rf80EVWsQZjIbo8uSBOxefVyIhqU-S-H3xrMn68FMlU-5C_hoEo-4wK24ZmLHtd5T5G2STqZ5y7M6Wa4LANIg-HlyFJwtePYeFTgc5pKfJ_fAtGkC4lKL-K87AkbBb5gLJqdQW1K7oUwvJtjrDfZUP6PvA-R5PYCaXpkwE7iyi8ninTocWpsQTwTopMeyOrJywLwG005QqK7C2o8NBzFFmeJwymiC0woAG52BbfG1y_dUXV_gkz_VgwiViG2Nq3KEUiydMTBLyTKQ0X3hZuB1k-4iTZLg&sai=AMfl-YQfXe9OWRMjGGOTuh7XPlD1uilThjyLmsN3zd4g75oJPdlnbtLGHb9CgaFcWJ9Dvd-ug_-C5ftKVd3XI6OuNDdK3Y3cxBOVWlbTr7weTkA2emn1W4QGYn-5sVvmbLioUCJdlsdwCfHD_dt9tHJgd4J7vnTcbMcdpk4y2xdMSBvVPicOtPHjgB-CN0yYPXDXOk4TAv0sffdFVnSRoZZPotEmj2F5qkjc7PQAa68_S6Vz-U2lkzr0_37Y9F_DRk9lkOV05zqpGhqK_sMEObot3P3ErhwnPM62RYxiZzu3IQ&sig=Cg0ArKJSzE6h9fwljq5SEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=212&cbvp=1&cstd=210&cisv=r20231109.09215&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-18-203-77-106.eu-west-1.compute.amazonaws.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame 2595 43 B
1 KB 92ms
20ms Image
image/gif 85.14.248.91
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvApi=sky-dv360&extProvId=300&extPu=sky-dv360&extLi=1014760199&extPm=531080194&extCr=20765306149&gdpr=&gdpr_consent=&rnd=3629728459

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

85.14.248.91 Neukirchen-Vluyn, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Date: Wed, 29 Nov 2023 05:47:47 GMT
X-Content-Type-Options: nosniff
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
cross-origin-resource-policy: cross-origin
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
X-Xss-Protection: 0
Pragma: no-cache
Last-Modified: Mi, 29 Nov 2023 05:47:48 GMT
X-ET-Code: 0
Accept-CH: sec-ch-ua-platform-version,sec-ch-ua-full-version,sec-ch-ua-full-version-list,sec-ch-ua-model,sec-ch-ua-arch,sec-ch-ua-bitness,sec-ch-ua-wow64
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://googleads.g.doubleclick.net
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 923
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

firstevent
skydeutschland.demdex.net/ Frame 2595
Redirect Chain

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=204544316&d_placement=380650885&d_campaign=30999372&d_bust=3629728459&gdpr=&gdpr_con...
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=204544316&d_placement=380650885&d_campaign=30999372&d_bust=3629728459&gdpr=&gdp...

42 B
736 B

38ms
37ms

Image
image/gif

18.203.77.106
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=204544316&d_placement=380650885&d_campaign=30999372&d_bust=3629728459&gdpr=&gdpr_consent=

Requested by

Protocol

Server

18.203.77.106 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

dcs: dcs-prod-irl1-1-v054-06e6f5928.edge-irl1.demdex.com 4 ms
pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: W+lA08/zTnQ=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

dcs: dcs-prod-irl1-1-v054-05348b51c.edge-irl1.demdex.com 0 ms
pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: krQovftMSgo=
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=204544316&d_placement=380650885&d_campaign=30999372&d_bust=3629728459&gdpr=&gdpr_consent=
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H/1.1 200
OK request.php Show response
hal90008.redintelligence.net/ Frame 4336 2 KB
1 KB 138ms
91ms Script
application/x-javascript 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90008.redintelligence.net/request.php?zone=okg862ss9p0j&nw=20&renderingType=javascript&namespace=9d459bec8a&subid=&uid=b4abbce114fe8e78&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC6Upeg9BmZezjHquJ5LcPx6udgAzr0sGhaZ3x3vTFD_AuEAEgrYmDJmCVoqaCsAfIAQmpAm7843OJd7I-qAMByAObBKoEqwJP0I5oVuLM5N5ZJtlfQy7XaY7u3uIhgdMNyMSnIRaTr_2S-4Zaui_fOCxaY-22qKS2tQdnB6SmJT5F8kYVY5JXW3EnrbenAFVIgyAOp65ebgtOb9joxWpRnlYErwME9lVg2ijBao99XCX9mBvKEStNzOdNA1K0YxXm6xgWn6uvRorLbMQgD8bVElyl9QLBveuvvqQ-AVr907-0sSJFmPOmb5JPMpdCVM5QqCcEz-DeOEsBMGOARkAv7XFpvyv1ESGX1gSb3rPpqbhqMpYeuvHCj4uLR99YcFwbVexAKOxkuoVdt1H-Gj4Zy6eSxmIV2kYUvq01-g4bx80fbLr6h_tySUfvtDDJnDVAcnRd_5UG8AKw68wA23CWDFJFzT_JHQoaVwOJYyARqR0YD8AEvo7q5PkD4AQDiAW91IqIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgfMgKqAjoCgEBIvf3BOlj47qWZweiCA4AKAZgLAcgLAYAMAaIMGCoWChTktLEC7rWxArW4sQLktLEC7rWxAqoNAkRFsBOH77EV0BMA2BMDiBQC2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNBqtFjf9o_aiGpclcqcl6_-Gb7HYQeyMVZ4YI36Ls14oCe2toDLsFFqdrWeVAcYp70Ckc6_L1FNV-WZRIz08u69DHDZjr8z83ZhgB%26sig%3DAOD64_3pRUVJtP2W3B2X0aPFZbH6FciU-g%26client%3Dca-pub-6266313190087173%26dbm_c%3DAKAmf-Dm3DofRcrnyM-ebdbNELqEShHotGdZLs5WyygOvgWkAAPZBhlb55TQ5iR2XpfT3JPBplD-4TGB5sH4i73B4mgY_qWgeqobYStECC5Yb1DLN0Ejwp4cJ94zPGkYKVTGvjKkFd8cV8SryeC5IRfb1lw1flo89z0i4qkZ44CehVyt5PMENiU%26cry%3D1%26dbm_d%3DAKAmf-AhS0wC7lIlT1PmbvXmrZ13LEvg1p--cmMLj2luN098xHuFdBJfUqlSGVYC1z7bOv9wSX-tUrlQ5jVVI9GJvHDeCzMTLKtcp84QUxIaIuUX1IDlXqSJ4RvokPOWs8PffzndMl1UFJecWANq48iKpsXbqFCO3Ym2yu4GXPThPWs74OQ5aAusfcXZo8XaQooM1zz1NkSGs-jr0VaK0LtQ3w8QwM4zB-il6XGNV-wr5IXCcAIosbaxP1Q7Zk1_dBdHS2hqBhnpJv9-8fLgipAMSAq9470QabX6VKTTRwi7aoXF4k79c1xchgcQIKO0oI4bNXeN_ZYKMEfLr02EDXXWSbc1UeAIOh4KVbe8K7x7iDK6SLjqF27frsBB2unO6CYMjV9xP1GUiuuBWPcsRuVmUMrH9kKb_mtJV_JWVNBKEiFZZK2EsJde8NO9yrU6KnZp8u8C4mxa6x-U53Sx-O1a9xtmxGT45fBiyRX3xo47zNxDYfF-caPvcHotjowTzYAdKz_XlRBDRr37gNvUBl-yMj5Asdx13gBVfHiDrgKvU0D4rhAM_DQi7CgDVSsMPp9RhRgi1Wvn%26adurl%3D&documentReferer=https%3A%2F%2Fwww.farfeshplus.online%2F&ancestorOrigins=https%3A%2F%2Fwww.farfeshplus.online&random=4761348377744&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by: Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/okg862ss9p0j?subid=&gdpr=&gdpr_consent=&rnd=1701236867504300&extVar[]=DV360_SSP:1&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC6Upeg9BmZezjHquJ5LcPx6udgAzr0sGhaZ3x3vTFD_AuEAEgrYmDJmCVoqaCsAfIAQmpAm7843OJd7I-qAMByAObBKoEqwJP0I5oVuLM5N5ZJtlfQy7XaY7u3uIhgdMNyMSnIRaTr_2S-4Zaui_fOCxaY-22qKS2tQdnB6SmJT5F8kYVY5JXW3EnrbenAFVIgyAOp65ebgtOb9joxWpRnlYErwME9lVg2ijBao99XCX9mBvKEStNzOdNA1K0YxXm6xgWn6uvRorLbMQgD8bVElyl9QLBveuvvqQ-AVr907-0sSJFmPOmb5JPMpdCVM5QqCcEz-DeOEsBMGOARkAv7XFpvyv1ESGX1gSb3rPpqbhqMpYeuvHCj4uLR99YcFwbVexAKOxkuoVdt1H-Gj4Zy6eSxmIV2kYUvq01-g4bx80fbLr6h_tySUfvtDDJnDVAcnRd_5UG8AKw68wA23CWDFJFzT_JHQoaVwOJYyARqR0YD8AEvo7q5PkD4AQDiAW91IqIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgfMgKqAjoCgEBIvf3BOlj47qWZweiCA4AKAZgLAcgLAYAMAaIMGCoWChTktLEC7rWxArW4sQLktLEC7rWxAqoNAkRFsBOH77EV0BMA2BMDiBQC2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNBqtFjf9o_aiGpclcqcl6_-Gb7HYQeyMVZ4YI36Ls14oCe2toDLsFFqdrWeVAcYp70Ckc6_L1FNV-WZRIz08u69DHDZjr8z83ZhgB%26sig%3DAOD64_3pRUVJtP2W3B2X0aPFZbH6FciU-g%26client%3Dca-pub-6266313190087173%26dbm_c%3DAKAmf-Dm3DofRcrnyM-ebdbNELqEShHotGdZLs5WyygOvgWkAAPZBhlb55TQ5iR2XpfT3JPBplD-4TGB5sH4i73B4mgY_qWgeqobYStECC5Yb1DLN0Ejwp4cJ94zPGkYKVTGvjKkFd8cV8SryeC5IRfb1lw1flo89z0i4qkZ44CehVyt5PMENiU%26cry%3D1%26dbm_d%3DAKAmf-AhS0wC7lIlT1PmbvXmrZ13LEvg1p--cmMLj2luN098xHuFdBJfUqlSGVYC1z7bOv9wSX-tUrlQ5jVVI9GJvHDeCzMTLKtcp84QUxIaIuUX1IDlXqSJ4RvokPOWs8PffzndMl1UFJecWANq48iKpsXbqFCO3Ym2yu4GXPThPWs74OQ5aAusfcXZo8XaQooM1zz1NkSGs-jr0VaK0LtQ3w8QwM4zB-il6XGNV-wr5IXCcAIosbaxP1Q7Zk1_dBdHS2hqBhnpJv9-8fLgipAMSAq9470QabX6VKTTRwi7aoXF4k79c1xchgcQIKO0oI4bNXeN_ZYKMEfLr02EDXXWSbc1UeAIOh4KVbe8K7x7iDK6SLjqF27frsBB2unO6CYMjV9xP1GUiuuBWPcsRuVmUMrH9kKb_mtJV_JWVNBKEiFZZK2EsJde8NO9yrU6KnZp8u8C4mxa6x-U53Sx-O1a9xtmxGT45fBiyRX3xo47zNxDYfF-caPvcHotjowTzYAdKz_XlRBDRr37gNvUBl-yMj5Asdx13gBVfHiDrgKvU0D4rhAM_DQi7CgDVSsMPp9RhRgi1Wvn%26adurl%3D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b994ab0a345e4cf15a6567b728847085ed40f12eb0bcabf0f5f15dc77eb049

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 29 Nov 2023 05:47:48 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 78552800015844704444544012523008
Connection: close
Content-Length: 794
Expires: Wed, 29 Nov 2023 05:47:48 +0100

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 83E1 38 KB
13 KB 22ms
21ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 307777
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 16:18:11 GMT
expires: Sun, 24 Nov 2024 16:18:11 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 5E3B 38 KB
13 KB 22ms
22ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 307777
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 16:18:11 GMT
expires: Sun, 24 Nov 2024 16:18:11 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 main.19.8.461.js Show response
static.adsafeprotected.com/ Frame AAB1 213 KB
66 KB 27ms
17ms Script
application/javascript 2600:9000:26da:9e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.461.js
Requested by: Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rjss/st/1854208/76774665/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1014933263&ias_pubId=pub-6266313190087173&ias_chanId=1&ias_placementId=20808097378&bidurl=https://www.farfeshplus.online/FP66.asp&ias_dealId=&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0gJFAwKguqwihDmI5OoV4cH
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26da:9e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5d60c053b0001fc62bddd8d273be2d45bd62085f6179c57e1d2ae8fc6be54819

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 22 Nov 2023 09:25:14 GMT
x-amz-version-id: SsS9NfODLbDHY8VzzB.lL2F1gs9DY59I
content-encoding: gzip
via: 1.1 99a7400285d83f528f50f54d665628e2.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P4
age: 591755
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Wed, 22 Nov 2023 09:25:12 GMT
server: AmazonS3
etag: W/"315b08a0e21410ecc940dd381f9a8dd0"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: 3LjrZ24_NJR8NxGVlJIH-V7GdZlqzwZ1lyTluyISf4v2Ddcabg6j_w==

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 9A5E 1 KB
643 B 24ms
20ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 48578
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 28 Nov 2023 16:18:10 GMT
etag: 48472445140208031
expires: Wed, 29 Nov 2023 16:18:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 3FD1 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 707720b1d6c0ab3a7ce624f400f44a4b34aafbd47d27d56291d69c77c97e3e41

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

htlp Show response
futalis.de/ Frame A78C
Redirect Chain

https://cdn.retailads.net/tb.php?t=150337V2172132532M&subid=91751600011821804444546012523004&ra_cnt_active=1&ra_cnt=1
https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3351361775

350 B
401 B

51ms
10ms

Document
text/html

167.233.14.134
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3351361775
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request.php?zone=kjmi9fqzw10q&nw=20&renderingType=javascript&namespace=9c4327427d&subid=&uid=f72b82034090e059&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCD5o5g9BmZYDBHqSZn88P4Z6VyAzr0sGhad3z3vTFD_AuEAEg7L-QEWCVoqaCsAfIAQmpAu9_vvbrerI-qAMByAObBKoEsQJP0MmVrQdlApGesqIR1PVJp_8PqB95rsLOMLU3OeEwQQmO7g_UtV5rL1GQRMYA2kV5shISdMuNTtNU1eEmgmgPpKquGSDbvTewuOQeBMvyScG7bFvq_NuTAPvKyxc_ihEJ1wO73QsFCPPDE0BoborkrQm7hpJa6jFdxBc27AkqjQ539B7IsvZDV07Ju8LkxrG8L1ptwguX4wILXF_TC6miIMii7TkYhZCNSXpIb6x6h7mvAHlUyVOIjOdKM_aAMjzRmsGqz9m4hASjSvQKFFFl1NFaEeDYnvJyFUteI0yN9B3JyccIBUyUSd-o1guUq0x_vo1e52zFiVQ7gpoJKYM0Yo9vnJ8ouieMv-BfJNdLu1TGC1FHNPEGyflJYB_GEEzhmRXoVFtJvVPRtpCMTCR7tcAEvo7q5PkD4AQDiAW91IqIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgfMgKqAjoCgEBIvf3BOliC3aWZweiCA4AKAZgLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJERbATh--xFdATANgTA4gUAtgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNzGwRpEKSPaJhad8pIKp1BKb9gwOTGT4GSae_kc92uq5sOMzFvft7lc_3X4ZhUymjzAZ2UX00G0EUN-i6uBLJllbOz42Jdb_DU6YYAQ%26sig%3DAOD64_1G8xh_QY5YE1-uFo6ND-ucNLXnSg%26client%3Dca-pub-1231661633440980%26dbm_c%3DAKAmf-CSpnyx4NnDcrnjk_XlvNe25PJ-BUFLmu9GI3wgA29oyhL86w8g3VggEFcbuQsrFpyA_sapODd8DZ3B8PfC3ITx3yv6v2FqTxhpc8Rm3nDoP1dwCUmcMiWcYjlkpq3w7WVxIgIMY--kDrAUI2bilvCFpWyjjbPxx3jNujug9QeeYHUTS4g%26cry%3D1%26dbm_d%3DAKAmf-DeDLLq0Sl_hGmkYpUcJ2FPGjYQ-_H85XNjYd9-6Oi5BdcfT3tYN8Rc02PJrqewF1DAir606ucY7XQJ7r8K1v3lJexH1J4uryRJPYk7D5do78kmxE8d-3ZhqQdMjdvPfBl1ZQ_0NU5eOlcw03b_MWt4kmHgcfqlkf79hN55sbZb-VDH94zH1VgWBh-cKlED5L0HZIf7jNHuJ9aDJ5uZ_hqab1cLYqxZBWfUU3sdAeUX1UaLOfo2UhaEdZLb5sxtNuGu-EMtJmqW-IPMEiUcxPEsFE4039IIV5c76cnGuLO6hCAD4DV91yLf8jxEXapIm5UyvBglbmNJuXxvCuYnWYFj5EUu1K3mX_4gsMMxPoBWpJyzI_UyfKdhU21J6p8Lg0MITpI_aiPqGxa4DRtutmdDKXesysb-qzcC_t0pptAb_mQArGdciPfgjk4tMeSdPTW6zxBQO2JZGmVNvhS9A5pQLVsWP62i6il4VW4JfDTIgGPrgFT5xmDgr8JB9A2rYPE42kvmoLsNJ9iZqkZ0t4Vu0Q8D-aTnsy8Bj2eEguSi146dqa_X6d-YPC8tyglSF9kYSdbo%26adurl%3D&documentReferer=https%3A%2F%2Fwww.farfeshplus.online%2F&ancestorOrigins=https%3A%2F%2Fwww.farfeshplus.online&random=7572262290643&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 167.233.14.134 Hallbergmoos, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: lb-2.futalis.de
Software: /
Resource Hash: 582e283baa4cce4006055beb2eb8fe257c1ec5ef573a40f173b880636089e8cd

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 350
content-type: text/html; charset=utf-8

Redirect headers

content-length: 0
content-type: text/html; charset=utf-8
date: Wed, 29 Nov 2023 05:47:48 GMT
location: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3351361775
p3p: policyref="https://www.retailads.net/w3c/p3p.xml",CP="NOI CUR OUR STP"
server: Apache
xphp81: true

GET
H/1.1 200
OK request_content.php Show response
hal90004.redintelligence.net/ Frame 1CD0 7 KB
2 KB 36ms
12ms Document
text/html 138.201.63.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90004.redintelligence.net/request_content.php?s=91751600011821804444546012523004&a=a32fa66c
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request.php?zone=kjmi9fqzw10q&nw=20&renderingType=javascript&namespace=9c4327427d&subid=&uid=f72b82034090e059&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCD5o5g9BmZYDBHqSZn88P4Z6VyAzr0sGhad3z3vTFD_AuEAEg7L-QEWCVoqaCsAfIAQmpAu9_vvbrerI-qAMByAObBKoEsQJP0MmVrQdlApGesqIR1PVJp_8PqB95rsLOMLU3OeEwQQmO7g_UtV5rL1GQRMYA2kV5shISdMuNTtNU1eEmgmgPpKquGSDbvTewuOQeBMvyScG7bFvq_NuTAPvKyxc_ihEJ1wO73QsFCPPDE0BoborkrQm7hpJa6jFdxBc27AkqjQ539B7IsvZDV07Ju8LkxrG8L1ptwguX4wILXF_TC6miIMii7TkYhZCNSXpIb6x6h7mvAHlUyVOIjOdKM_aAMjzRmsGqz9m4hASjSvQKFFFl1NFaEeDYnvJyFUteI0yN9B3JyccIBUyUSd-o1guUq0x_vo1e52zFiVQ7gpoJKYM0Yo9vnJ8ouieMv-BfJNdLu1TGC1FHNPEGyflJYB_GEEzhmRXoVFtJvVPRtpCMTCR7tcAEvo7q5PkD4AQDiAW91IqIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgfMgKqAjoCgEBIvf3BOliC3aWZweiCA4AKAZgLAcgLAYAMAaIMECoOCgzktLEC7rWxArW4sQKqDQJERbATh--xFdATANgTA4gUAtgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTwDICaaNzGwRpEKSPaJhad8pIKp1BKb9gwOTGT4GSae_kc92uq5sOMzFvft7lc_3X4ZhUymjzAZ2UX00G0EUN-i6uBLJllbOz42Jdb_DU6YYAQ%26sig%3DAOD64_1G8xh_QY5YE1-uFo6ND-ucNLXnSg%26client%3Dca-pub-1231661633440980%26dbm_c%3DAKAmf-CSpnyx4NnDcrnjk_XlvNe25PJ-BUFLmu9GI3wgA29oyhL86w8g3VggEFcbuQsrFpyA_sapODd8DZ3B8PfC3ITx3yv6v2FqTxhpc8Rm3nDoP1dwCUmcMiWcYjlkpq3w7WVxIgIMY--kDrAUI2bilvCFpWyjjbPxx3jNujug9QeeYHUTS4g%26cry%3D1%26dbm_d%3DAKAmf-DeDLLq0Sl_hGmkYpUcJ2FPGjYQ-_H85XNjYd9-6Oi5BdcfT3tYN8Rc02PJrqewF1DAir606ucY7XQJ7r8K1v3lJexH1J4uryRJPYk7D5do78kmxE8d-3ZhqQdMjdvPfBl1ZQ_0NU5eOlcw03b_MWt4kmHgcfqlkf79hN55sbZb-VDH94zH1VgWBh-cKlED5L0HZIf7jNHuJ9aDJ5uZ_hqab1cLYqxZBWfUU3sdAeUX1UaLOfo2UhaEdZLb5sxtNuGu-EMtJmqW-IPMEiUcxPEsFE4039IIV5c76cnGuLO6hCAD4DV91yLf8jxEXapIm5UyvBglbmNJuXxvCuYnWYFj5EUu1K3mX_4gsMMxPoBWpJyzI_UyfKdhU21J6p8Lg0MITpI_aiPqGxa4DRtutmdDKXesysb-qzcC_t0pptAb_mQArGdciPfgjk4tMeSdPTW6zxBQO2JZGmVNvhS9A5pQLVsWP62i6il4VW4JfDTIgGPrgFT5xmDgr8JB9A2rYPE42kvmoLsNJ9iZqkZ0t4Vu0Q8D-aTnsy8Bj2eEguSi146dqa_X6d-YPC8tyglSF9kYSdbo%26adurl%3D&documentReferer=https%3A%2F%2Fwww.farfeshplus.online%2F&ancestorOrigins=https%3A%2F%2Fwww.farfeshplus.online&random=7572262290643&isIframe=1&container=&adPos=0x0&adPosCheck=0x0&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.116 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 1766e7ba8fff71f78c99f000e762fab3f71d1d5cf19dd12d47344b019ae8eac6

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2000
Content-Type: text/html; charset=utf-8
Date: Wed, 29 Nov 2023 05:47:48 GMT
Expires: Wed, 29 Nov 2023 05:47:48 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 419D 43 B
705 B 104ms
48ms Image
image/gif 23.56.205.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3266505&v=11601&q=357526&r=113440&pref1=91751600011821804444546012523004&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.56.205.163 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-205-163.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 29 Nov 2023 05:47:48 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 419D 43 B
702 B 94ms
41ms Image
image/gif 23.56.205.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2229232&v=11671&q=344795&r=296283&pref1=91751600011821804444546012523004&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.56.205.163 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-205-163.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 29 Nov 2023 05:47:48 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 9C1B 174 KB
62 KB 24ms
23ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

50c7dc2f52939e193b1b362cea8c29ab3a6a31680d59bb7b474a132a10fbbfeb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 63921
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame A4AD 38 KB
13 KB 15ms
14ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 307777
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 16:18:11 GMT
expires: Sun, 24 Nov 2024 16:18:11 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/ Frame B13C 94 KB
21 KB 15ms
14ms Document
text/html 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5573aa239d8cba2eb75e5145f8af0d81fd198299ff0ae200ef21a895db077d2b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 159627
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 21339
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 09:27:21 GMT
expires: Tue, 26 Nov 2024 09:27:21 GMT
last-modified: Fri, 24 Nov 2023 13:28:58 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame AAB1 0
0 59ms
58ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssLatnLjP92wrQZszjxa578d0WEE3KWavY7cmWEuNEKRd5a8-4qjK3UnqA8bUamI4Kw154Yr5fET9rUjQ2T6t6J7UjI0-t8sU3PgTx0ry4INcBIM1IB1otcD9TDDvPZK94EHv9m8K1EMN7FiGW6O-AHyfTfpu_L_8UPHZFrJhzKIaRxhnkUggEKaTQOwgCuWf35vi8YDRzLD2YlpgtAoDWXmXzdBvJ4YfwgyKSKOLu22U0h5sQ3Ekgkw28QxrAJUiI6fFvszwsuExlMeiUhSYuC4axcHAcXfh88a81cVfJ44E2QxrJCBSda9Y9TVA6EDG2d4qE5B61qyTutWI_zUgbuqIzAYtuVtbAe9S_8QuF-gaOqLUeupJBEfj1-gQJ-zjq9S9EXT-harX-87Bpw-9H2WmVqFVVFDO6NtxJpnyTnPLKaAuht4oc8PM9NRO-_p9s0XD8CdaKFi4bM_Q63-suig6UjwdxE4WjngakQ_TmvLBDRsiIPCBcGCJGPPgJtY_mM0kd_Z8yazdiWYl3Kthw873E9TlbYGVFVw8bK1FzT5tTRu2vgT6s1GbwzYlC0MuyeL4h0F2XfpynOrJZ9ouc1XMEMWzqBGtwn9x-wI-WqF-Vb1WnxLea4cTB8Tma5D61vmm3J7XgqZOJ1GMlnw8bzlVR6N0SPLF5kHK8r8zhtpmk3JVCJh6BeHGeSg719YQT9aYkSeEhTakS9tyTQmeW8OpyKP5JGGodzhch6UtebG0WZq8IVXTHtvYUfIDnnbb7EjbJ_EzlogYWwEapCMDunuiYzJTyb3SdGF3MwfNwRvOrNDUdgqBHO3IzEQrKXzz5ntNpDM9yoh5lOfhViUKHvIqHrhQOYWwL9W-1f65llQj5C_P7E5abuRr9Vb7GvpYq5M1pl8FHTtj8Snt5Y30esughPRC5dCVBrFGU7hMi26nJVUawtX8V0wDLIupr6_UVakzaHQbkM5Z2O4WZSeq1zhuXYGBQC0q8GsJA_6bFZhWaFBKa-3snWLE2zrA7yrD2khjPj9OqIRRfAV3kYFXLLGpfhNqeqnglsR2ZT_M3NiuS91IRH2ojJ0BkCDkE1mrSvF7wVU8gU6W72EBw2BvQXVjjAikyYBJV20sT_dD4VXi-2xdjqUYIWU253QOrwHgwRuNDfDuNgutJ3G4WV67Jao4tkMNAZG0RzkwQpM5owRJYODQ6Af8LDevcTrRgc74JFtSXPG7E2LhPiu2MD1bp8whqotMWUP4Dvz5lFsh0isX82jhINaDGLBACmjhXXjvPt8P-Z9vGlCHZOJX8p4q1OHLkWDPyV9rry9UUkdxh7pBPGaGctqRhcFnh_CElmzFx0lWMaSetTUAckOKlgIsRYC7ySbPA0UFFJilC8Zqaz7l9fvZRphGOMlZembEWrIBB4FOEyRNiezPwfKwicbHICjK06-_RjL2aBJwaxDpXAU_MtDZdbCMVGSIr3nnowOy_OKxdfC8g7ABLnbzsJswpOK_8y&sai=AMfl-YQdYRCDmSn2T1SYu-dxsnZuQUb37xPpLgL3tml1aCSU-QxK0mjRNWR7o9UmtB9kyH7fHGlafk-K7G1tRCYWr7WNMJakkEYZ5Nst6O2rVae_I6laxVcSka-lyDH4kW-48KJkMONtJD2AlOjS1PzU-aXwejQRJ6pzR1oo5x0jj7x5R0m9DeU8qvGpL_06F8Q-AVyfj1xhFFc75Gfk2j02prGYGfoca8m9CJ3bUSeTWNfK9Ft3EaUVGjBWbeXiP_maLxi7OMULaIs0XW0dj4g89VMU7wRDXYAhXab5QfdY4lilVg1-pElumiv5aOCrMAoBf9M&sig=Cg0ArKJSzCWpvuCuuq9qEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=278&cbvp=1&cstd=277&cisv=r20231109.38328&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 93656
tags.bluekai.com/site/ Frame AAB1 62 B
576 B 211ms
162ms Image
image/gif 2.19.104.189
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/93656?limit=0&phint=event%3Dimp&phint=aid%3D6531095&phint=cid%3D30972058&phint=crid%3D206015523&phint=pid%3D382345656
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.104.189 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-104-189.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Wed, 29 Nov 2023 05:47:48 GMT
content-length: 62
bk-server: b514
content-type: image/gif

GET
H2 200 skeleton.js Show response
fw.adsafeprotected.com/rjss/st/1854208/76774456/ Frame 9CEC 46 KB
12 KB 36ms
36ms Script
application/javascript 63.34.117.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/st/1854208/76774456/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1014933263&ias_pubId=pub-3831894559014614&ias_chanId=1&ias_placementId=20808097378&bidurl=https://www.farfeshplus.online/FP66.asp&ias_dealId=&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0jRXcR-x7m_stGyLnMSsf86
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.34.117.188 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-63-34-117-188.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: f6604fa8090d6bfb00e544f6da11c2c4a34b4fdb6f5ac3dc24b71647033e108f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_278.js Show response
s0.2mdn.net/879366/ Frame 9CEC 111 KB
39 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1642dd5dc126df4feff2255cba0988528507973d842d0a73331a5873f6b9d4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
Origin: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 07:40:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 79640
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 39806
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 18:44:05 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 07:40:28 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame 9CEC 11 KB
4 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CS8obkcmyUPTfvQY9mFBBZQY6jZXyiNgTyTyaxw7murwyC5c66LGwDRZXog72Hm-UtrIo90547IsRKQMjm-mMft_lMgxABw6jhgah6BFTHj0I1WNbxFDaREZEIMpVZGCE9YOv0xxNYn1oo1pbgY3sXM4Wdz3cHTHJWxtKFsi9W1BpOE18&dbm_d=AKAmf-C2cZ6esuS9a_IYEY4jRTx5cpiTb21C1bjddyTxa919e3qwN1F3udtDs-yRlTBje4X9QnlsBC_Htd2yKqZcNWIUMzWMoqxtB1MT00XH_0g9no0QWePCyxV9bkWRJ4-2TywA-gTKN8MX9EWq7EYzKfA663Ml1GlORxsigTMjTXak1Eah73WsL-JY-3ZhU61wFsvVmPe3JVVWzt47vFBb8sX0jcAXDTr0wuC9ootN52c1o4TrcpPoVzJLegboq79dxJucLG3FG5G9F_zrkQvEsg0RGBWVzg_y5h2by5-F84ZLcEf1XSu8grSx5bnxh7k9dLHnO1WsywXXa24UnLgD_yduh5Fwqqpp3_goTtbRuGpa-fv_nfvN0Wpby7C8twzoXiMRiXBOTMbYGy9gcA1oKRpxzEYjYclOZSWXUEi9U1Ab6jDBBMm9AvSOAFWNhpuYRhRNnabvxOKPi_Oyiy-1xrOV45O_EUmKz9298rGhyZTYPTBsMIghnWGBzM4Khk6qQNOLGHyZxCG2S66h3Lin1kkaWSroqA2IRL7WMZPhwGf588SlyP1GVKcPaIZ3paw7P5dLzkHsQmeGG40d6_SoJFgyfPBySDNVaOdi9oOdAr_9Eet1TBIzDsI92VFveQhSMAaV932n9ek7YZEJaur8rXF7AWyFHTtuFAF1gGRagTHWIffTs_Iw8IhyVA_02gMUIB_fIcQxm9HG4YXE-Y3SACmz7BGi6rhvjL3md5uN_oj4mgz4tMOGKkewGPPikGiw8tWrouVniRMFDVcIAJiyUfu9Tr49UMmK008p1RNSEV61oTH6DG6yHA65SRui4UdHLdHhWsZW8lFo9mldfxCwrY_RAAI62WvD9j71ZY6oWRYHKUPmdC3sLQsS1J65qIx8k4NXA30amxHPO_XSXsvDwTUDo31LqOxuElPDnH4hwcQ8EAryj_iSuYtk2OCv8uD35prgCSXpsln5qacJofq8DJYoH7J2pxm69npyh_xm7JmIteJUXx5JNWg7k7ToDgE589XqSmTaQlWWwNGE0qPM3dhUM2_XQ5uxkCAAefgHV0FxvnDXySrqLtZ7hE2tpylDYH-lmLfpC62GSVMuLL1_ga5mgxQ7g95NkU_Q-7fxRYQ2TgHBe7SV-Lh9H3neNsGa7QSO3zLQ1vuH39DTHU2WTK_yOknEhPMNeTqnCnv8Ssg7GgVHNcQXR-XvG4ziJwJLElKq955Iu3uqRC-BZ60trXMol93rpjHcDdJkLdOWisMXpgcEE-S9SSWEIPyU3Rn6ATxBg8qUbgWXcL50_AT8toSqVaW-DWIYAJeSvG40mAKbHcbKrI5aCOluuQN9D4ITG_KDi1o7fqxkIm8edx57jXfuEbJGPfGo30KAfK-7iMqo9IannMbnJwLW-5zkewPXHcDNgoCJJ-62XIiQJdzc94lIb5WfgdQoN0mK93sQl-DHpVFvOVBp3TZjOO-ADVMPd2EdO1ggsyCAYyxXU5GAqcGbYh6cO1f-cHMyHRPq467-Jhm3SJufJ05a4mPlpAugfvK6GFQ9Jj5G4DvQyt0GIN6100ZhEM-SkQzJjuY7T9AML-r2MMbOdwcvjQaOoeC8lFFcU5NpOfOhrcMcQSDRr4jF659EfEyp4Zh8O-iNhQ3goKisCNIJauQyC5rRO_Pmf0RC8L2fEtuobY8HOjCFnY-96FaP6h_scEbMqv_4SVvbq-Wigsog6XH8R28siqpnpaaUKkiCEx6ly2XRnt4F93N1w8vAq9ckfvMXDAN0dV-UFZCCnkS38BL4UeUHFNZwVxR7O2ALq5bvBasrRrM9bLAC-xKo3Jq5jbfy9tKbx_oenSmiPcr4tag8p2KYAQRDPX-6H54hTWeRfi3VJxYQYX8UuiVMIvqv08vnSdoqoJZy7s53zjDkrbrRHX-h7H44NU96NXrpSCY7Piuuy6Nt_GrKrYoW6Hy4SAw9L4Fq5Cf4pV-rrvqf2Q767F3jxekH3gx1rEURvm3Z4k82zjil6VYHl5YGy4OlaWjim018vaTJPmuPUZZgeSJhV9NNQRluHHvEWekoOyALRuEOxkotlyodOhiUfG5iSMWQxrteECQBgkcg8RAHJXdeJPMDr46BI2uDcWS82KKe44Vfq1IgQgtVoXmgdZPjWTnsFQNQBgSWjvEpi8EqPwDVlLOkecpK5n9l0hitOCLFWZPTPdR7O8LfmJYhCGI7i6dDNIKkiDcLAg2XJF-peCb9QLtbJPxhOjsetueaq8fmlJnPr3dDAHiLpkaVf7P9Bdm_0kvuXiAah9EZ9Qi952RBAnNbLuKwvtjDD9Nb7gkE78GKVBQlCfS1L19Cskz2wtj7rT6KdRRB4AvkpjwNXsMyUmTELI5Xlr_QeMT16G3MSP6Fw8qfWcdI7-y1IBnWh4Q3n0M5wt8uqI8_IL9pI7G50TAajeh0AttglQ2OKN3ChwT_HJ2wDsfkD0I_yTVx36PHZMO9_z0Pn315V5bUCmCIJjZ0E7ZuVJcYdg8dRGDwqaeU1HdGrlOTVYewl1f-XToAWaohFn8_utD0rp3I8s-YgQPOsYm8DFmvbkr2LMBf1JuZoBCS8kR57yAHFk-jJdQ0oE7Hx_jYoXV8HRkST1qv8gHcKiUHPTRpGeApzN9_dZi_KjpQYDovSCfDIGDdGE0ON8WUq0RnnNX_Z6j9B_JRxYp0SYvcr9D0p5xuECXVu6kkhcZywtOGVZNLT0sM-4lLBlwwAU0sAHmtyOk6YFI7TrPrelp3pF82tCy9pDC4NTapP6V5fMUwXUL6CG1G5fcYWObg_bMJrWuMrw7ESmMpTN5AWBA3Yp5Y8M7rgNbUDOqa8fR3fODSQD2ooyoO_649q__49fQJ2DDX_RRWQU-ntyvbG5jZvthcf7OR_d8FlsOU5puafUnsDjP2ILIaFSEZwnlUHa-JT9MAcKoMEN5R0vgmT4IHIQz2m1AjdolpyBvow2XXSoqNvISoyyZyDwqcWeCNqSYGtRGaKQ65wPOxNUpBCPp_C7bxcCa6FYbKj9kAYYwlQC5z-HOJK2BCvq8z2JANdRuwP2EMauxBvhHnGqf61kNjy9b9lerBHk7Y5TdIJio9NFgdW5JA5OEHCgyA0Qab7uC6bUKinCrDYgLnAoHbytsp5v4oTiuKAg1na2Da1-xTJXdUSZwSRVhI4Cnwb2U0OqbOJ8cKmTQKTJr4jgg1H3iAejk81-3lcM72FIxz390sYD8knzAEzI9Q47xuJK6BSN9skKj8YqwsrO3CdOAj23Wu_pz_W5NCj8O9e4J15RElfh7w0Ri-OhNbIwECrL_xw7Eni9TkRn7p5gZkEcGXyoD0DCLPKqxp5uJ6GHGe1pNG7z24obzJyNlaWmgmiLF9nhbXrHJzBnDH_6ow2i-jqSNaB2Gi-YEtSc4bmFcbQObBpr1CbUi_8XHvxYcQSp5c_ojNHFTTJKuXmK0TueuSyGIJ7PbJMK7VjLv8v_bSwAJZiRXrP4eX081P8lJp329gF0wpg5_Qg-vzeoxrtB5if0Wqha1SW9O-vb5IFHhp-mnO278Qk8--uDUqwyyHqYGdGZmFJrnZpsiVenmzSocWDE3aGcI09THBvltU5klZUb2e9YQky_m9G2VViH3uGay0Iw8zFIjHo7v_gWTaK9M78sMwsfKD-m4P1z7HQ85VpHg60QufaOFeP_4tW6Dtu4mxvDRuI_sMtUesLO7fBjfY61xXj-DDEDhnvnmZHpRcBKK-no235_ZBjGtk1fbhkA4ant2EiPYjlsKgkqeUDMIKo24zSTMrvZURuHZpeH2QasqbtXT4q264ljdn5PLG9SPXbxNzh--o34cY_sbyN0ohH1XY3WgzH1HP23e6WmqAj9bwO85KJ3Yavzu6E-uKjK_5ud8--BtD5Nf4sDJaVcKSqYUUD40KTbqeHsvu2Ro1xTnPzHrtLXhv8eduUcZx6KDmf5I7IqQ-XTRfcCLFA_DgAMu27lrDyrvbNegocEj0GVyjqlhP7HjZGE9ySZvO0pk_aNPLfKx-11WZSC_VKBTzxSS05gwB1bUjJag_XM8lCbwY6uebptpdaUu5_a51sG2jK5na5_zKsqt-IMKdFl1WBZ2IHRYM0tBpy2oOZWJ6mxXH6sPVoPzMpBE0L18b0b1fz3Oh7SQpv2eN6zFR9vR2SjxjwDVr1S-3L9amcqIHNUZe8WSMqstbrGEULCW0-rVun8w1YOhI49LTvDY9jY7IlcIqF67hlzpRTxnGULJ12auvGY3tp1j0HHaMqVkeYToSnELLllJkcjGDzsnnb-3URKSoQiY-oqpJFOt7s_mPNSvt3tfoWLH24rC7NoQphp7jEvEr7kJ-utem0c6sczf7CLrx0pdXY3Ey&cid=CAQSPADICaaNxBmaA6FrJ3mbz3xDGp2PTRiPMDx5Jh_Qf6lnz9b7V02RJhhJrq4YfemoS9ACPNx5dbn07vluXRgB&dc_eid=31079496&dv3_ver=m202311060101&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=1058475413627300600&adk=3430571818&idt=118&cac=0&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48626
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:22 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame 9CEC 31 KB
12 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

610d24f5996131b3ab98f18e05441cc246aa8674c3842df0df2b40b57ac9fd0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48626
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11874
x-xss-protection: 0
server: cafe
etag: 3876053170955424897
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:22 GMT

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame 9CEC 41 KB
14 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 307826
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 16:17:22 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 1CA6 1 KB
643 B 18ms
17ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 48578
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 28 Nov 2023 16:18:10 GMT
etag: 48472445140208031
expires: Wed, 29 Nov 2023 16:18:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 9CEC 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 156ab3064b82f74e08b206def277d1bd3053bb5813d0575ba3b64e7c94ff5eb8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 css2
fonts.googleapis.com/ Frame 0197 4 KB
745 B 22ms
22ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 04:23:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 0197 205 B
519 B 14ms
13ms Image
image/png 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 07:42:07 GMT
x-content-type-options: nosniff
age: 79541
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 27 Nov 2024 07:42:07 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 0197 604 B
695 B 15ms
14ms Image
image/png 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 18:12:33 GMT
x-content-type-options: nosniff
age: 128115
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 26 Nov 2024 18:12:33 GMT

GET
H3 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame 0197 15 KB
7 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2881d8eadc298102d2462e8d32e40792adce37b6cd89d99045f574eb3ecbb748

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 07:40:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 79639
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6702
x-xss-protection: 0
server: cafe
etag: 11213825687312121238
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 07:40:29 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame 0197 21 KB
9 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

25b1b4e9934aa4cb8e8bdf5fd7911f6ec67acde6b6b39f1561aec2244f7826af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 70713
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8781
x-xss-protection: 0
server: cafe
etag: 9666818975682992898
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 10:09:15 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4773 624 B
242 B 60ms
58ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLm-qd4DEIKN_vEDGJmQpv8BMAE&v=APEucNWl8RsHL1Vx5tmqEuS4CygrUVWKvp3vjRXUlamYbQawf9XhQKl5gt91YYpbTasrdp1AlXAVrv0BlUx5CwzIPSWWenLgk0iOMZGeWNhLPrvv38t3MRg0ZNoXbnmlz0vfBazVBfmwr3V5xLwVDATx1YwH7D3vSJvyHY3iOl3mA4wtdWYPBqI

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame F4F5 89 KB
31 KB 71ms
70ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38eb0379c855f10a0e69073af6b54582216fa37b7e2b1563a1246bbf1ef49642

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 31485
x-xss-protection: 0
server: cafe
etag: 7119415641918660631
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H/1.1 200
OK dvbs_src.js Show response
cdn.doubleverify.com/ Frame F4F5 2 KB
1 KB 76ms
13ms Script
application/javascript 2a02:26f0:1700:6::17d5:a18f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=26679214&cmp=30758062&plc=382221960&sid=8351941&dvregion=0&unit=728x90
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:1700:6::17d5:a18f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: bcf8f42f390686367155673ac10b31702dd14b03764d9ef4bf1554a2e5a1b459

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:48 GMT
Content-Encoding: gzip
Last-Modified: Tue, 28 Nov 2023 07:41:51 GMT
Server: UploadServer
ETag: "4bec59ab2a9fb77e9ba1af294cf3504b"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: no-transform, max-age=86400
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 932
Expires: Thu, 30 Nov 2023 05:47:48 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame F4F5 3 KB
1 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33131
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 20:35:37 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame F4F5 20 KB
8 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48629
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:19 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame F4F5 202 KB
64 KB 38ms
37ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame F4F5 42 B
63 B 49ms
48ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CUyRNvACbwIkOHwtDjHS7dC_w8aNxOW2x6tIKy8qe_r8EDT5-NI7ji_6cL4M4QXPQhnuvsO1bbwIqDrJa8fj_ujBZdCZToiAyl_z0dnebpCmreu4Y

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F4F5 0
20 B 48ms
47ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=2524739453863501011&x=1&ct=76

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 575A 236 KB
63 KB 30ms
30ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6137497824312366086/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6137497824312366086/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H3 200 Enabler_01_250.js Show response
s0.2mdn.net/879366/ Frame 69A0 120 KB
41 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=LGiGKR6JLe&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=LGiGKR6JLe&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48623
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 16:17:25 GMT

GET
H3 200 template-489be870.js Show response
s0.2mdn.net/sadbundle/7683192671021942909/ Frame 69A0 40 KB
14 KB 19ms
18ms Script
application/x-javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7683192671021942909/template-489be870.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=LGiGKR6JLe&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfcce6fbc676bcdc4c9f2e2cbdd40cee40a4b9066f829f4e9e400cbe142183f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=LGiGKR6JLe&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 16:27:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 393597
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14187
x-xss-protection: 0
last-modified: Fri, 01 Sep 2023 16:27:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 23 Nov 2024 16:27:51 GMT

GET
H3 200 index-be1f7599.css
s0.2mdn.net/sadbundle/7683192671021942909/ Frame 69A0 4 KB
1 KB 17ms
16ms Stylesheet
text/css 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7683192671021942909/index-be1f7599.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=LGiGKR6JLe&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be1f75994e53be710e621d9552d7cc796a347e85622acc435325d94e076b6996

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=LGiGKR6JLe&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 16:27:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 393597
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1385
x-xss-protection: 0
last-modified: Fri, 01 Sep 2023 16:27:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 23 Nov 2024 16:27:51 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 1CD0 5 KB
682 B 22ms
21ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=91751600011821804444546012523004&a=a32fa66c

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 29 Nov 2023 05:47:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 04:28:22 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 29 Nov 2023 05:47:48 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 1CD0 16 KB
17 KB 182ms
158ms Image
image/png 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=150&height=90&url=https://cdn.contentspread.net/24i/advertiser/36340/creativesup/native2.png
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=91751600011821804444546012523004&a=a32fa66c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 96a09c1b738b7b277dcdd633746e88124617b99a1b850a91793d85b33ce67957

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16833
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 1CD0 20 KB
20 KB 40ms
16ms Image
image/png 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=150&height=90&url=https://cdn.contentspread.net/24i/advertiser/55487/creativesup/1200x627.jpg
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=91751600011821804444546012523004&a=a32fa66c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: d4a94657f2e34dbff7265f0197a0efa03f829f3c5f808081e591cda90b1b426a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:48 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 20628
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 1CD0 20 KB
21 KB 137ms
115ms Image
image/png 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=150&height=90&url=https://cdn.contentspread.net/24i/advertiser/71422/creativesup/1200x627.jpg
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=91751600011821804444546012523004&a=a32fa66c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 3099f4654625afab56358e40582b6a4761944dc03baf9764b5ebbe84e163eae7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 20829
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 DcmEnabler_01_250.js Show response
s0.2mdn.net/879366/ Frame B13C 32 KB
11 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9fe8ec0612072dc6d3b4acd268e09d28c253807f47846a5f70dd8360d1a0d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 17:05:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 45710
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11558
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 17:05:58 GMT

GET
H2 200 ts.js Show response
cdn.retailads.net/ Frame A78C 5 KB
5 KB 11ms
10ms Script
application/javascript 2a01:4f8:d0a:2321::2
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.retailads.net/ts.js
Requested by: Host: futalis.de
URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=3351361775
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 2a01:4f8:d0a:2321::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: 525e7c89461afb3f73ea7030fbceba4f9e9383570159926acee637b4f86b8148

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://futalis.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:48 GMT
last-modified: Wed, 05 Apr 2023 20:14:46 GMT
server: Apache
etag: "1416-5f89c717cdc2f"
content-type: application/javascript
xphp81: true
accept-ranges: bytes
content-length: 5142

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 4773
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEN4ajXyAmbu8qAfDLv-qips&google_cver=1

43 B
740 B

21ms
21ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEN4ajXyAmbu8qAfDLv-qips&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLm-qd4DEIKN_vEDGJmQpv8BMAE&v=APEucNWl8RsHL1Vx5tmqEuS4CygrUVWKvp3vjRXUlamYbQawf9XhQKl5gt91YYpbTasrdp1AlXAVrv0BlUx5CwzIPSWWenLgk0iOMZGeWNhLPrvv38t3MRg0ZNoXbnmlz0vfBazVBfmwr3V5xLwVDATx1YwH7D3vSJvyHY3iOl3mA4wtdWYPBqI
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9AEyVX8%2BzL3FxKo9uRaPhjgdjyuWw5DsLF5ChYKKy3PVyEpDZGf41j9jPYWatvQV4Ya9on4OLUrzcaQbqo%2FroP%2FtZi3%2FPgMH5dMqy%2FhGMtAUSFVaWx5g9%2BYChPTRPvOV8o1vAFPNuiMCsg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82d88edf3daa1917-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEN4ajXyAmbu8qAfDLv-qips&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

rum
dsum-sec.casalemedia.com/ Frame 4773
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZWbQgxrhAdvYahmWZn9RwwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEN4ajXyAmbu8qAfDLv-qips&google_cver=1

43 B
735 B

28ms
27ms

Image
image/gif

172.64.151.101
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEN4ajXyAmbu8qAfDLv-qips&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLm-qd4DEIKN_vEDGJmQpv8BMAE&v=APEucNWl8RsHL1Vx5tmqEuS4CygrUVWKvp3vjRXUlamYbQawf9XhQKl5gt91YYpbTasrdp1AlXAVrv0BlUx5CwzIPSWWenLgk0iOMZGeWNhLPrvv38t3MRg0ZNoXbnmlz0vfBazVBfmwr3V5xLwVDATx1YwH7D3vSJvyHY3iOl3mA4wtdWYPBqI
Protocol: H3
Server: 172.64.151.101 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S1bryyfPDSmRywU0nzY3RBQLbrR5PhkoEpL5ChxrPdyf98NLjxsOFu5iu25kGOOyl3vaCBRFHBbG8T4D%2F7IhVmx36V4hmaarx4IlgHxc1DMqR%2BfpAH%2FqgLZNj3PPjjNaK41FIasqxe3i1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 82d88edf5dc11917-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEN4ajXyAmbu8qAfDLv-qips&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
ib.adnxs.com/ Frame 4773
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESELLlv0jSGXeU2X6aojJUll4&google_cver=1

43 B
841 B

18ms
18ms

Image
image/gif

185.89.210.141
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESELLlv0jSGXeU2X6aojJUll4&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLm-qd4DEIKN_vEDGJmQpv8BMAE&v=APEucNWl8RsHL1Vx5tmqEuS4CygrUVWKvp3vjRXUlamYbQawf9XhQKl5gt91YYpbTasrdp1AlXAVrv0BlUx5CwzIPSWWenLgk0iOMZGeWNhLPrvv38t3MRg0ZNoXbnmlz0vfBazVBfmwr3V5xLwVDATx1YwH7D3vSJvyHY3iOl3mA4wtdWYPBqI

Protocol

Server

185.89.210.141 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
an-x-request-uuid: 738a731e-e259-4ef1-820b-3b9a8d4965e4
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
cache-control: no-store, no-cache, private
x-proxy-origin: 37.58.58.248; 37.58.58.248; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESELLlv0jSGXeU2X6aojJUll4&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4773
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMzNDI0ODQxODI2NTcwODgyOA%3D%3D

170 B
188 B

25ms
25ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMzNDI0ODQxODI2NTcwODgyOA%3D%3D

Requested by

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
an-x-request-uuid: 5e5deaef-121b-4548-b212-669721614f57
server: nginx/1.21.3
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: text/html; charset=utf-8
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMzNDI0ODQxODI2NTcwODgyOA%3D%3D
x-proxy-origin: 37.58.58.248; 37.58.58.248; 950.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
content-length: 0
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/7683192671021942909/ Frame 78B7 671 B
437 B 22ms
22ms Document
text/html 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=sfXhF88Pnb&t=1&renderingType=2&ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d39d9ea438d324f737b2157a05e09297eaca7530c078d66025d070e2ef9d7596

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 409
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:48 GMT
expires: Thu, 28 Nov 2024 05:47:48 GMT
last-modified: Fri, 01 Sep 2023 16:27:20 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3FD1 0
0 60ms
59ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuD-_JI0WMXULORyRu8NAte4PEB5MKLJ2TCff2KcYoOMecc-SOqcCyaeTJD8KkroaUIhCiFyXdvhEpF93_0ZKiHdnTiIcJv_PTkZrxgTgwlLhbrjKtdRidhI8voL98EWesdkblPbCLISqpMpBPouaMw5iaX8xiNjm13pr7u5CiHJQwFl50ya3FiT3IsWyJznZQYwwl2ef7YVUP9W8JJQkq8fIYt1cfBs8hf7bQU2756zRB-6LfJMIp1gi97I3ISqSSGfSZYniXQsXCqr_6XvIP3uyTQ-yiUV0Ke6-iYmYBjZHoN259HPoQm1l4LwLKpJXpItREmpPKvWG7YI-aCDdPTXWvdqeIUMWlcnFHe8RUoURapEgZ0WlRLRSXlOEgYA-X2JVbC4-EqnuFV8ryaNCxjN1OSUxcETNxdU2btLo-Ou4uxBd4j_YioagUAriGVKbo_Vf4UOLUX4KPoXpY2H0OlinmmLsor5TjHwnipHpavMktdiTJE2TVO0k_uhXdtV6aplNkpEL5CiKdKB58AjgLHe96vEXavrGGIVLCCrdJBHuXCWnP4T-YN7esbf8fZEu-K8_2F86H8JtNplJOUZ2K6DElEdOfDdRH8hX0PttbWxUd_7JoL-kp7EMQyLVo2gaoNU2lprZ2e-k3XjcsR8QNJnPWKCAsMACfknuJECQeD1FNURBjYxwr8AZU3Ap9O6bUeTlcBiDTisBuqKwB8jUMPe0bxO24T0PotddVMh7OAdxSBDYOxILgFaqBP0SR5roDHJVKdZTSo1M0yjQqnJ9J3OODsfO2lOfAg8v9pbzsakGWFdROrQwTFu3cNWgt1X3ncU6p8TAELr5XSAR_nLUYivF8RwlFWOenDbuR0loHlKpGrJVwSwLzSF50YH6V9YBzg9DbMQ6RCX5q8X008MS55ePrSuleBOcwVpgw9hU0TD6xkxSBCy6Dre0CGe4IVXvJ5uB_nVmMRBWF7_Nq_4FnTVoahg7ARuX2nkBcZPngn7tCvTeJP8bBbA6QRgOtycoRKISVHl_-e-HfGlM4A0v1fcSx1LnMuTPyvdRjSzaBOZ_VfDHi7hBHrIgZcamHrQR9UNrtQcH0CwYyYwx1T5xymM8S5B7q3AV2c__6Nu_dO2vxTilWhHpa8afWpwprbp4A6LFByydCyJJCpYLMUT_lbHk3CGpj1C0KcHACwIzLvuK_m3sv_3P5NayzLLLwnfv2fJsK9um8XCkxLEtkf4ZK18qolLe3K9RtYku0YeItXG7kshfmrlB6ZeZiNnZ-BGaVEdmaiJnVImYqXZShmF-uAQfW_Z0E1c7eWfktLlefAgWV93p_QAmfFVAwhX84jXnd6JxB2AArAr35vX0aXLhkHFSfx18tBH9gWjleAKhK7qoj0FXnUeoPZVXYcRFGtUVF2q1dbJkYM3hcDQ639jMSNmYTaPS0_1MK2V93nyR-i0gO1XaMlqZgbboht9WQC5E0OeSBhXIgj4q22pmh9oowS0jjEmIARBzdAnRCxNLba-46tnGB9HI1GoiliqrXrOSrZCiI5EReYS1qa9-mmPzILgXnXfrpMerXg8COPwTw&sai=AMfl-YRnTqzhqldvWeP6HVXfcMgGT-Of60PwXRwjxC5oN5YOENmQIskcqryKQ99greOqCrf56QYfN26Dhr8QNsR-q2GtjgGQmGnq_XghWxR4rIZ09wGDjciWsbI-_-kpHbGt7y0JcUWrz0JS13LoEaKGPjLqAz0Y2oHHyap2jwvTca8xSBQnKQb5S-yB3DGve0TY7g1T-q1bw65ahn-1p5zWCHRkv_HRdRTRlLmQ2BnST-srmTRHVfb9ZAkoTEKx8bF2YECT&sig=Cg0ArKJSzKWvFcc8hpaMEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=355&cbvp=1&cstd=350&cisv=r20231109.22696&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

a23-56-205-163.deploy.static.akamaitechnologies.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 29 Nov 2023 05:47:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal90008.redintelligence.net/ Frame 0B46 7 KB
2 KB 39ms
16ms Document
text/html 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90008.redintelligence.net/request_content.php?s=78552800015844704444544012523008&a=0abc6272
Requested by: Host: hal90008.redintelligence.net
URL: https://hal90008.redintelligence.net/request.php?zone=okg862ss9p0j&nw=20&renderingType=javascript&namespace=9d459bec8a&subid=&uid=b4abbce114fe8e78&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&extVar[]=DV360_SSP%3A1&envData=&gdpr=&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DC6Upeg9BmZezjHquJ5LcPx6udgAzr0sGhaZ3x3vTFD_AuEAEgrYmDJmCVoqaCsAfIAQmpAm7843OJd7I-qAMByAObBKoEqwJP0I5oVuLM5N5ZJtlfQy7XaY7u3uIhgdMNyMSnIRaTr_2S-4Zaui_fOCxaY-22qKS2tQdnB6SmJT5F8kYVY5JXW3EnrbenAFVIgyAOp65ebgtOb9joxWpRnlYErwME9lVg2ijBao99XCX9mBvKEStNzOdNA1K0YxXm6xgWn6uvRorLbMQgD8bVElyl9QLBveuvvqQ-AVr907-0sSJFmPOmb5JPMpdCVM5QqCcEz-DeOEsBMGOARkAv7XFpvyv1ESGX1gSb3rPpqbhqMpYeuvHCj4uLR99YcFwbVexAKOxkuoVdt1H-Gj4Zy6eSxmIV2kYUvq01-g4bx80fbLr6h_tySUfvtDDJnDVAcnRd_5UG8AKw68wA23CWDFJFzT_JHQoaVwOJYyARqR0YD8AEvo7q5PkD4AQDiAW91IqIPpAGAaAGTYAHrK31nwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggfCIDhgBAQARgfMgKqAjoCgEBIvf3BOlj47qWZweiCA4AKAZgLAcgLAYAMAaIMGCoWChTktLEC7rWxArW4sQLktLEC7rWxAqoNAkRFsBOH77EV0BMA2BMDiBQC2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSTgDICaaNBqtFjf9o_aiGpclcqcl6_-Gb7HYQeyMVZ4YI36Ls14oCe2toDLsFFqdrWeVAcYp70Ckc6_L1FNV-WZRIz08u69DHDZjr8z83ZhgB%26sig%3DAOD64_3pRUVJtP2W3B2X0aPFZbH6FciU-g%26client%3Dca-pub-6266313190087173%26dbm_c%3DAKAmf-Dm3DofRcrnyM-ebdbNELqEShHotGdZLs5WyygOvgWkAAPZBhlb55TQ5iR2XpfT3JPBplD-4TGB5sH4i73B4mgY_qWgeqobYStECC5Yb1DLN0Ejwp4cJ94zPGkYKVTGvjKkFd8cV8SryeC5IRfb1lw1flo89z0i4qkZ44CehVyt5PMENiU%26cry%3D1%26dbm_d%3DAKAmf-AhS0wC7lIlT1PmbvXmrZ13LEvg1p--cmMLj2luN098xHuFdBJfUqlSGVYC1z7bOv9wSX-tUrlQ5jVVI9GJvHDeCzMTLKtcp84QUxIaIuUX1IDlXqSJ4RvokPOWs8PffzndMl1UFJecWANq48iKpsXbqFCO3Ym2yu4GXPThPWs74OQ5aAusfcXZo8XaQooM1zz1NkSGs-jr0VaK0LtQ3w8QwM4zB-il6XGNV-wr5IXCcAIosbaxP1Q7Zk1_dBdHS2hqBhnpJv9-8fLgipAMSAq9470QabX6VKTTRwi7aoXF4k79c1xchgcQIKO0oI4bNXeN_ZYKMEfLr02EDXXWSbc1UeAIOh4KVbe8K7x7iDK6SLjqF27frsBB2unO6CYMjV9xP1GUiuuBWPcsRuVmUMrH9kKb_mtJV_JWVNBKEiFZZK2EsJde8NO9yrU6KnZp8u8C4mxa6x-U53Sx-O1a9xtmxGT45fBiyRX3xo47zNxDYfF-caPvcHotjowTzYAdKz_XlRBDRr37gNvUBl-yMj5Asdx13gBVfHiDrgKvU0D4rhAM_DQi7CgDVSsMPp9RhRgi1Wvn%26adurl%3D&documentReferer=https%3A%2F%2Fwww.farfeshplus.online%2F&ancestorOrigins=https%3A%2F%2Fwww.farfeshplus.online&random=4761348377744&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 4f912bf9f48b21caa7eec5e638cbee679a6886f7f89db6e412efb8926d00fff5

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2022
Content-Type: text/html; charset=utf-8
Date: Wed, 29 Nov 2023 05:47:49 GMT
Expires: Wed, 29 Nov 2023 05:47:49 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 4336 43 B
702 B 75ms
74ms Image
image/gif 23.56.205.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3502280&v=23861&q=476504&r=296283&pref1=78552800015844704444544012523008&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.56.205.163 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 29 Nov 2023 05:47:49 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 4336 43 B
702 B 43ms
42ms Image
image/gif 23.56.205.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2329635&v=16160&q=356171&r=296283&pref1=78552800015844704444544012523008&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.56.205.163 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-205-163.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 29 Nov 2023 05:47:49 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 4336 43 B
702 B 67ms
53ms Image
image/gif 23.56.205.163
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=3458780&v=55355&q=466255&r=296283&pref1=78552800015844704444544012523008&pv=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.56.205.163 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-56-205-163.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 29 Nov 2023 05:47:49 GMT
Strict-Transport-Security: max-age=86400
Node: Helix
Content-Type: image/gif
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Connection: keep-alive
Content-Length: 43
Expires: 0

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame F41A 38 KB
13 KB 14ms
14ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 307778
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 16:18:11 GMT
expires: Sun, 24 Nov 2024 16:18:11 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 v3 Show response
id5-sync.com/gm/ 319 B
607 B 46ms
16ms XHR
application/json 162.19.138.116
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/gm/v3

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.116 Frankfurt am Main, Germany, ASN16276 (OVH, FR),

Reverse DNS

ns31533567.ip-162-19-138.eu

Software

Resource Hash

8a96ea846d617c5feaaa5178264d43bce3164dc52926e7f39393d070e010f94a

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.farfeshplus.online/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.farfeshplus.online
date: Wed, 29 Nov 2023 05:47:49 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
content-type: application/json;charset=UTF-8

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F4F5 0
20 B 47ms
47ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=8799995933922&version=m202309260101

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F4F5 0
20 B 47ms
47ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=8799995933922&version=m202309260101&ct=76&x=1&cor=2524739453863501000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame F4F5 16 KB
12 KB 184ms
184ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DkBrVdudxl_Z37jZ4246kgGHekxVzKuUqNf_uTn_P9-Pqute3Ek5UcAuirXQP_OrLc3VJq4Fc9Oaha4kQgnqpFKhAJjAzKztssvyUlnYqos0XcR4lLeanJYsuSBYh6JtW5D0M2wE8Beg-p4H7L52nF4T8VEgZkQCxgGD110DderYD58XE&cry=1&dbm_d=AKAmf-CXPocB4yuPDp7VZawcEUuXtVhird8dkL0BngK78G3BWqD3gpjR8kBap48BqXt5rz95ZgeAFtU08mbAjZMacPMdWLHDwcdqkNCLmfOa42uySWm56bknfHEmMaHkoAzKhag99zStaWKglmLcG-xINshvHFsEfbN_6imHXkbbM5U2ZTPHA3kuRzHUgtLricKrBURlSYV1bcN95hC3tnhHFWWui0_OwfipZ8WvTWejcxC7Z-rOc_QYcMvZw-Gq9gnp1r_aA2W4VXRVB1U0SXj9Q_S9wOYKQ_OmnfiuhxLC3Wdnk1RTFX0YDeSobkeXQplZ5JmGjkHj6r9AqHVzoHgEQ52PZ-r3_-AWJTQ8ZDfWM1XLpMH4jpLbWyp5frLp3qnvppQDcwtXM9NLLghcwwICu0xONlp6raQh-Nvll0v94PfMdnbIKQ5YfR-lYXN6rZPHOeam3Sduc9AmRhesYWMT9CPFbkGkzBQCMFei8FY5lApxnB_iL5RWlw8CU-ln2gwj0H4ruIRvg_fvO_AQUJ-cnpKRZ527tRB-jCFZjcYRoxi6FjImU7b0C2HQA_5SfPS-hoMi7RJBIjIFSAWgQV9XqdGK6xdm5cLpUtax359YTTD6ur2Tvjd40SBANIUScvX9nLPieT8PVILc6lZd03irLK5BcIrG7KrROx89Mbad8p7d0XiJI7ru-TkWdVuifXavF59lZGrkmFNYwyYUi6jk64sS5sqkeHEuIkdVbFUgrwojmo5oDXWWyz4Z2wU_g5G5zPszXgJuYjQWvRQMKKJYILT5fKMxgJ9e4jQOUFujZBjhTA0vB6TKuT9AbUeaMsxE12XgoPfEzaoXPMNHQBCiZgaEVasrU8VZyQGSfYKrSBnLBd63vVEN1mmzUfH94ftZ7-5zkn2DtHfNPPPNilfxci6tCN3vV6bXAmjnFmkpt6HXDxkWnK457rb2sOVp318Iq-2Zch3V9fNindeG3rMKeglCt_D8O1rA_7RSsSCi4F1Ksh3nwSUjtUUpxx4jjCLdamCffXl57LYD-jmLJD3K0Mbt0vIigq7fNF4g75-E2GtRe-XF4BAg5Rxtwy4sc_d6sIh4tYdcD6AmF5k1WS1aOf67KfLxU6Ywlho3WZeWHMUiNhMv352Z85CGriXfb6cFHOGoobMxNfGWRwUUo63RBVQR4JcHaxf3orC3mJ4b_Rm9WVDZHW0eJJfNDKqbNXFqBrPkQkBwVvXR_bADiK3sleeb59t_koLqJGmxZCdyo5o5AGJAoQi3W6xrX48JUw81_WdrIiWlS-4OqWxxJvmd3ff7hibg8f7u6aCkloHs4CV1qk0W5eHTKtM3vknW83uwggd074Z-XcMnsB9I_niC74Lvf5Gtfh2AfYTv_tayCfzugxgQGJu0bXl3k-QMWPJalfiPO73BdtTFCoQA1cyk8LWkvWJePpZEHM1IBCjHN6ORlMfPRdDjmhsYIy_h8fRaI6DqMnoyWa0hLecg6N5E_3E4XiXHvfF75aoz7jxbE2WFGniESTyLtVwkSQ2jWCdc3rohX9Y3hsKT0QhJif7oKeda1l82-8FychWzatRpNPU6GKy2SmR_cKb_rr5APg0s_OUdpyIaA27j1xfxpjna4c2bhxq6w-xlUUOULnt3vB2gs8TL-Fi1AlBGCFC13Do7_Siltn8bYXOpmA6iVRDMUzink7iB5ij1PecGkUv4yu8gGDmhqh_cKo0fSh2NclF9JU2J5auGAZR7edsDKVyBopLyTVFxiaFZDUTsNa20Zn50uMO9mcfs2njRFmjOFJN7Eaut68380LGywJji2B5nM8gq6FHmaILQ0GUnY4PG9Vvk6Y_iSJIDm1_oERlWsh-h38GRjSVKEvbqpxTRDbkDAhAVAu91XD6zE9oDsEKsWQUWDoUDM-kvBASxHrLw1rzrF_71IlNIlE7VRC9ZBiIK1qS7qIfpMeK6fLQO8zrnu-LbWPqn0ywTKBvP5sojaurmLgwzLGEAKc-MCqzimYNfgUga6hRbVnojTXKTD8SIo2xkf9zTVJSoJwfeapMnP2Zt0c0rNx1L---_0VaqKKPmfeFcqiosW7CfCGCytkKzS17WDBjRKU3jgOwoRjO99uMLvCGS4FJJjklUazREdsMw31lLdApzVwZ4wIFQ5qwvcITE3AOxY3j8ykP5xyIFIv5sh3YHpruqxG--vJQ6jn3OHg9R0ZPoKE_EHqI1phro5E0eOfvrytl9J5Oh-8gGL0PwVmO6QMZoKbk7ybpp-QpBrhAJwnHCNflK9bWkJZ9FOO5dIEH1YFL_uBBPmCl8hGBPlBJ-_M5a6u8C_-rfsOciYtBq11flKQ5eDWxsZItn945aJBIBj_TfSZSqileZHJgc4MjbUq3HUKDnUAaf0VNn7xyNIp54zUi07V7HekQYA-4iGFg7a0mBtrpHeU_Yq5-TyFdbY4McFtBdvpJtDELoG-RZAf7ZmTjHpgsDhWH6m7HInjiv4Re_J8HrAZ3tUO8UY_hdyZSiTW9kZ8CLk9qPnKrzW1P6OmQPwzn_2TYOThklwE2jU3SUpXaBE2Kca3hzPUloLNivazUDdfBHkFzgG7ske-LlVWaI78RmZ2XO1agJ6LB1N2WitgngafRydt_nsIxbV4qhXug5NCFGPGkeQpv4DPUIDR5hxDhyB5Xo5HXHFUEpHs4y0H3NKzg9cJFcZiYJMNK9icLYnZaG24xwrr18XSraKVqZxFeoBq-Etvxbt1B5WiNcuHEf_tOtfs4iMZfKh6AqScDNeD5YwubePksB_mBnpatE0xx9QyYRMrD_fc4vNTI59w4xz87E1AyonvPxhZCbiT832rmpGcZl3kVyKG7iQJw8hE3pDzkv7PzhfFuevym4KBdew9PwC6ryoaYM0ZDsg6JA9p4U2K6Prp2cZiRlWiaI7wd09oO1CMkeVANAL3PTL1ekkwIcYA4E-MC5F1BJhtdcE_s9m76cydbzomsWl2hAXkr4hQAUtS5tAE48YGIJQlXdnNJKsZe69wx-0Nf1te_khQJwzP1YDSZBJC7PgsWk_ggpWdytMg67EwlhoP8Xs3zlnV42VL1qo3QPhwOHovsXyUyyuQ-VjWfcuDJC2rvqX6ktQmAouICzGGGzHa1Pb78mRxCH_mwLiTePv38KTwKXzsakw-m9T5W_V15bpR5hR-M29sbjTDutsfSu2BPOWBqvw4h5XVo5GCHCHP4wces9Bqv_e2_r-Ij7gUO4RY5KUhTPrZ902zSRhveqqcfouLUxBQ2HGCOOHiLGwMzjr5Ooo_QQ4rw5QbDSBY4KLhjldkn8HT4XgGVD27DgPr6wd7v4FOcx3mxLFbNq95ulPLMuqF6drOsH1OG0NlfyWQ&cid=CAQSTwDICaaNkp8__KLLG6fuP0J6dt5ad-7h0-ZLpFOvOnX-CkrNPCbBivPYQgVu1NCX3kNtjoIL69GF8xrkfW52RavWQgcpaQJPSPf3j2SrrosYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=2524739453863501000&adk=388007313&idt=77&cac=0&dtd=13

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37b85c87042e72e2489408f181dcc691b8cf67ace4886efa26b29aac0768e17f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12494
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9A5E
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEEKXLl4wE4OdoMt7b83_Foo&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEEKXLl4wE4OdoMt7b83_Foo&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=OXF3bTljUlUxUjhkcWw1&google_gid=CAESEEKXLl4wE4OdoMt7b83_Foo&google_cver=1&google_push=AXcoOmScqm5rPRqau-09-kbYJYGtI3wSIX_Of8So3fWuL3F...

170 B
188 B

25ms
24ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=OXF3bTljUlUxUjhkcWw1&google_gid=CAESEEKXLl4wE4OdoMt7b83_Foo&google_cver=1&google_push=AXcoOmScqm5rPRqau-09-kbYJYGtI3wSIX_Of8So3fWuL3FRggRh6pMqAdqwIpQvD2APF48JOsXnTkdOKPofde4nJzqYJ88YOwI5Vg

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 29 Nov 2023 05:47:49 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-029f22d856dc4e10e@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=OXF3bTljUlUxUjhkcWw1&google_gid=CAESEEKXLl4wE4OdoMt7b83_Foo&google_cver=1&google_push=AXcoOmScqm5rPRqau-09-kbYJYGtI3wSIX_Of8So3fWuL3FRggRh6pMqAdqwIpQvD2APF48JOsXnTkdOKPofde4nJzqYJ88YOwI5Vg
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9A5E
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESELgKbNyRrc1amdyNWmEzRGI&google_cver=1&google_push=AXcoOmQgDrbqwio8UPoPESYMO6OEO4GX0Gy088BoKkkUupx3XR27wKiTSfmdLOyQWOzC1GFLWw2o5F7hnWqinG...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMwNjc1NjcxNTEwNzA1NTc2MA%3D%3D&google_push=AXcoOmQgDrbqwio8UPoPESYMO6OEO4GX0Gy088BoKkkUupx3XR27wKiTSfmdLOyQWOzC1GFLWw2o5F7hnWqinGkwpv...

170 B
188 B

31ms
26ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMwNjc1NjcxNTEwNzA1NTc2MA%3D%3D&google_push=AXcoOmQgDrbqwio8UPoPESYMO6OEO4GX0Gy088BoKkkUupx3XR27wKiTSfmdLOyQWOzC1GFLWw2o5F7hnWqinGkwpv-j6f0Ql2so7w

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMwNjc1NjcxNTEwNzA1NTc2MA%3D%3D&google_push=AXcoOmQgDrbqwio8UPoPESYMO6OEO4GX0Gy088BoKkkUupx3XR27wKiTSfmdLOyQWOzC1GFLWw2o5F7hnWqinGkwpv-j6f0Ql2so7w
Date: Wed, 29 Nov 2023 05:47:49 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9A5E
Redirect Chain

https://match.adsby.bidtheatre.com/adxcookie?id=&google_gid=CAESEIXlWkIA37Z-obftXP1tYGM&google_cver=1&google_push=AXcoOmS_Fbu3-OWTS1F2Zsh4OhWLbVCOAyWxz_6PLnJ8NZ_tNJPFlfaqh7ZhNsFFQyJVu6Ywc7d4if00uuD...
https://cm.g.doubleclick.net/pixel?google_nid=bt&google_push=AXcoOmS_Fbu3-OWTS1F2Zsh4OhWLbVCOAyWxz_6PLnJ8NZ_tNJPFlfaqh7ZhNsFFQyJVu6Ywc7d4if00uuDjuxoLrtL_lCpXBiBlGQ

170 B
188 B

31ms
26ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bt&google_push=AXcoOmS_Fbu3-OWTS1F2Zsh4OhWLbVCOAyWxz_6PLnJ8NZ_tNJPFlfaqh7ZhNsFFQyJVu6Ywc7d4if00uuDjuxoLrtL_lCpXBiBlGQ

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=bt&google_push=AXcoOmS_Fbu3-OWTS1F2Zsh4OhWLbVCOAyWxz_6PLnJ8NZ_tNJPFlfaqh7ZhNsFFQyJVu6Ywc7d4if00uuDjuxoLrtL_lCpXBiBlGQ
Date: Wed, 29 Nov 2023 05:47:49 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=3000
Content-Length: 0
P3P: policyref="/w3c/p3p.xml", CP="DSP NON LAW OUR CUR DEVo PSAo PSDo IND STA NAV COM INT"

GET
H2 200 UCookieSetPug
image6.pubmatic.com/AdServer/ Frame 9A5E 0
167 B 67ms
19ms Image
text/html 198.47.127.19
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEFlVkkmkluFsQmv7_tdX5gU&google_cver=1&google_push=AXcoOmSK7agVKnbMfo2QSu70DHxD3wC5g2xiZ8P_WrPS4TSfFl46VoZw6ULX0nhRrRo_Y5_nbGTI_NbGGk0jsQG50LOKM-L82EbRGQ
Requested by: Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 198.47.127.19 , United States, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
date: Wed, 29 Nov 2023 05:47:48 GMT
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9A5E
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEO0kyGMIhIpIO1jW5B6smlU&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEO0kyGMIhIpIO1jW5B6smlU&google_hm=ZWbQgxrhAdvYahmWZn9RwwAADHoAAAIB&google_nid=index&google_push=AXcoOmTU1Zuhq32SDAuJtZPbyHIuat3IsRRZX...

170 B
188 B

35ms
35ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEO0kyGMIhIpIO1jW5B6smlU&google_hm=ZWbQgxrhAdvYahmWZn9RwwAADHoAAAIB&google_nid=index&google_push=AXcoOmTU1Zuhq32SDAuJtZPbyHIuat3IsRRZXsMtLvrWizds2hu7-H28-IcYl8lpzCj5sD2XceaFVYYxCLEiOiOL-_lZNPOBFEA6dA

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F%2FMIpdFbC9GG9s5t1D1aONxupN3jwN8zX55MHykEFjPqazmSUAXk1l8BDAwOZ4ObhDyXOkDhxWvW6dfkDV8wmFg5uTzCbI6q42Lo6uIc75onJmJFp73%2FapiO04VFH0AaHAAxxGbDyGpO4A%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEO0kyGMIhIpIO1jW5B6smlU&google_hm=ZWbQgxrhAdvYahmWZn9RwwAADHoAAAIB&google_nid=index&google_push=AXcoOmTU1Zuhq32SDAuJtZPbyHIuat3IsRRZXsMtLvrWizds2hu7-H28-IcYl8lpzCj5sD2XceaFVYYxCLEiOiOL-_lZNPOBFEA6dA
cache-control: no-cache
cf-ray: 82d88edf89bc71c1-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H2 204 -
s.ad.smaato.net/c/n/// Frame 9A5E 0
239 B 50ms
21ms Image
text/plain 2600:9000:211e:ee00:1b:5138:8a40:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEEBjdfnT0-fTbrDJaFq5P-o&google_cver=1&google_push=AXcoOmSrD7hUPBVa2lm0nbfmNGXxUKqdE68YcpEJZqrJ4uILLBdIHmLhVTq4Actcz1s-cCkYbwSUgJ-ZYOBl61UbdtqMkKj29O7yBA
Requested by: Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:ee00:1b:5138:8a40:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:49 GMT
cache-control: no-cache, must-revalidate
via: 1.1 0363fab377de19b9b4f85394469f6fca.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-C2
x-amz-cf-id: vBAgwKInBOQTe7PRxFBei1iCHzU7T5MCcsgLiVs5N1i6BYpfJu7PPg==
x-cache: Miss from cloudfront

GET
H2 200 ebda
match.360yield.com/match/ Frame 9A5E 43 B
200 B 137ms
31ms Image
image/gif 54.76.73.93
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.360yield.com/match/ebda?google_gid=CAESEJAVx3NjV4OSPTAk2z1G3VU&google_cver=1&google_push=AXcoOmTKDb8IQZR_p900ZmrCpMt5edpgDJOEMVLB51UBJOuQBNJmpGkhHKCxA9DIm2VJTI5eGR0fj5RihhlujodoubkpSeV0_ReCug
Requested by: Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 54.76.73.93 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-73-93.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 29 Nov 2023 05:47:49 GMT
content-type: image/gif
content-length: 43
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 9A5E 0
12 B 21ms
21ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13J4qfDI7_kN_qhqA3ZTExenwgwRSbbFgNZV3Ndmg-mWLeiHvRr1VtZAq5TiQgw_0V2uKWGX

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 7548 53 KB
19 KB 91ms
17ms Script
application/javascript 108.138.36.89
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=57853200014847804444544012523024&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.36.89 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-36-89.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fbc6bed540723f219a878e5735ae8cb1c05aa9f7012bf21870cd79e41af25bcd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:26:48 GMT
content-encoding: gzip
via: 1.1 3d7648aa47c887339ebd63c859836150.cloudfront.net (CloudFront)
last-modified: Thu, 23 Nov 2023 16:26:10 GMT
server: AmazonS3
x-amz-cf-pop: MUC50-P2
age: 48061
x-amz-server-side-encryption: AES256
etag: W/"1180a1bfee0aad979766ecd6180b923e"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: ABCN9mYI3kbrkQOLq4U46jh3yWfNU1xQgBQCdYt6bRSHob7dRGnvaA==

GET
H2 200 1x1.png
cdn.track.production.webgains.team/7121/ Frame 7548 3 KB
3 KB 61ms
17ms Image
image/png 108.138.36.21
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1.png?Expires=1701237168&Signature=Qn5-Rd58uPIybYkM9rIZ9QBlk8p1v~WvDC9nl8XIe7SoaGpR2wb8NZIV3h0EIUNdqmKA9GYPTz3j1AEB4Wx8FkAqiv9ZgwQ9wj5mLbxHkn3fLxQ6O3JnpvbaBDP5iRSi51D0aRBMFtIMG7JVOBwTMfKc5Wuhl5qHPt9tTsj3H-kU~J03JytPU2dqUqF7FZK6lqR4KXFmPzpyH~btw3dMmovpasG6eqlQLcavlCdbaOCoFeh9TziihN7w2wLltsKeRamGG2OdLreiG3VRdZNyeeeRqv1ZKpv113ve02KPE1qWuhM5PhroDqxZaovaEsDU4RVHssTjSyLtzTDdjeHs5g__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=250&slotname=6076681977&adk=2278793534&adf=954853469&pi=t.ma~as.6076681977&w=300&lmt=1701236867&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867142&bpp=1&bdt=605&idt=1&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280%2C300x250&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=574&ady=4615&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=5&fsb=1&dtd=4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.36.21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-36-21.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-amz-version-id: null
date: Tue, 28 Nov 2023 07:14:33 GMT
via: 1.1 068dc56746723ff514ed3604e029e74e.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: MUC50-P2
age: 81198
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: fIkSi60Q1TqiONnDHyopmIgBRnpWZW9oyQYQGFD0yZfhOZBR4O7RRA==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1CA6
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEMJ0eJqSWV18P7EIZrlV7iI&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEMJ0eJqSWV18P7EIZrlV7iI&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=OXF3bTljUlUxUjhkcWw1&google_gid=CAESEMJ0eJqSWV18P7EIZrlV7iI&google_cver=1&google_push=AXcoOmS_3pz8NVAHLPCrkj1GudiEy9o0B37rlgXEGUbldLd...

170 B
188 B

25ms
25ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=OXF3bTljUlUxUjhkcWw1&google_gid=CAESEMJ0eJqSWV18P7EIZrlV7iI&google_cver=1&google_push=AXcoOmS_3pz8NVAHLPCrkj1GudiEy9o0B37rlgXEGUbldLdA0JufHYIjR8O6cH034plKKhOreBwZ15ljzem3p3zy5x8j-z1RhpFe7A

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 29 Nov 2023 05:47:48 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-006fa252bd7417634@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=OXF3bTljUlUxUjhkcWw1&google_gid=CAESEMJ0eJqSWV18P7EIZrlV7iI&google_cver=1&google_push=AXcoOmS_3pz8NVAHLPCrkj1GudiEy9o0B37rlgXEGUbldLdA0JufHYIjR8O6cH034plKKhOreBwZ15ljzem3p3zy5x8j-z1RhpFe7A
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1CA6
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEPa83_PALqKE3LTrcgYmOXE&google_cver=1&google_push=AXcoOmQizkDRY6-rUUdNSuoyUQG6WgnbF4xfaRX7wIa5Sw00hoVi8J9OmKQs1Z2ye8xuknr3nj-0-Crml5VhboLV...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=vqSV-zTwTIUYueqm3Hqd8A&google_push=AXcoOmQizkDRY6-rUUdNSuoyUQG6WgnbF4xfaRX7wIa5Sw00hoVi8J9OmKQs1Z2ye8xuknr3nj-0-Crml5VhboLVJIte8dEpD9Trhg

170 B
188 B

23ms
23ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=vqSV-zTwTIUYueqm3Hqd8A&google_push=AXcoOmQizkDRY6-rUUdNSuoyUQG6WgnbF4xfaRX7wIa5Sw00hoVi8J9OmKQs1Z2ye8xuknr3nj-0-Crml5VhboLVJIte8dEpD9Trhg

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 29 Nov 2023 05:47:49 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=vqSV-zTwTIUYueqm3Hqd8A&google_push=AXcoOmQizkDRY6-rUUdNSuoyUQG6WgnbF4xfaRX7wIa5Sw00hoVi8J9OmKQs1Z2ye8xuknr3nj-0-Crml5VhboLVJIte8dEpD9Trhg
x-host: tde-deliveryengine-production-6987bbc57b-mf92d
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 dds
rtb.openx.net/sync/ Frame 1CA6 43 B
246 B 84ms
21ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEK3MACtDFZAADB1fuJ5_f6s&google_cver=1&google_push=AXcoOmR3qTljt1VQjuv--6VL68iBmVodGJQHphCIpxLAdCU2AtWjKW70M8gevkd7UJabtcVeYHxVcDFgxOXNrJw1A1WNDYBPmMmt
Requested by: Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1CA6
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEIaJ7XwXMvWAMOruq_aAJlY&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIaJ7XwXMvWAMOruq_aAJlY&google_hm=ZWbQgxrhAdvYahmWZn9RwwAADHoAAAIB&google_nid=index&google_push=AXcoOmQxIRFYWObPpCaasi1MuIFGOVMGbWu0u...

170 B
188 B

33ms
33ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIaJ7XwXMvWAMOruq_aAJlY&google_hm=ZWbQgxrhAdvYahmWZn9RwwAADHoAAAIB&google_nid=index&google_push=AXcoOmQxIRFYWObPpCaasi1MuIFGOVMGbWu0uA2oSRDK_UcWH-EWuwewLtUGcLkJ20sg71x_-MoMY50ix5b-4ORszIM-uF6wKiukMw

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zU%2FI5rrqi2096u92RbQLXBzL%2FZhx4ofxuy9IaNNY6VqxPbG%2F4%2FTJ%2FLISOeCPKIzuxopefQyokGFdyZ2JsWej1SvxRrPuedJ6lusVMuBnq12VZb%2FB%2FKgP7uyiXEyJeWc88lrlMHlw0l%2BUlQ%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEIaJ7XwXMvWAMOruq_aAJlY&google_hm=ZWbQgxrhAdvYahmWZn9RwwAADHoAAAIB&google_nid=index&google_push=AXcoOmQxIRFYWObPpCaasi1MuIFGOVMGbWu0uA2oSRDK_UcWH-EWuwewLtUGcLkJ20sg71x_-MoMY50ix5b-4ORszIM-uF6wKiukMw
cache-control: no-cache
cf-ray: 82d88edf99c071c1-FRA
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1CA6
Redirect Chain

https://cs.media.net/cksync?type=g&google_gid=CAESEIzjEeoJgDHsxZLORzMu6OA&google_cver=1&google_push=AXcoOmQPBI6L-RljVeEaXeoF-PjARSMwtXxuUvU1BM4jnC-PjpsZR1id1AnstwdmrDx1tY7HHfgbanIhqrWAuSjlXgt9tC_zZ...
https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzQ0MjM4NDY5NzMxNzYyNjAwMFYxMA%3d%3d&mn_hm=MzQ0MjM4NDY5NzMxNzYyNjAwMFYxMA%3d%3d&google_sc=1&google_push=AXcoOmQPBI6L-RljVeEaXeoF-PjARSM...

170 B
188 B

24ms
23ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzQ0MjM4NDY5NzMxNzYyNjAwMFYxMA%3d%3d&mn_hm=MzQ0MjM4NDY5NzMxNzYyNjAwMFYxMA%3d%3d&google_sc=1&google_push=AXcoOmQPBI6L-RljVeEaXeoF-PjARSMwtXxuUvU1BM4jnC-PjpsZR1id1AnstwdmrDx1tY7HHfgbanIhqrWAuSjlXgt9tC_zZUM7fg&gdpr=&gdpr_consent=

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 29 Nov 2023 05:47:49 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzQ0MjM4NDY5NzMxNzYyNjAwMFYxMA%3d%3d&mn_hm=MzQ0MjM4NDY5NzMxNzYyNjAwMFYxMA%3d%3d&google_sc=1&google_push=AXcoOmQPBI6L-RljVeEaXeoF-PjARSMwtXxuUvU1BM4jnC-PjpsZR1id1AnstwdmrDx1tY7HHfgbanIhqrWAuSjlXgt9tC_zZUM7fg&gdpr=&gdpr_consent=
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Wed, 29 Nov 2023 05:47:49 GMT

GET
H2 200 https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25
x.bidswitch.net/check_uuid/ Frame 1CA6 43 B
147 B 30ms
8ms Image
image/gif 3.69.41.2
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/check_uuid/https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dthe_mediagrid_eb%26google_hm%3D%24%7BBSW_UUID%7D%26%25%25GOOGLE_PUSH_PAIR%25%25?google_gid=CAESEB1BNy6Ln8miA1jkPgZDsnI&google_cver=1&google_push=AXcoOmQYOMuyQ51J842tHooGo-DILQdOWw2OEt7y_KwsLXCYWx3y-uFwi5ht16_v8QW5adHIjwx0p2phzTvSgqWWNuXkwGHyzGLz5WU
Requested by: Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.69.41.2 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-69-41-2.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1CA6
Redirect Chain

https://csync.loopme.me/?pubid=11537&gdpr=${GDPR}&gdpr_consent=${GDPR_CONSENT_109}&redirect=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dloopme_eb_%26google_hm%3D{viewer_token}&google_...
https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=491e9348-3c3f-4728-86ff-a3e96a5134b0&google_cver=1&google_gid=CAESEK5ugQSsPkluhcyj2NZvZJg&gdpr_consent=${GDPR_CONSENT_109}&google_...

170 B
188 B

23ms
23ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=491e9348-3c3f-4728-86ff-a3e96a5134b0&google_cver=1&google_gid=CAESEK5ugQSsPkluhcyj2NZvZJg&gdpr_consent=${GDPR_CONSENT_109}&google_push=AXcoOmThoQRHfZ4EdxtFUKGB606JkWrBOQF5umWgvaBsKcAg_P31rgVHk-qKwvo2Azrer6nCzVU4SDxTz1goMCOhJZQMWSKuyLeD7A&gdpr=${GDPR}

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=loopme_eb_&google_hm=491e9348-3c3f-4728-86ff-a3e96a5134b0&google_cver=1&google_gid=CAESEK5ugQSsPkluhcyj2NZvZJg&gdpr_consent=${GDPR_CONSENT_109}&google_push=AXcoOmThoQRHfZ4EdxtFUKGB606JkWrBOQF5umWgvaBsKcAg_P31rgVHk-qKwvo2Azrer6nCzVU4SDxTz1goMCOhJZQMWSKuyLeD7A&gdpr=${GDPR}
date: Wed, 29 Nov 2023 05:47:49 GMT
server: _
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 1CA6 0
12 B 22ms
20ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LOMGRU-qwdZfxHcbCi2MvMxeO4mlxBz_INfcJ0QZlDqWjQtS3CStM0X7kwa0qtxJCm8zP5Mpg

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK viewability Show response
hal90004.redintelligence.net/ Frame 1CD0 0
150 B 35ms
12ms Script
text/html 138.201.63.116
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90004.redintelligence.net/viewability?s=91751600011821804444546012523004&a=82205bab&vb=m
Requested by: Host: hal90004.redintelligence.net
URL: https://hal90004.redintelligence.net/request_content.php?s=91751600011821804444546012523004&a=a32fa66c
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.116 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.116.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90004.redintelligence.net/request_content.php?s=91751600011821804444546012523004&a=a32fa66c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:49 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
DATA 200
OK truncated
/ Frame 4336 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 83df26a0c525173e13f7e65e2626a677bce089a28ee2d3fc3757430dd55f38f8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 main.19.8.461.js Show response
static.adsafeprotected.com/ Frame 9CEC 213 KB
66 KB 16ms
16ms Script
application/javascript 2600:9000:26da:9e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/main.19.8.461.js
Requested by: Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rjss/st/1854208/76774456/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1014933263&ias_pubId=pub-3831894559014614&ias_chanId=1&ias_placementId=20808097378&bidurl=https://www.farfeshplus.online/FP66.asp&ias_dealId=&ias_xappb=&adsafe_par&ias_impId=v4~~ABAjH0jRXcR-x7m_stGyLnMSsf86
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26da:9e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5d60c053b0001fc62bddd8d273be2d45bd62085f6179c57e1d2ae8fc6be54819

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 22 Nov 2023 09:25:14 GMT
x-amz-version-id: SsS9NfODLbDHY8VzzB.lL2F1gs9DY59I
content-encoding: gzip
via: 1.1 99a7400285d83f528f50f54d665628e2.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P4
age: 591756
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Wed, 22 Nov 2023 09:25:12 GMT
server: AmazonS3
etag: W/"315b08a0e21410ecc940dd381f9a8dd0"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: bEfWYpSy_4vnFS8pWdqeMEhRz0FhppmM3xoZ9UQc3yYUb_riKXnVQg==

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 6CBF 39 KB
15 KB 17ms
13ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 04:52:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3309
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Nov 2024 04:52:40 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 83E1 39 KB
15 KB 22ms
20ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 04:52:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3309
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Nov 2024 04:52:40 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 5E3B 39 KB
15 KB 26ms
24ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 04:52:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3309
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Nov 2024 04:52:40 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 9F53 2 KB
823 B 14ms
14ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 70714
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 10:09:15 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame 9F53 23 KB
9 KB 16ms
13ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33132
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9282
x-xss-protection: 0
server: cafe
etag: 14645652906762492339
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 20:35:37 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 9F53 3 KB
1 KB 18ms
15ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33132
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 20:35:37 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 9F53 20 KB
8 KB 20ms
17ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48630
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:19 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9F53 202 KB
64 KB 34ms
31ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:49 GMT

GET
H3 200 a6de5423b7c632060e8f86136bd5d27a.js Show response
www.gstatic.com/mysidia/ Frame 9F53 37 KB
15 KB 22ms
19ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a6de5423b7c632060e8f86136bd5d27a.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0c21f21f7b1658ed6ab5c0461020a21d62f9e0a7cd7cf3d9e6ef61a2c481f31e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 10:09:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70714
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15478
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 14:10:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 26 Feb 2024 10:09:15 GMT

GET
H3 200 Enabler_01_250.js Show response
s0.2mdn.net/879366/ Frame 78B7 120 KB
41 KB 17ms
14ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=sfXhF88Pnb&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

31d02f43dd0c7fc5c0d95db087a23f1c2d729c93f10450884c8da6b415f7839b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=sfXhF88Pnb&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48624
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42247
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:42 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 16:17:25 GMT

GET
H3 200 template-489be870.js Show response
s0.2mdn.net/sadbundle/7683192671021942909/ Frame 78B7 40 KB
14 KB 19ms
17ms Script
application/x-javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7683192671021942909/template-489be870.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=sfXhF88Pnb&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cfcce6fbc676bcdc4c9f2e2cbdd40cee40a4b9066f829f4e9e400cbe142183f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=sfXhF88Pnb&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 16:27:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 393598
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14187
x-xss-protection: 0
last-modified: Fri, 01 Sep 2023 16:27:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 23 Nov 2024 16:27:51 GMT

GET
H3 200 index-be1f7599.css
s0.2mdn.net/sadbundle/7683192671021942909/ Frame 78B7 4 KB
1 KB 18ms
16ms Stylesheet
text/css 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7683192671021942909/index-be1f7599.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=sfXhF88Pnb&t=1&renderingType=2&ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

be1f75994e53be710e621d9552d7cc796a347e85622acc435325d94e076b6996

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=sfXhF88Pnb&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 16:27:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 393598
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1385
x-xss-protection: 0
last-modified: Fri, 01 Sep 2023 16:27:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 23 Nov 2024 16:27:51 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 22E8 0
20 B 51ms
50ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BC5qeg9BmZdTgOdHi7gO7nLjAAQAAAAA4AeAEAg&bg=!aWqlaiXNAAZxrfrxUa07ADQBe5WfODxCZ5j5mxqx-37MCcwXXbbQONdo5B5lznBDPEBMmRkkigHPu-_rv41ln5AAqpoKAgAAAm5SAAAAAmgBB5kC6mpriOGwoZ_h7xgsGN-wyEbcmlynqAoOm0mfoiTCkObhzgPoYKPdj4EkI9SSLzK9ESXZUX1BxXLogy1ESeXvUbRbl693Z0rA5_K9JEFSovAKxpUc931UcvfiydeFc6JisBY5shgD0WUq6reFAeoe2QkYlvZlL92wNBFyDGiDhE8M4gsj1G6FSdW4xIksJrmUFEIs1R80jSMcQvbOOtaJdSiGjYARxIql1MAE30sphF-5RRqLd5YnO7AE6LDTidDcFtfLcPc1_7uX4cAPD6Ckd-TzLWcrayz0C8VBghAhfQV3AZEpK1-jGJfK3QO1u4fHBA48-x_NHRVzqZ_9aXpUt5GYDqX3atqWhlH3Y_pr2f1VId4RzqDt6DZDWaibxcIGaL5hffd3z1WxcLVHIqUbJZPEHNad2nhfPqqRVn2VaKEsusbF-KYSBf86IUpOO7KMltUOYl913cmBj7g7QWjgw-vI9BS7C4s2Nzij7bamkB1yFPmPpTILh-yDh-dLVIy7RObl2mlGl-BaEIIADRdM00xHMZs8N_6DH2cizLOtb4ZlLWfnp9R4cYyMMAdsE18QvnhkKeinMrSLl6WanNq_w4d-CwIr086eUvegw8I9HGvey7_JORkcaOUkpYiYe52Me_yCYTD7zZxUjl6Fj3yDLUeohpy-zN2gBKVOewefXVGn7HznnmXSJqQCXyqdDegHPB_w8SfKzoTrg9lpAJlsntc5jUsm1V8tprxbim6VM97V6MXlbCyKtjJfODJMKC5kWqYEnqwKI9aUHeRcUqFfrDJJSyPBhEI-e7ag9fEEwLZn0bP8Fi4QIOP1IavGKVKJIVn5KMMPNm9dHPShpEdgBJVuncWA1ELE6dPInII_5Tu2244r2Kuy5eUd4vE6oQIgvhL3of_iqVTCwTSJb3Bw9TrN7smykB5irDvJXoAy-T4OG6tUjm6cwm00L8qoSJYk0X8F9CGbF7FgumSMqyvJIV9UiciR70v38qDD

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 0B46 5 KB
682 B 24ms
23ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal90008.redintelligence.net
URL: https://hal90008.redintelligence.net/request_content.php?s=78552800015844704444544012523008&a=0abc6272

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90008.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 29 Nov 2023 05:47:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 04:28:58 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 29 Nov 2023 05:47:49 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 0B46 12 KB
12 KB 37ms
14ms Image
image/png 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/74889/creativesup/AEG-1200x627.jpg
Requested by: Host: hal90008.redintelligence.net
URL: https://hal90008.redintelligence.net/request_content.php?s=78552800015844704444544012523008&a=0abc6272
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 4187477ba401d64efeaa2049dee357b8badaae5adf6a511c868459b038333437

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90008.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 12528
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 0B46 14 KB
14 KB 36ms
13ms Image
image/png 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/49107/creativesup/forever_young_strunz_reachgroup_1200x627.jpg
Requested by: Host: hal90008.redintelligence.net
URL: https://hal90008.redintelligence.net/request_content.php?s=78552800015844704444544012523008&a=0abc6272
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: c0a9d8c23656e95e6540c3460ff581e64022da5e1e73a3db3f1e887cfc5989b2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90008.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 14262
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 0B46 17 KB
17 KB 149ms
127ms Image
image/png 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/72523/creativesup/1200x627_winter.jpg
Requested by: Host: hal90008.redintelligence.net
URL: https://hal90008.redintelligence.net/request_content.php?s=78552800015844704444544012523008&a=0abc6272
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 7724aad10e931920fb06e7ecb61ee580c37c49c907a49ad1be3882c8562e4259

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90008.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 17316
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 9C1B 273 KB
91 KB 22ms
22ms Script
application/javascript 2a00:1450:4001:810::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-Q7C756EV6G&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c6366d933a3224531ef1a1869c46241f4b1d4168d80f53a15c64845e47b091c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:49 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 92923
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Wed, 29 Nov 2023 05:47:49 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame A4AD 39 KB
15 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 04:52:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3309
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Nov 2024 04:52:40 GMT

GET
H2

200

skeleton.js Show response
static.adsafeprotected.com/ Frame AAB1
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1854208/76774665/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1014933263&ias_pubId=pub-6266313190087173&ias_chanId=1&ias_placementId=20808097378&bi...
https://static.adsafeprotected.com/skeleton.js?bundleId=${BUNDLE_ID}&ias_xappb=

17 B
464 B

14ms
14ms

Script
application/javascript

2600:9000:26da:9e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/skeleton.js?bundleId=${BUNDLE_ID}&ias_xappb=
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6
Protocol: H2
Server: 2600:9000:26da:9e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 09 May 2023 06:47:57 GMT
x-amz-version-id: nylqTweorRThFHMBJSrf_fHcWx3KVKN3
via: 1.1 99a7400285d83f528f50f54d665628e2.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P4
age: 17621993
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 17
last-modified: Mon, 17 Aug 2020 23:54:35 GMT
server: AmazonS3
etag: "53fab767ecbd3bf07990b10246befbd4"
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: b5xeKjG9b_qE0204i-VznVds-2MhvquTb92Kn3_cWeDAUqeph7rmpg==

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: nginx
x-server-name: app01.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.js?bundleId=${BUNDLE_ID}&ias_xappb=
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame AE0E 91 KB
92 KB 15ms
15ms Script
application/javascript 2600:9000:26da:9e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26da:9e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 20:43:31 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
via: 1.1 99a7400285d83f528f50f54d665628e2.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P4
age: 10659859
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 93606
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: "1f3488247c90bb5de253d3d0cb3b7458"
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: GURYt9gEi5qqrsBItqcj0mynZ4FI7aOcxNekuuGjgpF4_fw1Ee2ZMA==

GET
H2

200

activityi;dc_pre=CLSnmJrB6IIDFTZAkQUdoJMI5w;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7410282860387.254 Show response
8019191.fls.doubleclick.net/ Frame 23A1
Redirect Chain

https://8019191.fls.doubleclick.net/activityi;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7410282860387.254?
https://8019191.fls.doubleclick.net/activityi;dc_pre=CLSnmJrB6IIDFTZAkQUdoJMI5w;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7410282860387.254?

391 B
330 B

57ms
56ms

Document
text/html

142.250.74.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8019191.fls.doubleclick.net/activityi;dc_pre=CLSnmJrB6IIDFTZAkQUdoJMI5w;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7410282860387.254?

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.198 Plainview, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f6.1e100.net

Software

cafe /

Resource Hash

4f3329a79cf396e529d7db46355497ccb73a149f21a1d9118dc02bf320c954a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 219
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:49 GMT
expires: Wed, 29 Nov 2023 05:47:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:49 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8019191.fls.doubleclick.net/activityi;dc_pre=CLSnmJrB6IIDFTZAkQUdoJMI5w;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7410282860387.254?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900024.redintelligence.net/ Frame 0E01 7 KB
2 KB 35ms
12ms Document
text/html 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900024.redintelligence.net/request_content.php?s=57853200014847804444544012523024&a=1f1a964d
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=250&slotname=6076681977&adk=2278793534&adf=954853469&pi=t.ma~as.6076681977&w=300&lmt=1701236867&format=300x250&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867142&bpp=1&bdt=605&idt=1&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280%2C728x90%2C728x90%2C760x280%2C336x280%2C300x250&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=574&ady=4615&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=13&uci=a!d&btvi=5&fsb=1&dtd=4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: bc2688ee74ad933bbe2f074c983bfd29dd35e3171814893a8a7f8991e162f213

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2059
Content-Type: text/html; charset=utf-8
Date: Wed, 29 Nov 2023 05:47:49 GMT
Expires: Wed, 29 Nov 2023 05:47:49 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame 7548 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5d2c6f9875c8ed5b2bf2165bed5cdc6f7aaacfe6e075705b80023eea39fa6474

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2595 0
0 51ms
51ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvcvsUYvI3R7qNYRaCPjCqHz9oMnUDeDcOhT3URZFQCv3dAY6HCqhM3wp4jR4P8g1dODxtvTXVQ1rNJZZPa2WUqaRmls_PU4KrafywjFAEXo2lybWOY_pqJ8dkhi6AQWJOEWZ7xvMKuD3gPfX3g434WQYwuAPhRVa4wUXia8R6L85x-n4EgFImoGiSxUIzkjVpt52UsSEsAWZxpE01N7R6PyFYltJzAVPLHR7AvPMnwGeoDxSEHqaU518JSDH9gK0gjb5sRMwoEC6O-Z0_bEfSwruyo-Xq4Lf_BxKwpVi_Yi-Iv51nZqUVjcyk7fpOJJKVycmA5Qqojemd30RXgcqggd_uTx9sy6Nr54h6gb0_1gO9JcmyFKXWON3fyyn5rb0KLzVREsgf0k-lpObpv_EvS3y3c1oG9fePYNVLHE_WgL6CD69KtjkHomnMm-G1VwCoWMJAlxhbQpZ_l-mEhc4-CdcsH0usId16jyerdUrjIPh8zCCq9OZ-crMpW5PN0MmV8qTA1_nK23AQb1FKJM5xjIlE7brDcEbYU64TSf6RiGB9-MBqnet1SpNCpZYXxDHeAI2CutoB9sgoLMEf_YwJAaoEF1CKbjGDytF0tZhnWloJ2U-s9I8lgZGAkRlxrnVrBDeZabJ17Jk4kamO4qWv2s-kMLZgBqNLMMMB-JFNJNXSBe8wUt6IyG052mMjf5M8VrDRJHwr8zpR7oN2DlH4SqSts8u97sY0QLMV5D7_rcZvassP10IP_0gp72-mFSSmprneu_cKrKFs-mqzHlVLVmWGI090UNfJrXGc5OP9JGXAOceaNZHKXNa1triZYxXt7xBhEG7p_XyxkVS8-dkgYVvh5j2hc7i2EP0AXqT3dDIiXvdfLdeeOo3elQVhqUk9jxj7TwWhJGsImT-nCoi8yATGyIzDJ2v_FdEu4mkbfWB7hfzfUPM094cMFOFhGQ-XK15txjFVTGlDuAefCFQzFBCjqducyKwFE9TNq8oepKEkp-gje9jfhBdTq2nuZGgJeVhyZVhxA9uFVeqGfRcLzQ4GroHr0xv_PglFTC3AN6wb_3Wp-WONCfYz0sJXEzvdjxKf3qcR82Ck66AoQ9PRm1kBSc6y1e2pAa1WnASyMWlYJfkTAVpGjXHTaGkpIvBCsnCvuSIbLhELqUjs51uxIWd2Pjn7i_J2yB4zc7Rf80EVWsQZjIbo8uSBOxefVyIhqU-S-H3xrMn68FMlU-5C_hoEo-4wK24ZmLHtd5T5G2STqZ5y7M6Wa4LANIg-HlyFJwtePYeFTgc5pKfJ_fAtGkC4lKL-K87AkbBb5gLJqdQW1K7oUwvJtjrDfZUP6PvA-R5PYCaXpkwE7iyi8ninTocWpsQTwTopMeyOrJywLwG005QqK7C2o8NBzFFmeJwymiC0woAG52BbfG1y_dUXV_gkz_VgwiViG2Nq3KEUiydMTBLyTKQ0X3hZuB1k-4iTZLg&sai=AMfl-YQfXe9OWRMjGGOTuh7XPlD1uilThjyLmsN3zd4g75oJPdlnbtLGHb9CgaFcWJ9Dvd-ug_-C5ftKVd3XI6OuNDdK3Y3cxBOVWlbTr7weTkA2emn1W4QGYn-5sVvmbLioUCJdlsdwCfHD_dt9tHJgd4J7vnTcbMcdpk4y2xdMSBvVPicOtPHjgB-CN0yYPXDXOk4TAv0sffdFVnSRoZZPotEmj2F5qkjc7PQAa68_S6Vz-U2lkzr0_37Y9F_DRk9lkOV05zqpGhqK_sMEObot3P3ErhwnPM62RYxiZzu3IQ&sig=Cg0ArKJSzE6h9fwljq5SEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=789&vt=11&dtpt=577&dett=3&cstd=210&cisv=r20231109.09215&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 container.html Show response
58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 39B6 6 KB
3 KB 14ms
14ms Document
text/html 2a00:1450:4001:808::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202311150101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:47 GMT
expires: Thu, 28 Nov 2024 05:47:47 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
483 B 17ms
17ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://live.demand.supply/e/e.js?gl=0.2&b=3&r=farfeshplus.online_auto_interstitial_desktop&sy=ed9ddb4c-c9e4-4291-8087-180349e2679c&ts=95&cd=2&mlbr=ch&mlos=wi&mlla=en&mlco=us&mldo=www.farfeshplus.online&mlre=undefined&mlin=1&mlsi=undefinedxundefined&mlbw=4g&mlcs=NaN&mltp=28b1299c-1e08-4457-bdf2-4ca258e10f1c&e=lm&dsReferer=ZmFyZmVzaHBsdXMub25saW5lL0ZQNjYuYXNw

Requested by

Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.22.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-nf-request-id: 01HEQ1MZJBXHMY5B8H1HQ8BKGW
date: Wed, 29 Nov 2023 05:47:49 GMT
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1650805
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "4de2110991f3807e8b4a19c48c14f2d1-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 82d88ee0cd3b368c-FRA

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 6DB0 38 KB
13 KB 14ms
14ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 307778
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 16:18:11 GMT
expires: Sun, 24 Nov 2024 16:18:11 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/ Frame 537A 94 KB
21 KB 14ms
14ms Document
text/html 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/index.html?ev=01_250

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_278.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5573aa239d8cba2eb75e5145f8af0d81fd198299ff0ae200ef21a895db077d2b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 153287
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 21339
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 27 Nov 2023 11:13:02 GMT
expires: Tue, 26 Nov 2024 11:13:02 GMT
last-modified: Mon, 27 Nov 2023 08:27:56 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9CEC 0
0 60ms
60ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvf54ZfZwP4AMy99UcZTlhQ_pj47eB1FgGT-r7h6C1XFa3j0BtZ03QUamt_3dciKRZxTK7BbjnP8KapM7G7c_VFLs19lb04UzeRndkZj_omLm0NE0MEcwDCPeE4O0OsW8fbcHsvfTZsKhLZ2MZZ7yB8SlweJa4r7iiEy__pycA_gBSAQJWknUasfgw3-KuNTnNEf4eWsOvXN6d4u3FfwTKo2g2Zzieor9xtT3GGWSobc-mV423RyTB5atEBEyQMPuEliCVgH9418X0qTZOXTZpn6TtlkiyYW7hDNELprB5jAKWa2P8CxLaP6tEuDjWqhNc0aGbOVutvgCG4cklRlho4e6dLNAXJ3j0GTOWVDRe-bCVYXLouzmgvrZ2gQGd4JWbKlBkGnBhLyT9fC4Pj0dAC2eKygOKTi_7cezVtahQOt0mMeNHwfx20sw3--DfwIhvy2bqHxUi5hfFCXIKsbpaVPpgxhJGetFYjNfP9JvqXwlDuk8SRqwZkRwngjjm0KZSgxXHSQ1erxn2uOkSMhmIKXb5ke0s5Y_l-ec5ayggxMz0QenGvad_0mo0rfP0HYC8EKaP43-zoXXtKGofLYPmZcdvRMLp6p2J-txsT1G3WGWX3TVOD9SYT0Kls78crKOTy-eo850-nC_A1l5pfeAahwmK-9Eqil0nigH6CE_3WPicFfQsrM4FD9YwiCooyN4BbQLyBYYBup6AWX6a1vuqkx2iKLzFdwXWNa_1GjhHY2yIRkuKsUGY9614xAlKyr-2Za8GWh_fjYah-mdpOSU_BROA12GLV_7VbXBv2GNIrjjTZ2GmVdWJLudm6WZIZL_zKLiaszz4gqKeZHw_GDtkGhnnhuQVQ6sKSb0eSKWUqcGpYmvBdY1k64dxUasf1CvgsWMgyhZ7Emymgt1iBbfh7dQDZ3K6KhBZf9Afw97Ym2GZH9g-_sA_gNxFURkqiwSp2UQ_qLQngmQARPfp5Fu-8GZ1XlL1h9ffRqBGCAcskpXRQKx160S0yjb5d4D-svYlMTJ8CnWshOX1_FXQwA-auhCqf4Ec6-2aoCCD3ZXR14zIJB8KoeFrNgW6IjKfETFwdPH7BKA09hc5MnARHNVwWVrNVs5XkAXjszhsoZ7g3w16-2582asVR14lrW7I5fo5zRDq8-NoSseZhsPHJf2WH_obojncmSVtI45UT6hZ9IXHpvrgcCKFYQdkw3YAjeYLCE-FQlGyCCn9IMqiFRCssMZigLNXEPMp8dLSeUQKbkEMNxNh_jsr6mijaLXcUpQXuE5KahJEQKk4ydU4iUnK7356jQ21e8SR0WIKMUGJvfKBQJSBDSjAhUa4T64kuRlOzy2bMk85AaiXFQQOppVSdXEfeW-YYMAa_OHerjeB_vePn7yg4DduDZ8IoC9A9oScR8PW6hvDlMGmfvMRE_vuj8hghzBHus1KQ9NNAbBLfoB1cb4wfgPvg_NXFViQerZrzT4mDye9oo9ic854e1oL77qH8P_tAuhSVj2YwFlX-NLLM6gzyO6a-untnpYpSWjw07PgqvfptpG1C0zJ3rdsPLnL2hIuU9MwiF9ZqUCBN-kjww8JwnatmyMaNuCLiKkiYrxrZ&sai=AMfl-YQcZS2mYKIruxxIT174sREpF4tasiGKAZuKlNU1xQMFWukf6WpAzJifbDaLZQ1Rxxga5SiCuDmZRlD0OPiN2B6OYpWA8b-BFfTyYYaM7OUAxjF0gVieFahQ8DgUsKiDA8b0AHC1hkmIXHzmV0tdxfbyPqVeU6h59J11W3u5qD3ztrvXSg5zP-JWzsRbW8dYed9A5EV5IlKe8bwXy0HHCIuibwqEbVSBLZ34jbPROMYMtO9bL_TnqngHysA5ZiJKVDAPG8pvua6gQji4Ysjlekk1O5j962hU&sig=Cg0ArKJSzKu1dKa6nlJzEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=513&cbvp=1&cstd=512&cisv=r20231109.68303&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 29 Nov 2023 05:47:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
content-type: image/gif
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 93656
tags.bluekai.com/site/ Frame 9CEC 62 B
456 B 169ms
169ms Image
image/gif 2.19.104.189
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/93656?limit=0&phint=event%3Dimp&phint=aid%3D6531095&phint=cid%3D30972058&phint=crid%3D206060721&phint=pid%3D382004576
Requested by: Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.19.104.189 Düsseldorf, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-19-104-189.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
content-type: image/gif
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
cache-control: max-age=0, no-cache, no-store
content-length: 62
bk-server: 9f0f
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame AAB1 43 B
216 B 318ms
103ms Image
image/gif 2600:1f18:1aca:4280:3d67:f8d:404:f402
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1854208&asId=57bd2e34-2388-d815-8d7b-133681662f40&tv=%7Bc:vkVaq2,pingTime:-3,time:609,type:v,im:%7BpBlk:530%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:515%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:609,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:515,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B105~0%5D,as:%5B105~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tWYwwJ7+11%7C12%7C13%7C14%7C15%7C161%7C1621%7C163%7C164%7C171%7C172%7C173%7C18%7C19*.1854208-76774665%7C191%7C192%7C193%7C1a1%7C1a2%7C1a3%7C1b1%7C1b2%7C1b3%7C1c1%7C1d1%7C1d2%7C1d3%7C1e1%7C1e2%7C1e3%7C1e4%7C1e5%7C1f%7C1g%7C1h1%7C1h2%7C1h3%7C1h4%7C1i11%7C1i12%7C1j1%7C1k11,idMap:19*,rmeas:1,rend:0,renddet:na,siq:516%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:3d67:f8d:404:f402 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: nginx
x-server-name: dt13.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame AAB1 43 B
216 B 315ms
102ms Image
image/gif 2600:1f18:1aca:4280:3d67:f8d:404:f402
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1854208&asId=57bd2e34-2388-d815-8d7b-133681662f40&tv=%7Bc:vkVaq2,pingTime:-6,time:609,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:610,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:515,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B106~0%5D,as:%5B106~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tWYwwJ7+11%7C12%7C13%7C14%7C15%7C161%7C1621%7C163%7C164%7C171%7C172%7C173%7C18%7C19*.1854208-76774665%7C191%7C192%7C193%7C1a1%7C1a2%7C1a3%7C1b1%7C1b2%7C1b3%7C1c1%7C1d1%7C1d2%7C1d3%7C1e1%7C1e2%7C1e3%7C1e4%7C1e5%7C1f%7C1g%7C1h1%7C1h2%7C1h3%7C1h4%7C1i11%7C1i12%7C1j1%7C1k11,idMap:19*,rmeas:1,rend:0,renddet:na,siq:516%7D&tpiLookup=ao:www.farfeshplus.online*&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:3d67:f8d:404:f402 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: nginx
x-server-name: dt12.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame AAB1 0
0 54ms
54ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssLatnLjP92wrQZszjxa578d0WEE3KWavY7cmWEuNEKRd5a8-4qjK3UnqA8bUamI4Kw154Yr5fET9rUjQ2T6t6J7UjI0-t8sU3PgTx0ry4INcBIM1IB1otcD9TDDvPZK94EHv9m8K1EMN7FiGW6O-AHyfTfpu_L_8UPHZFrJhzKIaRxhnkUggEKaTQOwgCuWf35vi8YDRzLD2YlpgtAoDWXmXzdBvJ4YfwgyKSKOLu22U0h5sQ3Ekgkw28QxrAJUiI6fFvszwsuExlMeiUhSYuC4axcHAcXfh88a81cVfJ44E2QxrJCBSda9Y9TVA6EDG2d4qE5B61qyTutWI_zUgbuqIzAYtuVtbAe9S_8QuF-gaOqLUeupJBEfj1-gQJ-zjq9S9EXT-harX-87Bpw-9H2WmVqFVVFDO6NtxJpnyTnPLKaAuht4oc8PM9NRO-_p9s0XD8CdaKFi4bM_Q63-suig6UjwdxE4WjngakQ_TmvLBDRsiIPCBcGCJGPPgJtY_mM0kd_Z8yazdiWYl3Kthw873E9TlbYGVFVw8bK1FzT5tTRu2vgT6s1GbwzYlC0MuyeL4h0F2XfpynOrJZ9ouc1XMEMWzqBGtwn9x-wI-WqF-Vb1WnxLea4cTB8Tma5D61vmm3J7XgqZOJ1GMlnw8bzlVR6N0SPLF5kHK8r8zhtpmk3JVCJh6BeHGeSg719YQT9aYkSeEhTakS9tyTQmeW8OpyKP5JGGodzhch6UtebG0WZq8IVXTHtvYUfIDnnbb7EjbJ_EzlogYWwEapCMDunuiYzJTyb3SdGF3MwfNwRvOrNDUdgqBHO3IzEQrKXzz5ntNpDM9yoh5lOfhViUKHvIqHrhQOYWwL9W-1f65llQj5C_P7E5abuRr9Vb7GvpYq5M1pl8FHTtj8Snt5Y30esughPRC5dCVBrFGU7hMi26nJVUawtX8V0wDLIupr6_UVakzaHQbkM5Z2O4WZSeq1zhuXYGBQC0q8GsJA_6bFZhWaFBKa-3snWLE2zrA7yrD2khjPj9OqIRRfAV3kYFXLLGpfhNqeqnglsR2ZT_M3NiuS91IRH2ojJ0BkCDkE1mrSvF7wVU8gU6W72EBw2BvQXVjjAikyYBJV20sT_dD4VXi-2xdjqUYIWU253QOrwHgwRuNDfDuNgutJ3G4WV67Jao4tkMNAZG0RzkwQpM5owRJYODQ6Af8LDevcTrRgc74JFtSXPG7E2LhPiu2MD1bp8whqotMWUP4Dvz5lFsh0isX82jhINaDGLBACmjhXXjvPt8P-Z9vGlCHZOJX8p4q1OHLkWDPyV9rry9UUkdxh7pBPGaGctqRhcFnh_CElmzFx0lWMaSetTUAckOKlgIsRYC7ySbPA0UFFJilC8Zqaz7l9fvZRphGOMlZembEWrIBB4FOEyRNiezPwfKwicbHICjK06-_RjL2aBJwaxDpXAU_MtDZdbCMVGSIr3nnowOy_OKxdfC8g7ABLnbzsJswpOK_8y&sai=AMfl-YQdYRCDmSn2T1SYu-dxsnZuQUb37xPpLgL3tml1aCSU-QxK0mjRNWR7o9UmtB9kyH7fHGlafk-K7G1tRCYWr7WNMJakkEYZ5Nst6O2rVae_I6laxVcSka-lyDH4kW-48KJkMONtJD2AlOjS1PzU-aXwejQRJ6pzR1oo5x0jj7x5R0m9DeU8qvGpL_06F8Q-AVyfj1xhFFc75Gfk2j02prGYGfoca8m9CJ3bUSeTWNfK9Ft3EaUVGjBWbeXiP_maLxi7OMULaIs0XW0dj4g89VMU7wRDXYAhXab5QfdY4lilVg1-pElumiv5aOCrMAoBf9M&sig=Cg0ArKJSzCWpvuCuuq9qEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=820&vt=11&dtpt=542&dett=3&cstd=277&cisv=r20231109.38328&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 css
fonts.googleapis.com/ Frame 0E01 5 KB
682 B 21ms
21ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=57853200014847804444544012523024&a=1f1a964d

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e334ca19f092778f57815a534078daf8e3fce269e56f7ea374ab3a117eee92ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 29 Nov 2023 05:47:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 04:28:00 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 29 Nov 2023 05:47:49 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 0E01 10 KB
10 KB 37ms
14ms Image
image/png 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=100&height=50&url=https://cdn.contentspread.net/24i/advertiser/50502/creativesup/Fyrst-1200x627.jpg
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=57853200014847804444544012523024&a=1f1a964d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: b581118c8c3738d40075c1e0414427274406dafe99345a8c0ea1cfa29b4240dc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 10046
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 0E01 12 KB
12 KB 36ms
13ms Image
image/png 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=100&height=50&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=57853200014847804444544012523024&a=1f1a964d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: cbf16900f9a7da45b2e989231c048e440a7bf2719a975f106e88306f6a2372c9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 12074
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 0E01 12 KB
12 KB 36ms
13ms Image
image/png 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=100&height=50&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/produkte-kredite-privatkredit-mann-auf-pferd-teaser-logout-1200x627.jpg
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=57853200014847804444544012523024&a=1f1a964d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: a308dbd248b430c86c9f99e3965db50747a372abc483db5011fb916be9de7c6b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 12180
Vary: Accept-Encoding
Content-Type: image/png

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9794 0
0 52ms
52ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvJURQ4D4bEpko_RmSpNgtddAHNu9FWX39Mu4H37CGi3RfLmQWmLbD5lKe-U4SH9OMKL9XZNs_yFBTWJAmO_-yQw8yiZLdLIAUWuuPA0cFHz5ctFk-tZAj95OMb8XMD1OsoYbOPbswbf834AeiaA6UyaOx7nrKcD_LqHXAUzK78GdfMHTZkuut_YKnqpmS5its7bhFTFvL67f39klrhxDIie8PmFhM6kHRBmU1_1sfSAl8KeSS28aSJnREAWWIcxI4cSdMeglXecC-rwUM_4-PPL8nr3fjPQD5juUbBRcbIhCeNYhIGdT5JA3f80V3TL4H2YJ0fqbbWTsOHgU35fuah_9pRTZxdNrWjLl3TfT54HT1dpTa_64EYBgLFb2rN27ZGgIeXJbg_m23agjbWXiJopWo6kD-lydzapHSH3GJn1YRtjH0LYp2L_NbJv-5bSudNbKwnlPdur-648RsS6XKKjbmAtQXlVwaQHwGehMfl2ZIRv-gpeNqjnKscnjZBxFsxfn2h7w4-s0_joar-hTGrKz1oZ20ur49sHg8BCw392wsKlOiy6E50MWfpmIjif4fvt06Z1uAymHXbMIlIFLG9as2nqE-SLYqViGhlUQxAL4FNGOdLjfGTaDn0WCbrNn69GsJo4FncrhT0NrGsHjxERUvCD2Nxsj2Z-MsXEbbpUaMBvVaaycOgFFfI16K_HRSRAZQYv2-I8DlETqXkJa-uatDvuBY4RDKqENBrZyMcjSbaJBLKf2zq1dauxj9MRI7oOYTWjxn7qm5q1YHbHrbF5RE-uEfihC4bBP40heMxjwtVPgYFeghgVeyiPyDg_Hn7rVoTI5YKx1fw9d9ooRNlu5JfoDC8Yncg634N2145WKWw-Z5PUnPdZg1XfVF4TVNzXPjkYCSeh3v1BQWRihhP7ntpx3U7zyCWu1I3op5sgXaGC4eIFku8nDEwbVS0Vs6glLTXGkcXiSzcTv7I6SAaGXNVLN5reoq1oTxmsR4-4H4Hr7M6_pTmPF188ZVtX_UWh_65mC9mWtEbsZBpxaQM68hU91nHxqQbxfC69bFCTNDBP9yHaS8DBiZOHzaVhBPd-wgE3QfGdRGPXbTyV9OxcZOSA5PMT-V5_dKPOf-J_Ce5zJkIpOHwnFUiuN2JYqBkq1Zz6loBZwNmMqM8GsvPNQOW1AEfW7qlvefrMqtdAyxvOwOknc6r-2XmYId_uLWoVmBS6RpMK6hELOOfWvP_dpE-aZOKdIlwje1HwBCl7BMH1sUk7QKniptCE6Xy9qE2VaQAlG0vkEIyvdoM7Y9BV3xn-8BsQPnVKoHJdUBw67aUR4Ml6rwBCNYEW_5dLh10R1sloSxCQdDMqHADeCAgDmafRZlgghaCEipcYL5IztKOyy9kHLyw6DZUrpXZbqcHCK3ZSwXS-tdEFs5hgEPfe5Twvcms7scmqWkYZzAq-_tjnhJz31KTsBRBF75NX_1qBfK4Ndhz9OUUU0NiRw&sai=AMfl-YSrsmdIBupYUOHMaX-BRpREw5z2Wrh__CKY41EzI2Ibqmp02-LVJNk1s7XO1aCXPrEUNH8BH8o8yiRwegTIhNIXarFI1ZEQ3xWnY1dk93YHNl3FKCOU0TJLe2lPRAghxzaHZzER9JOyoU05J2x0s1PwfcWOCk6-ecTb-pYbKB20OHAHJ1qMmyb6F_tC8gxBHWXnHcrlpCset3_SAPOQXYoHdye2Cms4eFbrY5F_gCtn_TEw60fY9E_wfC77zQT_7BYMAVkDisZFbGVDME9XcKgOG8mS7HVqniemGA&sig=Cg0ArKJSzEUeA9SI810jEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=928&vt=11&dtpt=689&dett=3&cstd=231&cisv=r20231109.16141&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK viewability Show response
hal90008.redintelligence.net/ Frame 0B46 0
150 B 40ms
15ms Script
text/html 138.201.63.150
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal90008.redintelligence.net/viewability?s=78552800015844704444544012523008&a=391e0a11&vb=m
Requested by: Host: hal90008.redintelligence.net
URL: https://hal90008.redintelligence.net/request_content.php?s=78552800015844704444544012523008&a=0abc6272
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.150.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal90008.redintelligence.net/request_content.php?s=78552800015844704444544012523008&a=0abc6272
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:49 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 DcmEnabler_01_250.js Show response
s0.2mdn.net/879366/ Frame 537A 32 KB
11 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_250.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc9fe8ec0612072dc6d3b4acd268e09d28c253807f47846a5f70dd8360d1a0d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 17:05:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 45711
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11558
x-xss-protection: 0
last-modified: Tue, 14 Mar 2023 21:28:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 17:05:58 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame AAB1 43 B
217 B 268ms
100ms Image
image/gif 2600:1f18:1aca:4280:3d67:f8d:404:f402
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1854208&asId=57bd2e34-2388-d815-8d7b-133681662f40&tv=%7Bc:vkVaqN,pingTime:-2,time:656,type:a,im:%7Bsf:0,pci:%7Btdr:106%7D,pom:1,prf:%7BbeA:1561,beZ:1561,mfA:2063,cmA:2064,inA:2064,inZ:2067,prA:2067,prZ:2073,si:2077,poA:2078,bl:2091,poZ:2091,cmZ:2091,mfZ:2091,loA:2170,loZ:2172,ltA:2217,ltZ:2217,mdA:1562,mdZ:1606%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:728.90,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:515%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:656,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:515,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B152~0%5D,as:%5B152~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tWYwwJ7+11%7C12%7C13%7C14%7C15%7C161%7C1621%7C163%7C164%7C171%7C172%7C173%7C18%7C19*.1854208-76774665%7C191%7C192%7C193%7C1a1%7C1a2%7C1a3%7C1b1%7C1b2%7C1b3%7C1c1%7C1d1%7C1d2%7C1d3%7C1e1%7C1e2%7C1e3%7C1e4%7C1e5%7C1f%7C1g%7C1h1%7C1h2%7C1h3%7C1h4%7C1i11%7C1i12%7C1j1%7C1k11,idMap:19*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:516,sinceFw:139,readyFired:true%7D&br=c
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:3d67:f8d:404:f402 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: nginx
x-server-name: dt14.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame F4F5 41 KB
14 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DkBrVdudxl_Z37jZ4246kgGHekxVzKuUqNf_uTn_P9-Pqute3Ek5UcAuirXQP_OrLc3VJq4Fc9Oaha4kQgnqpFKhAJjAzKztssvyUlnYqos0XcR4lLeanJYsuSBYh6JtW5D0M2wE8Beg-p4H7L52nF4T8VEgZkQCxgGD110DderYD58XE&cry=1&dbm_d=AKAmf-CXPocB4yuPDp7VZawcEUuXtVhird8dkL0BngK78G3BWqD3gpjR8kBap48BqXt5rz95ZgeAFtU08mbAjZMacPMdWLHDwcdqkNCLmfOa42uySWm56bknfHEmMaHkoAzKhag99zStaWKglmLcG-xINshvHFsEfbN_6imHXkbbM5U2ZTPHA3kuRzHUgtLricKrBURlSYV1bcN95hC3tnhHFWWui0_OwfipZ8WvTWejcxC7Z-rOc_QYcMvZw-Gq9gnp1r_aA2W4VXRVB1U0SXj9Q_S9wOYKQ_OmnfiuhxLC3Wdnk1RTFX0YDeSobkeXQplZ5JmGjkHj6r9AqHVzoHgEQ52PZ-r3_-AWJTQ8ZDfWM1XLpMH4jpLbWyp5frLp3qnvppQDcwtXM9NLLghcwwICu0xONlp6raQh-Nvll0v94PfMdnbIKQ5YfR-lYXN6rZPHOeam3Sduc9AmRhesYWMT9CPFbkGkzBQCMFei8FY5lApxnB_iL5RWlw8CU-ln2gwj0H4ruIRvg_fvO_AQUJ-cnpKRZ527tRB-jCFZjcYRoxi6FjImU7b0C2HQA_5SfPS-hoMi7RJBIjIFSAWgQV9XqdGK6xdm5cLpUtax359YTTD6ur2Tvjd40SBANIUScvX9nLPieT8PVILc6lZd03irLK5BcIrG7KrROx89Mbad8p7d0XiJI7ru-TkWdVuifXavF59lZGrkmFNYwyYUi6jk64sS5sqkeHEuIkdVbFUgrwojmo5oDXWWyz4Z2wU_g5G5zPszXgJuYjQWvRQMKKJYILT5fKMxgJ9e4jQOUFujZBjhTA0vB6TKuT9AbUeaMsxE12XgoPfEzaoXPMNHQBCiZgaEVasrU8VZyQGSfYKrSBnLBd63vVEN1mmzUfH94ftZ7-5zkn2DtHfNPPPNilfxci6tCN3vV6bXAmjnFmkpt6HXDxkWnK457rb2sOVp318Iq-2Zch3V9fNindeG3rMKeglCt_D8O1rA_7RSsSCi4F1Ksh3nwSUjtUUpxx4jjCLdamCffXl57LYD-jmLJD3K0Mbt0vIigq7fNF4g75-E2GtRe-XF4BAg5Rxtwy4sc_d6sIh4tYdcD6AmF5k1WS1aOf67KfLxU6Ywlho3WZeWHMUiNhMv352Z85CGriXfb6cFHOGoobMxNfGWRwUUo63RBVQR4JcHaxf3orC3mJ4b_Rm9WVDZHW0eJJfNDKqbNXFqBrPkQkBwVvXR_bADiK3sleeb59t_koLqJGmxZCdyo5o5AGJAoQi3W6xrX48JUw81_WdrIiWlS-4OqWxxJvmd3ff7hibg8f7u6aCkloHs4CV1qk0W5eHTKtM3vknW83uwggd074Z-XcMnsB9I_niC74Lvf5Gtfh2AfYTv_tayCfzugxgQGJu0bXl3k-QMWPJalfiPO73BdtTFCoQA1cyk8LWkvWJePpZEHM1IBCjHN6ORlMfPRdDjmhsYIy_h8fRaI6DqMnoyWa0hLecg6N5E_3E4XiXHvfF75aoz7jxbE2WFGniESTyLtVwkSQ2jWCdc3rohX9Y3hsKT0QhJif7oKeda1l82-8FychWzatRpNPU6GKy2SmR_cKb_rr5APg0s_OUdpyIaA27j1xfxpjna4c2bhxq6w-xlUUOULnt3vB2gs8TL-Fi1AlBGCFC13Do7_Siltn8bYXOpmA6iVRDMUzink7iB5ij1PecGkUv4yu8gGDmhqh_cKo0fSh2NclF9JU2J5auGAZR7edsDKVyBopLyTVFxiaFZDUTsNa20Zn50uMO9mcfs2njRFmjOFJN7Eaut68380LGywJji2B5nM8gq6FHmaILQ0GUnY4PG9Vvk6Y_iSJIDm1_oERlWsh-h38GRjSVKEvbqpxTRDbkDAhAVAu91XD6zE9oDsEKsWQUWDoUDM-kvBASxHrLw1rzrF_71IlNIlE7VRC9ZBiIK1qS7qIfpMeK6fLQO8zrnu-LbWPqn0ywTKBvP5sojaurmLgwzLGEAKc-MCqzimYNfgUga6hRbVnojTXKTD8SIo2xkf9zTVJSoJwfeapMnP2Zt0c0rNx1L---_0VaqKKPmfeFcqiosW7CfCGCytkKzS17WDBjRKU3jgOwoRjO99uMLvCGS4FJJjklUazREdsMw31lLdApzVwZ4wIFQ5qwvcITE3AOxY3j8ykP5xyIFIv5sh3YHpruqxG--vJQ6jn3OHg9R0ZPoKE_EHqI1phro5E0eOfvrytl9J5Oh-8gGL0PwVmO6QMZoKbk7ybpp-QpBrhAJwnHCNflK9bWkJZ9FOO5dIEH1YFL_uBBPmCl8hGBPlBJ-_M5a6u8C_-rfsOciYtBq11flKQ5eDWxsZItn945aJBIBj_TfSZSqileZHJgc4MjbUq3HUKDnUAaf0VNn7xyNIp54zUi07V7HekQYA-4iGFg7a0mBtrpHeU_Yq5-TyFdbY4McFtBdvpJtDELoG-RZAf7ZmTjHpgsDhWH6m7HInjiv4Re_J8HrAZ3tUO8UY_hdyZSiTW9kZ8CLk9qPnKrzW1P6OmQPwzn_2TYOThklwE2jU3SUpXaBE2Kca3hzPUloLNivazUDdfBHkFzgG7ske-LlVWaI78RmZ2XO1agJ6LB1N2WitgngafRydt_nsIxbV4qhXug5NCFGPGkeQpv4DPUIDR5hxDhyB5Xo5HXHFUEpHs4y0H3NKzg9cJFcZiYJMNK9icLYnZaG24xwrr18XSraKVqZxFeoBq-Etvxbt1B5WiNcuHEf_tOtfs4iMZfKh6AqScDNeD5YwubePksB_mBnpatE0xx9QyYRMrD_fc4vNTI59w4xz87E1AyonvPxhZCbiT832rmpGcZl3kVyKG7iQJw8hE3pDzkv7PzhfFuevym4KBdew9PwC6ryoaYM0ZDsg6JA9p4U2K6Prp2cZiRlWiaI7wd09oO1CMkeVANAL3PTL1ekkwIcYA4E-MC5F1BJhtdcE_s9m76cydbzomsWl2hAXkr4hQAUtS5tAE48YGIJQlXdnNJKsZe69wx-0Nf1te_khQJwzP1YDSZBJC7PgsWk_ggpWdytMg67EwlhoP8Xs3zlnV42VL1qo3QPhwOHovsXyUyyuQ-VjWfcuDJC2rvqX6ktQmAouICzGGGzHa1Pb78mRxCH_mwLiTePv38KTwKXzsakw-m9T5W_V15bpR5hR-M29sbjTDutsfSu2BPOWBqvw4h5XVo5GCHCHP4wces9Bqv_e2_r-Ij7gUO4RY5KUhTPrZ902zSRhveqqcfouLUxBQ2HGCOOHiLGwMzjr5Ooo_QQ4rw5QbDSBY4KLhjldkn8HT4XgGVD27DgPr6wd7v4FOcx3mxLFbNq95ulPLMuqF6drOsH1OG0NlfyWQ&cid=CAQSTwDICaaNkp8__KLLG6fuP0J6dt5ad-7h0-ZLpFOvOnX-CkrNPCbBivPYQgVu1NCX3kNtjoIL69GF8xrkfW52RavWQgcpaQJPSPf3j2SrrosYAQ&dv3_ver=m202309260101&rfl=https%3A%2F%2Fwww.farfeshplus.online%2F&ds=l&xdt=1&iif=1&cor=2524739453863501000&adk=388007313&idt=77&cac=0&dtd=13

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 307827
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 16:17:22 GMT

GET
H/1.1 200
OK dvbs_src_internal124.js Show response
cdn.doubleverify.com/ Frame F4F5 60 KB
20 KB 15ms
15ms Script
application/javascript 2a02:26f0:1700:6::17d5:a18f
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.doubleverify.com/dvbs_src_internal124.js
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src.js?ctx=26679214&cmp=30758062&plc=382221960&sid=8351941&dvregion=0&unit=728x90
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:1700:6::17d5:a18f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: UploadServer /
Resource Hash: b1567c9af517c0e55991081919f4dc2263f00b8deea21f3c94087737d2401fc2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:49 GMT
Content-Encoding: gzip
Last-Modified: Tue, 28 Nov 2023 07:41:53 GMT
Server: UploadServer
ETag: "36b6087525da09e8974d3f2aa1f7282d"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: *
Cache-Control: no-transform, max-age=31536000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 19649
Expires: Thu, 28 Nov 2024 05:47:49 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame F41A 39 KB
15 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 04:52:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3309
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Nov 2024 04:52:40 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 69A0 8 KB
6 KB 57ms
57ms XHR
application/json 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_250&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3f4b0c8727c365e0da1a06a214d50bce0df852b65be8cb84e2471299f900f1d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5873
x-xss-protection: 0

GET
H3 200 06232023-053002206-background_quadratisch.png
s0.2mdn.net/4528404/ Frame 69A0 28 KB
28 KB 14ms
14ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/06232023-053002206-background_quadratisch.png

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4338b399e437bda69b997b7de46a7869b9244a1f7cebc91ddaf57329c41e7ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=LGiGKR6JLe&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 08:11:47 GMT
x-content-type-options: nosniff
age: 77762
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28774
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 12:30:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 08:11:47 GMT

GET
H3 200 annick_sitzend.png
s0.2mdn.net/4528404/ Frame 69A0 2 MB
2 MB 16ms
15ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/annick_sitzend.png

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7327225cdf3eb28cd7f8ed4ab98de9d079fe2f007c3d73fd58dc4c757cf6b4cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=LGiGKR6JLe&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 10:48:56 GMT
x-content-type-options: nosniff
age: 68333
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2539328
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 12:30:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 10:48:56 GMT

GET
H3 200 congstar-stoerer_gb-plus_full.svg
s0.2mdn.net/4528404/1687525202405/ Frame 69A0 4 KB
2 KB 19ms
18ms Image
image/svg+xml 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1687525202405/congstar-stoerer_gb-plus_full.svg

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd5e51e4be28957472ed34851536685ff162bb43dec37c9a7be46de1c1b72ee9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=LGiGKR6JLe&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:22:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48315
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1929
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 13:00:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 16:22:34 GMT

GET
H3 200 logo.svg
s0.2mdn.net/4528404/1687521602712/ Frame 69A0 5 KB
2 KB 22ms
21ms Image
image/svg+xml 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1687521602712/logo.svg

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0d80991c6e4b62d5c77985c1e293aad44cc120e03aee7ae6936c79d25a0e467

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=LGiGKR6JLe&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 12:28:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 62362
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1913
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 12:00:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 12:28:27 GMT

GET
H3 200 cta_mit-pfeil_01.svg
s0.2mdn.net/4528404/1687937402098/ Frame 69A0 2 KB
1 KB 22ms
22ms Image
image/svg+xml 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1687937402098/cta_mit-pfeil_01.svg

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a9cba16c5a30dc7cc3bdcbba2a45e9e2e28ec4437894302c6676369ed0ec732

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=LGiGKR6JLe&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 12:28:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 62362
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1134
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 07:30:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 12:28:27 GMT

GET
H3 200 congstar-stoerer_gb-plus_small.svg
s0.2mdn.net/4528404/1687525202075/ Frame 69A0 2 KB
1007 B 23ms
23ms Image
image/svg+xml 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1687525202075/congstar-stoerer_gb-plus_small.svg

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

644aace6e359180bf6b29b4a7b172f7b6cb8c937fa531eed22a6447fab6a2c8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=LGiGKR6JLe&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:53:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46477
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 974
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 13:00:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 16:53:12 GMT

GET
H3 200 logo-d0d80991.svg
s0.2mdn.net/sadbundle/7683192671021942909/ Frame 69A0 5 KB
2 KB 24ms
24ms Image
image/svg+xml 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7683192671021942909/logo-d0d80991.svg

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0d80991c6e4b62d5c77985c1e293aad44cc120e03aee7ae6936c79d25a0e467

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=LGiGKR6JLe&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 14:00:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 143261
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1913
x-xss-protection: 0
last-modified: Fri, 01 Sep 2023 16:27:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 26 Nov 2024 14:00:08 GMT

GET
H3 200 css2
fonts.googleapis.com/ Frame 39B6 4 KB
671 B 25ms
25ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 29 Nov 2023 05:47:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 04:22:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 29 Nov 2023 05:47:49 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame F04F 2 KB
823 B 15ms
14ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 70714
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 10:09:15 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame F04F 23 KB
9 KB 23ms
17ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite_fy2021.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33132
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9282
x-xss-protection: 0
server: cafe
etag: 14645652906762492339
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 20:35:37 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame F04F 3 KB
1 KB 26ms
21ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33132
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 20:35:37 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame A768 1 KB
643 B 23ms
19ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 48579
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 28 Nov 2023 16:18:10 GMT
etag: 48472445140208031
expires: Wed, 29 Nov 2023 16:18:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame F04F 20 KB
8 KB 25ms
22ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48630
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:19 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame F04F 202 KB
64 KB 32ms
28ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:49 GMT

GET
H3 200 a6de5423b7c632060e8f86136bd5d27a.js Show response
www.gstatic.com/mysidia/ Frame F04F 37 KB
15 KB 28ms
24ms Script
text/javascript 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a6de5423b7c632060e8f86136bd5d27a.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0c21f21f7b1658ed6ab5c0461020a21d62f9e0a7cd7cf3d9e6ef61a2c481f31e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 10:09:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 70714
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15478
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 14:10:21 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 26 Feb 2024 10:09:15 GMT

GET
H3 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 39B6 205 B
229 B 29ms
26ms Image
image/png 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 07:42:07 GMT
x-content-type-options: nosniff
age: 79542
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 27 Nov 2024 07:42:07 GMT

GET
H3 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 39B6 604 B
628 B 30ms
27ms Image
image/png 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 18:12:33 GMT
x-content-type-options: nosniff
age: 128116
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 26 Nov 2024 18:12:33 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame 39B6 21 KB
9 KB 26ms
24ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

25b1b4e9934aa4cb8e8bdf5fd7911f6ec67acde6b6b39f1561aec2244f7826af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 10:09:15 GMT
content-encoding: br
x-content-type-options: nosniff
age: 70714
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8781
x-xss-protection: 0
server: cafe
etag: 9666818975682992898
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 10:09:15 GMT

GET
H2

200

skeleton.js Show response
static.adsafeprotected.com/ Frame 9CEC
Redirect Chain

https://fw.adsafeprotected.com/rfw/st/1854208/76774456/skeleton.js?bundleId=${BUNDLE_ID}&ias_dspID=3&ias_campId=1014933263&ias_pubId=pub-3831894559014614&ias_chanId=1&ias_placementId=20808097378&bi...
https://static.adsafeprotected.com/skeleton.js?bundleId=${BUNDLE_ID}&ias_xappb=

17 B
467 B

30ms
29ms

Script
application/javascript

2600:9000:26da:9e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/skeleton.js?bundleId=${BUNDLE_ID}&ias_xappb=
Requested by: Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2600:9000:26da:9e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: bdeed1e1c0751610c8f3dc2a5c78c93f841c366b36a7f7a54f5e6752c2656c05

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 09 May 2023 06:47:57 GMT
x-amz-version-id: nylqTweorRThFHMBJSrf_fHcWx3KVKN3
via: 1.1 99a7400285d83f528f50f54d665628e2.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P4
age: 17621993
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 17
last-modified: Mon, 17 Aug 2020 23:54:35 GMT
server: AmazonS3
etag: "53fab767ecbd3bf07990b10246befbd4"
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: IqPCyI7XxUyr-g_f8J0SBwtI8BEIg2YMzT1xqI0hbTjY4mTyeciOHg==

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: nginx
x-server-name: app02.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.js?bundleId=${BUNDLE_ID}&ias_xappb=
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 983C 91 KB
92 KB 26ms
25ms Script
application/javascript 2600:9000:26da:9e00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:26da:9e00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 28 Jul 2023 20:43:31 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
via: 1.1 99a7400285d83f528f50f54d665628e2.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P4
age: 10659859
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 93606
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: "1f3488247c90bb5de253d3d0cb3b7458"
content-type: application/javascript
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: Aw17d17OjTEcP5hm53VHbDFRCogyHqhsEIjiBU3564OLkh6dXIG2Nw==

GET
H2 200 dc_pre=CLSnmJrB6IIDFTZAkQUdoJMI5w;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7410282860387.254
adservice.google.com/ddm/fls/z/ Frame 23A1 42 B
402 B 109ms
69ms Image
image/gif 2a00:1450:4001:802::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CLSnmJrB6IIDFTZAkQUdoJMI5w;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7410282860387.254

Requested by

Host: 8019191.fls.doubleclick.net
URL: https://8019191.fls.doubleclick.net/activityi;dc_pre=CLSnmJrB6IIDFTZAkQUdoJMI5w;src=8019191;type=invmedia;cat=1up4h04i;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7410282860387.254?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://8019191.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK viewability Show response
hal900024.redintelligence.net/ Frame 0E01 0
150 B 38ms
13ms Script
text/html 138.201.84.252
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900024.redintelligence.net/viewability?s=57853200014847804444544012523024&a=49b77df2&vb=m
Requested by: Host: hal900024.redintelligence.net
URL: https://hal900024.redintelligence.net/request_content.php?s=57853200014847804444544012523024&a=1f1a964d
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.252 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.252.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900024.redintelligence.net/request_content.php?s=57853200014847804444544012523024&a=1f1a964d
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Date: Wed, 29 Nov 2023 05:47:49 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 0B46 14 KB
15 KB 14ms
13ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90008.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 12:44:49 GMT
x-content-type-options: nosniff
age: 320580
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 12:44:49 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 0B46 15 KB
15 KB 18ms
17ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal90008.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 20:59:44 GMT
x-content-type-options: nosniff
age: 290885
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 20:59:44 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 69A0 17 KB
6 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 29 Nov 2023 05:47:49 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9CEC 43 B
216 B 111ms
110ms Image
image/gif 2600:1f18:1aca:4280:3d67:f8d:404:f402
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1854208&asId=5aa6d1d1-b17f-5aa6-5442-a558eb4fcaa5&tv=%7Bc:vkVavG,pingTime:-3,time:542,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:401%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:542,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:401,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B155~0%5D,as:%5B155~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tWYwwPQ+11%7C12%7C13%7C14%7C15%7C161%7C1621%7C163%7C164%7C171%7C172%7C1731%7C18%7C191%7C1921%7C193%7C194%7C1a1%7C1a2%7C1a31%7C1b1%7C1b2%7C1b3%7C1c1%7C1d1%7C1d21%7C1d3%7C1e1%7C1e2%7C1e3%7C1e4%7C1e5%7C1e6%7C1e7%7C1f%7C1g%7C1h1%7C1h2%7C1h3%7C1h4%7C1i1*.1854208-76774456%7C1i11%7C1i12%7C1i13%7C1i14%7C1j1%7C1k11%7C1l11,idMap:1i1*,rmeas:1,rend:0,renddet:na,siq:401%7D&br=c
Requested by: Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:3d67:f8d:404:f402 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: nginx
x-server-name: dt09.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9CEC 43 B
216 B 111ms
111ms Image
image/gif 2600:1f18:1aca:4280:3d67:f8d:404:f402
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1854208&asId=5aa6d1d1-b17f-5aa6-5442-a558eb4fcaa5&tv=%7Bc:vkVavG,pingTime:-6,time:542,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:542,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:401,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B155~0%5D,as:%5B155~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tWYwwPQ+11%7C12%7C13%7C14%7C15%7C161%7C1621%7C163%7C164%7C171%7C172%7C1731%7C18%7C191%7C1921%7C193%7C194%7C1a1%7C1a2%7C1a31%7C1b1%7C1b2%7C1b3%7C1c1%7C1d1%7C1d21%7C1d3%7C1e1%7C1e2%7C1e3%7C1e4%7C1e5%7C1e6%7C1e7%7C1f%7C1g%7C1h1%7C1h2%7C1h3%7C1h4%7C1i1*.1854208-76774456%7C1i11%7C1i12%7C1i13%7C1i14%7C1j1%7C1k11%7C1l11,idMap:1i1*,rmeas:1,rend:0,renddet:na,siq:401%7D&tpiLookup=ao:www.farfeshplus.online*%2C58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com*&br=c
Requested by: Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:3d67:f8d:404:f402 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: nginx
x-server-name: dt01.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 InterstateCondensedBlack.woff2
s0.2mdn.net/creatives/assets/4925812/ Frame 69A0 14 KB
14 KB 14ms
14ms Font
font/woff2 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4925812/InterstateCondensedBlack.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7683192671021942909/index-be1f7599.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3b7bf416424abed17314649bb71a1de7a3afc6af66840d04b730e69652e27ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index-be1f7599.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:43:55 GMT
x-content-type-options: nosniff
age: 234
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14644
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 09:13:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 05:58:55 GMT

GET
H3 200 InterstateCondensed.woff2
s0.2mdn.net/creatives/assets/4925812/ Frame 69A0 28 KB
28 KB 15ms
15ms Font
font/woff2 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4925812/InterstateCondensed.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7683192671021942909/index-be1f7599.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

241bb801b29748e542884f7b902c02f12f6a318ba97f70224986634926dbc433

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index-be1f7599.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:42:20 GMT
x-content-type-options: nosniff
age: 329
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28596
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 09:13:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 05:57:20 GMT

GET
H3 200 06232023-053002206-background_quadratisch.png
s0.2mdn.net/4528404/ Frame 69A0 28 KB
28 KB 14ms
14ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/06232023-053002206-background_quadratisch.png

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4338b399e437bda69b997b7de46a7869b9244a1f7cebc91ddaf57329c41e7ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=LGiGKR6JLe&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 08:11:47 GMT
x-content-type-options: nosniff
age: 77762
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28774
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 12:30:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 08:11:47 GMT

GET
H3 200 annick_sitzend.png
s0.2mdn.net/4528404/ Frame 69A0 2 MB
2 MB 16ms
15ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/annick_sitzend.png

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7327225cdf3eb28cd7f8ed4ab98de9d079fe2f007c3d73fd58dc4c757cf6b4cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=LGiGKR6JLe&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 10:48:56 GMT
x-content-type-options: nosniff
age: 68333
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2539328
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 12:30:04 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 10:48:56 GMT

GET
H3 200 congstar-stoerer_gb-plus_full.svg
s0.2mdn.net/4528404/1687525202405/ Frame 69A0 4 KB
2 KB 17ms
16ms Image
image/svg+xml 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1687525202405/congstar-stoerer_gb-plus_full.svg

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd5e51e4be28957472ed34851536685ff162bb43dec37c9a7be46de1c1b72ee9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=LGiGKR6JLe&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:22:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48315
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1929
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 13:00:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 16:22:34 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 3FD1 0
0 67ms
67ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuD-_JI0WMXULORyRu8NAte4PEB5MKLJ2TCff2KcYoOMecc-SOqcCyaeTJD8KkroaUIhCiFyXdvhEpF93_0ZKiHdnTiIcJv_PTkZrxgTgwlLhbrjKtdRidhI8voL98EWesdkblPbCLISqpMpBPouaMw5iaX8xiNjm13pr7u5CiHJQwFl50ya3FiT3IsWyJznZQYwwl2ef7YVUP9W8JJQkq8fIYt1cfBs8hf7bQU2756zRB-6LfJMIp1gi97I3ISqSSGfSZYniXQsXCqr_6XvIP3uyTQ-yiUV0Ke6-iYmYBjZHoN259HPoQm1l4LwLKpJXpItREmpPKvWG7YI-aCDdPTXWvdqeIUMWlcnFHe8RUoURapEgZ0WlRLRSXlOEgYA-X2JVbC4-EqnuFV8ryaNCxjN1OSUxcETNxdU2btLo-Ou4uxBd4j_YioagUAriGVKbo_Vf4UOLUX4KPoXpY2H0OlinmmLsor5TjHwnipHpavMktdiTJE2TVO0k_uhXdtV6aplNkpEL5CiKdKB58AjgLHe96vEXavrGGIVLCCrdJBHuXCWnP4T-YN7esbf8fZEu-K8_2F86H8JtNplJOUZ2K6DElEdOfDdRH8hX0PttbWxUd_7JoL-kp7EMQyLVo2gaoNU2lprZ2e-k3XjcsR8QNJnPWKCAsMACfknuJECQeD1FNURBjYxwr8AZU3Ap9O6bUeTlcBiDTisBuqKwB8jUMPe0bxO24T0PotddVMh7OAdxSBDYOxILgFaqBP0SR5roDHJVKdZTSo1M0yjQqnJ9J3OODsfO2lOfAg8v9pbzsakGWFdROrQwTFu3cNWgt1X3ncU6p8TAELr5XSAR_nLUYivF8RwlFWOenDbuR0loHlKpGrJVwSwLzSF50YH6V9YBzg9DbMQ6RCX5q8X008MS55ePrSuleBOcwVpgw9hU0TD6xkxSBCy6Dre0CGe4IVXvJ5uB_nVmMRBWF7_Nq_4FnTVoahg7ARuX2nkBcZPngn7tCvTeJP8bBbA6QRgOtycoRKISVHl_-e-HfGlM4A0v1fcSx1LnMuTPyvdRjSzaBOZ_VfDHi7hBHrIgZcamHrQR9UNrtQcH0CwYyYwx1T5xymM8S5B7q3AV2c__6Nu_dO2vxTilWhHpa8afWpwprbp4A6LFByydCyJJCpYLMUT_lbHk3CGpj1C0KcHACwIzLvuK_m3sv_3P5NayzLLLwnfv2fJsK9um8XCkxLEtkf4ZK18qolLe3K9RtYku0YeItXG7kshfmrlB6ZeZiNnZ-BGaVEdmaiJnVImYqXZShmF-uAQfW_Z0E1c7eWfktLlefAgWV93p_QAmfFVAwhX84jXnd6JxB2AArAr35vX0aXLhkHFSfx18tBH9gWjleAKhK7qoj0FXnUeoPZVXYcRFGtUVF2q1dbJkYM3hcDQ639jMSNmYTaPS0_1MK2V93nyR-i0gO1XaMlqZgbboht9WQC5E0OeSBhXIgj4q22pmh9oowS0jjEmIARBzdAnRCxNLba-46tnGB9HI1GoiliqrXrOSrZCiI5EReYS1qa9-mmPzILgXnXfrpMerXg8COPwTw&sai=AMfl-YRnTqzhqldvWeP6HVXfcMgGT-Of60PwXRwjxC5oN5YOENmQIskcqryKQ99greOqCrf56QYfN26Dhr8QNsR-q2GtjgGQmGnq_XghWxR4rIZ09wGDjciWsbI-_-kpHbGt7y0JcUWrz0JS13LoEaKGPjLqAz0Y2oHHyap2jwvTca8xSBQnKQb5S-yB3DGve0TY7g1T-q1bw65ahn-1p5zWCHRkv_HRdRTRlLmQ2BnST-srmTRHVfb9ZAkoTEKx8bF2YECT&sig=Cg0ArKJSzKWvFcc8hpaMEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1027&vt=11&dtpt=672&dett=3&cstd=350&cisv=r20231109.22696&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 5686647303429821299
tpc.googlesyndication.com/daca_images/simgad/ Frame 9A6C 121 KB
121 KB 34ms
34ms Image
image/jpeg 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/5686647303429821299

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1701236867&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867074&bpp=3&bdt=538&idt=3&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7668197056731&frm=20&pv=2&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee84019ae0ae0d4941dbfc81004eec7b2d95a1049b95d53efd00b33eae39d20d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Thu, 23 Nov 2023 10:39:13 GMT
x-content-type-options: nosniff
age: 500916
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 123790
x-xss-protection: 0
last-modified: Thu, 23 Nov 2023 10:32:21 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 22 Nov 2024 10:39:13 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/ Frame 9A6C 23 KB
9 KB 64ms
64ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1701236867&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867074&bpp=3&bdt=538&idt=3&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7668197056731&frm=20&pv=2&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f665ba5c27890ebed553836dee5572ad583c0a65374373741ec0a5309df2b5a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33132
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9282
x-xss-protection: 0
server: cafe
etag: 14645652906762492339
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 20:35:37 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 9A6C 3 KB
1 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1701236867&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867074&bpp=3&bdt=538&idt=3&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7668197056731&frm=20&pv=2&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:35:37 GMT
content-encoding: br
x-content-type-options: nosniff
age: 33132
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 20:35:37 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 9A6C 20 KB
8 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1701236867&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867074&bpp=3&bdt=538&idt=3&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7668197056731&frm=20&pv=2&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c30eaaa059a466037880c18c01c2fe94183d8e67eaab42061d4d2a180114658

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:19 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48630
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8541
x-xss-protection: 0
server: cafe
etag: 737174102934380276
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:19 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9A6C 202 KB
64 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1701236867&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867074&bpp=3&bdt=538&idt=3&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7668197056731&frm=20&pv=2&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:49 GMT

GET
H3 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/ Frame 9A6C 36 KB
14 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231109/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1701236867&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867074&bpp=3&bdt=538&idt=3&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7668197056731&frm=20&pv=2&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a3e5c486ca9cab98b690f2f3fcc83c73141a667293c8a8236bb1e376313f0e36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:55:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46359
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14803
x-xss-protection: 0
server: cafe
etag: 12205605038930952422
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:55:10 GMT

GET
H3 200 MM_logo.png
s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/ Frame B13C 2 KB
2 KB 35ms
35ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/MM_logo.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

75a5283bb381c20c0c57415204535fda60c0574b39c2395f5af96a5120ffc024

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 09:27:21 GMT
x-content-type-options: nosniff
age: 159628
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1847
x-xss-protection: 0
last-modified: Fri, 24 Nov 2023 13:28:58 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 26 Nov 2024 09:27:21 GMT

GET
H3 200 SA_logo.png
s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/ Frame B13C 1 KB
1 KB 39ms
38ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/SA_logo.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b81852fce11a1b998090d79b90e869555f6dc0eebdf099b6a5c8e8f27609195c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 09:27:21 GMT
x-content-type-options: nosniff
age: 159628
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1391
x-xss-protection: 0
last-modified: Fri, 24 Nov 2023 13:28:58 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 26 Nov 2024 09:27:21 GMT

GET
H3 200 Prod1.png
s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/ Frame B13C 5 KB
5 KB 38ms
37ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/Prod1.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

188da46f4f834fca628101333d4b28b98b6f2ce4d89e10f75c35d476837feb47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 09:27:21 GMT
x-content-type-options: nosniff
age: 159628
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5396
x-xss-protection: 0
last-modified: Fri, 24 Nov 2023 13:28:58 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 26 Nov 2024 09:27:21 GMT

GET
H3 200 Preis1.png
s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/ Frame B13C 2 KB
2 KB 41ms
40ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/Preis1.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0cecae91a7b14d8e948bd90227977b44fdba1fefe592d0d0a6d2c845f36c81aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 09:27:21 GMT
x-content-type-options: nosniff
age: 159628
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2379
x-xss-protection: 0
last-modified: Fri, 24 Nov 2023 13:28:58 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 26 Nov 2024 09:27:21 GMT

GET
H3 200 Visual2.png
s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/ Frame B13C 6 KB
6 KB 44ms
43ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/Visual2.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

00d184dea9b20275957f0fc9f5dc114b301ee272f9b6617eaa8ebf41810fe687

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 09:27:21 GMT
x-content-type-options: nosniff
age: 159628
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6182
x-xss-protection: 0
last-modified: Fri, 24 Nov 2023 13:28:58 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 26 Nov 2024 09:27:21 GMT

GET
H3 200 Visual.png
s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/ Frame B13C 7 KB
7 KB 43ms
42ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/Visual.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46753860d0730fc5088579a15aef992954a2dbfcf5875563835d10e60bff4ffe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 09:27:21 GMT
x-content-type-options: nosniff
age: 159628
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6772
x-xss-protection: 0
last-modified: Fri, 24 Nov 2023 13:28:58 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 26 Nov 2024 09:27:21 GMT

GET
H3 200 Bild.jpg
s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/ Frame B13C 13 KB
13 KB 42ms
41ms Image
image/jpeg 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/Bild.jpg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8e0d9bcf4c59fa71e263e52fd95f262a1ac7e25a59e8f6574c8bbaf9be520bff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 09:27:21 GMT
x-content-type-options: nosniff
age: 159628
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13458
x-xss-protection: 0
last-modified: Fri, 24 Nov 2023 13:28:58 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 26 Nov 2024 09:27:21 GMT

GET
H3 200 Gradient.png
s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/ Frame B13C 3 KB
3 KB 39ms
39ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/Gradient.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6266313190087173&output=html&h=90&slotname=5788561387&adk=2966895748&adf=3370249990&pi=t.ma~as.5788561387&w=728&lmt=1701236867&format=728x90&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867085&bpp=5&bdt=548&idt=5&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600%2C760x280&nras=1&correlator=7668197056731&frm=20&pv=1&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=861&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&fsb=1&dtd=6

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d87c09d002d7aaa01340da655c408cbe7e07e18b53cc404b15ecc2008de0c747

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17005337128393527042/HP_Notebook_728x90/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 09:27:21 GMT
x-content-type-options: nosniff
age: 159628
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3122
x-xss-protection: 0
last-modified: Fri, 24 Nov 2023 13:28:58 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 26 Nov 2024 09:27:21 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame AAB1 42 B
64 B 58ms
58ms Fetch
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss3yUHp32CxjwupXAdVwPx2dwh1x_ZdMteCqXmgWLNXJ-J8__dMnqMZxBMQF9iY6Hlhh2nCBOjdaRSqNfT2s2hb2FG4Q9GiJIo1o7n_TePaRZp4aVm1debP0F50vmXEpLa-Sua6RQnXToF_&sai=AMfl-YR4hUajmXd5HhETxgXQhYN1ffCrzMk4zctH2qGwJAYH7b-BOL4zn7wh42KXJOKvsApiUav43D0XLD2qZBswyjeXaTacjvx9f9JwvJN51REJ1qShw9U1bd4VlsSFhMOtyVO0YWovRv9A-_VFNo-qX8QprWTCP-c1___H&sig=Cg0ArKJSzMnnFlGkxFmwEAE&cid=CAQSTwDICaaNWPTS8UtjV7cWPVLX7YW6NGS1DxqcgBKo72z7KfkrjJ8YoVB_-RTKVsaEVlIvDPwMz19drAfSXZcstIPeY9sVNOhq3qf3LuKrIycYAQ&id=lidar2&mcvt=1107&p=0,0,90,728&mtos=1107,1107,1107,1107,1107&tos=1107,0,0,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2966895748&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701236867092&rpt=1445&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 6DB0 39 KB
15 KB 39ms
39ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 04:52:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3309
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Nov 2024 04:52:40 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 7C7C 38 KB
13 KB 27ms
26ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 307778
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 16:18:11 GMT
expires: Sun, 24 Nov 2024 16:18:11 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dc_oe=ChMI_aXXmcHoggMVm6GDBx1VeA3XEAAYACCq2oNdQhMIjYqmmcHoggMVgYyDBx3MgQgJ;dc_eps=AHas8cDtmh3Wf9lUfNtiFaX1JrFc7q7UQwf_j83-4_FYF3wyyQhZ5sC0Tt6uhvyTCovBi8etBkqY;stragg=1;&timestamp=1701236869699;str=...
ade.googlesyndication.com/ddm/activity/ Frame 9794 42 B
108 B 102ms
52ms Image
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI_aXXmcHoggMVm6GDBx1VeA3XEAAYACCq2oNdQhMIjYqmmcHoggMVgYyDBx3MgQgJ;dc_eps=AHas8cDtmh3Wf9lUfNtiFaX1JrFc7q7UQwf_j83-4_FYF3wyyQhZ5sC0Tt6uhvyTCovBi8etBkqY;stragg=1;&timestamp=1701236869699;str=nextSlide;strtype=1

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMI_aXXmcHoggMVm6GDBx1VeA3XEAAYACCq2oNdQhMIjYqmmcHoggMVgYyDBx3MgQgJ;dc_eps=AHas8cDtmh3Wf9lUfNtiFaX1JrFc7q7UQwf_j83-4_FYF3wyyQhZ5sC0Tt6uhvyTCovBi8etBkqY;stragg=1;&timestamp=1701236869700;str=...
ade.googlesyndication.com/ddm/activity/ Frame 9794 42 B
402 B 98ms
50ms Image
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9CEC 43 B
216 B 102ms
98ms Image
image/gif 2600:1f18:1aca:4280:3d67:f8d:404:f402
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1854208&asId=5aa6d1d1-b17f-5aa6-5442-a558eb4fcaa5&tv=%7Bc:vkVax7,pingTime:-2,time:631,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:794,beZ:796,mfA:1181,cmA:1181,inA:1181,inZ:1182,prA:1182,prZ:1194,si:1195,poA:1195,poZ:1200,cmZ:1200,mfZ:1200,loA:1336,loZ:1337,ltA:1425,ltZ:1425,mdA:796,mdZ:831%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:728.90,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:401%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:0,o:631,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:401,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B244~0%5D,as:%5B244~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tWYwwJ7+11%7C12%7C13%7C14%7C15%7C161%7C1621%7C163%7C164%7C171%7C172%7C1731%7C18%7C19.1854208-76774665%7C191%7C1921%7C193%7C194%7C1a1%7C1a2%7C1a31%7C1b1%7C1b2%7C1b3%7C1c1%7C1d1%7C1d21%7C1d3%7C1e1%7C1e2%7C1e3%7C1e4%7C1e5%7C1e6%7C1e7%7C1f%7C1g%7C1h1%7C1h2%7C1h3%7C1h4%7C1i1*.1854208-76774456%7C1i11%7C1i12%7C1i13%7C1i14%7C1j1%7C1k11%7C1l11,idMap:1i1*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:na,siq:401,sinceFw:230,readyFired:true%7D&br=c
Requested by: Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:3d67:f8d:404:f402 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: nginx
x-server-name: dt14.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 2595 42 B
64 B 54ms
50ms Fetch
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst0KGLaezmD3a2duET29gNvl9Oa1L6OWWn7gbkVMhBZPVjlpdILfhzBkk48kN_ElNShGI_Z_8hmxe7mANl3rAyagU3CSHotoJVTHDe8pvK5sxrtPFlfb3XY_MgzIqtgI48fO4k-fY6fxXSL&sai=AMfl-YSErlnMJEkc38jfFdFUf-TBKa9FsV23bU45JntT21bVlwajjQF0qeX73QLXna1jobDzuABMkHQLFnVZmquRXdWlbSN-SYQ8DraRdIkEM-m1kUyxNax2hoNelqFOWTO9Pckrzuodu0KxhhCkc1E7I_zjbJLei1yGhV4A&sig=Cg0ArKJSzCBBUUc8ZSi1EAE&cid=CAQSTwDICaaNyoppWIGMgCGYJx0980g4-TyMTzwpBQdmdBgQgk_LEaJNeLf-eY_0Jc4FO0rniuV0MmO6xTk_lTciMak4eJDo02wtkBwE_F_kDBkYAQ&id=lidar2&mcvt=1057&p=0,259,40,300&mtos=1057,1057,1057,1057,1227&tos=1057,0,0,0,170&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1530395088&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701236867072&rpt=1399&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 9214 143 B
166 B 19ms
16ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1701236867&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867074&bpp=3&bdt=538&idt=3&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7668197056731&frm=20&pv=2&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1701236867&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867074&bpp=3&bdt=538&idt=3&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7668197056731&frm=20&pv=2&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&fsb=1&dtd=4
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1592
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:21:17 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 0E01 14 KB
15 KB 18ms
18ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca57b79a870bbf54700730858603a70d79743779c1b059922ec401bfddc5adc9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900024.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 12:44:49 GMT
x-content-type-options: nosniff
age: 320580
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14824
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 12:44:49 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v22/ Frame 0E01 15 KB
15 KB 15ms
15ms Font
font/woff2 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7b348b30ea1fe43857e68fc462c29e5c6e63c97666af75135c4396a272e54762

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900024.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 20:59:44 GMT
x-content-type-options: nosniff
age: 290885
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14892
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 22:52:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 20:59:44 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A768
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEPNRN7wivjbdRFb7fck70sg&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=OXF3bTljUlUxUjhkcWw1&google_gid=CAESEPNRN7wivjbdRFb7fck70sg&google_cver=1&google_push=AXcoOmRhuK6MLHu_x2h47i4oXrMRScqdukrwCBA8HgV8Yy7...

170 B
188 B

23ms
23ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=OXF3bTljUlUxUjhkcWw1&google_gid=CAESEPNRN7wivjbdRFb7fck70sg&google_cver=1&google_push=AXcoOmRhuK6MLHu_x2h47i4oXrMRScqdukrwCBA8HgV8Yy7s3RekgNwDR4-Okk97-615JPvy4G6eOb-6Qy3vi68oH2c16SAVM2A_

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 29 Nov 2023 05:47:49 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-029f22d856dc4e10e@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=OXF3bTljUlUxUjhkcWw1&google_gid=CAESEPNRN7wivjbdRFb7fck70sg&google_cver=1&google_push=AXcoOmRhuK6MLHu_x2h47i4oXrMRScqdukrwCBA8HgV8Yy7s3RekgNwDR4-Okk97-615JPvy4G6eOb-6Qy3vi68oH2c16SAVM2A_
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame A768 0
174 B 58ms
18ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEIKhqZHKurem0VTr2LKdboU&google_cver=1&google_push=AXcoOmS_dkIKtduDSftbCUVXyi80Uvu7XJX_D8LcW2BvvkZJHj8q8qvLpC8pTWD_ppV0Zvex2p2U99PHIP7GB4tY9aY3mYhfydUI
Requested by: Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:49 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A768
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEOyXuWwHfJLOQEc4MVKTgOY&google_cver=1&google_push=AXcoOmSdFK5KHyp0bOVmT_aRsaUzjBibHA4pervlFa2aFIKmLoyJQMtPl8-RK59PLAoxqLusLTQevsCahGxGHu...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMwNjc1NjcxNTEwNzA1NTc2MA%3D%3D&google_push=AXcoOmSdFK5KHyp0bOVmT_aRsaUzjBibHA4pervlFa2aFIKmLoyJQMtPl8-RK59PLAoxqLusLTQevsCahGxGHut8Tw...

170 B
188 B

23ms
23ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMwNjc1NjcxNTEwNzA1NTc2MA%3D%3D&google_push=AXcoOmSdFK5KHyp0bOVmT_aRsaUzjBibHA4pervlFa2aFIKmLoyJQMtPl8-RK59PLAoxqLusLTQevsCahGxGHut8TwaqEU6jtpiQ

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzMwNjc1NjcxNTEwNzA1NTc2MA%3D%3D&google_push=AXcoOmSdFK5KHyp0bOVmT_aRsaUzjBibHA4pervlFa2aFIKmLoyJQMtPl8-RK59PLAoxqLusLTQevsCahGxGHut8TwaqEU6jtpiQ
Date: Wed, 29 Nov 2023 05:47:49 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H2 200 sync
x.bidswitch.net/ Frame A768 43 B
146 B 9ms
9ms Image
image/gif 3.69.41.2
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEAKosCBrvca9a-7TOLhatRo&google_cver=1&google_push=AXcoOmR6vHkrujCabX_P5bMHDaMXLlq_xJsNKO-JWZGX9sKYct7_KvB1gyjhDu1WCzYCicC0G4LsbUc-7GGBeEjoC6n4aJQFQLEk
Requested by: Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.69.41.2 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-69-41-2.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A768
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEJDlMwv4SpnZUu70xbvbs1I&google_cver=1&google_push=AXcoOmQkRNmT1vEGHHry3A26D797Vc0kJ99u65t3ipzwqK7cuAamDJYvQH_ZULNvFWpRgp4AYiNoGWVA...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEJDlMwv4SpnZUu70xbvbs1I&google_cver=1&google_push=AXcoOmQkRNmT1vEGHHry3A26D797Vc0kJ99u65t3ipzwqK7cuAamDJYvQH_ZULNvFWpRgp4AYiN...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjU5NDExMzE5NTY0Njg2MTA2MQ&google_push=AXcoOmQkRNmT1vEGHHry3A26D797Vc0kJ99u65t3ipzwqK7cuAamDJYvQH_ZULNvFWpRgp4AYiNoGW...

170 B
188 B

23ms
22ms

Image
image/png

142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjU5NDExMzE5NTY0Njg2MTA2MQ&google_push=AXcoOmQkRNmT1vEGHHry3A26D797Vc0kJ99u65t3ipzwqK7cuAamDJYvQH_ZULNvFWpRgp4AYiNoGWVAgiCJdjq8cES8FPCkmWE

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjU5NDExMzE5NTY0Njg2MTA2MQ&google_push=AXcoOmQkRNmT1vEGHHry3A26D797Vc0kJ99u65t3ipzwqK7cuAamDJYvQH_ZULNvFWpRgp4AYiNoGWVAgiCJdjq8cES8FPCkmWE
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame A768 0
12 B 21ms
21ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Ksg_gxYah7DZwjpKDxdYBhAzP8RFH1VNv8Eu0uRgVWG7SNXR0F4iZIk64

Requested by

Host: 58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com
URL: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK verify.js Show response
rtb0.doubleverify.com/ Frame F4F5 1 KB
925 B 126ms
28ms Script
text/javascript 130.211.44.5
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb0.doubleverify.com/verify.js?flvr=0&jsCallback=__verify_callback_479844229603&jsTagObjCallback=__tagObject_callback_479844229603&num=6&ctx=26679214&cmp=30758062&plc=382221960&sid=8351941&advid=&adsrv=&unit=728x90&isdvvid=&uid=479844229603&tagtype=&adID=&app=&sup=&isovv=0&gmnpo=&crt=&nav_pltfrm=Win32&dvp_strhd=0.20&dvpx_strhd=0.20&brid=3&brver=119&bridua=3&dup=null&chro=1&hist=2&winh=0&winw=0&wouh=1200&wouw=1600&scah=1200&scaw=1600&srcurlD=0&ssl=1&refD=2&htmlmsging=1&tstype=128&m1=13&noc=4&fcifrms=21&brh=2&vavbkt=&lvvn=28&dvp_idcerr=undefined&ver=171&eparams=DC4FC%3Dl9EEADTbpTauTauHHH%5D72C76D9A%3DFD%5D%40%3F%3D%3A%3F6TauU2%3F4r92%3A%3Fl9EEADTbpTauTauHHH%5D72C76D9A%3DFD%5D%40%3F%3D%3A%3F6Tar9EEADTbpTauTau8%40%408%3D625D%5D8%5D5%40F3%3D64%3D%3A4%3C%5D%3F6ETar9EEADTbpTauTau8%40%408%3D625D%5D8%5D5%40F3%3D64%3D%3A4%3C%5D%3F6E&dvp_exetime=28.00&callbackName=__verify_callback_479844229603
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal124.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.44.5 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 5.44.211.130.bc.googleusercontent.com
Software: /
Resource Hash: ed3f6be39d0b1dde7df1192ddbee8c225cb8419bc79ee7a00b2b00ec187f7d3f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 29 Nov 2023 05:47:49 GMT
Content-Encoding: br
X-DV-Response: 1
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=0
Connection: keep-alive
Timing-Allow-Origin: *
Expires: 11/28/2023 05:47:49

GET
H3 200 Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js Show response
pagead2.googlesyndication.com/bg/ Frame 3F36 38 KB
15 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61fe41cde1b6df00f34e5a9795741e926e8861b8e80d396ff799d48bacda5300

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 17:34:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 389578
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14900
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 23 Nov 2024 17:34:51 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9CEC 0
0 52ms
52ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvf54ZfZwP4AMy99UcZTlhQ_pj47eB1FgGT-r7h6C1XFa3j0BtZ03QUamt_3dciKRZxTK7BbjnP8KapM7G7c_VFLs19lb04UzeRndkZj_omLm0NE0MEcwDCPeE4O0OsW8fbcHsvfTZsKhLZ2MZZ7yB8SlweJa4r7iiEy__pycA_gBSAQJWknUasfgw3-KuNTnNEf4eWsOvXN6d4u3FfwTKo2g2Zzieor9xtT3GGWSobc-mV423RyTB5atEBEyQMPuEliCVgH9418X0qTZOXTZpn6TtlkiyYW7hDNELprB5jAKWa2P8CxLaP6tEuDjWqhNc0aGbOVutvgCG4cklRlho4e6dLNAXJ3j0GTOWVDRe-bCVYXLouzmgvrZ2gQGd4JWbKlBkGnBhLyT9fC4Pj0dAC2eKygOKTi_7cezVtahQOt0mMeNHwfx20sw3--DfwIhvy2bqHxUi5hfFCXIKsbpaVPpgxhJGetFYjNfP9JvqXwlDuk8SRqwZkRwngjjm0KZSgxXHSQ1erxn2uOkSMhmIKXb5ke0s5Y_l-ec5ayggxMz0QenGvad_0mo0rfP0HYC8EKaP43-zoXXtKGofLYPmZcdvRMLp6p2J-txsT1G3WGWX3TVOD9SYT0Kls78crKOTy-eo850-nC_A1l5pfeAahwmK-9Eqil0nigH6CE_3WPicFfQsrM4FD9YwiCooyN4BbQLyBYYBup6AWX6a1vuqkx2iKLzFdwXWNa_1GjhHY2yIRkuKsUGY9614xAlKyr-2Za8GWh_fjYah-mdpOSU_BROA12GLV_7VbXBv2GNIrjjTZ2GmVdWJLudm6WZIZL_zKLiaszz4gqKeZHw_GDtkGhnnhuQVQ6sKSb0eSKWUqcGpYmvBdY1k64dxUasf1CvgsWMgyhZ7Emymgt1iBbfh7dQDZ3K6KhBZf9Afw97Ym2GZH9g-_sA_gNxFURkqiwSp2UQ_qLQngmQARPfp5Fu-8GZ1XlL1h9ffRqBGCAcskpXRQKx160S0yjb5d4D-svYlMTJ8CnWshOX1_FXQwA-auhCqf4Ec6-2aoCCD3ZXR14zIJB8KoeFrNgW6IjKfETFwdPH7BKA09hc5MnARHNVwWVrNVs5XkAXjszhsoZ7g3w16-2582asVR14lrW7I5fo5zRDq8-NoSseZhsPHJf2WH_obojncmSVtI45UT6hZ9IXHpvrgcCKFYQdkw3YAjeYLCE-FQlGyCCn9IMqiFRCssMZigLNXEPMp8dLSeUQKbkEMNxNh_jsr6mijaLXcUpQXuE5KahJEQKk4ydU4iUnK7356jQ21e8SR0WIKMUGJvfKBQJSBDSjAhUa4T64kuRlOzy2bMk85AaiXFQQOppVSdXEfeW-YYMAa_OHerjeB_vePn7yg4DduDZ8IoC9A9oScR8PW6hvDlMGmfvMRE_vuj8hghzBHus1KQ9NNAbBLfoB1cb4wfgPvg_NXFViQerZrzT4mDye9oo9ic854e1oL77qH8P_tAuhSVj2YwFlX-NLLM6gzyO6a-untnpYpSWjw07PgqvfptpG1C0zJ3rdsPLnL2hIuU9MwiF9ZqUCBN-kjww8JwnatmyMaNuCLiKkiYrxrZ&sai=AMfl-YQcZS2mYKIruxxIT174sREpF4tasiGKAZuKlNU1xQMFWukf6WpAzJifbDaLZQ1Rxxga5SiCuDmZRlD0OPiN2B6OYpWA8b-BFfTyYYaM7OUAxjF0gVieFahQ8DgUsKiDA8b0AHC1hkmIXHzmV0tdxfbyPqVeU6h59J11W3u5qD3ztrvXSg5zP-JWzsRbW8dYed9A5EV5IlKe8bwXy0HHCIuibwqEbVSBLZ34jbPROMYMtO9bL_TnqngHysA5ZiJKVDAPG8pvua6gQji4Ysjlekk1O5j962hU&sig=Cg0ArKJSzKu1dKa6nlJzEAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1108&vt=11&dtpt=595&dett=3&cstd=512&cisv=r20231109.68303&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 78B7 8 KB
6 KB 55ms
54ms XHR
application/json 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_250&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b35ee2d2c702ab55a91ee9d9060787a24c3f1ec016789e4442ab0f3e75a13965

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5966
x-xss-protection: 0

GET
H3 200 logo-d0d80991.svg
s0.2mdn.net/sadbundle/7683192671021942909/ Frame 78B7 5 KB
2 KB 14ms
13ms Image
image/svg+xml 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7683192671021942909/logo-d0d80991.svg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7683192671021942909/template-489be870.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0d80991c6e4b62d5c77985c1e293aad44cc120e03aee7ae6936c79d25a0e467

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=sfXhF88Pnb&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 14:00:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 143261
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1913
x-xss-protection: 0
last-modified: Fri, 01 Sep 2023 16:27:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 26 Nov 2024 14:00:08 GMT

GET
H3 200 congstar-stoerer_5g_full-quer_gruen.svg
s0.2mdn.net/4528404/1688137202285/ Frame 78B7 7 KB
3 KB 16ms
16ms Image
image/svg+xml 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1688137202285/congstar-stoerer_5g_full-quer_gruen.svg

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b26a30acec5605f96cba20b604e9690e38c43256fe955c64eed9b373adaddb5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=sfXhF88Pnb&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 10:49:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 68329
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2933
x-xss-protection: 0
last-modified: Fri, 30 Jun 2023 15:00:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 10:49:00 GMT

GET
H3 200 logo.svg
s0.2mdn.net/4528404/1687521602712/ Frame 78B7 5 KB
2 KB 14ms
14ms Image
image/svg+xml 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1687521602712/logo.svg

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0d80991c6e4b62d5c77985c1e293aad44cc120e03aee7ae6936c79d25a0e467

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=sfXhF88Pnb&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 12:28:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 62362
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1913
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 12:00:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 12:28:27 GMT

GET
H3 200 cta_mit-pfeil_01.svg
s0.2mdn.net/4528404/1687937402098/ Frame 78B7 2 KB
1 KB 15ms
15ms Image
image/svg+xml 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1687937402098/cta_mit-pfeil_01.svg

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a9cba16c5a30dc7cc3bdcbba2a45e9e2e28ec4437894302c6676369ed0ec732

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=sfXhF88Pnb&t=1&renderingType=2&ev=01_250
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 12:28:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 62362
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1134
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 07:30:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 12:28:27 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 0768 0
20 B 50ms
50ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B1pVeg9BmZev0PLyvjuwPwpavIAAAAAA4AeAEAg&bg=!DwylDEPNAAZxrfrxUa07ADQBe5WfOKoWeK2_o9FGPPHvuEzFnXjk9ZjsE9RhYVA0xuAWk_FR4_OEKjztWQpxUUsvzhIOAgAAAvlSAAAAAmgBB5kC6DwzGpcHXU9DIGfIGNj7woyFFnMxWAD_qLZy5KK6bFk1FASzjCUkGnRqjSsqWoYBTgx-60jzZeqLK2-CU5HsPGCNFf1bG0mj7upoQ5gP-MX0DsLwxmmhose8ggEk6KOt6c02VpcEd3V7iHf--zOQAEUwbHINVaXkKgqztLGzWAZe8OC599_JB5OBtfh9cCOdOLrat3Y_uAbb0x5Mku42-FsgemXtN6oLtJHGOSLl0HWWI0NzpI72CxLzoHoJKgf9GaCZLjhxlu-B-2Suj2wT7WznVlHxBcRZkb66jA8Vrmai9f_RBFDCUPBvLPe61IeI4cg8bgccrfufK4tojmb-iwasmghwVYG6U1T7BRB-qROSzdmv9KqOqMknqJoD_3GfGCAZog-Zggda5ISb7aA6MWy3_lAqOaPy4Rra7eI-woyhqR7sRd6pEm8xOMi_RELXZ1_R-DhvFFZwNQWJeeGHeqB3FH_oAEkLWJdB_tvLeR2YANatQIgUP-U9vIIzOXa9ZfEMRSmkIdE3MQS9UCDrUnyg90Tp9NP4PWVCD5TfI-X7WoxxAgkm_AthvAp6evnoalW0JtawpI_VFbPrMgm-K4uAqmyzZp4_8VaZ4bX4p2DssQvgEZgkYsynABSOs1SpJ1OnztQxG9FLklPrF3xKBy441qs7ifv4hr04xOOtHV6Qfq6NQ_BkxBvlOgx8ZRZMTqcyeYBgyKtvnsXKbqY0Ug1qG9gfHFNZW6l1EDnbp4If8f-7XY9nV8zAUUYtjvME6Z8CaIAwp4gbuxu4Fz39apg4VAAyNhwxQ6PXngh5ugxxB30YxHHUZb5YL-YJs3pgxNV-u0LtfSv3PYcSKa-oVMs6VHXRnIHIGE5NF0u-rAbDnXAXN-GpAV0eC8ood_9nWqdngidvVx6OzlJNi_0RncNJwdJGjWHihoPuzER-M1k6kupG3IQyWtQwP28raJgovv4Nxey0Tb0yznvleYtG7x_Au_EKRTLm3g

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9CEC 42 B
64 B 57ms
56ms Fetch
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvaBp2sMp4uEuD2WQvqyEL6kbTMmxDhoUEGMjGpYkKOOMNKoloXq83hksbbBxsgneHKdWSxzTYX1pWbS9Y3V4r4rqjn9KnsX1eJD69GlldJQxWPiCKPO6AkNkzBJLwGSKoVsbqwK5C7rmWe&sai=AMfl-YQ6EfZSyfZf1OXQDijO7ziFzOfoBvnIutp7O1_nqoSDxvthRyho9h8bQDbZLiSmlaqaiDybG9NaSdJIfUk6mTg8zXTn_VFn4UKHMVp94QQvN7Lz_2V6E1EWHlFDCcb7SvUvUBqRmCw&sig=Cg0ArKJSzBjpgPBxgNNJEAE&cid=CAQSPADICaaNxBmaA6FrJ3mbz3xDGp2PTRiPMDx5Jh_Qf6lnz9b7V02RJhhJrq4YfemoS9ACPNx5dbn07vluXRgB&id=lidar2&mcvt=1117&p=0,0,90,728&mtos=641,1012,1117,1117,1117&tos=641,371,105,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3444336792&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701236868276&rpt=473&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame AAB1 43 B
215 B 208ms
208ms Image
image/gif 2600:1f18:1aca:4280:3d67:f8d:404:f402
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1854208&asId=57bd2e34-2388-d815-8d7b-133681662f40&tv=%7Bc:vkVaBq,pingTime:-10,time:1315,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwtNjB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMTkuMC42MDQ1LjE1OSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1701236869967%7C%7C932be5ed37133d95a474a4113b76e4f3%7C%7C1b7de7e82db1163ab7a1342e5def95a8%7C%7C1b2adf106ceadf909e001dd881d7882a%7C%7Cfe7b89ba5fea3bfab79842e5203e9cf9%7C%7C64efb4804417a976f51533a80d1de66d%7C%7C53207d53e7ae723de38ea4c16a334388%7C%7C797c370a89a5290df3a8130fa5b5871f%7C%7C1663701684,im:%7BpWait:91,pLoad:1174%7D%7D
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:3d67:f8d:404:f402 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:50 GMT
server: nginx
x-server-name: dt21.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame F585 39 KB
15 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 04:52:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3310
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Nov 2024 04:52:40 GMT

GET
H3 200 InterstateCondensedBlack.woff2
s0.2mdn.net/creatives/assets/4925812/ Frame 78B7 14 KB
14 KB 14ms
14ms Font
font/woff2 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4925812/InterstateCondensedBlack.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7683192671021942909/index-be1f7599.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3b7bf416424abed17314649bb71a1de7a3afc6af66840d04b730e69652e27ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index-be1f7599.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:43:55 GMT
x-content-type-options: nosniff
age: 235
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14644
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 09:13:06 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 05:58:55 GMT

GET
H3 200 InterstateCondensed.woff2
s0.2mdn.net/creatives/assets/4925812/ Frame 78B7 28 KB
28 KB 14ms
14ms Font
font/woff2 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4925812/InterstateCondensed.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7683192671021942909/index-be1f7599.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

241bb801b29748e542884f7b902c02f12f6a318ba97f70224986634926dbc433

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index-be1f7599.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:42:20 GMT
x-content-type-options: nosniff
age: 330
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28596
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 09:13:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 05:57:20 GMT

GET
H3 200 congstar-stoerer_5g_full-quer_gruen.svg
s0.2mdn.net/4528404/1688137202285/ Frame 78B7 7 KB
3 KB 14ms
14ms Image
image/svg+xml 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1688137202285/congstar-stoerer_5g_full-quer_gruen.svg

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b26a30acec5605f96cba20b604e9690e38c43256fe955c64eed9b373adaddb5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=sfXhF88Pnb&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 10:49:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 68330
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2933
x-xss-protection: 0
last-modified: Fri, 30 Jun 2023 15:00:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 10:49:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 78B7 17 KB
6 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_250.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 29 Nov 2023 05:47:50 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame AAB1 43 B
215 B 101ms
100ms Image
image/gif 2600:1f18:1aca:4280:3d67:f8d:404:f402
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1854208&asId=57bd2e34-2388-d815-8d7b-133681662f40&tv=%7Bc:vkVaLw,pingTime:1,time:1941,type:p,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:515%7D,%7Bpiv:100,vs:i,r:,t:708%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1233,o:708,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:515,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B204~0%5D,as:%5B204~728.90%5D%7D%7D,%7Bsl:i,t:708,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1233~100%5D,as:%5B1233~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:419,fm:tWYwwJ7+11%7C12%7C13%7C14%7C15%7C161%7C1621%7C163%7C164%7C171%7C172%7C173%7C18%7C19*.1854208-76774665%7C191%7C192%7C193%7C1a1%7C1a2%7C1a3%7C1b1%7C1b2%7C1b3%7C1c1%7C1d1%7C1d2%7C1d3%7C1e1%7C1e2%7C1e3%7C1e4%7C1e5%7C1f%7C1g%7C1h1%7C1h2%7C1h3%7C1h4%7C1i1.1854208-76774456%7C1i11%7C1i12%7C1j1%7C1k11,idMap:19*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:516,sis:1032%7D&br=c
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:3d67:f8d:404:f402 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:50 GMT
server: nginx
x-server-name: dt23.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame AAB1 43 B
215 B 100ms
100ms Image
image/gif 2600:1f18:1aca:4280:3d67:f8d:404:f402
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1854208&asId=57bd2e34-2388-d815-8d7b-133681662f40&tv=%7Bc:vkVaLw,pingTime:1,time:1941,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:515%7D,%7Bpiv:100,vs:i,r:,t:708%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1233,o:708,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:515,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B204~0%5D,as:%5B204~728.90%5D%7D%7D,%7Bsl:i,t:708,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1233~100%5D,as:%5B1233~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:419,fm:tWYwwJ7+11%7C12%7C13%7C14%7C15%7C161%7C1621%7C163%7C164%7C171%7C172%7C173%7C18%7C19*.1854208-76774665%7C191%7C192%7C193%7C1a1%7C1a2%7C1a3%7C1b1%7C1b2%7C1b3%7C1c1%7C1d1%7C1d2%7C1d3%7C1e1%7C1e2%7C1e3%7C1e4%7C1e5%7C1f%7C1g%7C1h1%7C1h2%7C1h3%7C1h4%7C1i1.1854208-76774456%7C1i11%7C1i12%7C1j1%7C1k11,idMap:19*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:516,sis:1032%7D&br=c
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:3d67:f8d:404:f402 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:50 GMT
server: nginx
x-server-name: dt24.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 index.js Show response
s0.2mdn.net/sadbundle/6137497824312366086/ Frame 575A 130 KB
22 KB 15ms
14ms Script
application/x-javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6137497824312366086/index.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6137497824312366086/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

356d0c75ea7695f7da2de877d8441ff02a2c1a2017b905cd12095eb20d9382c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6137497824312366086/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 08:16:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 163903
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22819
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 13:36:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 26 Nov 2024 08:16:07 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2595 0
22 B 47ms
46ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6138781310629&version=m202309260101&ct=76&x=1&cor=5370459519191871000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9794 0
22 B 47ms
47ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=8420645232971&version=m202309260101&ct=76&x=1&cor=11031375670977624000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 419D 0
22 B 48ms
48ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6610561621107&version=m202309260101&ct=77&x=1&cor=17494896701144228000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMIyprmmcHoggMVbRNVCB0c1AyWEAAYACCq2oNdQhMI2_m6mcHoggMVibh3Ch1TSAd_;dc_eps=AHas8cA3cxg0vBU5Gm1f5p1mVLfNkO5krLnKgL6YwjB-dUXFtHOKimgONNockJR1trYC1YE9rvwu;stragg=1;&timestamp=1701236870710;str=...
ade.googlesyndication.com/ddm/activity/ Frame 3FD1 42 B
107 B 53ms
53ms Image
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMIyprmmcHoggMVbRNVCB0c1AyWEAAYACCq2oNdQhMI2_m6mcHoggMVibh3Ch1TSAd_;dc_eps=AHas8cA3cxg0vBU5Gm1f5p1mVLfNkO5krLnKgL6YwjB-dUXFtHOKimgONNockJR1trYC1YE9rvwu;stragg=1;&timestamp=1701236870710;str=nextSlide;strtype=1

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-35-176-121-206.eu-west-2.compute.amazonaws.com

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js Show response
pagead2.googlesyndication.com/bg/ Frame EFBA 38 KB
15 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61fe41cde1b6df00f34e5a9795741e926e8861b8e80d396ff799d48bacda5300

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 17:34:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 389579
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14900
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 23 Nov 2024 17:34:51 GMT

POST
H/1.1 204
No Content bsevent.gif
rtbc-ew1.doubleverify.com/ Frame F4F5 0
308 B 75ms
18ms Ping
text/plain 130.211.44.5
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://rtbc-ew1.doubleverify.com/bsevent.gif?flvr=0&impid=c2449a5be56e44ad8d0f244deb2a0796&vfdur=127&cbust=1701236870762697
Requested by: Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal124.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 130.211.44.5 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 5.44.211.130.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://googleads.g.doubleclick.net
Pragma: no-cache
Date: Wed, 29 Nov 2023 05:47:50 GMT
Cache-Control: max-age=0
Access-Control-Allow-Credentials: true, true
Connection: keep-alive
Expires: 2023-11-28T05:47:50

GET
H3 200 dcmads.js Show response
www.googletagservices.com/dcm/ Frame F4F5 18 KB
8 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/dcmads.js

Requested by

Host: cdn.doubleverify.com
URL: https://cdn.doubleverify.com/dvbs_src_internal124.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62cf47440cbf69b9d0a37c238c923e6544394913a5e5e615d017b1537aa06ec2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 04:58:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2940
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7823
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 23:04:01 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Wed, 29 Nov 2023 05:58:50 GMT

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 7C7C 39 KB
15 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 04:52:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3310
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Nov 2024 04:52:40 GMT

GET
DATA 200
OK truncated
/ Frame 9A6C 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 455b9f78660267a8e9eb1806bd00316533ebbbd61437d2491ba4f8088f2e817b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 3FD1 0
22 B 47ms
46ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=6830518573591&version=m202309260101&ct=76&x=1&cor=5654054392329633000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 MM_logo.png
s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/ Frame 537A 2 KB
2 KB 16ms
14ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/MM_logo.png

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

75a5283bb381c20c0c57415204535fda60c0574b39c2395f5af96a5120ffc024

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 11:13:35 GMT
x-content-type-options: nosniff
age: 153255
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1847
x-xss-protection: 0
last-modified: Mon, 27 Nov 2023 08:27:56 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 26 Nov 2024 11:13:35 GMT

GET
H3 200 SA_logo.png
s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/ Frame 537A 1 KB
1 KB 21ms
19ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/SA_logo.png

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b81852fce11a1b998090d79b90e869555f6dc0eebdf099b6a5c8e8f27609195c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 11:13:35 GMT
x-content-type-options: nosniff
age: 153255
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1391
x-xss-protection: 0
last-modified: Mon, 27 Nov 2023 08:27:56 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 26 Nov 2024 11:13:35 GMT

GET
H3 200 Prod1.png
s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/ Frame 537A 6 KB
6 KB 20ms
18ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/Prod1.png

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

504e34e7f1b0bff5f66cc4e5b7426a3b7072362d69e2d4a4f382f162e4302789

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 12:26:09 GMT
x-content-type-options: nosniff
age: 62501
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5892
x-xss-protection: 0
last-modified: Mon, 27 Nov 2023 08:27:56 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 27 Nov 2024 12:26:09 GMT

GET
H3 200 Preis1.png
s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/ Frame 537A 3 KB
3 KB 19ms
17ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/Preis1.png

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0d62dd6431fdf89c21a7cd34417608ab374dc2fd4c4d2d5d968f63860f4b4a6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 11:13:35 GMT
x-content-type-options: nosniff
age: 153255
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2796
x-xss-protection: 0
last-modified: Mon, 27 Nov 2023 08:27:56 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 26 Nov 2024 11:13:35 GMT

GET
H3 200 Visual2.png
s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/ Frame 537A 6 KB
6 KB 22ms
21ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/Visual2.png

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

00d184dea9b20275957f0fc9f5dc114b301ee272f9b6617eaa8ebf41810fe687

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 11:13:35 GMT
x-content-type-options: nosniff
age: 153255
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6182
x-xss-protection: 0
last-modified: Mon, 27 Nov 2023 08:27:56 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 26 Nov 2024 11:13:35 GMT

GET
H3 200 Visual.png
s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/ Frame 537A 7 KB
7 KB 24ms
22ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/Visual.png

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

46753860d0730fc5088579a15aef992954a2dbfcf5875563835d10e60bff4ffe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 12:26:04 GMT
x-content-type-options: nosniff
age: 62506
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6772
x-xss-protection: 0
last-modified: Mon, 27 Nov 2023 08:27:56 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 27 Nov 2024 12:26:04 GMT

GET
H3 200 Bild.jpg
s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/ Frame 537A 13 KB
13 KB 20ms
19ms Image
image/jpeg 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/Bild.jpg

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8e0d9bcf4c59fa71e263e52fd95f262a1ac7e25a59e8f6574c8bbaf9be520bff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 11:13:35 GMT
x-content-type-options: nosniff
age: 153255
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13458
x-xss-protection: 0
last-modified: Mon, 27 Nov 2023 08:27:56 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 26 Nov 2024 11:13:35 GMT

GET
H3 200 Gradient.png
s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/ Frame 537A 3 KB
3 KB 21ms
20ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/Gradient.png

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d87c09d002d7aaa01340da655c408cbe7e07e18b53cc404b15ecc2008de0c747

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/892361945508833855/728x90/_export/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 11:13:35 GMT
x-content-type-options: nosniff
age: 153255
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3122
x-xss-protection: 0
last-modified: Mon, 27 Nov 2023 08:27:56 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 26 Nov 2024 11:13:35 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 9214
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

26ms
25ms

Document
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1701236867&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867074&bpp=3&bdt=538&idt=3&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7668197056731&frm=20&pv=2&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:51 GMT
expires: Wed, 29 Nov 2023 05:47:51 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:51 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 tracking-event Show response
api.webgains.io/ Frame 7548 16 B
209 B 81ms
81ms Fetch
application/json 35.176.121.206
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.webgains.io/tracking-event

Requested by

Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.176.121.206 London, United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx / PHP/8.1.14

Resource Hash

c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 29 Nov 2023 05:47:51 GMT
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/8.1.14
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache, private
x-xss-protection: 1; mode=block

OPTIONS
H2 204 tracking-event
api.webgains.io/ Frame 0
0 94ms
24ms Preflight 35.176.121.206
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api.webgains.io/tracking-event
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.176.121.206 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-176-121-206.eu-west-2.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
date: Wed, 29 Nov 2023 05:47:51 GMT
server: nginx

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9CEC 43 B
215 B 102ms
102ms Image
image/gif 2600:1f18:1aca:4280:3d67:f8d:404:f402
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1854208&asId=5aa6d1d1-b17f-5aa6-5442-a558eb4fcaa5&tv=%7Bc:vkVaRP,pingTime:-10,time:1915,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwtNjB8fE1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMTkuMC42MDQ1LjE1OSBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1701236869967%7C%7C932be5ed37133d95a474a4113b76e4f3%7C%7C1b7de7e82db1163ab7a1342e5def95a8%7C%7C1b2adf106ceadf909e001dd881d7882a%7C%7Cfe7b89ba5fea3bfab79842e5203e9cf9%7C%7C64efb4804417a976f51533a80d1de66d%7C%7C53207d53e7ae723de38ea4c16a334388%7C%7C797c370a89a5290df3a8130fa5b5871f%7C%7C1663701684,im:%7Bpci:%7Btdr:373%7D%7D,sca:%7Bspg:57bd2e34-2388-d815-8d7b-133681662f40%7D%7D
Requested by: Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:3d67:f8d:404:f402 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:51 GMT
server: nginx
x-server-name: dt16.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame AAB1 0
22 B 51ms
51ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=132917013526&version=m202309260101&ct=76&x=1&cor=15891318497451885000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4336 0
22 B 48ms
48ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=8008031553738&version=m202309260101&ct=77&x=1&cor=4575565311474138600

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 9A6C
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=C1oPEg9BmZbG5GtPD7gPP8rSADtvr3r901sjkyf0Rv-EeEAEg4OLZVmCVoqaCsAegAYeDv_cDyAECqAMByAPJBKoEnAJP0BfvZe5iXAPtQa6BhU0Ihknpbmeyo76d-E8rqiF0EQbBAf1XP1K...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%22716426950163787980%22,%22debug_reporting%22:true,%22destination%22:%22https://lightinthebox.com%22,%22event_report_window%...

0
0

59ms
59ms

Fetch
text/css

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%22716426950163787980%22,%22debug_reporting%22:true,%22destination%22:%22https://lightinthebox.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%221055900039%22],%224%22:[%2211-29%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2214298249239457606849%22}&andc=true

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:51 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"716426950163787980","debug_reporting":true,"destination":"https://lightinthebox.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["1055900039"],"4":["11-29"],"6":["true"]},"priority":"500","source_event_id":"14298249239457606849"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 29 Nov 2023 05:47:51 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 29 Nov 2023 05:47:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"716426950163787980","debug_reporting":true,"destination":"https://lightinthebox.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["1055900039"],"4":["11-29"],"6":["true"]},"priority":"500","source_event_id":"14298249239457606849"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 6C85 39 KB
15 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 04:52:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3311
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Nov 2024 04:52:40 GMT

GET
H3 200 impl_v99.js Show response
www.googletagservices.com/dcm/ Frame F4F5 59 KB
23 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/dcm/impl_v99.js

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/dcmads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3df5746a25ab4dc32517df57deca8ecc5c425a2abd15c6d6f5fc817472e4d632

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 07:58:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 78541
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-dcm-tag
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23872
x-xss-protection: 0
last-modified: Thu, 02 Nov 2023 14:22:33 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-dcm-tag"
vary: Accept-Encoding
report-to: {"group":"ads-dcm-tag","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-dcm-tag"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 27 Nov 2024 07:58:50 GMT

GET
H3 200 script.js Show response
s0.2mdn.net/sadbundle/6137497824312366086/ Frame 575A 8 KB
2 KB 14ms
14ms Script
application/x-javascript 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6137497824312366086/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6137497824312366086/index.html?ev=01_250

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b774a4be3b45ab7c1cbba8d6a4b19bcbcb4e9ebae699b125b05e6f17b6bd57d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6137497824312366086/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 08:16:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 163904
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1993
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 13:36:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 26 Nov 2024 08:16:07 GMT

OPTIONS
H3 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 48ms
48ms Preflight
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 29 Nov 2023 05:47:51 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6CBF 0
22 B 50ms
49ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=Bt1W4hNBmZf3TDpvDjuwP1fC1uA0AAAAAOAHgBAI&bg=!_v2l_bLNAAZxrfrxUa07ADQBe5WfOF6DGO2gkQdYxImR05UNc0Vtfq6KUmhB0XLDobGOzit6naSutk8hOLnXcfVokJV0AgAABwpSAAAAAmgBB5kC88-mpeOx7e2fg_MrBcvR0VmxZeVp5QueZRJ5jcFbaCT0CgIwMrOkvgDFVXtZEJx1WKOplGIz3hmY8N4fEG983kZSZCklcPGnS09b1dc4i64EgPyxt1kRJi9zF97p1CFeSNSdjpZXsSUNd2CZyULM27wq26G_gzie-w8iW3VWi2OkwTZbz7-zMwPGeRqkQT908fgB1rS6EDRI3iGTzGWUgteVXQ_qwt85hiaccHbUnF02UfmY2w0XAplywHUfllPzbS1WuegbA6wzud_CagIa8FFLsnmmz33UM9emXSiIuadelvWvu5g1F8WFUONhhvzTYJPNSpG1bNgbxw0uXJNsEiogTbpPmMud0zpMlDROnxnWb0A3sq24wm99wv0Lhg3mmmA45CSHVZL4wffGykwlXcx1cbuKkVwtGDY3TMcNt7fC_W898rwcJojok16iwRQQKv8A7rlBDVf73Pi5_zYQgBwCAdWoMvFxaWVeSR--9qUoxjhQ2LRFFD6Nt_qVf5X8Tv2afHRRCYqg1H1iOL4p2xDPTZYGf2T5MWR8L3FYZRSviyqzBXukIXUQJK4uQdeAhF5Qw_G8aA_gVNYgNv2SD0jCbILYIQW_o4rYBuFTQAtmc-izfRQadBgsUNGryl65dctAwOCrMnhkO7FgShK_0OI5x2N8NCV9rRqakCMn9chiDlXP9VMc5nwUlaOi_zVRNW_NkzrGGC7xP8RQ-IQDr2P_OH-UXDPE3s930KqkTOmrm8Ezw3_6fOcxUOsW9WFBCWO1zSq3RgFHSTyQXTmQ6oMa_Ywga5A87cU7f0N5N1WRhHkHSzIvC4FwryfHe9KGTZR_3_pGF8FOeQWCwB2KiOashTLT9iBqXa34epnTFOQRDn_9KUIluYYbRuSQSJM0ejYTpRZbJqxez7OTTjyVH189lzri4AP8gPfQoO2LadvKXyuHhXmyzBU-0XY6LDSLwKMN74YaeHzm7DR9hFl4nHAMbO5CVdQ0i3hCTtwFixhF4juz

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js Show response
pagead2.googlesyndication.com/bg/ Frame FAA1 38 KB
15 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Yf5BzeG23wDzTlqXlXQekm6IYbjoDTlv95nUi6zaUwA.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8367749956917006&output=html&h=280&slotname=5661428205&adk=1067503192&adf=1738279810&pi=t.ma~as.5661428205&w=760&fwrn=4&fwrnh=100&lmt=1701236867&rafmt=1&format=760x280&url=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701236867074&bpp=3&bdt=538&idt=3&shv=r20231109&mjsv=m202311150101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C120x600%2C120x600%2C160x600%2C300x600&nras=1&correlator=7668197056731&frm=20&pv=2&ga_vid=2062919147.1701236867&ga_sid=1701236867&ga_hid=1295869862&ga_fc=1&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=420&ady=121&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44809314%2C31078297%2C44807764%2C44808148%2C44808285%2C44809072&oid=2&pvsid=923086590804078&tmod=1245961457&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&fsb=1&dtd=4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61fe41cde1b6df00f34e5a9795741e926e8861b8e80d396ff799d48bacda5300

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Fri, 24 Nov 2023 17:34:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 389580
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14900
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 23 Nov 2024 17:34:51 GMT

GET
H3 200 B9689862.280630144;dc_ver=99.292;dc_eid=40004000;sz=728x90;u_sd=1;dc_adk=4277687812;ord=r29j6d;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=2,https%3A%2F%2Fwww.farfeshplus.onlin... Show response
ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/ Frame F4F5 67 KB
30 KB 56ms
56ms Script
text/javascript 142.250.184.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280630144;dc_ver=99.292;dc_eid=40004000;sz=728x90;u_sd=1;dc_adk=4277687812;ord=r29j6d;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=2,https%3A%2F%2Fwww.farfeshplus.online%2F$0;xdt=1;crlt=U8uA4Tj019;stc=1;chaa=1;sttr=184;prcl=s

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/dcm/impl_v99.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7caa61852ba59e4d9e0de857d997fd107886ab046e6f0cf45d0af92efb0c15cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:51 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 30914
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 83E1 0
22 B 52ms
51ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=Bevy7hNBmZZ-KD8aMgAfTtZvYAwAAAAA4AeAEAg&bg=!xMelx4jNAAZxrfrxUa07ADQBe5WfOKKYsdadht7sQtN09oFPGRSJU6iUv--QLGRIqlItqa935NKHcqgikAmxHzFolra9AgAABxBSAAAAAmgBB5kC7tcPNgrSPUyRl_eay9YWyh5lGi8727ko_mbG7MWV4_XlZH1J8PxDOPfVt6TY5NAwvYPvPtVv6Hg_fSh2mNQsIhqch7wjcJ_HfMcTm2BD11oasl826d5i4ylohVJl-67QBWMlp9fOEc6sCsY0Fo2cPMim5YSgwL4eioD3aCdavFdPywenZ-5vOauRi9pDw00w_m8U-qYeGHtHfOv-pNNjjWBwnYdlnSyNOauKyEQlSfM8AFfcahA84bShutNKwSp31UUopOvN_9_ETv7pzYjmW4r2LYc-2ZinTZcNomJyLvOivXq_OcIcEy0BkWm7GLsRWexrxf5w-CDtftkabyA1aqVDK8gxnL7t3ikomA5HlCF1Dsg1FUFWx6zIrFkomLXAoJ3BssgROgtf9oftN-6vJCuSSu20aMA7Atzrc-rEZTPVpEqKWiG99HCbCQKsWesBo9hjRTbMP7XCu7ZIXuvj0h0j57iewwjp99dZ6WABXCCMJRqXvxJJtX3RGldetc-wvSZ702HF8grtvJc8icLiyvtB51F7tapRKc7AW9ApjRV1xmi6bwJv6p9s5UtjUVc0njPH-InU0pgo1lNf5kZkP2A2ZIWe0x52LOiBxp18CBIw0JbSBpeF16ApGoR-GCVcaSxCPVeQ8ichuJzCU3Uxg3Hm6N-Y0VJe5r8tz8tVgs4e_Bnvq8YkaIdrHHwL0DUmlmUmCegSOGOgB979NbYpDgAHJDJvIo8PM_124spboRRdB8lRXyeutngVI1UOFJro_lcU37CcqqlZkRTJSs7Dk_O_TTtGPoldPMWh53Wl_UiDsWrsJu47Gx8_MbstRAitEjG_wZQ3ELPfnuvn0X3vjAMo0dzhu6H1kW97aEiUkbzHMkucTCkq2bFSbJ3wfw3lbBMFDKVPFg0SXQ4x6zsBO7lvnt_2HQf2161OEWvME2kWlH_WPBbbzRPgI9PGpXAO98UetBM6NvwLE61gj3xS3FllY-pbXW9s4wFn3XpbUA

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5E3B 0
22 B 49ms
49ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=Beyl0hNBmZajkCtKD4gGfgqzoCwAAAAA4AeAEAg&bg=!rq2lreLNAAZxrfrxUa07ADQBe5WfODvrcZItILIDxmhZp0q4EYYr6BkF0k1VYz50Vx6KMi5CG4NMpSlNCxSqbvXIwL6RAgAABxBSAAAAAmgBB5kC6gqnP7jQfcRzgLiSeXa5I7XQfNOdiPFgZIWUEOb37mky7xEp-HCYxhixdYdMKdp7ULr19P2cGsnjB1mJKJkM3Ba3XpdOq5lp_5YhuDw6M2ILJCR7PA1wojy2Aw9QAE1oSaiK9MwZ0uZxzu1dhaGJU9YIKMGpQq-cPTmQYBksfZu7wWjkoqeM0mz28KUJeK3P1DV7mvitGy5TB8UUXTL_axszcjVYGqlQQCY-_1msEmeorVoC4SiLlcRBkah8GtcNmSp9qIi52Yo1m7QMUftU2oq_Do-WLLby5_vAsA5Q8c4Af2cxKXVOid0Gk3YiLUebGIqUdCZDX3gXO8S1ZGV--vQfD8aNp6MK_DLNfWU5bBRFXlfLxBzjSCUVtqwKWGvIr52EwmFU0Z_g2NzEvZ58kcByQy9MlDsnilP4D1RSSdYdu8B3qrimardlwhHhZv3C0mds0veahR5NVbUWnJFxdxFMSfeb4npyka7eMj81qy1zMrKcfmfpgDqZwHYvoNlsUGLV_YPWGiFEq2iGQSWrnMXPvmATXC4KKRv0wb3cUcld72ogMrQBMK6Woi6Mf5AnVIrY2ZpybUOrjbZMsqqpaTV9fx_uzcG_BFmwB2C5D190dVmO8dKLHc_-E1-bEjUgubeXezMjz--hpsoL-PscaF6y1nmllpLO4bCTMx5RBCv-tVX2OqpPmHmPw9VYtmmzjg0UEzMkTEYVv8Cp5ay16A66vjOY_yczgxBxq6ywWOXH4FG7fXLjaqcScVEmMptvHSu1RfeLSV7QIXgpKzeOhStaMfP1PUt3mbmuMf_e8d9JJeN3XzrbtLNa_MZtkcYtP7Cx_zQ_HhE9RV4dlNRJkFwUokBlS5Q591y6ekgaGsIzNXOFTFZ6CbCxbqjok1lRpoFsl2a1uUYR6v-PAp789GkZOOgpnR7aceLgqrzBytsNptTkDWjQOuJ0FXmxEL52uKNOOGgQsRi2A7Nd4l9DD2EeuotENxc2IZxs

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A4AD 0
22 B 52ms
51ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BT8XchNBmZc-3ErDpx_APwZ630AQAAAAAOAHgBAI&bg=!qqmlqebNAAZxrfrxUa07ADQBe5WfODgV4NqLV1MgATSj2RacuEc8DduUJs6aoEja0HdbBqb3v_INyhQIhKydQN0E73fAAgAABuNSAAAAA2gBB5kC_M83zACOY0tKYUYNhGIdlAKaDxvcxz4-p3e-L1z7kvZyh_GxZguIQCrnPUjEFp8m_8Eqxr8LhNwI5CXjS3CHtW8hhiRc8vqrA04Gsv00wjjom7R1lkskUpLqb6g2ZCw5T2Hz4wDPcKQnYdDtO4-xpR-cML0fzl0PnJZbfsCPYq7ylVrNV7K5KuQR4h-I4iIQ2WEgb5r3_AuY3zWbRqxxXLjaz5tYb_X5bOFsOpNKRIgYnkoZ0D8TKedwoiPC_KFFj9_NocvNOGiSMLf6TCrKrEISCRHQHrnAFU10UVTfRdJT5JwAYdSgMi1h3n5-1P2WVY7A9X1yBAbYoBVaQGbgL6gaQf1wig-hDh5JkVUugw0Gym5X9KpcYuYiY8qATCPF6UZyr7R0WL2990n8flyR1VBVnDD17empHSiOsnwYuJcwoHO7kNbs3RE3OAaKvbXw1mXeSr-8fp9diE_biF3hzwwzo4S7MLDCuik1W0IJtSiF9QuIlpvgGZ7aIQxxf62C3AxmOY1EpIP-n8y_2zeVc7o3tha0si9IP6dIaoGmIaRm9ZXZCTnsBIJmKVn2PrjQWCVq7oEkOyq8zGY3cW3dxuEx6zGWvPaok_u635EUffpC3v9-tBcx9_3_8S_rT_81WPxiHk7wLYdttkaJKg8LhLLUB-RESNI8NS_BMBm-o8187_JzOaMbQvVaF2SGcQFiiVNJpHuSdRtWkKJNK1TqtIDdqk-l7aLn9hNWV3nUAB9T93B6ukw8YDo0B-S_jUgtNT73g2gw39ucn_GGyfD5bwneyH7Rs2QtYH26zwusjb9qTtZMSjZRVdkot8lxexmGy49Pb_QitdFFNSJQk4sIU8d9JZnZxpehnthZDTa6WHmAWbw7gIf_pw_cc_zXHF5UKKCowwXPnmovdHVPUxcjcxH7wr2SXazLOX69d3O9NaybBHmY0LHVm85U9h4Dy-JzZ2X2DXV-kZLDPJN9L9X4bkw-JKneBCcIh9o6TjmdXBJ1-VGEpQ2oH3Ez17fp

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 index_atlas_P_1.png
s0.2mdn.net/sadbundle/6137497824312366086/images/ Frame 575A 74 KB
74 KB 15ms
14ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6137497824312366086/images/index_atlas_P_1.png

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7f89f7f1ec6812b5923214dd305eb1c3c4d33aba3b66d680cfad0c38afc18e16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6137497824312366086/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 20:30:37 GMT
x-content-type-options: nosniff
age: 33434
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75516
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 13:36:26 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 27 Nov 2024 20:30:37 GMT

GET
H3 200 index_atlas_NP_1.jpg
s0.2mdn.net/sadbundle/6137497824312366086/images/ Frame 575A 4 KB
4 KB 14ms
14ms Image
image/jpeg 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/6137497824312366086/images/index_atlas_NP_1.jpg

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5627973aec606e37049178e4429006c509f0c8ae3f3034bff5553bf5c103d4c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6137497824312366086/index.html?ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Mon, 27 Nov 2023 08:16:07 GMT
x-content-type-options: nosniff
age: 163904
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4019
x-xss-protection: 0
last-modified: Wed, 08 Nov 2023 13:36:26 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 26 Nov 2024 08:16:07 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F41A 0
22 B 51ms
51ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BKbkhhNBmZcrIHe2m1PIPnKizsAkAAAAAOAHgBAI&bg=!rK-lr-DNAAZxrfrxUa07ADQBe5WfOChdAKrkbBLvm4KNkYT68_KombNELmpfsRQXeEPFzcaa5yFniIYomxp9K8tL40v_AgAABlFSAAAAAmgBB5kDD59GPn-GYmy5PCDZvGZRXxiMt6r7_Q-U5oCve-R_kZQA7w3awmS1LtJWVR2IB1KxO7DHMpwEzzsfl4ydfIg1xovbxdt7d9IlixK9zxELepArR4qqh9-4FrwNXPuOladisvFduGvW3rU3a6ik_DpM4s64XMBA0N-EV32TjDb0oKzs_UWsHQyRy1rHNiRfXQNKxNFmlyfc0mh5xab_4Bzg_sMFCyEZG7woi-FLLG7pkcj0qMn9GrU8HAHiXBYraWulVGdrafTl70MENm_iPOkc34DsDAl49MymqeihHiVFVkMBSYPcuQP1KfWiK8AFavYcmibzgvizb_WXTMqcXbSxq72Z93vlO689thqY_t4gV8Xx-a07MbbnVSHVRwLlgmexRq4ZQ0N5uSsUkueifgvVD4VYdRIbRmbE6RdZ-krj45jMiYCZK20pGDUy7wqb99_mZ5kjvDKtWWJFEcAdhlYu9W3Ca0PbFhCyNJ-LY-x5j0GATX4rRgmBecrkxyDOvyIncZbVUs1kqNwJ2AE6ttyCYErHWWQ7YUW6VKHwMqj7ikZhtrXPgrm-epvJTLGvvZE6gOliTVHA97zt80X9f1XilcmSz7LdMehTWVDQn9m069U1uW--tDdkvafVISvTSz6kpuzqZZOvMC3BbHJhsl_emV788mnGuiMhDcLG4YtWfWP7H7RXrkyfcRjowHTtQSFubP8Lo52cMwaqMNGazw0HICG_tMSP5hWBt8ZWcwnyaN8xvXBUblA4Q6R74Y1o56mqJQqPiYZtDfclSqJSkr7m6GXDg4Si0E0Kb4VxW-IpKYVLX1oajPG1nCO0nkAVmgadwcjeAqkHY_AW2ptIW9iSWTtDo1jGAGOL3bdjDtP2iAFyj-r77Za1uMNebdEAnQCENSCFXHZJ9Mcjqreh1o6FU8fJFBPkRbbHEDFlAV0Zm3woVuoxnL_jFecbqjrgPWXnJG1AB8iFjk_MftBmKSCyTN6JVPNRUY-xwRZqGfJjOvZBqSHwoJBDJPswGil4w5N5RbIC9boMuV_U-nOvEMe_KA

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/ Frame F4F5 11 KB
4 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20231109/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1395.150740DOUBLEVERIFY/B9689862.280630144;dc_ver=99.292;dc_eid=40004000;sz=728x90;u_sd=1;dc_adk=4277687812;ord=r29j6d;uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.;dc_rfl=2,https%3A%2F%2Fwww.farfeshplus.online%2F$0;xdt=1;crlt=U8uA4Tj019;stc=1;chaa=1;sttr=184;prcl=s

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47a0342d90a877ec7125c3a38706b2faefa9b867661ebcef4a98ec6cf3e60b40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 48629
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4206
x-xss-protection: 0
server: cafe
etag: 17947678125179771625
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 12 Dec 2023 16:17:22 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame F4F5 0
0 56ms
56ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsval2nR2ZEwfgdyRYWItc61o_WfQ7WMNOOG2246cGGyVUW711iPPvL6wbV-gnUOHwTnI1Ork7ExJpHN4YWxgU6pU6w3UGewBR6bygxn7lLcfecSPb2Tz2yYIhsKQqKowIK3A3Z_z6-pxGzxdO6_WTRsPSWN8SThSlBbq-4Egyr6gZ-4FVs&sai=AMfl-YS6H31M3gND1xg-ajcS61xN98bZD9xZ3iM932Yj1qrPT_p_5gZ15P_EyNFCiCKfJqjsWBvLUH2_GXok2ZjAWVsJ4TBd-QdPuJBKvw&sig=Cg0ArKJSzAkfPAmhYiw5EAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20231109.88692&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:51 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 Q12zgMmT.js Show response
tpc.googlesyndication.com/sodar/ Frame F4F5 41 KB
14 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

435db380c9936c0970dcd3d9941eab6aec2fcf2a38c3e2b4e02d957e8e76bd1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 16:17:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 307829
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13937
x-xss-protection: 0
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 24 Nov 2024 16:17:22 GMT

GET
H3 200 7410484386335067809
s0.2mdn.net/simgad/ Frame F4F5 123 KB
123 KB 16ms
16ms Image
image/png 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/7410484386335067809

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dcbd4882f0c4557f44d9d7340ab5a08c7b8cdf3dc5cba9996a18c95160acbd5d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Sat, 25 Nov 2023 08:57:35 GMT
x-content-type-options: nosniff
age: 334216
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 126353
x-xss-protection: 0
last-modified: Mon, 17 Apr 2023 16:06:36 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 24 Nov 2024 08:57:35 GMT

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame F4F5 202 KB
64 KB 32ms
31ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d00881661ce5e766ce98430f69d6d217ab80bdfa98811e039afc92a327d57a68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65070
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1700193896630564"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 Nov 2023 05:47:51 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame F4F5 0
0 52ms
51ms Fetch
image/gif 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsval2nR2ZEwfgdyRYWItc61o_WfQ7WMNOOG2246cGGyVUW711iPPvL6wbV-gnUOHwTnI1Ork7ExJpHN4YWxgU6pU6w3UGewBR6bygxn7lLcfecSPb2Tz2yYIhsKQqKowIK3A3Z_z6-pxGzxdO6_WTRsPSWN8SThSlBbq-4Egyr6gZ-4FVs&sai=AMfl-YS6H31M3gND1xg-ajcS61xN98bZD9xZ3iM932Yj1qrPT_p_5gZ15P_EyNFCiCKfJqjsWBvLUH2_GXok2ZjAWVsJ4TBd-QdPuJBKvw&sig=Cg0ArKJSzAkfPAmhYiw5EAE&uach_m=%5BUACH%5D&cry=1&fbs_aeid=%5Bgw_fbsaeid%5D&urlfix=1&omid=0&rm=1&ctpt=98&vt=11&dtpt=97&dett=2&cstd=0&cisv=r20231109.88692&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:51 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9CEC 0
22 B 46ms
46ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=5635424550005&version=m202311060101&ct=76&x=1&cor=1058475413627300600

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7548 0
22 B 47ms
47ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=5698630274856&version=m202309260101&ct=77&x=1&cor=2048597919789156400

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6DB0 0
22 B 50ms
49ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BKP4mhNBmZemuI4iA-gbo04b4BAAAAAA4AeAEAg&bg=!ERKlEl3NAAZxrfrxUa07ADQBe5WfOCm08VRK6Zi_ToSkevLe26D3kS8AieI8ClezrreCo7VxDjtkpZ6JbnKw9AVX6t1gAgAAA9FSAAAAA2gBB5kDVSwS8Xfv_xT_6uHtByrVgb5j_OMq7fDuiJ4t_lJVdkcbhrIiGMZPYl4WlzkD-L3z7qlraZw_ROZeBAe2R1a6IKULYzTQ6ZMhX4Rvg_-NADXDvReKQUQ_hVQCKxY9EPaRRx993WrwqFsDv84Nz7fW4gDnspbPSAmx9s2ogb2lR_MGI68nhwck16Y1ACp-vnFAvL48NyiivZz73Q_qboGAURvY_84Uv2-nZiqJr1yhv4m8PyZ4dNZkG_OKm1vHuFMAKOomVTDZ8gF3LxZMumOZqf4UAOZi8TZImfDSw86beVmTJhVC5mXYHyqpDHp2b54XdmeMZgwNRmdq7hTBAldgDDY4PRmkM4XHCwCNS4iPygzzp-fEZUvvNbgFytOzd0MwnpcpfmDBaL7UjYkCAScQKkB_-1SyjHVzlRFrd6ImRnY6a5ZMaAmeWu-CHq_LZ3QtEh4kCdE2_om39895q1wEhw6y3CJDpYy0N4_KBqRJW-Yk996PtBgSpkUOVipxJWwpICJ9WV1sM6efgbpBwLCzTHcPx1BJoR0ZvsqT9ew3WRchdlsCgsuHoRD-_RtKoJGILswXDe9ZERpPLQKFlP_m--oG9WRfYSe8ORE3pw_EuaYRhGIgVgVV7uRckABw6P8SmnCSuEbaNZyi1tw0FxkMASxbxVSSXH5ZyybX88ZoVWX66tGtcmlCm6PfuDva1bMJwSbBoy3H4P9XfM475DmgKWiG-gv2fZCdq9xF6IxVuhDBfJIdDRHYr5qJIVMZyjUz5I7328kMxAtNXzw_earrTk7rTbZRnTXOVevNlA7OUE8kH_zasNcTllrjX9bfgQe036SVZHamvGHChs-yHK0M6OD947I5BdIlq_xm9V6ZR_xWWVc609K5i38A5_PPGWYPTVVpsOIKJkfRS2VFCY4XZOUqgY5gunn8a0X4rur9VltXmLCc6djE2hdkJjVpar5ujN3C0rscRWMIPpAYCfwa5kNvxZZLfxgI0oQZjKbd_wyYwf_k_8nJEo91twf7JThqpvA9WgUVbb5jWzhfZ64LuDeC3Hqk2TIFhBr7RY-853Stn1BLi18AK3h_LZa5Fehs7YTx2FCGw-wumK4Rmu70nA6uUg1XBEx4cDQQrSssQQTJ2N3YFDo

Requested by

Host: www.farfeshplus.online
URL: https://www.farfeshplus.online/FP66.asp

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 62bHydCX.html Show response
tpc.googlesyndication.com/sodar/ Frame 675A 38 KB
13 KB 14ms
13ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/62bHydCX.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Q12zgMmT.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eb66c7c9d097d5ba414230f422484c17fa6f37157d30e1ded2cc5f65a9667987

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 307780
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: br
content-length: 13045
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sat, 25 Nov 2023 16:18:11 GMT
expires: Sun, 24 Nov 2024 16:18:11 GMT
last-modified: Fri, 25 Aug 2023 23:48:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7C7C 0
22 B 52ms
52ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=B4NdPhdBmZealA9PAjuwP9MmauAsAAAAAOAHgBAI&bg=!Y2ClYC_NAAZxrfrxUa07ADQBe5WfOO5iVgrGMuBUDxkhF7yHzGPbDF_CMviaLiYGBUAZL9bIw-_jB_426GyjRhBRbzAcAgAAAdBSAAAAAmgBBwoAbTst0Jyxt7U2QBHXoMyJMUPGstVCm2V4cgiO35wqXtRiWtMRbj75hkCwWoK0YUGoC6NTro5xaoDihxuPLiO4dQogSVKzeG7oG4dQLUnVh1boajxxyryMxdkFIUt_YXHtW-QKUZ_l1kXQIdmVHmaZAxBF2peRb1YFz6SFz_7I11kfKjRpVv9_9B4CZKZBb3B8E0E0kJ_qjIDZAST6CAoDbKEhC1C9ZUUkZpfdm3YeYl22TMUjzVwtl5uSNAc88O8VltXmIIv4UpyNHfKaRtwnb2rTzceWwr0SrwTrGIbZ7czjRcmsck9PY-F1lJCGxUxy0uQC1eieVvQdGT13Hy6seDnIhAZae0JmLyj6v3lNFh2ganzbafNkF1swFgYsMXQmCPZfi4gPPmpSXJafDvum9z1Vb_xxBBkw7WuFMR6N6Aq_zbaAgCb9WJ6j21clCQx0hT9dEsmLjao_41E93qhGAtvQbOTi2fStpw_RwRliHjRkvP0EdBuVJ7bihN1z-42rGIbGRsMKnJsYqZqka57Wvqhi7K-kfT14QuHKTy3XL0ovWXaO9xyXWf_-5L9iPAWIF359pFcHizIT3szyWeex_cqban_zIdd9fOuKSuYA3ocv91M1mpZ3-TQWIQMS_okid2NzpQhwFrzxuy2w-i5yhM3hgIaVGst1yqb__SBaILSOGjuRjt0A4AEj6WcLxOEQmVzS_4_mNnLDFlN6CgMzkb0nBMgijUJ0DA1hsd6lEUtle89JOaSq8p-OWoLu6v5rKAH2rXp4SZjhckS_7_-LNCmgSYDEXydYLuj0O_kipIdfiThCcqr0WABK_mTfGQCCvN-9h6evOCO9vVxcMUs3ak69l11e5tBmci5_GvHXj09HVWbarY4-kXlTQbb_WFAVst7yi9W17OUUrU9NkVZjX8LO-tMmIB_GHxvjMN9YF-WMSAbmZouoxxmUlg1GmMSVB6Vxe9zcY1FwHld4wVWFjVE14S4WGClKiZD7WO5Lw_Z3g5tMBa4IIfTu_giARCfVge-vNzocCtIQFzYRXDAY-Pfq6sLusHxQT1iOcmzVwbtQfbELCZJweU5pd35f2GjA6nV-81ouLLbXUb0n6M6FYh5ImHTVGPzfpSQDUcY6pVIWG-eBY_BX1caFMBLiIM4gRnJ95MQ3NFj1vv9pWSJbtEjnegDJ5cwhPtNYWgVyInsw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231109/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 61ms
60ms XHR
application/json 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231109&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

acb73ccde78381e4851b7bb1e65fdea320fcc27ff2b9e6896ff9b7ad3888e830

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:51 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12309
x-xss-protection: 0

GET
H2 200 like.php Show response
www.facebook.com/plugins/ Frame 585D 0
1 KB 38ms
37ms Document
text/html 2a03:2880:f177:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?action=like&app_id=382287608570983&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df358387d26eb64%26domain%3Dwww.farfeshplus.online%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.farfeshplus.online%252Ff186aef9958a038%26relation%3Dparent.parent&container_width=100&href=https%3A%2F%2Fwww.farfeshplus.online%2F&layout=button&locale=en_US&sdk=joey&share=true&show_faces=false&size=small&width=50

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=ab1ad291233049a6d43fa4989ac691b5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f177:83:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com .fbcdn.net 'unsafe-eval';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-length: 0
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com *.fbcdn.net 'unsafe-eval';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'unsafe-eval';style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com https://sandbox.paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-type: text/html;charset=utf-8
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 29 Nov 2023 05:47:51 GMT
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
reporting-endpoints: default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown"
x-content-type-options: nosniff
x-fb-debug: 9dF8j0/1Wmd8czoSz4kAfryA07ENu1DjZixFXNYRO53pjXu3gZUHZ6yNgXEOk80k+XuHbEaXly3wR/2Lm+HLxw==
x-xss-protection: 0

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 675A 39 KB
15 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/62bHydCX.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 04:52:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3311
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Nov 2024 04:52:40 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 282ms
282ms Script
text/javascript 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 29 Nov 2023 05:47:52 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 675A 0
22 B 50ms
50ms Image
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=44&t=2&bgai=BeJcAh9BmZdXAFcSu9u8Pt--FwA4AAAAAOAHgBAI&bg=!ycqlyoXNAAZxrfrxUa07ADQBe5WfOMF4bja-1eVrEpx8ilSx2UEvHAADJn-p8LNB53URByZPY8sQ9K2SyQ7GU8ImdTo6AgAAAHtSAAAAAmgBBwoAFkm1y-D58hTmAd1pe11bSJDa0E3IF2eZAxKR3wfmvrGxD3ov6xobcz5oq2H7stJ9PaR-g9oScf03so4Q9MGTs_NoRiMLiuN4puH3iU4G8BPfjbAOUKhAcJa6VhTPd622pyQwGQNSqvV2RuPZtgKosTh5OYPNyIrDmMqNYfN5J_4cDn_7U4ai0Fcbr-KjTa7sZ1hC0DAOKxdMCWJM2A9o-llKP_Uufl7eS9u8h1ulFemuyagid9su9tfeqfE5prDqPd_I3eFn_0Z6AFd0JdXs8aJYgBH7fkw3Z4s5Is8yYQuUtZWv0dE2HcIY8-oM9AAhhpJRkKp3fth--Tz_uAjxsQHKPD__YKK1slw8bGYgcIR98INbHBwPppY93y5xRu0da0NoQ65elhC4ZGBRoi9jIudJQb8t2NCeKrD97HbFUUlvS33GV5hOqcm0hWarFWhGFkTjoB1u-luiicqQ7pt9mnq_3ee4V91D1qJFLdZBeKyCSo22uNQfOJEfS6lG1tt6-8_DIryVRiQqnNP5BOttZyxgsnFzX0sWkQoauWHpfPf3cnpf748EoqWe4gobQDG8Aw03JD8MTddArnhUU_aJjO7z-Z-UF3zH7pS09Al_zee1i2cG4ZA7fGQ5aVFAlvTFZZ84-uG7Wfs0YYSq9clgkx_DwRm7yFam8M60EPys2yVSXHkbYtaco-NLFF8XZk8kqphd1GJCjC6B4miIL9EeakvrcOAFHa4Ke5IZIpLqedv6y99VwiFjP_F9IGz4bF9qKmGE8CwW0Glz1SrcWkHt5dr62GPKlGUCwzRxZNz_MDmt40aUa7rEfZn3WOXnDG5f0mzDRZSgEjdD0UMWqZXbpzyFnuJMZ2Zwdh_OT0ZX-J1_6afcmXID5gYEGjcyhWMKOptx69hH0C9vyQML6vM7IXLKD-NgE6j17nAZ52au1ZAiDxfoQmqLA-Lhp1Wa28g8ruaQD9OEE8zzJdqu1fHEqXs3rjAdxgKNEgeUJB1aKIdx2cJ36LoWaGWlbEYqj0be93xxVttFxEsAbz4HRLhZHoywf75SPgJBjsYWOB58NPKIlGdr_idWZPsmGDk

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9CEC 43 B
215 B 100ms
100ms Image
image/gif 2600:1f18:1aca:4280:3d67:f8d:404:f402
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1854208&asId=5aa6d1d1-b17f-5aa6-5442-a558eb4fcaa5&tv=%7Bc:vkVb80,pingTime:1,time:2918,type:p,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:401%7D,%7Bpiv:100,vs:i,r:,t:1911%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1007,o:1911,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:401,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1524~0,0~100%5D,as:%5B1524~728.90%5D%7D%7D,%7Bsl:i,t:1911,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1007~100%5D,as:%5B1007~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:171,fm:tWYwwJ7+11%7C12%7C13%7C14%7C15%7C161%7C1621%7C163%7C164%7C171%7C172%7C1731%7C18%7C19.1854208-76774665%7C191%7C1921%7C193%7C194%7C1a1%7C1a2%7C1a31%7C1b1%7C1b2%7C1b3%7C1c1%7C1d1%7C1d21%7C1d3%7C1e1%7C1e2%7C1e3%7C1e4%7C1e5%7C1e6%7C1e7%7C1f%7C1g%7C1h1%7C1h2%7C1h3%7C1h4%7C1i1*.1854208-76774456%7C1i11%7C1i12%7C1i13%7C1i14%7C1j1%7C1k11%7C1l11,idMap:1i1*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:401,sis:1476%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:3d67:f8d:404:f402 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:52 GMT
server: nginx
x-server-name: dt11.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9CEC 43 B
215 B 101ms
101ms Image
image/gif 2600:1f18:1aca:4280:3d67:f8d:404:f402
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1854208&asId=5aa6d1d1-b17f-5aa6-5442-a558eb4fcaa5&tv=%7Bc:vkVb81,pingTime:1,time:2919,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:401%7D,%7Bpiv:100,vs:i,r:,t:1911%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:1008,o:1911,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:401,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1524~0,0~100%5D,as:%5B1524~728.90%5D%7D%7D,%7Bsl:i,t:1911,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1008~100%5D,as:%5B1008~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:171,fm:tWYwwJ7+11%7C12%7C13%7C14%7C15%7C161%7C1621%7C163%7C164%7C171%7C172%7C1731%7C18%7C19.1854208-76774665%7C191%7C1921%7C193%7C194%7C1a1%7C1a2%7C1a31%7C1b1%7C1b2%7C1b3%7C1c1%7C1d1%7C1d21%7C1d3%7C1e1%7C1e2%7C1e3%7C1e4%7C1e5%7C1e6%7C1e7%7C1f%7C1g%7C1h1%7C1h2%7C1h3%7C1h4%7C1i1*.1854208-76774456%7C1i11%7C1i12%7C1i13%7C1i14%7C1j1%7C1k11%7C1l11,idMap:1i1*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:401,sis:1476%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:3d67:f8d:404:f402 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://58ed6c893c80a292b2160d2f08dfb954.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:52 GMT
server: nginx
x-server-name: dt12.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9A6C 42 B
64 B 50ms
50ms Fetch
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstNxL-nnovR-K7gtCwByR1b-UGG1pi2D78xs7FQ0P4V9GiVypBKpkuY82AmWU8iaU707h4f8ztTrG6XM4dbe_FYdjtqE0Y1gdws6lGyNdp2mWmyzLQqla0y7qhQ_DYp03SeeCSpgokIAk1p&sai=AMfl-YT3BV22aArhHDSPwXPTp832CSe121LlwHhFzyEvIbtM0TEup9lLt4F0lxl4Q3Kh4a02BfTQduKF0Us5I_TZgzS3zjldItr1GXhdU8DwZ6zZvMLYZUNu0Xdt20bN2S1d-SUdykPiyuT1wBeT3dCFo8NDrSgeMi021Z-4&sig=Cg0ArKJSzDcvT0umYhZjEAE&cid=CAQSTwDICaaN37FCtOVEYEp7ugGRKIh2kERodDldAoeM5qa75VacRDfjka4e1eBorHse1FWyxAtFy1wHFOdMkkMAoFVr80wcuwjW7T6l5TW6IkkYAQ&id=lidar2&mcvt=1000&p=0,0,196,760&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20231116&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=4&adk=1067503192&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701236867079&rpt=3848&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 6D32 13 KB
5 KB 14ms
13ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3270
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 04:53:22 GMT
expires: Thu, 28 Nov 2024 04:53:22 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 017A 829 B
559 B 25ms
24ms Document
text/html 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

ef9881a462afe4b87f929d58f199d7b0dec9401216daab6754ca1efdcee9b8fc

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-BtYRuJpHHOYwarvDKNrD-g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.farfeshplus.online/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-BtYRuJpHHOYwarvDKNrD-g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 29 Nov 2023 05:47:52 GMT
expires: Wed, 29 Nov 2023 05:47:52 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js Show response
pagead2.googlesyndication.com/bg/ Frame 6D32 39 KB
15 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/GOa2ZK97xVqw-WOSDw2lqG4V8l_qTiI5JNj0tnI6N88.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18e6b664af7bc55ab0f963920f0da5a86e15f25fea4e223924d8f4b6723a37cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 04:52:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3312
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15296
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 16:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 28 Nov 2024 04:52:40 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 017A 0
0 48ms
48ms Image
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231109&jk=923086590804078&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 6D32 0
12 B 13ms
13ms Image
text/plain 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?gCdcdQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:47:52 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F4F5 0
22 B 49ms
49ms Ping
image/gif 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=8799995933922&version=m202309260101&ct=76&x=1&cor=2524739453863501000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:52 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 50ms
49ms Image
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20231109&jk=923086590804078&bg=!n5ylnNPNAAZxrfrxUa07ADQBe5WfOOSBeD2gL4hEh4FZIES5Qya2WCtvV8V2VbabxtQZe6GJPfRpkkykWsP0twiOx-7mAgAAAHpSAAAAAWgBB5kC0SJMdyfvPI3tzhK8XCIB3EV7noDZJFHNFpY2JV0MvFiozkK80_m_8tr9682vf8fGp2ckz9LsxtzneljGJOgphy2_do3wyyi-QT8sV1OjPtL-C_vGTpIz54G18lAK2mB9wPg3jMOHQVkqt23eUMbX-YbLiaX-Gn31flfSalAVNZxVUprmk5Jvvg4hk299mmQB6B38s50Fhg1BK9IYFpcb038QjJOAgXLvmO1j2yyU5KXZUcFLJ8IqyfuBwf2gIytvPTRMlDXUk-BGzWx0kvOWezRV_P2wG3zLeBGO7TyH-xVtkeZx1h3vBkCe0dFskJiNw9IGwQl-hU3UUdLabH5Q07YO65f8CwRE7yZ2qxvuIfcbZvq-Tdqyc6vURVemDbCKkXCpF6-ZwS9wLBV72ngEQSpwZieTCjmU03EdchGWf_5qxANwr3CGI5-ja44t0jisee0UpKOf9OhrHqIX4Q1IAOMwKDWQu9H7gEyVtQXtEPd4MeE6-uqzV-_48Z4pT8jED6_VckZWWuclCMGoTvOAepL33n3IVBO6b7J87hcmGPWCQMrFWQT5cSekv4WylO_AwcecbMVgzZOxWbikUDExwxPwD220S1s7niYiiFGgCsg8dj2PMVdidq0Ezzq2gRawuSFDIK6qAQRMD8rWEyp_8Y0oCjaU7TsyZnG9fOjJJpKa7CdB4eU29aNkbtK7G3Aa1csBFq7ijxdwcnMqaojxEs9KVSiNL8jXms8FChx3BgcrBASAmE97DF2TGZ9QYaptCJJGOQzcB_UDuGaVWQu4zJyMtQlezYqL_sUGhcgqeNQ0iOS-kI6NQqS8Ak6fTTFnZZgFlBRkph6w7YI3PKCWuxxoNOmLbj5340ephmhSuPgxFynsqRsgHQZ-60cvVK1pV_tuIfgS7D4Z9URp8zEWAyS8n_KzXN1JsFIhV7rPtk0xNHqB9vHsUp85Rz5NGZj4lOc
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

POST
H3 204 collect
region1.google-analytics.com/g/ 0
17 B 17ms
17ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-DNX5KLEBSB&gtm=45je3b81v874724234&_p=1701236867020&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=2062919147.1701236867&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEI&ngs=1&sid=1701236867&sct=1&seg=0&dl=https%3A%2F%2Fwww.farfeshplus.online%2FFP66.asp&dt=Farfeshplus.online%20%7C%20%D9%85%D9%88%D9%82%D8%B9%20%D9%81%D8%B1%D9%81%D8%B4%20-%20%D8%B4%D8%A7%D9%87%D8%AF%20%D9%85%D8%AC%D8%A7%D9%86%D9%8A%20%D8%A3%D8%AD%D8%AF%D8%AB%20%D9%85%D8%B3%D9%84%D8%B3%D9%84%D8%A7%D8%AA%20%D8%B1%D9%85%D8%B6%D8%A7%D9%86%202023&_s=3&tfd=7696
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-DNX5KLEBSB
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.farfeshplus.online/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:52 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.farfeshplus.online
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
482 B 2717ms
2716ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://live.demand.supply/e/e.js?r=farfeshplus.online_auto_728x90_sticky_display_bottom&e=ufp&dsReferer=ZmFyZmVzaHBsdXMub25saW5lL0ZQNjYuYXNw

Requested by

Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.22.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-nf-request-id: 01HEQ1MZJBXHMY5B8H1HQ8BKGW
date: Wed, 29 Nov 2023 05:47:55 GMT
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1650811
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "4de2110991f3807e8b4a19c48c14f2d1-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 82d88f09fa84368c-FRA

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
481 B 2645ms
2645ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://live.demand.supply/e/e.js?r=farfeshplus.online_728x90_sticky_display_bottom_new-sticky-right&e=ufp&dsReferer=ZmFyZmVzaHBsdXMub25saW5lL0ZQNjYuYXNw

Requested by

Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.22.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-nf-request-id: 01HEQ1MZJBXHMY5B8H1HQ8BKGW
date: Wed, 29 Nov 2023 05:47:55 GMT
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1650811
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "4de2110991f3807e8b4a19c48c14f2d1-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 82d88f09fa85368c-FRA

HEAD
H3 200 e.js Show response
live.demand.supply/e/ 0
482 B 2646ms
2645ms XHR
application/javascript 2606:4700::6810:8516
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://live.demand.supply/e/e.js?r=farfeshplus.online_728x90_sticky_display_bottom_stiky-bottom&e=ufp&dsReferer=ZmFyZmVzaHBsdXMub25saW5lL0ZQNjYuYXNw

Requested by

Host: live.demand.supply
URL: https://live.demand.supply/impl.v17.22.0.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:8516 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.farfeshplus.online/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

x-nf-request-id: 01HEQ1MZJBXHMY5B8H1HQ8BKGW
date: Wed, 29 Nov 2023 05:47:55 GMT
strict-transport-security: max-age=31536000
cf-cache-status: HIT
age: 1650811
cf-polished: origSize=2
alt-svc: h3=":443"; ma=86400
content-length: 1
cf-bgj: minify
server: cloudflare
etag: "4de2110991f3807e8b4a19c48c14f2d1-ssl"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: s-maxage=2592000,stale-if-error=604800
accept-ranges: bytes
cf-ray: 82d88f09fa86368c-FRA

GET
H2 200 dt
dt.adsafeprotected.com/ Frame AAB1 43 B
216 B 1554ms
1553ms Image
image/gif 2600:1f18:1aca:4280:3d67:f8d:404:f402
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1854208&asId=57bd2e34-2388-d815-8d7b-133681662f40&tv=%7Bc:vkVbKz,pingTime:5,time:5726,type:p,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:515%7D,%7Bpiv:100,vs:i,r:,t:708%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:5018,o:708,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:515,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B204~0%5D,as:%5B204~728.90%5D%7D%7D,%7Bsl:i,t:708,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B5018~100%5D,as:%5B5018~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:387,fm:tWYwwJ7+11%7C12%7C13%7C14%7C15%7C161%7C1621%7C163%7C164%7C171%7C172%7C173%7C18%7C19*.1854208-76774665%7C191%7C192%7C193%7C1a1%7C1a2%7C1a3%7C1b1%7C1b2%7C1b3%7C1c1%7C1d1%7C1d2%7C1d3%7C1e1%7C1e2%7C1e3%7C1e4%7C1e5%7C1f%7C1g%7C1h1%7C1h2%7C1h3%7C1h4%7C1i1.1854208-76774456%7C1i11%7C1i12%7C1j1%7C1k11,idMap:19*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:516,sis:1032%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:3d67:f8d:404:f402 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:55 GMT
server: nginx
x-server-name: dt12.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame AAB1 43 B
216 B 1553ms
1552ms Image
image/gif 2600:1f18:1aca:4280:3d67:f8d:404:f402
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1854208&asId=57bd2e34-2388-d815-8d7b-133681662f40&tv=%7Bc:vkVbKA,pingTime:5,time:5727,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:515%7D,%7Bpiv:100,vs:i,r:,t:708%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:1,b11:0,cnod:1,intblk:1,gm:0,slTimes:%7Bi:5019,o:708,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:515,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B204~0%5D,as:%5B204~728.90%5D%7D%7D,%7Bsl:i,t:708,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:sp,cc:0.0.728.90,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B5019~100%5D,as:%5B5019~728.90%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:387,fm:tWYwwJ7+11%7C12%7C13%7C14%7C15%7C161%7C1621%7C163%7C164%7C171%7C172%7C173%7C18%7C19*.1854208-76774665%7C191%7C192%7C193%7C1a1%7C1a2%7C1a3%7C1b1%7C1b2%7C1b3%7C1c1%7C1d1%7C1d2%7C1d3%7C1e1%7C1e2%7C1e3%7C1e4%7C1e5%7C1f%7C1g%7C1h1%7C1h2%7C1h3%7C1h4%7C1i1.1854208-76774456%7C1i11%7C1i12%7C1j1%7C1k11,idMap:19*,rmeas:1,rend:1,renddet:XIFRAME.qs.lf,siq:516,sis:1032%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4280:3d67:f8d:404:f402 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:55 GMT
server: nginx
x-server-name: dt13.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 InterstateRegular-Bold.woff2
s0.2mdn.net/creatives/assets/4925812/ Frame 69A0 29 KB
29 KB 1228ms
1228ms Font
font/woff2 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4925812/InterstateRegular-Bold.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7683192671021942909/index-be1f7599.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d52c7c5050b088109075328a9e830e4bfdf6446c763b9e69c637d5c0e11d599

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index-be1f7599.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:37:05 GMT
x-content-type-options: nosniff
age: 650
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29232
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 09:13:13 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 05:52:05 GMT

GET
H3 200 logo.svg
s0.2mdn.net/4528404/1687521602712/ Frame 69A0 5 KB
2 KB 1224ms
1223ms Image
image/svg+xml 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1687521602712/logo.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0d80991c6e4b62d5c77985c1e293aad44cc120e03aee7ae6936c79d25a0e467

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=LGiGKR6JLe&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 12:28:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 62368
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1913
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 12:00:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 12:28:27 GMT

GET
H3 200 cta_mit-pfeil_01.svg
s0.2mdn.net/4528404/1687937402098/ Frame 69A0 2 KB
1 KB 1224ms
1224ms Image
image/svg+xml 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1687937402098/cta_mit-pfeil_01.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a9cba16c5a30dc7cc3bdcbba2a45e9e2e28ec4437894302c6676369ed0ec732

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=LGiGKR6JLe&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 12:28:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 62368
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1134
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 07:30:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 12:28:27 GMT

GET
H3 200 congstar-stoerer_gb-plus_small.svg
s0.2mdn.net/4528404/1687525202075/ Frame 69A0 2 KB
1013 B 1225ms
1224ms Image
image/svg+xml 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1687525202075/congstar-stoerer_gb-plus_small.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

644aace6e359180bf6b29b4a7b172f7b6cb8c937fa531eed22a6447fab6a2c8c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=LGiGKR6JLe&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 16:53:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46483
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 974
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 13:00:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 16:53:12 GMT

GET
H3 200 dc_oe=ChMI_aXXmcHoggMVm6GDBx1VeA3XEAAYACCq2oNdQhMIjYqmmcHoggMVgYyDBx3MgQgJ;dc_eps=AHas8cDtmh3Wf9lUfNtiFaX1JrFc7q7UQwf_j83-4_FYF3wyyQhZ5sC0Tt6uhvyTCovBi8etBkqY;stragg=1;&timestamp=1701236874632;str=...
ade.googlesyndication.com/ddm/activity/ Frame 9794 42 B
63 B 1252ms
1252ms Image
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 dc_oe=ChMI_aXXmcHoggMVm6GDBx1VeA3XEAAYACCq2oNdQhMIjYqmmcHoggMVgYyDBx3MgQgJ;dc_eps=AHas8cDtmh3Wf9lUfNtiFaX1JrFc7q7UQwf_j83-4_FYF3wyyQhZ5sC0Tt6uhvyTCovBi8etBkqY;stragg=1;&timestamp=1701236874636;str=...
ade.googlesyndication.com/ddm/activity/ Frame 9794 42 B
63 B 1248ms
1248ms Image
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Nov 2023 05:47:55 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 InterstateRegular-Bold.woff2
s0.2mdn.net/creatives/assets/4925812/ Frame 78B7 29 KB
29 KB 318ms
318ms Font
font/woff2 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4925812/InterstateRegular-Bold.woff2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7683192671021942909/index-be1f7599.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d52c7c5050b088109075328a9e830e4bfdf6446c763b9e69c637d5c0e11d599

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index-be1f7599.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 05:37:05 GMT
x-content-type-options: nosniff
age: 650
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 29232
x-xss-protection: 0
last-modified: Mon, 26 Jun 2023 09:13:13 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 05:52:05 GMT

GET
H3 200 logo.svg
s0.2mdn.net/4528404/1687521602712/ Frame 78B7 5 KB
2 KB 318ms
317ms Image
image/svg+xml 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1687521602712/logo.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0d80991c6e4b62d5c77985c1e293aad44cc120e03aee7ae6936c79d25a0e467

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=sfXhF88Pnb&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 12:28:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 62368
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1913
x-xss-protection: 0
last-modified: Fri, 23 Jun 2023 12:00:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 12:28:27 GMT

GET
H3 200 cta_mit-pfeil_01.svg
s0.2mdn.net/4528404/1687937402098/ Frame 78B7 2 KB
1 KB 318ms
318ms Image
image/svg+xml 2a00:1450:4001:831::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/4528404/1687937402098/cta_mit-pfeil_01.svg

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1a9cba16c5a30dc7cc3bdcbba2a45e9e2e28ec4437894302c6676369ed0ec732

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7683192671021942909/index.html?e=69&leftOffset=0&topOffset=0&c=sfXhF88Pnb&t=1&renderingType=2&ev=01_250
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.159 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 12:28:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 62368
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1134
x-xss-protection: 0
last-modified: Wed, 28 Jun 2023 07:30:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 Nov 2023 12:28:27 GMT

GET
H3 200 dc_oe=ChMIyprmmcHoggMVbRNVCB0c1AyWEAAYACCq2oNdQhMI2_m6mcHoggMVibh3Ch1TSAd_;dc_eps=AHas8cA3cxg0vBU5Gm1f5p1mVLfNkO5krLnKgL6YwjB-dUXFtHOKimgONNockJR1trYC1YE9rvwu;stragg=1;&timestamp=1701236875543;str=...
ade.googlesyndication.com/ddm/activity/ Frame 3FD1 42 B
63 B 343ms
343ms Image
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS