pastelink.net Open in urlscan Pro
2a01:7e00::f03c:91ff:fe39:1dbe Public Scan

Software

sffe /

Resource Hash

fc9000807addd460467b7f6ccc2a30638c0d5efc15a07f53bf826005684a94f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "993 / 697 of 1000 / last-modified: 1632176111"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25053
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 21 Sep 2021 08:14:48 GMT

GET
H2 200 prebid-4.43.4.js Show response
cdn.adligature.com/prebid/ 444 KB
133 KB 33ms
32ms Script
application/javascript 2606:4700:3035::6815:5d0e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.adligature.com/prebid/prebid-4.43.4.js
Requested by: Host: cdn.adligature.com
URL: https://cdn.adligature.com/rules.js/advally-4.8.1.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3035::6815:5d0e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4acafe4daf8d989eec849bdd8c025b2cda63bd1c3a91edaea56f948d04fd98a8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-goog-hash: crc32c=msxAWQ==, md5=z5RQdZzuWEiAct3OzqDEfQ==
date: Tue, 21 Sep 2021 08:14:48 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 547
cf-polished: origSize=454478
x-guploader-uploadid: ADPycdtQxqJ3OOCAVvAfS9UY8hwMJwwo9NA9Dzid-XhOHFRHIv6paDvaYoTxBbb5mG67ywY3pBqGCdpDkBg-1FReV1Q
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Tue, 24 Aug 2021 12:17:06 GMT
server: cloudflare
etag: W/"cf9450759cee58488072ddcecea0c47d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T%2BCVRZmaTf6k34oiWwXhwAItQhlaBWeTVgi7yS1GP0APpdOAU4e%2F5qCrNZ1qSyABCN6PXVClyJKQCaPbN9sIR%2BSAsiwaEQjW6m2QayDsW%2BpLANBbek4hQTairVLmBucx8kq1yuBmWrNeiZn1qvUODVI%3D"}],"group":"cf-nel","max_age":604800}
content-language: en
x-goog-generation: 1629807426503184
content-type: application/javascript
expires: Tue, 21 Sep 2021 08:15:41 GMT
cache-control: public, max-age=1800, s-maxage=600, must-revalidate
x-goog-stored-content-length: 454478
cf-ray: 6921d78f8a15c27c-FRA
cf-bgj: minify

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 128 KB
50 KB 23ms
22ms Script
application/javascript 2a00:1450:4001:812::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-S3DKHVPF03&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-55WHPWQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1b40e1af9bc518089fb58c55df703008ff93f18b874d07bbf83f378c3a30c8d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:48 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 51119
x-xss-protection: 0
expires: Tue, 21 Sep 2021 08:14:48 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 48 KB
20 KB 32ms
6ms Script
text/javascript 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-55WHPWQ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 5271
date: Tue, 21 Sep 2021 06:46:57 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Tue, 21 Sep 2021 08:46:57 GMT

GET
H2 200 pubads_impl_2021091501.js Show response
securepubads.g.doubleclick.net/gpt/ 334 KB
117 KB 16ms
15ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

52c41152c7916b4cf3b3a90f790faa0ba7f746603671e286531bc50407d844ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119151
x-xss-protection: 0
last-modified: Wed, 15 Sep 2021 08:39:44 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 21 Sep 2021 08:14:48 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 70 B
97 B 35ms
20ms XHR
application/json 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=pastelink.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

39c0b8be3e2bd4ecc61b4a789ac1e94d6a6812a15499181634db22e64fe7221c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 21 Sep 2021 08:14:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 72
x-xss-protection: 0
expires: Tue, 21 Sep 2021 08:14:48 GMT

POST
H2 204 collect
www.google-analytics.com/g/ 0
169 B 14ms
12ms Ping
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-S3DKHVPF03&gtm=2oe9k0&_p=781441858&sr=1600x1200&ul=en-us&cid=197347587.1632212088&_s=1&dl=https%3A%2F%2Fpastelink.net%2F3fu78&dt=7%20Questions%20You%20Need%20To%20Ask%20About%20Car%20Locksmiths%20Near%20Me%20-%20Pastelink.net&sid=1632212088&sct=1&seg=0&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S3DKHVPF03&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pastelink.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:48 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 1 B
91 B 14ms
13ms XHR
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&a=781441858&t=pageview&_s=1&dl=https%3A%2F%2Fpastelink.net%2F3fu78&ul=en-us&de=UTF-8&dt=7%20Questions%20You%20Need%20To%20Ask%20About%20Car%20Locksmiths%20Near%20Me%20-%20Pastelink.net&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAAC~&jid=1629610834&gjid=1692616646&cid=197347587.1632212088&tid=UA-55088947-2&_gid=1646222510.1632212088&_r=1&gtm=2wg9k055WHPWQ&z=917150322

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pastelink.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
69 B 13ms
13ms XHR
text/plain 2a00:1450:4001:80f::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j93&aip=1&a=781441858&t=pageview&_s=1&dl=https%3A%2F%2Fpastelink.net%2F3fu78&ul=en-us&de=UTF-8&dt=7%20Questions%20You%20Need%20To%20Ask%20About%20Car%20Locksmiths%20Near%20Me%20-%20Pastelink.net&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAEABAAAAAC~&jid=1846726122&gjid=586411282&cid=197347587.1632212088&tid=UA-197326395-9&_gid=1646222510.1632212088&_r=1&_slc=1&z=1444591450

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://pastelink.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:48 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 346 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ebd635d843d43673dd737988e3383b01614cfca991785e481a47e7bd6b8aea17

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
853 B 98ms
17ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=pastelink.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 21 Sep 2021 08:14:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 61ms
16ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=pastelink.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 21 Sep 2021 08:14:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 88 KB
28 KB 637ms
636ms XHR
text/plain 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=2460105505401543&correlator=2584966859519002&output=ldjh&impl=fifs&eid=31062464%2C44750533%2C31062312&vrg=2021091501&ptt=17&sc=1&sfv=1-0-38&ecs=20210921&iu_parts=22405481091%2Cpastelink.net%2CBottom_adhesion_banner%2CTop_leaderboard%2CInline_banner%2CSidebar_MPU&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F3%2C%2F0%2F1%2F4%2C%2F0%2F1%2F4%2C%2F0%2F1%2F4%2C%2F0%2F1%2F4%2C%2F0%2F1%2F5&prev_iu_szs=728x90%2C728x90%2C728x90%2C728x90%2C728x90%2C728x90%2C160x600&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1632212088&dt=1632212088480&dlt=1632212088008&idt=400&frm=20&biw=1600&bih=1200&oid=2&adxs=436%2C246%2C281%2C281%2C281%2C281%2C1119&adys=1104%2C307%2C655%2C1047%2C1369%2C1784%2C355&adks=3402602959%2C2883060502%2C4220404771%2C4220404772%2C4220404773%2C4220404774%2C2108190548&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fpastelink.net%2F3fu78&vis=1&dmc=8&scr_x=0&scr_y=0&psz=728x-1%7C797x270%7C757x90%7C757x90%7C757x90%7C757x90%7C197x652&msz=728x-1%7C797x-1%7C728x-1%7C728x-1%7C728x-1%7C728x-1%7C160x-1&ga_vid=197347587.1632212088&ga_sid=1632212088&ga_hid=781441858&ga_fc=true&fws=516%2C4%2C4%2C4%2C4%2C4%2C4&ohw=1600%2C1600%2C1600%2C1600%2C1600%2C1600%2C1600&btvi=0%7C0%7C0%7C0%7C1%7C2%7C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f3697f118f84359f651061ec8f59b9827c8c6d335f47dcfa1078b2413ede696a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:49 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28808
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1,-1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1,-1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pastelink.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 7372 6 KB
4 KB 91ms
15ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pastelink.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 21 Sep 2021 08:14:48 GMT
expires: Wed, 21 Sep 2022 08:14:48 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 55F7 6 KB
3 KB 309ms
7ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pastelink.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 21 Sep 2021 08:14:48 GMT
expires: Wed, 21 Sep 2022 08:14:48 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 8984 6 KB
3 KB 305ms
8ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pastelink.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 21 Sep 2021 08:14:48 GMT
expires: Wed, 21 Sep 2022 08:14:48 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame FBBB 6 KB
3 KB 301ms
8ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pastelink.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 21 Sep 2021 08:14:48 GMT
expires: Wed, 21 Sep 2022 08:14:48 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame F74C 6 KB
3 KB 297ms
9ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pastelink.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 21 Sep 2021 08:14:48 GMT
expires: Wed, 21 Sep 2022 08:14:48 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame D605 6 KB
3 KB 294ms
9ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pastelink.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 21 Sep 2021 08:14:48 GMT
expires: Wed, 21 Sep 2022 08:14:48 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame A1BD 6 KB
3 KB 279ms
10ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pastelink.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 21 Sep 2021 08:14:48 GMT
expires: Wed, 21 Sep 2022 08:14:48 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 container.html Show response
23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame D1C0 6 KB
3 KB 277ms
13ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pastelink.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Tue, 21 Sep 2021 08:14:48 GMT
expires: Wed, 21 Sep 2022 08:14:48 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
9 KB 74ms
23ms XHR
application/json 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021091501&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e776b934607a27d4f76019a1454ec37c6506fa530732140c3f5a5064a9a56ed1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 21 Sep 2021 08:14:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8702
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 72ms
20ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091501.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Tue, 21 Sep 2021 08:14:49 GMT

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame ECF3 12 KB
5 KB 307ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pastelink.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Tue, 21 Sep 2021 07:53:08 GMT
expires: Wed, 21 Sep 2022 07:53:08 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 1301
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 9F16 783 B
944 B 17ms
16ms Document
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

1a364f6e30bce81ae33b006de70f38e8f24d58920de0a30442016cb3f4ddc7e0

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-jOX0Hv99bjKeO+nM8aASiQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://pastelink.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://pastelink.net/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Tue, 21 Sep 2021 08:14:49 GMT
date: Tue, 21 Sep 2021 08:14:49 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-jOX0Hv99bjKeO+nM8aASiQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 513
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 9F16 0
0 359ms
35ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021091501&jk=2460105505401543&rc=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 05FE 624 B
996 B 44ms
18ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhiah6SzATAB&v=APEucNWaD0VINg5xIIE6RuvFedj-QyqWppsfVZWVv1u1KmpJAX3flSFeq9QAn61XZhFjpglbbKg6UakZ_az6VTGlU06rB-ZaXD9JgATBQAbXhW_qSKyzebVn0Ubdo-alzrvpUbEHYAh0mayrxLv8ycGjIb1S08ATaDkWYPkoCRgw6VuCUo_A8_M

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CLOokgEQ4p3QAhiah6SzATAB&v=APEucNWaD0VINg5xIIE6RuvFedj-QyqWppsfVZWVv1u1KmpJAX3flSFeq9QAn61XZhFjpglbbKg6UakZ_az6VTGlU06rB-ZaXD9JgATBQAbXhW_qSKyzebVn0Ubdo-alzrvpUbEHYAh0mayrxLv8ycGjIb1S08ATaDkWYPkoCRgw6VuCUo_A8_M
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 21 Sep 2021 08:14:49 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUmR4zOvpagRVmxn4jflexQ0oi8YNi-ZZ5JRn8szGuXNvysnsgHkOIuuEGlv; expires=Sun, 16-Oct-2022 08:14:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 21 Sep 2021 08:14:49 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 55F7 70 KB
28 KB 77ms
52ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AjDT_0jKglqBFKDqwk_mmCM9eQXnVTOwfOaRQoKVI5DYa_HOGZ2B44zDJZ4aRV0qnhG4qp97sofQM8Kmepexk2Ai8ZcUSgAPj-tzRbYJCwfhjU1m2S521q_6xlYu5I5-ZY1JQKfEfP8NQg7VO65VxwE0SDRQ&dbm_d=AKAmf-CeRlc_-PI0nhn__7jPOVfwNTMSXBOPe2bzDXijSWnB1FebMMTyCEHM-8QdTN47W0nyNhDTnqZ_juiow8CZSV3D6QSueXICjYL6QlzUo28P3OyKi_DC7fNF7x_N_P9DafDIjJfM81Fmnf178zzCPcHn303-HPr7QID4CplmiS-BBbgvzEVeXr48R7fGqcjLTSfYKGWfMaLhMU-tOGBBRBGihbOdXE10Spf1X_WZFIDzbACydz7Nsy1uEmh212qVxsVMxi8LQjIc2cs9arP8PDA0CIG-3VMGZODkw-EfLoiemv4gb3E7Ml2ZvnSNdZWzdyVIjjyrlEGP_gOTFKhAkBpGp3RiU1ykeYf80ZZufZQbzOg2Z1f4qdz004tAXrpFPVkKj6IZxVnMQKdERvWSkNAQXQgULpvAwfTN9cN3UPpENHrWwydNyD8sqMWoIR-q3S-MpLkxl3GoFploDLluzR9YHDeXyqTqV8MKjKtv_XMKJD-6XmYUyJK2c-H824vCRivktA-nYNet_3x0lfgDPcdYK7idBz6LWTWlo3P5JCdbUjImoLAAgBznVRJbDx_kgCnEnpSGHKVdHK9QwcDRiKhktegm5VIEfvM_g8Rzeu-I1rSDJ7BY2o44zVAzObBACiNoxLk6KSCNDa81vut2Y7EjRXRZYc-ZQ-0-UPDy55Bx2Mrhr7FCCNtbI4zdnfn0yKTsAHvA8ZXP7ER-Hu0sWOwab8ycFuAKd6Et1LLV2XNvuPgGbYWQniNyzPEJb1ZmnFmDq08aB-aqGwrzzjpAqy48qUNO3fE19AvFUVW75ptra-sqU3G98kPSJTXUJG301M2Og9thKE4yZlife9VkBLFl6OzF-4jqTpWE0gRiY8wIWWcI16OaE1EO6lADKRxTerhXE-UujGfSaiGaDHTtATNFAYt9k-FLo2G6LejeiH0QC1eO4xOrN806St3vk3aZniUkUI4n46FAdFjBTYkMWuRvxeaqSFYYoyp-669Jq_zl1gtA-wqWspnntLSnUM4618f-Hh09T8vk9Qyq4_NAVus9gTAx4mc42G_gBKgnfzUUvpMy597RwSJheQZBWw8tJmQF52Q_Zd7nyjIpiMRqGmmPus3uiXiJVSjbQHBKAuf0uOd-kufuAqUv4kUqM2aJuqnAC1O8lfs98BRwlB7Ks34-hh8uvYe60R9wyYwZQrX0XRpNoI2W5Vg26Lat6NBOTsDtsIKuUCXdICRCb0vc8aJ-hroEJfs2E_zjnW9uMvP1cwoCGwbsphK2o8DxZUO8IgFX2Pvmff3w3uNdnWuuLeZ8ipblamd6hLwvRpK1w5WBO4NhYSAY3Lat1HqWEQQQSBZ5zLJLxd3asA6rR6murCzl1dJgazPE3vI3UmNb-7wBBA9f_SzzChK3CyBdfkqkF38RAyVtrnMlaOnR6r_JntNkMMwvSrD38OV5zTHEVNMZmNxkFnJzaC6yvU4MWLRJhktrsFyPrC1W_d9hzepdBDEig1uGQl_sgfNFCvX65-TJR5vWQZRlE3A6H8QEPcwMhDpqwKWKrYQSIOMcCT37ZZbRZ2hL4aNzoSr61PMVUdfPhdLD8zZidXbbqbKsWgjA-qbvRUqH8vbv0GbN7Wq6BOAnK5Zsg1ED09DoXK1QcX0sGGDBz26xHUUqsB9F-vFZf_FiItrx0m6acLRdOnkm_lcTDaeRNBmjlz9OiJsF110XUSVkYhv9Bclv9w8IFGkWYKZmfKlKUwG3oUOxW1JxSBX4shIeRprzHMa5i64qGGIP607rEDDnLeWiuLYmn7tSrrKL8CYo0LvECJj9pSoygpJsElqTzL4lD7G87eTv2W-C2pg56NJpTf8eH5BnWMCl3EaR5hYu1socFaMa9ubT9jKB3ZiwvBNZ8W-ag3WfVDrEnL3KQlX6W56ZVBP09B7mc_HPm3cP83SvB8woEySlQOGplTTL4joqji-XfFBlo8wGrosmXhngdIQNDt5magG8xtaG88pB8yuLH-16hi1eVYvkLyc5zEq8WpB1_tcE-tfXbbi_gyAv9ycKZvZwtAY3kwvmKnIXDfJWnxDAl5i3KgScuQWiogFluBP2OQ7xPukO3TwPp7YQz0JPogbaJORgBap7Iscc4Vvzrg4KBGI-OaZHf47JYVp0_EWJS07fIN3AZiEgurJ4HUaeN49HW7HjMHBG-7tWpoArTxoLD4M2-fpoZI9TvZJ9dXEebTt4i3840YPbITZ0l2D7wlNsgJTMWFCf7T1QkprgXfGORpsm5BVV63KQgSo5DCcsaOdrxf5mKlao3o_3AVdV7rYWlZF8lk8ssMv7B4auIOK8Q8ETeDQB8P4cA4rAFznmPhD4PbKKHuOF9Z-cKslAtLJ3A9hs9s7ccCEkklC3VdBO1Vju3cWhVyjqcwv3jNZzwQRmGYmftI7B8jzHPAQwYYkqKI2F_4_G4JpMK4y56D3qW9bJg7CZk-mASgHaIVqeJf1B7CbOzpJomRVuTqjhg22UZ4VcJsfjryTVKBltfeSh4W7XLOu2XQkjZGShoQCmbbTfT1MmFwfq4XzxgUHUbeiVB98F1y39BVrE4iR0N09LMF77SRAz9so7ffKI_WFvv_5eemuITzI_LDoWksRzlo75ZQ13QWApi5l_n5QnPPTDmcCuxZU69BrKjAfIcJa6FxOuJJyYnMhVAlnB-FgimrWLhEwNFrmY_v5fMK54BdZnsuf8ukF0LAIKUOGHICx5bY7IR0MmXQ-aJkUs5mfRoxupk2rHqD7cYJKf_pYca4zyeiT75R1qjr8yyPkI15oZ4Jv3mexDlJtOSD7XBf1MsciW-f3muWFLkXErhdihibm7-cXPSdy9qNzjSzUeCV0frbDvf0k4Ogi1s_mMXLRZ72DqtbeSxCr-Be_qHtTiMW7JhDaw0IrRof2KpJ2IpEyyl-Q91xUJXOj9BLo3PLE0Jnxx_tUqBYyb37uEHHfUk1oxgluqfRHNMN2vnvs9YnY39LsIqqW390rANsx0lVKRQug4d0751Y_024HKxbqYb8xNsWyveTTdBtI9XP_E2E_Y19jLlPKghmv30fhyYGdP3zHpbq30qWKQY2o3n8imwbeyKrmZHCNw74Yrrix8_KzrktK9mJA8XmYhKoRF10AEb_UFqn-m0BwMOZQL&cid=CAASFeRoqo0WnTn1JT5WAY6zk11PG7t36w&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8ed1f2bc77ce4b963bc70f64b49c579d6f3d615912afa5e139c69aadbc1cabd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28505
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 55F7 42 B
107 B 218ms
26ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DRD-dyKOALL4aV1EZg93XoC_GPwPAm-QzqsXnoVwdLEKoEPJOOqD4WmVpyd4UGiYmSF0GPSpRBE5x5Gd0ApsSpquDFU_wfWeSPmH7nTXJ3vRR-fmo

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/ Frame 55F7 2 KB
1 KB 147ms
15ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/window_focus_fy2019.js

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:08:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 355
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 08:08:54 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 55F7 128 KB
39 KB 83ms
29ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f6a3511472d75e0a1c1fa830124b68279af32e7f37d7899257134c259c6ea3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39526
x-xss-protection: 0
server: sffe
etag: "1632137836110461"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Tue, 21 Sep 2021 08:14:49 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/ Frame 55F7 14 KB
6 KB 141ms
9ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

127fef9bff9c4a7bd820146a3785bf8c7d3c5dbf48dd087f2e0f1d91a25e32c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 07:43:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1862
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6211
x-xss-protection: 0
server: cafe
etag: 18326705275735229343
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 07:43:47 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 9962 624 B
559 B 42ms
20ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhimlbazATAB&v=APEucNVo7GHDrF585bWh1e_9FefMgj1MSBE7wUj_1fPVNy4Gn845nBWBBDm5nDzIj7me4M4ndagVlTFn_TgsT5gBCRKLqIaro65dQHr6HVlDrGNW3S4gutIo1fQhQFPAkTz_VrqAhKal_V_-MYsSUjhGr6zmgLdPrjL61jCEiTgHnodGD2XpyK0

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CLOokgEQ4p3QAhimlbazATAB&v=APEucNVo7GHDrF585bWh1e_9FefMgj1MSBE7wUj_1fPVNy4Gn845nBWBBDm5nDzIj7me4M4ndagVlTFn_TgsT5gBCRKLqIaro65dQHr6HVlDrGNW3S4gutIo1fQhQFPAkTz_VrqAhKal_V_-MYsSUjhGr6zmgLdPrjL61jCEiTgHnodGD2XpyK0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 21 Sep 2021 08:14:49 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUk0GfO2SUh_VHl3vnFK1KUaY35TjXY2Ei3kReebcXC-fSzskB99AeuJktPA; expires=Sun, 16-Oct-2022 08:14:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 21 Sep 2021 08:14:49 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 8984 70 KB
28 KB 63ms
41ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DJ-fYKnrDgr1yiHBRjfFwDdm9T625wF5BUasMQRffmYTX-GjaAIXtCilnR-I-uNpSIbKKRTZOPEp-8dfoS6N_RBhMqAezSIjmlPGYCH0iR1B8kNy8O0EiA3U_VwJl4ovoGzlCMN1Y7g02jBHfUr-vDzyRVrg&dbm_d=AKAmf-DsbRWs-ln0flXvZDezk6-BVisweYdlPykttXb4sycPttvOpmFD4v07bMgbFYE0zZi35VRzfXo-1rVyt84PD_IJjQVsjs4LGnEUrwMXXxrVyP_5w9briEiGp84c4hMA1rdGGAk6cDDFZxz4VpkCsWp9GaFA-F0ik6DRiA7TOC1u6P90t2k56HD7mtDStGqC8gO7eQ-jhpiZKNuvlpqMpdJU_NqXY8RDs4S5_kt6mr5rl8amsLetqf8nk1J1Nna5XuHzOuJYG6jzpqpj2JzWopSZo_OEfAY-Qta8I_u6pGjPQb3b3KooQgNDRNOocC_WgQZHMp0IJJg80wrTU7nZ2tBHb-h_ABncVKu3JhFmGebbbcY_NVkwgw8IIySeeD7OMQlJ52AJGHzWjn_dxIT5VrXoOiJKh4FZ7SVK3--dHxbXNmsVkakN1KgIFfzqZ4Cq-G9cCOuq1RIusakQ1U7WTWlEcLOfmLwJmSfsGLfCwqVtCdYHBE_vXYHJsLW9AJBjVRDtyqoofiIuGVUioV0N3VKsGIfj-1W-24SJujPyzVaYWTYogcFfvv3Vp-z6cEnVtc5k1AqHiOchRF-G7_sV5WfNVkXEDzp34iQA-4aT8_6vosj6ppmCl8ghuE7WLtfsKFAcjPxBP_IKjx1zB8Aiui3cTOMJsjR-QUn7sOuBH9N4KVfJGwd3hbvTGbO0xOgixOjr4smx8JGHFftiiYNaafhkVEoFMuCKD5gFQLfdbADjdYdfKzJ34b8b1NtdgPg26Jz0aK_b39L3RrIQ5u6Omp5EQ9MtLVAmqAyIq2lBG2ruY1uKi7QrddeGCVLpaF9vy28zoAQpbtCC2vt8LUiJORHrrg210pgQZCVckdSlO1T_XJzH9FR2S5Ga5LR0CTs4VH9-AAXjfAZH3n63B6rWx_h6CgfRjMXcFEfmxIN-ILKwf_sGz-ONP_gmSQ5b9PGEwrBPHZGVg4nC5JjB0P4ELrmOxZa-Bg_mLzFM0l44QAQxi_sI5IVWia0fBiQQ-t5VXLO-jDAau3g6dY1F9ET7aPKzQ1IDh4WgV1KhjKqdXHyp6qw2iW-MKFMne-vCoQpcGNwOW05O5N4zcskAIrfvr7i-DhuoEcKT7o-2qHdBfLPrDXpKVsNXxc3hP8m8HyLYnIwVtP5IVhaCMy0TFCPzeNrrB4AllQwfhlVgff1qz4g7nSnuru8fFDNXqzCV_KCPAQTleax-HJUlkgxHm1MD3MWXITijQCJY4n8LtYfjEmIAetXlHHEWffjk4ETAudNdXRjf_89QLLpZyeaGfo5RadyBwjjSAbfZ8RxkYAhBxWM2U60JVYHhfIstczW-_H2o--pEPKT2jMlUDyNAVfTMUdYbGwA5qP34NVfhhelMyZ2KMkQHVbznSr4R0jmK3NhFBhAq882cpgEGJvaRb4DUkeOnr_oPF5apkqXIdRe3DzComnUxux16AzpzMYyC6geYVrc5UhhVFPJ4S3C-_1e1_Dr0NaG8spM7KJZNjZOOVEV26kLOe1DiKcZI5xFkVW_oPr0NfsuaQMTPw6onf2lpMPq_SKEI0OVEUXLbIsaZIYdC-thBH5_5HwugFJhlhQpLsLtTkrzdykJe4-loN8JOQ1DHB75ptBnS_5ImwsdTESZqMU6-5eF-SA2LFVZPV61KrBublprt7O5BC8IckYUJT3VMl7ZnB8oHI56qQSNYGopTCHQeYoCdM0s651HPsYXV4Bj4B7mmeHWjWvxnNZUHgH1Nx3w9OIOG1frw2XfaB3PS5kF6TPjd74K9EmO64qVDYcI8GYBopKhEt1oTq0SGKl8yzVnT8Fp4trwF3X5mraTtqNNml4VMPv0YgNnYUZSmj38-MVVOk1hvb7R5aOLY-DOTbTIVA2VKULKVamTSC5m29hy5Rw13Yeu3vt1CMECHOwpE-O3Qxn_V6xLIan5iVK16ORXZjdirp9SXudGPcpZK5BYT_3HHZaZFextCoVhN2EFcl5H4njwXd3crVON_rZlSHVCsfBM0CA3hqM7zdaq8NQMy9S1sdpL3T4i16SpkqqeIG6kJIJN5bstIDZkLvXqb0IVLYeHpIbu9fvp5zHSGwbNS9q4f7H9zU3mFiOAbz9YtMz1hTfcAEBRET14phXW6vi-kWODbFAB4GjbAgPlZ4cdYa6vxBHKowwg2Mx5Dbn2ekd7qatqECO5S6Rhlkdn0InC0O8ohgB44sZFg44IxkySb0dYJRoDp3EYTZB-lLo6z21VogzNfoKrIaAnSehzGtcw2Rt1aTaQoWns5bpIxRCJI_rIxUkM_TMl0FIidTStXimAcJ_X8iuztDeFN13dkj78nXDNG4u0I5hTF9sUvktmeaEcLGamsRaTcZFD7XSWd8p8-0xNN79YmiJjVAgN8bF_MPUftanTUtjRO-CrjAo-Fhh-tXEyYR5_bumfco7cz3J6ACjV9471ejTrfnCC4S8WSmqILAgMjUXZFVfD2yvs-B5quH7YvvE0KbdqQzB7OzvyhtZbdu4ixnj114NscUDnpKv1gTzFdRPBPs37PLxTQ80ak9JcMl8OMkHGWP-bYcCHMeb1jVpzRIhu1qy1jhAI2tMfbDUOnQmyefhuuth8AtyWOzy9M1m4pRuoqxv0QW6S7_o5VIlFiqhb4_0vRGGACrQcVCGxDRrWvBaq5bRIIuItuHS5GCitEOjWbs2u2hUoBiS3cGSwLml4YUNkHvE_k_KktRq93L3n0FYdSCXtewWM3PySqSsJ7p6aIRa-BjJb5kHJ5VD9lWXj8u6jTDSJKovqsuXw77T-uluH0v9fYRdaIk1cvcZV9ppAQBcyXRAZKsi9HhVQr_rHvCg_8lqXuCKNRlTDItXN6bTeygKw1X4YDm3ZkzCacLAh7xCLSQcS-_HTFJmI9AGemOV33_2byweGWP49Oo_vpgAD0M_rQuLw_P2JuOOYTKMQupTG8zRZWVfCm7bP-1e6qmRBEiJo9sWXUa2rp8ugiR0CG1fs6jW2_J7sH92XEehsFZZWCBgckTJYV6w0Lw5I5n3yDxngCqB3w7E1UKmuoFZaOjRl6aG1Owk4dZrGbrI45ssHH6A5HCJsRLDL_YF3PLokWxCG5OjBQ9d_i5bndUaa5bjHyKOpfYWWWmCwlfkXOB_dVG_op29EVc410PKdnf0TBELRF8w&cid=CAASFeRoVGTraVTf9G7cQN73Nvvdn2A4bQ&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

240201edf8e4d99725ede001251bc50d6d45b8063816744741778afc0576d422

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28464
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8984 42 B
173 B 212ms
23ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CCMhL44uRhCskl1s18fCUbtRM48hk8bsp7kRC0dzHuACVk4JQwsllSNUCQBGTLjFFWiJ6qHbVKVdd2H62eey19VYb_LNXqQji4MGaXpmbVT0Edkoo

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/ Frame 8984 2 KB
1 KB 145ms
15ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/window_focus_fy2019.js

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:08:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 355
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 08:08:54 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8984 128 KB
39 KB 94ms
43ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f6a3511472d75e0a1c1fa830124b68279af32e7f37d7899257134c259c6ea3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39526
x-xss-protection: 0
server: sffe
etag: "1632137836110461"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Tue, 21 Sep 2021 08:14:49 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/ Frame 8984 14 KB
6 KB 140ms
11ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

127fef9bff9c4a7bd820146a3785bf8c7d3c5dbf48dd087f2e0f1d91a25e32c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 07:43:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1862
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6211
x-xss-protection: 0
server: cafe
etag: 18326705275735229343
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 07:43:47 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 8984 0
0 14ms
14ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSWlNLjX--Cjgr81kHw01E2qKx3fEd6MDmO3qFI-6xXTMZPmp7TQvvBk_UXcfguf3nXHyEAKWcX3hEnA1hpncNMlfnfpA
Requested by: Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4B2F 624 B
558 B 41ms
23ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhimlbazATAB&v=APEucNUtJ0YcrdTJFoLE2Gazxj8eQAeEd9L071BqGGFvCFqDblQRS8ouIIVNF3O07P5PkEvNmNKiKBjyQgAfOsZYlRJtG6v500rT1d_hryC75o23KEZO4sG5jx1xP34RnLtAgO0vY3wxuVv0O2LpT59ICoC-p-NryS7Sp8JmMfjUfMDg8zyX-gI

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CLOokgEQ4p3QAhimlbazATAB&v=APEucNUtJ0YcrdTJFoLE2Gazxj8eQAeEd9L071BqGGFvCFqDblQRS8ouIIVNF3O07P5PkEvNmNKiKBjyQgAfOsZYlRJtG6v500rT1d_hryC75o23KEZO4sG5jx1xP34RnLtAgO0vY3wxuVv0O2LpT59ICoC-p-NryS7Sp8JmMfjUfMDg8zyX-gI
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 21 Sep 2021 08:14:49 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUmvx6U9U4atoPhyWD2vWk3Iwewni8sK0alqwgIGid9tO61WdWnxsTCd53pp; expires=Sun, 16-Oct-2022 08:14:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 21 Sep 2021 08:14:49 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame FBBB 70 KB
28 KB 62ms
44ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B24qsYxXb95b_d4HqV49Blzd849dinarzQzj8PPaRaU-2pLAWs2MB5wWQH_NklIDP-OHun-8DbVPqQbO1MHOjXRol1wJeUI1ES3b4n6pGc5pThgW9JiiwDw025Xley1B8tQ_noVl0cNKKeM7DYFTPV8VhNeg&dbm_d=AKAmf-BfbsbjmSsGejZvFHG9nJpaA8VTmq2iBpHgUXKMADPmxK5zWxJtykxseX_Sb4BuLcTmgboGNQqmCE2fv1hIYrZlcKXyoGFh1J4J4OZZC06D5Ic6HizURyL7Ht6y_B6thVHGhTQpYByHD69q6baXkHyh_SJBbAmLs1UmP9kVyj03-pCwX73eLq7tcI6wBLcVBF54_KPBjqeJa6sebRMt-wb1Kkf6fnvchCEe8pEBj6FnZO30qJW4xVWODxbk3e2xlbJUEbOXkBa8i4jQvzhoK-acqhFcqRcAhBgNyjQiS6cEBiCzurVCVoqN0KUf1Y2eXqYgD9DxxuS8Qm6YfAOJDUhreoy5FkYPkHBRg4sGWJeWjf7955eipDvh13BpB1rsoMe3ivUDFQ8Yd2fSO-j2ZQZJPCQmTdnptgE3L7T1TkDqSWAKZQAFPKKy0ofX4QazbSODxa4Cf6ow9LYRbYsjuCK78Zz7xrW1hOioea6Z_BaKtKJ5yrB_jEk2iquvbBT5S_6iyDlow6ZET4E96oSTJl6ADWqFwjRWzLnNtSkoS8A9r4sfyuRHaEnfGea5sPYjrQOwKFk0aYoNMdZk2mOpujJwzCklMFSGUYei97259Gg5vgQSC_rSFbJpZsgCoiJDW_QphtF-d5T5f6LYKvq1GVRYvOjOaN9obmkdYLHVjaYJecjeVvj3u_PxF_47MGYQikgnlm4n6HxFA33KE8wBJzdq73eTlRdEdetxbbjm50dVnbOJtXFDnx_oVmFtauHGvO0ALXHLBr_PkQ7fHIiuIsHKPtj-wqbrt_NmwI-akPPEedtVkxkY01QTNwpKgEm3WJqVqgqaYpypvayURKZZwQ97Ef64r1d9H43lGyNTmFL0S6-J7J9TsUnNJdP_4aMxFxmqWd45r5PeCfc4cqNYBC1eXVRhM5qdYLZwQFMmuis51ks8a3nM1NyN0tjP9tom6GnfAycXeuanM2-ET98ZwSaTLSjiAXEnq-iKogjVZ98WHhj0JfyGKrnEl0-YjyVAL5HjKAEEXJqZ8lMR9G8WmSyFQGcSu-XAolUg0ieEUavVf0J4MNrerCJV17VWlfIJRW4uMcUZYw26iMYLcvp1y-MMvCMaJEMXcFYXDYoNORQNMB8PQkXwYjvoUgh1iODCmJi3qGH5m0vaosv6v0VHpwwH-zsuiLnS880i4XCuOtkVIW7WMyGXawSPCELWTPInDY-6hwxwGWSV0qDfrviMeGWXvChDfEycciLhdyB5zOgI2GU_MyxmiQtwKJ-Vz9yhxT36MQNdTmFQST2I_jjuIaSIpqE6aYz_VI5tVORMZei8B1dWdZbD4JXr2UNp-h3oYc0n6QY8iIariwEKoVGOvfI2IDDBbUeBeBtTDLlOvCY2QIbfB88smR90pHsuhAJMjDcu4Xc1kc0ZEp_1KLMQRIvBY5Y83aihBZmiHxQ5I5_kzUVQPYpWhRXqOK3RLbHoZEPvN2g-5F2zdaU3QLloIUBXSJ3t3f-s0aLmysfR-LwAoWBGYtc2ZxlHy3SwslqFo1XKHUiwSUVyB7W3do3r5K7o8LM-AuW5ibGgt0VTN6cs0ynfLgCDizFyME1B2GuSZc_wl1CRzA3TmftdDupfh4HmpIxs7A04SHtPHytM5QHuDuMQw3Lh0WCqHDjGagfjbYNk_I8Rj1Tnt37OdnhmTnQR-bYC8IK2iVGl2jMeuYr3AT-k0Baw7F6-w_9FV-Eit-hBiJlrtU4mAGNKd_6mi-SOmGcpVnjz5hoNEv-lMcGDCFURU3BgSnymu-yH5lG1VW1yO6ENQVJXP4w9xfrH3AhaAxqcFNlLxNYAuSU5cUK4w4UEMmtns4Y_tZyCVed1k7YXKeeQw05KKgq3EQQ_41N38QnYe4zLw3bmrIu_r5dzhQzuDqQp3YwB0YxHWOggBTYuR-pHC7qPrxtgcHWMQJsaqudaGuHYOfsNAROlXXTJ0iOdtDRSoxROdS9uapTt3SoMpLu4ZUG4x0LYDdeqHMhRK5C8unbqfYw0VUFN-YyF4jxT6rgwoUc0uHCHmYsmFfQqqP_fs9SDE0gJmtjUkB7U4E_ZNBIuudMXwKjNrgC8DO63dFWUzAl4w9wslW6ESONBOXK0eKWM94hCFcF1JTrfVZ10ajv_2qI7wTj2OdzkIyq55YxbvEUHAjgMwCoa-3zGd0KYnBlHlwv6TncaTBr1rIbI0XhBjFbHPBXhLZxhq0r7w4hgY1TjFObaXInj960A60d1B3pw1XMMT8k6Ce7wdne3jCJVJtdPV0ndVINhzgdt8GUNMFCA-UAZIRKXle-jBevNdtPGJU7ubVr1SrRsaSinmLp_8bTeZ8r5hbKoyUksF7GKeGNCpE0Txdgfoq83efbxCVpbQNOVL6BzxAGgobxNj0hL8QJj00dLmfBbm4_a8SRhxmdkC6HTTbbh2MnrarNj_pENAgdSwTU77XhWhoYHtnA4feQysvmSEVjONpsiB2ppWP0r7eoaEFE5_WUajNXboC-LrXi7JCUfFXsopkkzIp_jT2XEH5bM28oa6xm2_VxlGxnjlbCWUA3VA2GXMIzeWH_dqetAR4PajOw6Vi7kSAU8-Uf3e1aP9eHt_lWuSzOSQrG632IPULY-G48zsCGI_Vi4eCqe1TFCbORI2c0V--S5tlYDCQCBakjJBNjU5_2gGdt0r6DPBIsWXqQ8mf67c5SvB7nYrmU4VZYohIrY6RqB_TKXw5SPh7YjkuIj-QrS3vdXJEnW7UBOVkqKra68-5DlxQPhQQBk57iKU8p69ePBmEx3v1JEnWE7C1kIOj5D1TvJ4iz9eee1qZUbcQJtQse_SSFu0REdAKHnjqHiYRAeLjiNDdvvvxYHDxz7x4Qkp0nkJFD3khlZrNKOKbPmWJpBcaYG9Q67u_a7Sb9b-SKzeLfV7gVM5rNHE_KUn-g_O3fpd3cLC6jYRLWOs7IxX3g-spbEIEQ0yv7Kcz9GLK84uK6Ikrg3rIQSm0Vah-zV574hUavRMRY0ZGMG6yzYQwWRJY-CqNR0aCEFgsVoUffJ7LPELHBJWkWgTTJqawuk_v-QtloxRaL6B3TyInRX7qdQcEQimb0bCJiiMsCiJcKsh8pNY7QFLHb6fWev5nsAyukuUne02-Y7GDLe4GU-hUBToOyOEOQB5Fle_ZGoOw&cid=CAASFeRomHp4J9uSWCxnS0r95f9878UxXQ&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1a876a215b5c799805fa306cace81d98982d73fc4486acf792d7bb065f0d7f62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28440
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame FBBB 42 B
107 B 210ms
25ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-ASItTFW1BoO-QDbRfCxeZdaWi2spd7SBL9iemKBe3IsL7cgcGTNur5eIXd_Vg5fwf0jMtV_fJzx98CqCs_R7u-FeUMEXUyQ8EiR8ufNwLns_fs5kA

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/ Frame FBBB 2 KB
1 KB 142ms
16ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/window_focus_fy2019.js

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:08:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 355
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 08:08:54 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FBBB 128 KB
39 KB 86ms
38ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f6a3511472d75e0a1c1fa830124b68279af32e7f37d7899257134c259c6ea3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39526
x-xss-protection: 0
server: sffe
etag: "1632137836110461"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Tue, 21 Sep 2021 08:14:49 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/ Frame FBBB 14 KB
6 KB 137ms
12ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

127fef9bff9c4a7bd820146a3785bf8c7d3c5dbf48dd087f2e0f1d91a25e32c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 07:43:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1862
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6211
x-xss-protection: 0
server: cafe
etag: 18326705275735229343
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 07:43:47 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame FBBB 0
0 15ms
15ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRNkZsApcpqCNSYHjzemZKaDqi-UKD5U8GtoC4Yq_pNrQrcIypkixMspWSUcS2Y4Ot6aNJIrWEZn0MiLgog3SqISKR8Fw
Requested by: Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 208B 624 B
558 B 34ms
19ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhimlbazATAB&v=APEucNVwAw1EcI6aGdacOJtOdwSwaWYvR4ex5scYfhnfufo1dOB0wjTSek2GIhzHyn-Cnp86NrAerOHAemtkCLAO0pFE9hV5Qns9pCjRTv1MIt5qNmcnvqk2-vYgqiBLnJ5omvgc9AlzQG67IA2-BCxCWOkSB6sEfffQdBpTDNB87RhbHpxKuYI

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CLOokgEQ4p3QAhimlbazATAB&v=APEucNVwAw1EcI6aGdacOJtOdwSwaWYvR4ex5scYfhnfufo1dOB0wjTSek2GIhzHyn-Cnp86NrAerOHAemtkCLAO0pFE9hV5Qns9pCjRTv1MIt5qNmcnvqk2-vYgqiBLnJ5omvgc9AlzQG67IA2-BCxCWOkSB6sEfffQdBpTDNB87RhbHpxKuYI
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 21 Sep 2021 08:14:49 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUmJ_0t1fnYLkEUsdIQbs9jdL7dt2LBYleAIWVdHOM6FWA81LKLZjSaGAgc_; expires=Sun, 16-Oct-2022 08:14:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 21 Sep 2021 08:14:49 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame F74C 69 KB
28 KB 66ms
51ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C6QS1MQ9qvaqxKMqKPCW76QQXf1I9K0cWG7azM3JwiQGuzoVfQc2k2ZoIB2WjwylO6sgn2lbsaewtvoateG7aS1n3FAXWe0ov8Z13S_wlkl4lmZMP-9a_m2fJnofiDdr5zcC8mHqBlsYf5zmAw9D_Y_-yv4w&dbm_d=AKAmf-AsRy8sbGmFyy3_5yFBkN7uRSxaxV6MdoYwe0wU9qbh25JMbPf6ToR_oyPfwESyZYJ9kRilb3Ofv0_LhLGiX5kqMq8JEqhR1FK4aVf2b9UBprCJoqDciZBp_OFPZGy3saplAoD6_1Ch6dTEjEG1rAkB2ASHkkUj1hOpcCWDwbnaz2GaUATJOklrLPQvvYv3sePJhsrOCDbBZXRXbOAJ2UyZfvEfo1ssZAHJf91Xg74zCz7gwtUGxCZbjkkw8Hu8K6afKjEMZk9_x9EsME2RmKqGOB-DWh3HxA2wQj-A2vn3Sfrx_BkWb8l3BcXt9X_3ToxkWfINBr1S5Vsz6yRrJTR5xfsRpOcPGIohTJ_-Q3j4ICO2ImxJ9ovpvUy0Cbpep2VUuRl4WtQxm0a64pXLucKksmvvdqVU6xpYugEJM6Cjdpc3CF9s1G5Efba-CVGonU6bshBfv3b6lalJ9QK5Rfmuk-vcYBOuKxekq_9wOScD8i1GX_NclTIO5qYRLGFWDb6_lnUDeAm5LBfHpHv8HPezo9MyHcv-qJBS_YGalFCXZkjUV6O18x7HMfLhI5mCkDEBmED3TAzvWPUlZNyY1vNJQlzVX9r9aIBuQn0elR43gULoa9nV5C4mKG35dQ2qLl9FGGgDn2RUEZu7rLkYiVIv5zqQQDXa5Ck1RByFQkx3GIhH-dS25Y0xfrsIkN8arNG1hDUWNrVFR4mC__o95hErucX1vkq6KxoO_5h4WycEvIDeBIhXm26nDGWYyAWUq5T3vrd9lQxXF_AD08CWPOm_l4py7nnMpiCdErEE90aTgIaI14PxtA7hzsinTK56P579sKuOWshxVl9vaYbucOVdulbXh54JLJyHw0RrpiA08TPGFc9FsHb6K-LhgV_eEiFYpwYGo5xnCiP0X1ME4jYz8Lc63i0Jt9iXlkJ7B0FiOuJLlvTg9OYbFdGJzmBJsxiu58R3INmEOmpMhOZ-6lNhXDwo1CGc4X0s4qHaV4la0NXl2AAB0kc3Lp2qEJQlE2u4EmV_0FtYnaB8SMbSJ9lhEyptB-nWFu34sQSLQCpUvPyeqtV4g-t_NtbfWttxnqphrT5W6Cycykz4Wi3wbnPlpG7BZcmkDqFZXVORWiU7M7LKdCcrrjNBFP73hY0XgPsu0Qqxe7NDhnJumdX1Remyh8L-CGV41R1btsMrHKD9AjyGAlFbKxbSSF3WyegIXv-EsR_h27qI3LCZRNbSUd3rA48J5krIeFdvt2uFbsKFqxsCflNJp2KgfQrPbav3_tyD6LPP_pbPBuAa6n__tUuxfEBZbSlOCfHjwoWbdU8ryL6B8Bw667s4_8mOD5TcU_uRKARBJDQ6cHxQL2byymxPbtp1bAFw-_niRykE8tOF1TQBJByS1kBfk2dSw4iMxJpnE7e9yF9WpEJLM4ilFiepgXmHs_9qQDTMksWmPCrvBJmVfHKCqUSE1eZ76epW2LQ5dKXw6xvFHpYjP4YaRCQ-fIRSnwXkpaB5qMcHv6PcpYfc5vszv5FRbZixH1Frm38knEqFStZGVef4T6gTNJEfJuGz-FMCd_IBhNogPQEtEsm2Tm36ifvgQUovjmaySn_mzUf1nm2rdgKQojxp-44C-a1dNP5qqb6R06DKTi31pKsd0tSpiwd-w-cJm_FH_IYq0HhwGDEFCcatMn-t-XGBHJwJEOc6i9ZfjDsjXO4Dc0bHF9abIxTUq1q1GSNX31poYdGjfwA6r4cPNP4-7_xWXD2GMKytFol-v-pAJWBN16uo_mJdEkdwyDZFqm8zZGX4JAm0s2UJbGsX2wQtW_d6QOhDU4LGaMM4r_ya4FOitrOJPftyH2SZSY2RRiyutF_FZyAgHumqdlu-bek2L2VL5OFwWWtqlYQdL1zQfG1vn0E0mhRNhVPhNM1tT_QYOZBdne2hkB30BJcd8HCSXvvXXGkw5JXixZku8oD7jeJYXUYxXE4GT1dGmASpRlOf2hBc4Cp3Of8F05-LZDKgo3tL29-mvpLqUKjOrp1U_4E9ld8jMgyENAOBE26Hwzu8apSZ7JG8lmnj_FC3DVm3Z0j7O-c3jZTWvqoQG2Z5BDW6qfFpxJIAqE-deI7A0nargAYtHaSEhN49krZ3eBSmJdp7VJZWqmZLyLcjHMNbqKLGjXzg3VJJoFitrh3I0Xzqx2dz41o8e807UbreyqUOcNfkLG4mBbTTPqhwS3LPmjXK93k6UYNFrslsySHSnjNMiYLcClMEzIW77czzpzidLdF4KIburFuJ8I9S5sWJ1K1RjpF565CgZCdXRwaTjKLQ5cYKfYiFBbIBjro_MpW1-2KSYoiq3a3H9FV_mEGKQdFmRqjpZzDTEgsZfSarRj_gaMwpJA32Sf9iBTrSC638eK1hG7_ap7GK50BxnXKzmsFrqI7sdkf_lqu-wG7zfc8luyhCoFA_YvjdI4wu9c-LpJ1zgGbdWx6lB6Hv6VzZhTRdbHf2OmINAJt40t4VDa86y-RRDcvrcOA2XP-R3GfmObzVG4__LCHTiYWaHG-Yjlkq0KkiWQKY_c8R5P7uKyxPHE_M8ONZyTSgHIH-khoipJbAZO0elF0XP28IA4LBX21imMaJHqOxjqWVwLDGGW9sB5lUaYSMfdM2583dbSWuiXJUk_tnPFCtdpVcFMVnHDdyVROicy5_snx3MzZktLwjtJhT5gqd3uXZxVgj54mpjcOhlZBO91JC74pYZ1Ih_1j4DjZP8gKocQscL_uKOYBZS8gheyKc3uI25jSn7HOUjGfV1RcxmRqymGmzXP4Qh9wGjYdG7Eq-e52rctc9n8NMuobYB6O37bPpovi01St1Wx4NOFy4ROMvxMz4XrAvG2P3uRoWLZ1m7drG7ugtp6ArslOtmq_yNNUEzpRykVtAhkGuT65OxRf1Akz93t05u5lVMfH9Ds__u6qb3wSb-z8Wux-GGPlLrlHHm6l8oFERy3MMQWnr-LyC7vx11uh0qU_wASVxeXquLQZBzc5VKrjdQSj2Ox9Pj2Gd3likIpbjy0oWLl5bNZdnYoHh1usvHfqw5AZxedY&cid=CAASFeRodHS8z2Uuop0WjgQcsaCBQU6sVg&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ee77a52698a34acc938db4ba84264a236a3bde6e4f3caef36c1d12eb27ea4ed7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28185
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame F74C 42 B
107 B 207ms
25ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BVdaj8mkkadCb_lbmiQvHksjIsqNIBeaNtnUzA6lkbxBw_ieKK-yRNWkKVCP70VVfzrK82Ziu3XC5StNkpjTAbQ3KwnRoOYIcneCWhsBdfL289SVM

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/ Frame F74C 2 KB
1 KB 139ms
16ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/window_focus_fy2019.js

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:08:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 355
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 08:08:54 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F74C 128 KB
39 KB 85ms
41ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f6a3511472d75e0a1c1fa830124b68279af32e7f37d7899257134c259c6ea3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39526
x-xss-protection: 0
server: sffe
etag: "1632137836110461"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Tue, 21 Sep 2021 08:14:49 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/ Frame F74C 14 KB
6 KB 134ms
12ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

127fef9bff9c4a7bd820146a3785bf8c7d3c5dbf48dd087f2e0f1d91a25e32c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 07:43:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1862
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6211
x-xss-protection: 0
server: cafe
etag: 18326705275735229343
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 07:43:47 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame F74C 0
0 15ms
15ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRJOaThTxHpljZXlLUcYynoOIvGYvMf9GJb3gDZvKt1ODZhUEpt-ngwC6G_0QJjf_Kzcu11aqRcoVKW7BTWPGFVmWtoyA
Requested by: Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A44D 624 B
559 B 32ms
20ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhimlbazATAB&v=APEucNUDRUOxfRlc8NOrlugz3yoXDOSfSF24sOANGpak5vDGOrMYbur9ygaVSInTh0VN3ereqyiNVUZfHfaOqLmZeNmcR-NNHCJKBO-Dtub_Nrq_JRWYTlenvcgxMCKwop3wVxbBVzyXMKQNWkPeMkOgc8MEVAxQSvY6v2E2ZPuNDRQkbKu1OJk

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CLOokgEQ4p3QAhimlbazATAB&v=APEucNUDRUOxfRlc8NOrlugz3yoXDOSfSF24sOANGpak5vDGOrMYbur9ygaVSInTh0VN3ereqyiNVUZfHfaOqLmZeNmcR-NNHCJKBO-Dtub_Nrq_JRWYTlenvcgxMCKwop3wVxbBVzyXMKQNWkPeMkOgc8MEVAxQSvY6v2E2ZPuNDRQkbKu1OJk
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 21 Sep 2021 08:14:49 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUlzDqNG9U2Qd-mkEp44FJ5dryIb894YDXUn-PccWy4XcAnn-JmwIlnzh_dW; expires=Sun, 16-Oct-2022 08:14:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 21 Sep 2021 08:14:49 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame D605 70 KB
28 KB 68ms
56ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D6jQCNqFEb9ZGPVEHSMtdbQu9GhR6Olcs-YkZHv8Y0tgcrJ2aBD_YySRLtfSZSX3rjeXRNXeX81M4fcsmgW9K6CDnw2KseUZQL_OYOcN9QojE1bty57i8obmVdgQq60sewZWZcLKt9UZMLeHKBuz1ElKihuw&dbm_d=AKAmf-CEQMSCx33JYiVgy4mJaW5YAOsjUaw979_ILpLzIEeptq9Jn9VdqbwOl7PsNbyDI0BIgXMRDJzqqFMLTIAhEx4L6_VsdEDHdtzHqlq9mz8Wr6aBdsYrpTy1Nlcih7xbQyInQO67H0m1CXdi-VVuQZnFkXxyIT-cEa0CW4zZuzXDQ7eMf1St_xIdJtDaqel5VLN_uvKceEHwxMfedSUE_E5o9h5WPr6fmhsO4Q-2ZxDp1cKXPPwCAlEjJdbDiLoEXjz2naEg9b9kq64m_a5iUympb96rfl32V7NZW4YxDnnnvCtu7vpewF3W209uci8UWNU8Cr5mnU-UylPt6x16bqnFi0HBe22ODWMHrLT4yC9t8SPs1_zC6HKCs0Y06WVbCNbIN-Z5d0I0yrA8NhukneeACG-JCVQHO4gH_0k2MAROrqidR3Q5ts9H-nKLRiY9VSOhYx5YAtEnFcjqs7g_eJZlMgximig7jSnVrnukzrTa3DEVq6LUBFZQZ_8-y60YHxHzvUgY7qA1y_F-rLBMJJyUMX9H3li9ldF_929Ci-r2-PA9_RYWHQR5AOcPxvGn9ON_q3cwCXMIeQ0kk-ICP_JuQ_Qh4KZ80YJjU5ZK4YC4ZHQgXNBJt4L7z0srg4hHxkk8JhaIlqoA903OqGZ9LfASte9Z-1BLpW1n_1yTi2OXhfAEjyybAsU2J1GT3IgQ8xStbmmck49y8b2PlNs0Y6bzf46ABak7d-y9CalMmyje979TxGYwOzY7IT4OfPtVa0QoJGllc1VVJjxwiWJ2KN5_bHOknJuVDudwwW685tZlpPlW7WnBRk2F3FpUK2WYkS1wyNNtBlhO91M_fheMOdnaurP3aW6JGlGEEEoMvi4j4quhLX8wKjbV3t0rMdvMD-e6PeuRi4JQUr_PBs96ECD17_8Y0iVjE6MCIAMI6P0haqhXYXTHYgwJWRxf0Fx1I5qoCVeMK6SosRICOU3zMDtv9sK_rrPBdFp1zB8bFvYPrnsH4YzIooNaF1Mtbe-z5sJbUPRk7QPQwWGF9g9aBAfCab5Kn8h_mpJZ4gfNBl4n0cvOSIfqTCTDT_MhvEqG4UpJKuNgqu9ot8yfcMLVL9Y-gy4OqZg765k9heSm4oDR9_j7pSoDxJVa3nM6Y-Zog1rsYwrPjlEI1lRCWxk0n2WVA7rqGrnojBGBYgd6AleyG74okZB-S4Jv9vl1NNWikM89lJz_jL5oayA5AFpH9QJ0ZBR_K2d_wzZK4DronvFM5Ji3q-CHVRQjq_gu_z2k2WKazLSbWlJ6epniqyufrwKSZ4PgES88y8_up_tTFXjAsYb5DguPo-cjXWg-qN5_ex5Bx_w-B-h6eBXb-b62dYvgrYEyviEYcceD9F4yVEGvs73eh43AaBdRdsU5jsiXWY5AK-SzWWso5koSYTDOxoAI9bbRWNTLOJ6pryKkzDp_sT8jh8KxwJO2xrI0dM-b0Pvz_urahX9Va7HyR3fuhO0cDAoZqQT9Y3pPd4WaYgnQe9_MeAFOnLX2cbRM_ruovZBdYV5XSED2JXxUAEzJMQZ8ma721UC_Zdu4UqRWoLbOcKYNcL5IplRew7NSd3KTKr8xpCM_Ghmjy1HuFQYpCSDT1_dUhEthYTzeZPQFEOKtmWLCpZYllzfnlFNC2wPfMSgegI2n_hK-7mQD_vl9rEaiT6hck6veEp-rMTWr21CLiaRwfszMNgfLuq8Xes0oPpeiM4aHUOI7yb0tDJMxosgjVHkhF_V3JXlIZBGF0frrBe92akVKMg0iJNf2sUIqYJWsunoTdrbbrxcyQSgGqgIw3nLLtws7HQLp7QwlQ93-sFW1qZwqUL9f96xQ61kOFuIYTNZHipz5stf1zclUUFXaWFpbW8UwpGxcYHdEB99urU6igAOlKEYPNAhPoW7c7tg1wBReBzuNYcm3qGfiedPOUd66AApy1le-nNY3N8LdKR0fa-Gjh14Zu2dt9J5fSt1G_oeTgVtAwa3JT3euts7So4f0vScjGt4KSdJMaYmo4oQsmxlK4zqLeYsBUdIcnnPYu5_pdSgpWDFwoD59o1v8RO7aJC5DtDi9nkMW3nK_H_wuxX0_36NY4cDwz92C2MwkGSK_ReiB38gphUEuh3VSnJ4mE8Qbp-w8Vjj0M-xqzjJ1hOgurSMfA-a65qadrXsq3gGsIpyL2qy_hhVaMaCwCDEwIg8YvBOE_gKGAb9CUozJRC1YxTUGIMAs7ShZZe2m-Q5ca8hVnyuBSmqQbBJ4zLd61NtnxYzZ6PoERV1ABVXFP7JzxlAo8nvbt8Nw2rxhCLnNWRaBFD13rAvZHAJDvM6xgfRiWGSzfCkCEYCiVdx5PaveG6fNaGG8s_IRzLb2-0ZJsjXyvsv0NTqLbE_ST1Q5qqpAvCslTFiXe8tpk09nOBTMXwyBBrWyr9Wiu2WxqLEPWGE3W2m25HFY4mzr-D8kLLXOeTSTgKkzQ4crIX85N2yD48FK_tK6-3SHliLSnPCDcCrqY7wrq5NxGljPNVTIoveOAumFfKKGBX2hkjKe_6C6AE7novK60zXnOA4B56GATtqCFPR0RumwudM9n98TOHdFpjRQ_klolvRA50Tf-s_gT_X3Q_TUCmZXl-MNoWOTwCIWr3JQM6u6Ua-jNfqbQtF4MNBAhE3uUCqQISIxgoVI19Ggaml8I1OQCahVcOFzQ33RpKXswFKOCIMr1HpzA3USYcwNmEVUZxcVwa1_E_yobXYYJiNutLyaMTVm4Ww-5w6fej9WxCgW_ntf4j75qLU_b0iCVqphRpsJnBjrNKZzs2sgJAxhtTqU-r_LcGgSAzaZ7nG2HPKuuhLwDocSm0gemKuX_R0xSUmL3LPV9pN8R99EqJjBdkCc2jxmrssfrqsAnin2swSKg3c9DZtxdSq28gqOYOJd06xX0kQad2--5PLsl94LCiZGlYx74Kg_UiF9yoOlESqWH3OkDUWrwR1qyeIxPttosDct7ckec1TGuSk6UwDqoFoWOwKzYpCpQFX4CkpVTZnOuU-NwjkkpVVWNbjY0jPaacf-_G8hfvDSopSz_BkefrGiNct9r-z5rhHo5e2HJjs6R__PxFAFt6MqpJQn580ArxGFs-wNlo-qgFYAB8euRhSatmGxFM7JkBxTXpuRIv8mwEXKlJfd9g&cid=CAASFeRoIElB0oq2m8eqanrdZ3rzrzWkNQ&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e2869015ac04d8dac01063d46b93dc42791681d80165f9e9c893d9f99d0b4214

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame D605 42 B
107 B 203ms
24ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DgcRykOKLlc5Ol21XuzjbOAG_oTa2Lofkhpljx9wL9vDevdjQCjn-9jbEj4EJN5kTiU6qvoVHvgjGI42Yhe4d8q8tEQ2nKl3hWPw97v1ZxQjKO7AY

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/ Frame D605 2 KB
1 KB 136ms
17ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/window_focus_fy2019.js

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:08:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 355
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 08:08:54 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D605 128 KB
39 KB 81ms
40ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f6a3511472d75e0a1c1fa830124b68279af32e7f37d7899257134c259c6ea3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39526
x-xss-protection: 0
server: sffe
etag: "1632137836110461"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Tue, 21 Sep 2021 08:14:49 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/ Frame D605 14 KB
6 KB 132ms
13ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

127fef9bff9c4a7bd820146a3785bf8c7d3c5dbf48dd087f2e0f1d91a25e32c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 07:43:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1862
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6211
x-xss-protection: 0
server: cafe
etag: 18326705275735229343
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 07:43:47 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 785F 624 B
559 B 27ms
18ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNVsTFoLucUKerk_Lv0g7bUN-bf23_SIZJT6LP0wxWGUIbgfQzfFh9Qg6M37tIUogZAT-E_qp1WYHoeuilApVwnqEJpDd60Q3C30oRoOzXdYpHEugjkVCWy7eszzirU0p2VkMpAUFuKvJXk25OFDz83qAhZj6TFgZ22oHuGGiFRSSp7YbFs

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNVsTFoLucUKerk_Lv0g7bUN-bf23_SIZJT6LP0wxWGUIbgfQzfFh9Qg6M37tIUogZAT-E_qp1WYHoeuilApVwnqEJpDd60Q3C30oRoOzXdYpHEugjkVCWy7eszzirU0p2VkMpAUFuKvJXk25OFDz83qAhZj6TFgZ22oHuGGiFRSSp7YbFs
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 21 Sep 2021 08:14:49 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUmiZVZcE_HzhnTEXsDk3hjaiDtT9vd_HeCgb5I8HO5xpSrNrkpmf_6nOB2a; expires=Sun, 16-Oct-2022 08:14:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 21 Sep 2021 08:14:49 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A1BD 24 KB
13 KB 67ms
58ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B8wTEyv8bGTLZzqe1KruKyw974n4OMbF5End5GTnc8OapReZgGGaWFlSLUVMupoJ97N5ijcEEC6zSe8OrHgh6q-TTgM4pYmK3xSWfPm40h3TkaVK1-bWwYjQZqfZ_3yXzFl9ajUygbrMcSaOMuToAsd9G4eg&cry=1&dbm_d=AKAmf-DmMhrXCxF27UbjuGiWKPu7Ip9OLsbB6xaI_f7n3oMDyqGatxQ9BbOPofhGhWso0HEIMXrxT-LUI_dP8F4_-4fA_ci1cJtRDfYD1wsaiMXSUSIBzB9MLNBKZQdZKwG1Q70ImGp8nYR5DscdJx1N6fa2dnBHPL0N-ABOvULxlgpuxTYVZgK7NTRtBOJivYKNDfjwwl_sNuBbkwMLljhOFTPr84d-tvuGPtfnjUahe-F030zWGBm8FJe3wkG3WFEc1mt6xiSyj1A3YkoHhLL5Dz7OCVnjFpIJ_q0N8nBAwMLynCWTf4OMmIvK4XD1eAvTI5fi026hcWNnzEa6u-4xbExOoxx9gj5Q_M3rpp0gFn6yxLASnj4IRzUhsCfZDQGLphs6tWPUDR7EDsYAZh97SnZf0-AT-OPVYTzOy0XtpHOm3xCPVCMg1isKjYMEapZBcrBx0fWucpdFZ4aE9IqHDkuK8GtrUFEu9CPbnIq9lyrTmGuNCWXfTyE_KEtJcavGS2wjhiusWOdRYVhNkux1IUQt_ZfVDLhve5c8mic_-P6Nh5-vmzajMdVZ1rrlEeGalSubXBF5hrEY0YZG8tjnVgUhUGPKCO3iu13eAF3Y6VubiFFiUKrDl9Tk0g3iPTz57PAvgHb41NuMkH6pT6AHc9NG8CF3E9voQcZDyAT6wsCEsg1keIvkQHN8KJ-qe43iVbDAzm4ppaDdLKgGUNRjPvwCGUCcF1-qUBE77D35bGd7lxguaU1lU4HbSXrABpjKGGypt8fFjlnOrNFAYfM7M0boIq6BxbgmeaQ6c-V0ubWmmxj-XV7R7NNHCDV2T9mopq6pojI96lj0R1Zomq66zhS4CDPWgDOqU2GVXsGIXv-MPFT5d7NxBn_ZvpTg9Gyo07QIWHEB7SchNYHoWBLXA2QbOQLaVEEsLc3EiJGTqf-Vk61QuAgWU-CL3zdb0tcUnJ11YBCxkygVYtd5xQYqgp89Q0L_PNzvUpGO18RRQADOna7n8YDTjD38iU-WjOhjwY5M0Hk7yIk8GFTWG7jLkTda4gLr84wpBRT6qpP8Pv9awk3dDIhmDsfCfn6YvKowcoY87enA16j2dwi9k0Om8dB-xvxCRymLWfsjjTJqBZ7YrlB9XHz4R-iVmuSrPz0Q7AXmcesuZXLwR7fsr8IHvFEFwxWWM92PGP7PQPxXvL8CV55TWHMRCz83MJtOAjZofy143A2WgU3qLC3ZfmeTO0mNSDWCplk9c6psIe5NC2IGVhdF1JIzGHSUMuwcTOMDJ5jZpKW8g8Pj6LAZUsrK13J1_E1mhGy6aMvmPJ6-HapBpz_ydY3MTIpInxcSWZ5v3iFY8k03D3plirNR_TN2DvJKZbVf8E_B13jwE-XMKkKYkCQ4fqsgRg4ZlbShnbDdPfWSrx5-6L9igMfmFc0gIjHrgMS55YsJtOlLlH7z2Z2TAbfGr1IuyQlUFwaIUU-iQtLwey6II3h5ex-IbAkUunD9eXP8TMsUdDKnGRszJ3vmBNVXPk0uq7iCWOFjTyGrqaVphWIG_jKpcnZ6HrmjP5dYOId4BIK41HIZAwE6ouw28mF48gbaWFszclDzxKDeLXDfFXbZIIO7bbL6zcK2Bjc-tpsqVOhqmCu1h4k4P6gqZxMTGwIVDW6d3PMlqwJYQyyFmYfvA2pnhlixrJA8HnTa-cioSfXMa9TgC0Z24s4nBaQX0ECz1YFvcHopzC80rylI2Y69UdJ9Z7gFd8oIS60DOS_wYUQT9_iKjfuLV7v7-QS5f--61Ph6KcYM3mBGd4xgLm5f2R3v3jqz3eSJ7pxf_4V5cl99I7EAhNr2LsjUZYKBw4V9ezlsAJoH9xccpOnel6Xc5SK5Ucv1QjcGKOK0O5saLph92zFjWF4L-hLEKwXxnucS1VZRplrXHz0114QJW7WCn2A5bR7RCQn-TAG6IeLqKo9YcWrMbKbS7sqamH9U0RJk18MSa1Gky7WujYL9pggMhwFkiKKH6m9eePNg36R-MYDvErobUlbhD2J7ql_93v4k1q7YxLUlMm-bQn6nB7APaS1PM16K9YuVSosiLyTqkpRl9DWWPnRlyBdScGiqFvoEyMoNidkIahj0SASlVvpg-tHbzUpsnOZ-Slz8GXrhYEFxTD0n5ypbgqxH3E7OX0vLViHswzwEa3Cxvd2gRLgBDnM-8XI5CX18yJGDgQrSIsUmts0Hw9hcW66anvI6QGmVg47_y_A9F6-b0LJ_bYFw5DKimJQV_thyDtmUoc-DYQd6K0IPnCGFtNHaNZqgjFhLz9agxOIjHwd0wAvXl21rnKTSgZx23DEGE6_0Ro3SWDw-5LsWHzClSxyBh5uIUmaZGSiv8LzJXxMt-RO24voQF2H8apXe3xV-_ZFyNllUcs12v0xMBbkULMGTTzRBqsQ3XTAGGHfOwRGOBrjRpJ-bhq5iDkNFhnWzSYAuY5sMZjACa-idatbs3T_7lUYTtAgnuvOBnAwsfdsMpvzOoontuuroymsjbWsY1gNJtuIZGzYZKt0IPZZ6ORh9l4Fd24r2U6_3Dg0pq0In0LFUyEX_Jd4cfHMZl2qsh4uLtbkWPrwJORvO4Q9oI6uQG4y8JNDqeySDVWrYSN2DfF9GiLOXMshq9XA-jaAMaAoeOdgbF9nlS-C0k8d00vy0GCMhXQu8coqqeVEHQXKGT29lOnNE0uGkJBzalpAtjsSpawxKFW0o2ewy_8WNwByMigb901GU4d7mMgH3HZXnsRj3tLf1pFJ8FKbozTYt69Zes2UDch7OAbs367HVsV2u77-TWPviVSLkyvyzvm2yMDHhgOSWhpV_y3VhFZxuZp5FqsTKoHXfL0751lMtB75-36vnOCv8Pdh8lEDf4FLCE7VHyqu2XrNg31hq0OwIm1A1It390a6g5_AklK3p8DPCjq89lWRbXPTa2aheiGe6tJ0bZ8EkUaw9KvSJRGrhe_OWIytPIUuOMmZZA9TVDebScywaP_w&cid=CAASFeRok5wDp7PEjKtogR8xbjYOCRWSpA&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ee3ca5e7fee250a2884b340ee7f9ec29a8228189519c4f79e7ff8e0c9c1940e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12829
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A1BD 42 B
107 B 200ms
24ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Axq7uvqdGHpsTdObobpV1UDTFoT4tMf0o-lUcAR5sNBkZlcjCHYvmHjX_ga30m5OS1JdH0_kq2epoxt3XBuRsm_5Gc60jle7cwdwwvam-ZmfW-p0A

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/ Frame A1BD 2 KB
1 KB 131ms
14ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/window_focus_fy2019.js

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:08:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 355
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 08:08:54 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A1BD 128 KB
39 KB 87ms
49ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f6a3511472d75e0a1c1fa830124b68279af32e7f37d7899257134c259c6ea3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39526
x-xss-protection: 0
server: sffe
etag: "1632137836110461"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Tue, 21 Sep 2021 08:14:49 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/ Frame A1BD 14 KB
6 KB 123ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

127fef9bff9c4a7bd820146a3785bf8c7d3c5dbf48dd087f2e0f1d91a25e32c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 07:43:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1862
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6211
x-xss-protection: 0
server: cafe
etag: 18326705275735229343
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 07:43:47 GMT

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C6FD 624 B
558 B 24ms
19ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMvTChCq8cMCGOqWq4UBMAE&v=APEucNUab8DQ5BtpPoWGuyT3s5oPVQPK3yWsfLA_7crF4Ska5TRvthiSmdqYK6w45b56k9h7X2vLeGHhxM3aUAJFkdlgblxVM_OQBvsOp6mTyipAX2IXsV6XTCElwX-AYC8mszpdLIffLjV_6RjLjOZnSwu0C3RPher8p_TnxGK8_PXyr9eC8ts

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CMvTChCq8cMCGOqWq4UBMAE&v=APEucNUab8DQ5BtpPoWGuyT3s5oPVQPK3yWsfLA_7crF4Ska5TRvthiSmdqYK6w45b56k9h7X2vLeGHhxM3aUAJFkdlgblxVM_OQBvsOp6mTyipAX2IXsV6XTCElwX-AYC8mszpdLIffLjV_6RjLjOZnSwu0C3RPher8p_TnxGK8_PXyr9eC8ts
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Tue, 21 Sep 2021 08:14:49 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure IDE=AHWqTUmVHxcisaKE0jqeWVHidDI0Jh9jcfp9DYohdGMc3t81FmJdXqNsjutvzMNG; expires=Sun, 16-Oct-2022 08:14:49 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Tue, 21 Sep 2021 08:14:49 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame D1C0 53 KB
25 KB 54ms
48ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B5sWg3OfES1jkDk_eBNXqX2VGYp8cVdpkTe0Ag-k0lJ1VStA5SRB-xN5fSm5kD8cMU1gIow96aWn34HTjSccpaRojgl8odq-DBKqnxo4KzEEZWiAaKT0P3T9ovFxx_5A839v7bw2OKHyoI2omh2nJqPFPYKA&dbm_d=AKAmf-BgBTCsSAB_YQiyl64vU5wWMwOe2KxtwVk8vZldoqxCzs8ENCiS9Ns5esI0DlTy4K0_0tjznNA_bMXRup48zTydg2HnXiJTKX1Vc7fTUZjuc8-y-bgnUSpJwMdyn-0T4D0jrBRiwhyCeVjhQvJMPK6W8O8i3_bnM18RXtGPh0RlHXb9Ui75OucNWjf0nmFKg87C8f2s-TJSVx1YtzyOXzQeuCa5kbHBJEbnBViUdv9fA4l4BDla27YVhuUk9m4PD3pcfSjSXcChpWzvjy7Xss7ahI8-RipT7YkuKUBtJ9L-NQdqscxUdK6Bh6nt_Pwt0_z1bEHTrAaC4vgUdsoLRx_PIOQiRjK3yRIpm-fTjjOcAcxmzUeOYVnDkWNT3pzlRQ9g1cd1wlvg-8lbFeA4bbwD-5s5qOb5V9_PP5UipV5mUA2F5c5mbIDOhjbGABykjBq5wA-qbAtuxLb0AjPzoXSPvvkVrc7t1C7oFeCxogiypG_fnNG4c2aszNwN7KzVB3rhOSSza49uOux427RueqHEU92VRhLjjQ6XuJSSO_x3sM58a6HGlrcLcuzAPYuajraIZ-rppXDMjgK1tTVMw6ma8cDyTJ5TOrheFzFnRpXZzSNfEqYSbzS1H00SbUj5b00jt2VOIwNjJqzz8f1hIq3l89y9FTK9hNU7yYqcTqZFb2UFL6Les07r-8Ubx6zOPe-oIh-aCLL7nTjSMhsXXWaFaEf7cvBti-Cysxf8rCtLTfbu5N-_otvY1COre5bZ7H1ti-Gq3HlKM2s6z9mei3IgIFsqjEYCvBansPEwxo18HDE0weeDFVQo9ZgXA52fk0njnjzsjVIsJrlffFzXsXbl9sN7rMK2hnVuboQ-fSHJHKTdtubeLY0XBr47HaKW92equ0JzmYNh5TRSZglwSGD5VbKBI7JQcTji9BC0OL0d3M8dr0Hr2MoKv8S6FeGtJvgKizAoTbvBaChRA0i8g1_yMcb6Ui1qVHWqf_4zFob0p7MrbevhxLE2WVDKYqCs3S1c-2yqY_KJhXvrfJbo-xBg_HRja3y4XioK7e8EdGeqW-xdO1hJwgbMOhInjIa15i0TkiWNkpB0TTsY40uzr6jIymOjuIhKKrjDlenfMzIxmO4PlfkEHa7ju5RzC9FUbgKpn1fYMl9IpUojLB3W4S1DyChbgNAiDsUvxFb-ICk_WfzZyy7UyiH2gLUymKMBRP5-cOiE3NM1KwP5zmeuqSeRFqg9VqthfcD4Twr0Gx7sjLM10Z0mcAvh5-aBrU0tClY_1IsPfxiFC2ie87xuf7K_KbHXfdwZMScIc_59-e8LjJd86HiyLoX-G4ZBE_NDx5v1mnDBLcK2P64zH1dUnbOmPLGtpb3QLyjrXg6lCJ6wFL28g11_MP-ZXpey6_ETNzRMEfWtNZAmJWRZGQTkdwDhwn78UAUXbMRh1c6Yy4PkIM9O8J0bJfF5D2xoI0QoVRmZDs4W5fwkdGJHe8EbDWC-9wawoB7-QwQsGbEw3wHxZpC53J4WFqHrMDO7USKGDvwGZSJQD3tFmfExFXY9cXPD_9rRcs2yWjAZ8O7HWS9I2w-5DSMgg6Fk_54R_5ltANowslu2ao3cPeAhf0CcnkYTuvu_eqyChhXrZIWWe1pfRYEJoMN61-9ONZ60HmR_3N_uavadhINNd4CA-OQvhDzD_Np2I7z5HWRaAljpP-MFV_ytQOz68eUb8lTyFD9ctDafMFAyP_N3nbZuthQc4F0NfbVXdkQT_E7JeZzwbKHeAQ0mISQPc1waXla5DqV8vHpbEiGx59XmPDFnf34he_h4JInLlISX-nGkKrzSoDrzEwUUC_MhywY25NR9ugCcMFtu_jcrcsmxTJWtcYO2i_B8y-0-JRr5q1D-Bu2zIFszOzQjU_e4Ka5L65J2yqRuphrLUVxPYQ3AkqCDr0ZbMEKOLIC2aK_IH0d7cx5uHFM7iM3UuC5ubE-sIVJeT-4yYoy-yhUdRHqBqaz2lfCSYtKTHJyHmfM3vJumlQ-Ec37rc4maeI-LOYuf9hdsrzakE8vo2ReBEdrATwalkb0kk5lDW55bem9ZzATJBYvc7X4TYNCjYEv8hoPJVV0p0U5HGBIMg97EadxDJvqZdbnNkPovXBD1Z-rKWnzvO8hbETm-FK-WqkuH9vCuaaQ-36mB-Vt8k7Afb0Q9Tlkb5ZI-QNkNejpR_AsCHxp9ps14JJgkqYhaf7RgGbJ5TOJIu5NOGmu9WbQIFAAxpjy8FKc8mghcrjCEguaW0uU5IRw2IZr8p0ore7FExBm7H2dtE0Lr5mm3DHDDsQA18fBAmjdrxdc4WMH3BzCuOb5nIMRnkDYYX-8KP8WtCEpEZo8RVp2d-Hq2l1p6PdsV2zHS3TmpaQIkhqZLk-XNb7xIeg6iBKORCdyiJIfhlluaMmaTJug_CKy98bQv1czCgDfbZSAAtUXBnuCTN8Bk6SWZmHFg_8pPBOK6DmFiFrQXEr1KtS91ZAjECYEA2vyxd2ma87fIa5x7OIq2eN0V2VJn_nM0ZbxS6rLIGFdNLEmBN6rvO1art3iDxF8q97llLkYAH9fK50n_5YhYGV1Tr-7JHO7YYkqYOxvNc313TNETrxYJPqyfqklfO1Yl1OhoSxLKNDrW9pTNQoG3uAuWAq8fyfdTuE0gz5JM8NzFr84bJ6f6e6K3x88VVMvzjTcNSD3crbPTlE1g-lx2aTBVrm2vUF_SWf7XeNuGvMaUDF7hF0gk71MMAvNRDxOQYYkBmkVafe8bV8mgaheKo5G25mq0XgzZ75vazg0EjC6ag2Rzwp9Uv-GQwJgpOOajhzjGB17-gw9OMGLi9s0ccbKcDmpDX9CkLdE2dQU6Y0kyj1bORgZoP406ohCmThEH02Rir95sWIlk1G4-JdhxwLZzhRhyxbsUd8zKKU9YpDN7I4d943k-xzQXBT--gK0wp8vVKnj3UqLxHTnTdVK3zuZxkT8fOq_L6ZlG4cuwXxyL9MJVIO2ziTf3nJ5EIXYNy9h6HvI5p-MLqrVAdt5ZAw&cid=CAASFeRoyFKyTgi7dfAbhU252wYX9cgoHA&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6eede7f81131ec3bdc3f80d4546d987654698f6df372cd767222022d93233bb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25164
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame D1C0 42 B
107 B 197ms
26ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BXGGUAJa-YYRftswY62zcscUNvyZp745nyCeLz-VDcTQvugFSFQEgI9wh7A_hz4s0lVDGiZ_Kq9r-TUoTidoUeovLgiqEH7wXgWjdXcFs52NYSVWw

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/ Frame D1C0 2 KB
1 KB 126ms
14ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/window_focus_fy2019.js

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:08:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 355
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 08:08:54 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D1C0 128 KB
39 KB 83ms
50ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2f6a3511472d75e0a1c1fa830124b68279af32e7f37d7899257134c259c6ea3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39526
x-xss-protection: 0
server: sffe
etag: "1632137836110461"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Tue, 21 Sep 2021 08:14:49 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/ Frame D1C0 14 KB
6 KB 120ms
8ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

127fef9bff9c4a7bd820146a3785bf8c7d3c5dbf48dd087f2e0f1d91a25e32c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 07:43:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1862
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6211
x-xss-protection: 0
server: cafe
etag: 18326705275735229343
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 07:43:47 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame D1C0 0
0 17ms
14ms Image
text/html 2a00:1450:4001:812::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTsZPdG23SgnzzfizikJtX_7MSvtho1eGjJcGvoSUmtnYqXH41DzFNkmLugbl4r9ZcO-qLk7MwU8MsFDtpbV-rNJBthpA
Requested by: Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:812::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 express_html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame 8984 114 KB
40 KB 81ms
6ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bc98b5956d216197013af35c909aa49d3aa7c26b48de9e9930eb4bd6b846391

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
Origin: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 09:40:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81265
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40185
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:50 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Sep 2021 09:40:24 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/elements/html/ Frame 8984 8 KB
3 KB 103ms
19ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DJ-fYKnrDgr1yiHBRjfFwDdm9T625wF5BUasMQRffmYTX-GjaAIXtCilnR-I-uNpSIbKKRTZOPEp-8dfoS6N_RBhMqAezSIjmlPGYCH0iR1B8kNy8O0EiA3U_VwJl4ovoGzlCMN1Y7g02jBHfUr-vDzyRVrg&dbm_d=AKAmf-DsbRWs-ln0flXvZDezk6-BVisweYdlPykttXb4sycPttvOpmFD4v07bMgbFYE0zZi35VRzfXo-1rVyt84PD_IJjQVsjs4LGnEUrwMXXxrVyP_5w9briEiGp84c4hMA1rdGGAk6cDDFZxz4VpkCsWp9GaFA-F0ik6DRiA7TOC1u6P90t2k56HD7mtDStGqC8gO7eQ-jhpiZKNuvlpqMpdJU_NqXY8RDs4S5_kt6mr5rl8amsLetqf8nk1J1Nna5XuHzOuJYG6jzpqpj2JzWopSZo_OEfAY-Qta8I_u6pGjPQb3b3KooQgNDRNOocC_WgQZHMp0IJJg80wrTU7nZ2tBHb-h_ABncVKu3JhFmGebbbcY_NVkwgw8IIySeeD7OMQlJ52AJGHzWjn_dxIT5VrXoOiJKh4FZ7SVK3--dHxbXNmsVkakN1KgIFfzqZ4Cq-G9cCOuq1RIusakQ1U7WTWlEcLOfmLwJmSfsGLfCwqVtCdYHBE_vXYHJsLW9AJBjVRDtyqoofiIuGVUioV0N3VKsGIfj-1W-24SJujPyzVaYWTYogcFfvv3Vp-z6cEnVtc5k1AqHiOchRF-G7_sV5WfNVkXEDzp34iQA-4aT8_6vosj6ppmCl8ghuE7WLtfsKFAcjPxBP_IKjx1zB8Aiui3cTOMJsjR-QUn7sOuBH9N4KVfJGwd3hbvTGbO0xOgixOjr4smx8JGHFftiiYNaafhkVEoFMuCKD5gFQLfdbADjdYdfKzJ34b8b1NtdgPg26Jz0aK_b39L3RrIQ5u6Omp5EQ9MtLVAmqAyIq2lBG2ruY1uKi7QrddeGCVLpaF9vy28zoAQpbtCC2vt8LUiJORHrrg210pgQZCVckdSlO1T_XJzH9FR2S5Ga5LR0CTs4VH9-AAXjfAZH3n63B6rWx_h6CgfRjMXcFEfmxIN-ILKwf_sGz-ONP_gmSQ5b9PGEwrBPHZGVg4nC5JjB0P4ELrmOxZa-Bg_mLzFM0l44QAQxi_sI5IVWia0fBiQQ-t5VXLO-jDAau3g6dY1F9ET7aPKzQ1IDh4WgV1KhjKqdXHyp6qw2iW-MKFMne-vCoQpcGNwOW05O5N4zcskAIrfvr7i-DhuoEcKT7o-2qHdBfLPrDXpKVsNXxc3hP8m8HyLYnIwVtP5IVhaCMy0TFCPzeNrrB4AllQwfhlVgff1qz4g7nSnuru8fFDNXqzCV_KCPAQTleax-HJUlkgxHm1MD3MWXITijQCJY4n8LtYfjEmIAetXlHHEWffjk4ETAudNdXRjf_89QLLpZyeaGfo5RadyBwjjSAbfZ8RxkYAhBxWM2U60JVYHhfIstczW-_H2o--pEPKT2jMlUDyNAVfTMUdYbGwA5qP34NVfhhelMyZ2KMkQHVbznSr4R0jmK3NhFBhAq882cpgEGJvaRb4DUkeOnr_oPF5apkqXIdRe3DzComnUxux16AzpzMYyC6geYVrc5UhhVFPJ4S3C-_1e1_Dr0NaG8spM7KJZNjZOOVEV26kLOe1DiKcZI5xFkVW_oPr0NfsuaQMTPw6onf2lpMPq_SKEI0OVEUXLbIsaZIYdC-thBH5_5HwugFJhlhQpLsLtTkrzdykJe4-loN8JOQ1DHB75ptBnS_5ImwsdTESZqMU6-5eF-SA2LFVZPV61KrBublprt7O5BC8IckYUJT3VMl7ZnB8oHI56qQSNYGopTCHQeYoCdM0s651HPsYXV4Bj4B7mmeHWjWvxnNZUHgH1Nx3w9OIOG1frw2XfaB3PS5kF6TPjd74K9EmO64qVDYcI8GYBopKhEt1oTq0SGKl8yzVnT8Fp4trwF3X5mraTtqNNml4VMPv0YgNnYUZSmj38-MVVOk1hvb7R5aOLY-DOTbTIVA2VKULKVamTSC5m29hy5Rw13Yeu3vt1CMECHOwpE-O3Qxn_V6xLIan5iVK16ORXZjdirp9SXudGPcpZK5BYT_3HHZaZFextCoVhN2EFcl5H4njwXd3crVON_rZlSHVCsfBM0CA3hqM7zdaq8NQMy9S1sdpL3T4i16SpkqqeIG6kJIJN5bstIDZkLvXqb0IVLYeHpIbu9fvp5zHSGwbNS9q4f7H9zU3mFiOAbz9YtMz1hTfcAEBRET14phXW6vi-kWODbFAB4GjbAgPlZ4cdYa6vxBHKowwg2Mx5Dbn2ekd7qatqECO5S6Rhlkdn0InC0O8ohgB44sZFg44IxkySb0dYJRoDp3EYTZB-lLo6z21VogzNfoKrIaAnSehzGtcw2Rt1aTaQoWns5bpIxRCJI_rIxUkM_TMl0FIidTStXimAcJ_X8iuztDeFN13dkj78nXDNG4u0I5hTF9sUvktmeaEcLGamsRaTcZFD7XSWd8p8-0xNN79YmiJjVAgN8bF_MPUftanTUtjRO-CrjAo-Fhh-tXEyYR5_bumfco7cz3J6ACjV9471ejTrfnCC4S8WSmqILAgMjUXZFVfD2yvs-B5quH7YvvE0KbdqQzB7OzvyhtZbdu4ixnj114NscUDnpKv1gTzFdRPBPs37PLxTQ80ak9JcMl8OMkHGWP-bYcCHMeb1jVpzRIhu1qy1jhAI2tMfbDUOnQmyefhuuth8AtyWOzy9M1m4pRuoqxv0QW6S7_o5VIlFiqhb4_0vRGGACrQcVCGxDRrWvBaq5bRIIuItuHS5GCitEOjWbs2u2hUoBiS3cGSwLml4YUNkHvE_k_KktRq93L3n0FYdSCXtewWM3PySqSsJ7p6aIRa-BjJb5kHJ5VD9lWXj8u6jTDSJKovqsuXw77T-uluH0v9fYRdaIk1cvcZV9ppAQBcyXRAZKsi9HhVQr_rHvCg_8lqXuCKNRlTDItXN6bTeygKw1X4YDm3ZkzCacLAh7xCLSQcS-_HTFJmI9AGemOV33_2byweGWP49Oo_vpgAD0M_rQuLw_P2JuOOYTKMQupTG8zRZWVfCm7bP-1e6qmRBEiJo9sWXUa2rp8ugiR0CG1fs6jW2_J7sH92XEehsFZZWCBgckTJYV6w0Lw5I5n3yDxngCqB3w7E1UKmuoFZaOjRl6aG1Owk4dZrGbrI45ssHH6A5HCJsRLDL_YF3PLokWxCG5OjBQ9d_i5bndUaa5bjHyKOpfYWWWmCwlfkXOB_dVG_op29EVc410PKdnf0TBELRF8w&cid=CAASFeRoVGTraVTf9G7cQN73Nvvdn2A4bQ&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcb80c86da267703311d2eeb3bdb5af0dedf63589d7d6eee4ed81f4bad7537f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3143
x-xss-protection: 0
server: cafe
etag: 2416364338287085106
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 08:14:01 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/ Frame 8984 23 KB
9 KB 92ms
12ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/abg_lite.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

289d6e0a0907342fcc661d9944f30ab735754993b96f13f5b59ef4f5269b40fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:11:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 191
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9237
x-xss-protection: 0
server: cafe
etag: 9463376652360951579
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 08:11:38 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame FBBB 114 KB
39 KB 80ms
14ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bc98b5956d216197013af35c909aa49d3aa7c26b48de9e9930eb4bd6b846391

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
Origin: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 09:40:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81265
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40185
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:50 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Sep 2021 09:40:24 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/elements/html/ Frame FBBB 8 KB
3 KB 96ms
21ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B24qsYxXb95b_d4HqV49Blzd849dinarzQzj8PPaRaU-2pLAWs2MB5wWQH_NklIDP-OHun-8DbVPqQbO1MHOjXRol1wJeUI1ES3b4n6pGc5pThgW9JiiwDw025Xley1B8tQ_noVl0cNKKeM7DYFTPV8VhNeg&dbm_d=AKAmf-BfbsbjmSsGejZvFHG9nJpaA8VTmq2iBpHgUXKMADPmxK5zWxJtykxseX_Sb4BuLcTmgboGNQqmCE2fv1hIYrZlcKXyoGFh1J4J4OZZC06D5Ic6HizURyL7Ht6y_B6thVHGhTQpYByHD69q6baXkHyh_SJBbAmLs1UmP9kVyj03-pCwX73eLq7tcI6wBLcVBF54_KPBjqeJa6sebRMt-wb1Kkf6fnvchCEe8pEBj6FnZO30qJW4xVWODxbk3e2xlbJUEbOXkBa8i4jQvzhoK-acqhFcqRcAhBgNyjQiS6cEBiCzurVCVoqN0KUf1Y2eXqYgD9DxxuS8Qm6YfAOJDUhreoy5FkYPkHBRg4sGWJeWjf7955eipDvh13BpB1rsoMe3ivUDFQ8Yd2fSO-j2ZQZJPCQmTdnptgE3L7T1TkDqSWAKZQAFPKKy0ofX4QazbSODxa4Cf6ow9LYRbYsjuCK78Zz7xrW1hOioea6Z_BaKtKJ5yrB_jEk2iquvbBT5S_6iyDlow6ZET4E96oSTJl6ADWqFwjRWzLnNtSkoS8A9r4sfyuRHaEnfGea5sPYjrQOwKFk0aYoNMdZk2mOpujJwzCklMFSGUYei97259Gg5vgQSC_rSFbJpZsgCoiJDW_QphtF-d5T5f6LYKvq1GVRYvOjOaN9obmkdYLHVjaYJecjeVvj3u_PxF_47MGYQikgnlm4n6HxFA33KE8wBJzdq73eTlRdEdetxbbjm50dVnbOJtXFDnx_oVmFtauHGvO0ALXHLBr_PkQ7fHIiuIsHKPtj-wqbrt_NmwI-akPPEedtVkxkY01QTNwpKgEm3WJqVqgqaYpypvayURKZZwQ97Ef64r1d9H43lGyNTmFL0S6-J7J9TsUnNJdP_4aMxFxmqWd45r5PeCfc4cqNYBC1eXVRhM5qdYLZwQFMmuis51ks8a3nM1NyN0tjP9tom6GnfAycXeuanM2-ET98ZwSaTLSjiAXEnq-iKogjVZ98WHhj0JfyGKrnEl0-YjyVAL5HjKAEEXJqZ8lMR9G8WmSyFQGcSu-XAolUg0ieEUavVf0J4MNrerCJV17VWlfIJRW4uMcUZYw26iMYLcvp1y-MMvCMaJEMXcFYXDYoNORQNMB8PQkXwYjvoUgh1iODCmJi3qGH5m0vaosv6v0VHpwwH-zsuiLnS880i4XCuOtkVIW7WMyGXawSPCELWTPInDY-6hwxwGWSV0qDfrviMeGWXvChDfEycciLhdyB5zOgI2GU_MyxmiQtwKJ-Vz9yhxT36MQNdTmFQST2I_jjuIaSIpqE6aYz_VI5tVORMZei8B1dWdZbD4JXr2UNp-h3oYc0n6QY8iIariwEKoVGOvfI2IDDBbUeBeBtTDLlOvCY2QIbfB88smR90pHsuhAJMjDcu4Xc1kc0ZEp_1KLMQRIvBY5Y83aihBZmiHxQ5I5_kzUVQPYpWhRXqOK3RLbHoZEPvN2g-5F2zdaU3QLloIUBXSJ3t3f-s0aLmysfR-LwAoWBGYtc2ZxlHy3SwslqFo1XKHUiwSUVyB7W3do3r5K7o8LM-AuW5ibGgt0VTN6cs0ynfLgCDizFyME1B2GuSZc_wl1CRzA3TmftdDupfh4HmpIxs7A04SHtPHytM5QHuDuMQw3Lh0WCqHDjGagfjbYNk_I8Rj1Tnt37OdnhmTnQR-bYC8IK2iVGl2jMeuYr3AT-k0Baw7F6-w_9FV-Eit-hBiJlrtU4mAGNKd_6mi-SOmGcpVnjz5hoNEv-lMcGDCFURU3BgSnymu-yH5lG1VW1yO6ENQVJXP4w9xfrH3AhaAxqcFNlLxNYAuSU5cUK4w4UEMmtns4Y_tZyCVed1k7YXKeeQw05KKgq3EQQ_41N38QnYe4zLw3bmrIu_r5dzhQzuDqQp3YwB0YxHWOggBTYuR-pHC7qPrxtgcHWMQJsaqudaGuHYOfsNAROlXXTJ0iOdtDRSoxROdS9uapTt3SoMpLu4ZUG4x0LYDdeqHMhRK5C8unbqfYw0VUFN-YyF4jxT6rgwoUc0uHCHmYsmFfQqqP_fs9SDE0gJmtjUkB7U4E_ZNBIuudMXwKjNrgC8DO63dFWUzAl4w9wslW6ESONBOXK0eKWM94hCFcF1JTrfVZ10ajv_2qI7wTj2OdzkIyq55YxbvEUHAjgMwCoa-3zGd0KYnBlHlwv6TncaTBr1rIbI0XhBjFbHPBXhLZxhq0r7w4hgY1TjFObaXInj960A60d1B3pw1XMMT8k6Ce7wdne3jCJVJtdPV0ndVINhzgdt8GUNMFCA-UAZIRKXle-jBevNdtPGJU7ubVr1SrRsaSinmLp_8bTeZ8r5hbKoyUksF7GKeGNCpE0Txdgfoq83efbxCVpbQNOVL6BzxAGgobxNj0hL8QJj00dLmfBbm4_a8SRhxmdkC6HTTbbh2MnrarNj_pENAgdSwTU77XhWhoYHtnA4feQysvmSEVjONpsiB2ppWP0r7eoaEFE5_WUajNXboC-LrXi7JCUfFXsopkkzIp_jT2XEH5bM28oa6xm2_VxlGxnjlbCWUA3VA2GXMIzeWH_dqetAR4PajOw6Vi7kSAU8-Uf3e1aP9eHt_lWuSzOSQrG632IPULY-G48zsCGI_Vi4eCqe1TFCbORI2c0V--S5tlYDCQCBakjJBNjU5_2gGdt0r6DPBIsWXqQ8mf67c5SvB7nYrmU4VZYohIrY6RqB_TKXw5SPh7YjkuIj-QrS3vdXJEnW7UBOVkqKra68-5DlxQPhQQBk57iKU8p69ePBmEx3v1JEnWE7C1kIOj5D1TvJ4iz9eee1qZUbcQJtQse_SSFu0REdAKHnjqHiYRAeLjiNDdvvvxYHDxz7x4Qkp0nkJFD3khlZrNKOKbPmWJpBcaYG9Q67u_a7Sb9b-SKzeLfV7gVM5rNHE_KUn-g_O3fpd3cLC6jYRLWOs7IxX3g-spbEIEQ0yv7Kcz9GLK84uK6Ikrg3rIQSm0Vah-zV574hUavRMRY0ZGMG6yzYQwWRJY-CqNR0aCEFgsVoUffJ7LPELHBJWkWgTTJqawuk_v-QtloxRaL6B3TyInRX7qdQcEQimb0bCJiiMsCiJcKsh8pNY7QFLHb6fWev5nsAyukuUne02-Y7GDLe4GU-hUBToOyOEOQB5Fle_ZGoOw&cid=CAASFeRomHp4J9uSWCxnS0r95f9878UxXQ&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcb80c86da267703311d2eeb3bdb5af0dedf63589d7d6eee4ed81f4bad7537f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3143
x-xss-protection: 0
server: cafe
etag: 2416364338287085106
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 08:14:01 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/ Frame FBBB 23 KB
9 KB 87ms
15ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/abg_lite.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

289d6e0a0907342fcc661d9944f30ab735754993b96f13f5b59ef4f5269b40fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:11:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 191
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9237
x-xss-protection: 0
server: cafe
etag: 9463376652360951579
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 08:11:38 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame F74C 114 KB
39 KB 76ms
17ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bc98b5956d216197013af35c909aa49d3aa7c26b48de9e9930eb4bd6b846391

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
Origin: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 09:40:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81265
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40185
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:50 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Sep 2021 09:40:24 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/elements/html/ Frame F74C 8 KB
3 KB 89ms
22ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C6QS1MQ9qvaqxKMqKPCW76QQXf1I9K0cWG7azM3JwiQGuzoVfQc2k2ZoIB2WjwylO6sgn2lbsaewtvoateG7aS1n3FAXWe0ov8Z13S_wlkl4lmZMP-9a_m2fJnofiDdr5zcC8mHqBlsYf5zmAw9D_Y_-yv4w&dbm_d=AKAmf-AsRy8sbGmFyy3_5yFBkN7uRSxaxV6MdoYwe0wU9qbh25JMbPf6ToR_oyPfwESyZYJ9kRilb3Ofv0_LhLGiX5kqMq8JEqhR1FK4aVf2b9UBprCJoqDciZBp_OFPZGy3saplAoD6_1Ch6dTEjEG1rAkB2ASHkkUj1hOpcCWDwbnaz2GaUATJOklrLPQvvYv3sePJhsrOCDbBZXRXbOAJ2UyZfvEfo1ssZAHJf91Xg74zCz7gwtUGxCZbjkkw8Hu8K6afKjEMZk9_x9EsME2RmKqGOB-DWh3HxA2wQj-A2vn3Sfrx_BkWb8l3BcXt9X_3ToxkWfINBr1S5Vsz6yRrJTR5xfsRpOcPGIohTJ_-Q3j4ICO2ImxJ9ovpvUy0Cbpep2VUuRl4WtQxm0a64pXLucKksmvvdqVU6xpYugEJM6Cjdpc3CF9s1G5Efba-CVGonU6bshBfv3b6lalJ9QK5Rfmuk-vcYBOuKxekq_9wOScD8i1GX_NclTIO5qYRLGFWDb6_lnUDeAm5LBfHpHv8HPezo9MyHcv-qJBS_YGalFCXZkjUV6O18x7HMfLhI5mCkDEBmED3TAzvWPUlZNyY1vNJQlzVX9r9aIBuQn0elR43gULoa9nV5C4mKG35dQ2qLl9FGGgDn2RUEZu7rLkYiVIv5zqQQDXa5Ck1RByFQkx3GIhH-dS25Y0xfrsIkN8arNG1hDUWNrVFR4mC__o95hErucX1vkq6KxoO_5h4WycEvIDeBIhXm26nDGWYyAWUq5T3vrd9lQxXF_AD08CWPOm_l4py7nnMpiCdErEE90aTgIaI14PxtA7hzsinTK56P579sKuOWshxVl9vaYbucOVdulbXh54JLJyHw0RrpiA08TPGFc9FsHb6K-LhgV_eEiFYpwYGo5xnCiP0X1ME4jYz8Lc63i0Jt9iXlkJ7B0FiOuJLlvTg9OYbFdGJzmBJsxiu58R3INmEOmpMhOZ-6lNhXDwo1CGc4X0s4qHaV4la0NXl2AAB0kc3Lp2qEJQlE2u4EmV_0FtYnaB8SMbSJ9lhEyptB-nWFu34sQSLQCpUvPyeqtV4g-t_NtbfWttxnqphrT5W6Cycykz4Wi3wbnPlpG7BZcmkDqFZXVORWiU7M7LKdCcrrjNBFP73hY0XgPsu0Qqxe7NDhnJumdX1Remyh8L-CGV41R1btsMrHKD9AjyGAlFbKxbSSF3WyegIXv-EsR_h27qI3LCZRNbSUd3rA48J5krIeFdvt2uFbsKFqxsCflNJp2KgfQrPbav3_tyD6LPP_pbPBuAa6n__tUuxfEBZbSlOCfHjwoWbdU8ryL6B8Bw667s4_8mOD5TcU_uRKARBJDQ6cHxQL2byymxPbtp1bAFw-_niRykE8tOF1TQBJByS1kBfk2dSw4iMxJpnE7e9yF9WpEJLM4ilFiepgXmHs_9qQDTMksWmPCrvBJmVfHKCqUSE1eZ76epW2LQ5dKXw6xvFHpYjP4YaRCQ-fIRSnwXkpaB5qMcHv6PcpYfc5vszv5FRbZixH1Frm38knEqFStZGVef4T6gTNJEfJuGz-FMCd_IBhNogPQEtEsm2Tm36ifvgQUovjmaySn_mzUf1nm2rdgKQojxp-44C-a1dNP5qqb6R06DKTi31pKsd0tSpiwd-w-cJm_FH_IYq0HhwGDEFCcatMn-t-XGBHJwJEOc6i9ZfjDsjXO4Dc0bHF9abIxTUq1q1GSNX31poYdGjfwA6r4cPNP4-7_xWXD2GMKytFol-v-pAJWBN16uo_mJdEkdwyDZFqm8zZGX4JAm0s2UJbGsX2wQtW_d6QOhDU4LGaMM4r_ya4FOitrOJPftyH2SZSY2RRiyutF_FZyAgHumqdlu-bek2L2VL5OFwWWtqlYQdL1zQfG1vn0E0mhRNhVPhNM1tT_QYOZBdne2hkB30BJcd8HCSXvvXXGkw5JXixZku8oD7jeJYXUYxXE4GT1dGmASpRlOf2hBc4Cp3Of8F05-LZDKgo3tL29-mvpLqUKjOrp1U_4E9ld8jMgyENAOBE26Hwzu8apSZ7JG8lmnj_FC3DVm3Z0j7O-c3jZTWvqoQG2Z5BDW6qfFpxJIAqE-deI7A0nargAYtHaSEhN49krZ3eBSmJdp7VJZWqmZLyLcjHMNbqKLGjXzg3VJJoFitrh3I0Xzqx2dz41o8e807UbreyqUOcNfkLG4mBbTTPqhwS3LPmjXK93k6UYNFrslsySHSnjNMiYLcClMEzIW77czzpzidLdF4KIburFuJ8I9S5sWJ1K1RjpF565CgZCdXRwaTjKLQ5cYKfYiFBbIBjro_MpW1-2KSYoiq3a3H9FV_mEGKQdFmRqjpZzDTEgsZfSarRj_gaMwpJA32Sf9iBTrSC638eK1hG7_ap7GK50BxnXKzmsFrqI7sdkf_lqu-wG7zfc8luyhCoFA_YvjdI4wu9c-LpJ1zgGbdWx6lB6Hv6VzZhTRdbHf2OmINAJt40t4VDa86y-RRDcvrcOA2XP-R3GfmObzVG4__LCHTiYWaHG-Yjlkq0KkiWQKY_c8R5P7uKyxPHE_M8ONZyTSgHIH-khoipJbAZO0elF0XP28IA4LBX21imMaJHqOxjqWVwLDGGW9sB5lUaYSMfdM2583dbSWuiXJUk_tnPFCtdpVcFMVnHDdyVROicy5_snx3MzZktLwjtJhT5gqd3uXZxVgj54mpjcOhlZBO91JC74pYZ1Ih_1j4DjZP8gKocQscL_uKOYBZS8gheyKc3uI25jSn7HOUjGfV1RcxmRqymGmzXP4Qh9wGjYdG7Eq-e52rctc9n8NMuobYB6O37bPpovi01St1Wx4NOFy4ROMvxMz4XrAvG2P3uRoWLZ1m7drG7ugtp6ArslOtmq_yNNUEzpRykVtAhkGuT65OxRf1Akz93t05u5lVMfH9Ds__u6qb3wSb-z8Wux-GGPlLrlHHm6l8oFERy3MMQWnr-LyC7vx11uh0qU_wASVxeXquLQZBzc5VKrjdQSj2Ox9Pj2Gd3likIpbjy0oWLl5bNZdnYoHh1usvHfqw5AZxedY&cid=CAASFeRodHS8z2Uuop0WjgQcsaCBQU6sVg&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcb80c86da267703311d2eeb3bdb5af0dedf63589d7d6eee4ed81f4bad7537f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3143
x-xss-protection: 0
server: cafe
etag: 2416364338287085106
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 08:14:01 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/ Frame F74C 23 KB
10 KB 72ms
8ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/abg_lite.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

289d6e0a0907342fcc661d9944f30ab735754993b96f13f5b59ef4f5269b40fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:11:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 191
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9237
x-xss-protection: 0
server: cafe
etag: 9463376652360951579
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 08:11:38 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame 55F7 114 KB
39 KB 75ms
23ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bc98b5956d216197013af35c909aa49d3aa7c26b48de9e9930eb4bd6b846391

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
Origin: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 09:40:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81265
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40185
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:50 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Sep 2021 09:40:24 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/elements/html/ Frame 55F7 8 KB
3 KB 79ms
18ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AjDT_0jKglqBFKDqwk_mmCM9eQXnVTOwfOaRQoKVI5DYa_HOGZ2B44zDJZ4aRV0qnhG4qp97sofQM8Kmepexk2Ai8ZcUSgAPj-tzRbYJCwfhjU1m2S521q_6xlYu5I5-ZY1JQKfEfP8NQg7VO65VxwE0SDRQ&dbm_d=AKAmf-CeRlc_-PI0nhn__7jPOVfwNTMSXBOPe2bzDXijSWnB1FebMMTyCEHM-8QdTN47W0nyNhDTnqZ_juiow8CZSV3D6QSueXICjYL6QlzUo28P3OyKi_DC7fNF7x_N_P9DafDIjJfM81Fmnf178zzCPcHn303-HPr7QID4CplmiS-BBbgvzEVeXr48R7fGqcjLTSfYKGWfMaLhMU-tOGBBRBGihbOdXE10Spf1X_WZFIDzbACydz7Nsy1uEmh212qVxsVMxi8LQjIc2cs9arP8PDA0CIG-3VMGZODkw-EfLoiemv4gb3E7Ml2ZvnSNdZWzdyVIjjyrlEGP_gOTFKhAkBpGp3RiU1ykeYf80ZZufZQbzOg2Z1f4qdz004tAXrpFPVkKj6IZxVnMQKdERvWSkNAQXQgULpvAwfTN9cN3UPpENHrWwydNyD8sqMWoIR-q3S-MpLkxl3GoFploDLluzR9YHDeXyqTqV8MKjKtv_XMKJD-6XmYUyJK2c-H824vCRivktA-nYNet_3x0lfgDPcdYK7idBz6LWTWlo3P5JCdbUjImoLAAgBznVRJbDx_kgCnEnpSGHKVdHK9QwcDRiKhktegm5VIEfvM_g8Rzeu-I1rSDJ7BY2o44zVAzObBACiNoxLk6KSCNDa81vut2Y7EjRXRZYc-ZQ-0-UPDy55Bx2Mrhr7FCCNtbI4zdnfn0yKTsAHvA8ZXP7ER-Hu0sWOwab8ycFuAKd6Et1LLV2XNvuPgGbYWQniNyzPEJb1ZmnFmDq08aB-aqGwrzzjpAqy48qUNO3fE19AvFUVW75ptra-sqU3G98kPSJTXUJG301M2Og9thKE4yZlife9VkBLFl6OzF-4jqTpWE0gRiY8wIWWcI16OaE1EO6lADKRxTerhXE-UujGfSaiGaDHTtATNFAYt9k-FLo2G6LejeiH0QC1eO4xOrN806St3vk3aZniUkUI4n46FAdFjBTYkMWuRvxeaqSFYYoyp-669Jq_zl1gtA-wqWspnntLSnUM4618f-Hh09T8vk9Qyq4_NAVus9gTAx4mc42G_gBKgnfzUUvpMy597RwSJheQZBWw8tJmQF52Q_Zd7nyjIpiMRqGmmPus3uiXiJVSjbQHBKAuf0uOd-kufuAqUv4kUqM2aJuqnAC1O8lfs98BRwlB7Ks34-hh8uvYe60R9wyYwZQrX0XRpNoI2W5Vg26Lat6NBOTsDtsIKuUCXdICRCb0vc8aJ-hroEJfs2E_zjnW9uMvP1cwoCGwbsphK2o8DxZUO8IgFX2Pvmff3w3uNdnWuuLeZ8ipblamd6hLwvRpK1w5WBO4NhYSAY3Lat1HqWEQQQSBZ5zLJLxd3asA6rR6murCzl1dJgazPE3vI3UmNb-7wBBA9f_SzzChK3CyBdfkqkF38RAyVtrnMlaOnR6r_JntNkMMwvSrD38OV5zTHEVNMZmNxkFnJzaC6yvU4MWLRJhktrsFyPrC1W_d9hzepdBDEig1uGQl_sgfNFCvX65-TJR5vWQZRlE3A6H8QEPcwMhDpqwKWKrYQSIOMcCT37ZZbRZ2hL4aNzoSr61PMVUdfPhdLD8zZidXbbqbKsWgjA-qbvRUqH8vbv0GbN7Wq6BOAnK5Zsg1ED09DoXK1QcX0sGGDBz26xHUUqsB9F-vFZf_FiItrx0m6acLRdOnkm_lcTDaeRNBmjlz9OiJsF110XUSVkYhv9Bclv9w8IFGkWYKZmfKlKUwG3oUOxW1JxSBX4shIeRprzHMa5i64qGGIP607rEDDnLeWiuLYmn7tSrrKL8CYo0LvECJj9pSoygpJsElqTzL4lD7G87eTv2W-C2pg56NJpTf8eH5BnWMCl3EaR5hYu1socFaMa9ubT9jKB3ZiwvBNZ8W-ag3WfVDrEnL3KQlX6W56ZVBP09B7mc_HPm3cP83SvB8woEySlQOGplTTL4joqji-XfFBlo8wGrosmXhngdIQNDt5magG8xtaG88pB8yuLH-16hi1eVYvkLyc5zEq8WpB1_tcE-tfXbbi_gyAv9ycKZvZwtAY3kwvmKnIXDfJWnxDAl5i3KgScuQWiogFluBP2OQ7xPukO3TwPp7YQz0JPogbaJORgBap7Iscc4Vvzrg4KBGI-OaZHf47JYVp0_EWJS07fIN3AZiEgurJ4HUaeN49HW7HjMHBG-7tWpoArTxoLD4M2-fpoZI9TvZJ9dXEebTt4i3840YPbITZ0l2D7wlNsgJTMWFCf7T1QkprgXfGORpsm5BVV63KQgSo5DCcsaOdrxf5mKlao3o_3AVdV7rYWlZF8lk8ssMv7B4auIOK8Q8ETeDQB8P4cA4rAFznmPhD4PbKKHuOF9Z-cKslAtLJ3A9hs9s7ccCEkklC3VdBO1Vju3cWhVyjqcwv3jNZzwQRmGYmftI7B8jzHPAQwYYkqKI2F_4_G4JpMK4y56D3qW9bJg7CZk-mASgHaIVqeJf1B7CbOzpJomRVuTqjhg22UZ4VcJsfjryTVKBltfeSh4W7XLOu2XQkjZGShoQCmbbTfT1MmFwfq4XzxgUHUbeiVB98F1y39BVrE4iR0N09LMF77SRAz9so7ffKI_WFvv_5eemuITzI_LDoWksRzlo75ZQ13QWApi5l_n5QnPPTDmcCuxZU69BrKjAfIcJa6FxOuJJyYnMhVAlnB-FgimrWLhEwNFrmY_v5fMK54BdZnsuf8ukF0LAIKUOGHICx5bY7IR0MmXQ-aJkUs5mfRoxupk2rHqD7cYJKf_pYca4zyeiT75R1qjr8yyPkI15oZ4Jv3mexDlJtOSD7XBf1MsciW-f3muWFLkXErhdihibm7-cXPSdy9qNzjSzUeCV0frbDvf0k4Ogi1s_mMXLRZ72DqtbeSxCr-Be_qHtTiMW7JhDaw0IrRof2KpJ2IpEyyl-Q91xUJXOj9BLo3PLE0Jnxx_tUqBYyb37uEHHfUk1oxgluqfRHNMN2vnvs9YnY39LsIqqW390rANsx0lVKRQug4d0751Y_024HKxbqYb8xNsWyveTTdBtI9XP_E2E_Y19jLlPKghmv30fhyYGdP3zHpbq30qWKQY2o3n8imwbeyKrmZHCNw74Yrrix8_KzrktK9mJA8XmYhKoRF10AEb_UFqn-m0BwMOZQL&cid=CAASFeRoqo0WnTn1JT5WAY6zk11PG7t36w&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcb80c86da267703311d2eeb3bdb5af0dedf63589d7d6eee4ed81f4bad7537f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3143
x-xss-protection: 0
server: cafe
etag: 2416364338287085106
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 08:14:01 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/ Frame 55F7 23 KB
9 KB 66ms
9ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/abg_lite.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

289d6e0a0907342fcc661d9944f30ab735754993b96f13f5b59ef4f5269b40fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:11:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 191
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9237
x-xss-protection: 0
server: cafe
etag: 9463376652360951579
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 08:11:38 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_273.js Show response
s0.2mdn.net/879366/ Frame D605 114 KB
39 KB 86ms
43ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2bc98b5956d216197013af35c909aa49d3aa7c26b48de9e9930eb4bd6b846391

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
Origin: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 09:40:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81265
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40185
x-xss-protection: 0
last-modified: Wed, 30 Jun 2021 20:54:50 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Sep 2021 09:40:24 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/elements/html/ Frame D605 8 KB
3 KB 75ms
22ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D6jQCNqFEb9ZGPVEHSMtdbQu9GhR6Olcs-YkZHv8Y0tgcrJ2aBD_YySRLtfSZSX3rjeXRNXeX81M4fcsmgW9K6CDnw2KseUZQL_OYOcN9QojE1bty57i8obmVdgQq60sewZWZcLKt9UZMLeHKBuz1ElKihuw&dbm_d=AKAmf-CEQMSCx33JYiVgy4mJaW5YAOsjUaw979_ILpLzIEeptq9Jn9VdqbwOl7PsNbyDI0BIgXMRDJzqqFMLTIAhEx4L6_VsdEDHdtzHqlq9mz8Wr6aBdsYrpTy1Nlcih7xbQyInQO67H0m1CXdi-VVuQZnFkXxyIT-cEa0CW4zZuzXDQ7eMf1St_xIdJtDaqel5VLN_uvKceEHwxMfedSUE_E5o9h5WPr6fmhsO4Q-2ZxDp1cKXPPwCAlEjJdbDiLoEXjz2naEg9b9kq64m_a5iUympb96rfl32V7NZW4YxDnnnvCtu7vpewF3W209uci8UWNU8Cr5mnU-UylPt6x16bqnFi0HBe22ODWMHrLT4yC9t8SPs1_zC6HKCs0Y06WVbCNbIN-Z5d0I0yrA8NhukneeACG-JCVQHO4gH_0k2MAROrqidR3Q5ts9H-nKLRiY9VSOhYx5YAtEnFcjqs7g_eJZlMgximig7jSnVrnukzrTa3DEVq6LUBFZQZ_8-y60YHxHzvUgY7qA1y_F-rLBMJJyUMX9H3li9ldF_929Ci-r2-PA9_RYWHQR5AOcPxvGn9ON_q3cwCXMIeQ0kk-ICP_JuQ_Qh4KZ80YJjU5ZK4YC4ZHQgXNBJt4L7z0srg4hHxkk8JhaIlqoA903OqGZ9LfASte9Z-1BLpW1n_1yTi2OXhfAEjyybAsU2J1GT3IgQ8xStbmmck49y8b2PlNs0Y6bzf46ABak7d-y9CalMmyje979TxGYwOzY7IT4OfPtVa0QoJGllc1VVJjxwiWJ2KN5_bHOknJuVDudwwW685tZlpPlW7WnBRk2F3FpUK2WYkS1wyNNtBlhO91M_fheMOdnaurP3aW6JGlGEEEoMvi4j4quhLX8wKjbV3t0rMdvMD-e6PeuRi4JQUr_PBs96ECD17_8Y0iVjE6MCIAMI6P0haqhXYXTHYgwJWRxf0Fx1I5qoCVeMK6SosRICOU3zMDtv9sK_rrPBdFp1zB8bFvYPrnsH4YzIooNaF1Mtbe-z5sJbUPRk7QPQwWGF9g9aBAfCab5Kn8h_mpJZ4gfNBl4n0cvOSIfqTCTDT_MhvEqG4UpJKuNgqu9ot8yfcMLVL9Y-gy4OqZg765k9heSm4oDR9_j7pSoDxJVa3nM6Y-Zog1rsYwrPjlEI1lRCWxk0n2WVA7rqGrnojBGBYgd6AleyG74okZB-S4Jv9vl1NNWikM89lJz_jL5oayA5AFpH9QJ0ZBR_K2d_wzZK4DronvFM5Ji3q-CHVRQjq_gu_z2k2WKazLSbWlJ6epniqyufrwKSZ4PgES88y8_up_tTFXjAsYb5DguPo-cjXWg-qN5_ex5Bx_w-B-h6eBXb-b62dYvgrYEyviEYcceD9F4yVEGvs73eh43AaBdRdsU5jsiXWY5AK-SzWWso5koSYTDOxoAI9bbRWNTLOJ6pryKkzDp_sT8jh8KxwJO2xrI0dM-b0Pvz_urahX9Va7HyR3fuhO0cDAoZqQT9Y3pPd4WaYgnQe9_MeAFOnLX2cbRM_ruovZBdYV5XSED2JXxUAEzJMQZ8ma721UC_Zdu4UqRWoLbOcKYNcL5IplRew7NSd3KTKr8xpCM_Ghmjy1HuFQYpCSDT1_dUhEthYTzeZPQFEOKtmWLCpZYllzfnlFNC2wPfMSgegI2n_hK-7mQD_vl9rEaiT6hck6veEp-rMTWr21CLiaRwfszMNgfLuq8Xes0oPpeiM4aHUOI7yb0tDJMxosgjVHkhF_V3JXlIZBGF0frrBe92akVKMg0iJNf2sUIqYJWsunoTdrbbrxcyQSgGqgIw3nLLtws7HQLp7QwlQ93-sFW1qZwqUL9f96xQ61kOFuIYTNZHipz5stf1zclUUFXaWFpbW8UwpGxcYHdEB99urU6igAOlKEYPNAhPoW7c7tg1wBReBzuNYcm3qGfiedPOUd66AApy1le-nNY3N8LdKR0fa-Gjh14Zu2dt9J5fSt1G_oeTgVtAwa3JT3euts7So4f0vScjGt4KSdJMaYmo4oQsmxlK4zqLeYsBUdIcnnPYu5_pdSgpWDFwoD59o1v8RO7aJC5DtDi9nkMW3nK_H_wuxX0_36NY4cDwz92C2MwkGSK_ReiB38gphUEuh3VSnJ4mE8Qbp-w8Vjj0M-xqzjJ1hOgurSMfA-a65qadrXsq3gGsIpyL2qy_hhVaMaCwCDEwIg8YvBOE_gKGAb9CUozJRC1YxTUGIMAs7ShZZe2m-Q5ca8hVnyuBSmqQbBJ4zLd61NtnxYzZ6PoERV1ABVXFP7JzxlAo8nvbt8Nw2rxhCLnNWRaBFD13rAvZHAJDvM6xgfRiWGSzfCkCEYCiVdx5PaveG6fNaGG8s_IRzLb2-0ZJsjXyvsv0NTqLbE_ST1Q5qqpAvCslTFiXe8tpk09nOBTMXwyBBrWyr9Wiu2WxqLEPWGE3W2m25HFY4mzr-D8kLLXOeTSTgKkzQ4crIX85N2yD48FK_tK6-3SHliLSnPCDcCrqY7wrq5NxGljPNVTIoveOAumFfKKGBX2hkjKe_6C6AE7novK60zXnOA4B56GATtqCFPR0RumwudM9n98TOHdFpjRQ_klolvRA50Tf-s_gT_X3Q_TUCmZXl-MNoWOTwCIWr3JQM6u6Ua-jNfqbQtF4MNBAhE3uUCqQISIxgoVI19Ggaml8I1OQCahVcOFzQ33RpKXswFKOCIMr1HpzA3USYcwNmEVUZxcVwa1_E_yobXYYJiNutLyaMTVm4Ww-5w6fej9WxCgW_ntf4j75qLU_b0iCVqphRpsJnBjrNKZzs2sgJAxhtTqU-r_LcGgSAzaZ7nG2HPKuuhLwDocSm0gemKuX_R0xSUmL3LPV9pN8R99EqJjBdkCc2jxmrssfrqsAnin2swSKg3c9DZtxdSq28gqOYOJd06xX0kQad2--5PLsl94LCiZGlYx74Kg_UiF9yoOlESqWH3OkDUWrwR1qyeIxPttosDct7ckec1TGuSk6UwDqoFoWOwKzYpCpQFX4CkpVTZnOuU-NwjkkpVVWNbjY0jPaacf-_G8hfvDSopSz_BkefrGiNct9r-z5rhHo5e2HJjs6R__PxFAFt6MqpJQn580ArxGFs-wNlo-qgFYAB8euRhSatmGxFM7JkBxTXpuRIv8mwEXKlJfd9g&cid=CAASFeRoIElB0oq2m8eqanrdZ3rzrzWkNQ&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcb80c86da267703311d2eeb3bdb5af0dedf63589d7d6eee4ed81f4bad7537f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3143
x-xss-protection: 0
server: cafe
etag: 2416364338287085106
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 08:14:01 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/ Frame D605 23 KB
9 KB 64ms
16ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/abg_lite.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

289d6e0a0907342fcc661d9944f30ab735754993b96f13f5b59ef4f5269b40fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:11:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 191
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9237
x-xss-protection: 0
server: cafe
etag: 9463376652360951579
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 08:11:38 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/ Frame A1BD 23 KB
9 KB 56ms
11ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B8wTEyv8bGTLZzqe1KruKyw974n4OMbF5End5GTnc8OapReZgGGaWFlSLUVMupoJ97N5ijcEEC6zSe8OrHgh6q-TTgM4pYmK3xSWfPm40h3TkaVK1-bWwYjQZqfZ_3yXzFl9ajUygbrMcSaOMuToAsd9G4eg&cry=1&dbm_d=AKAmf-DmMhrXCxF27UbjuGiWKPu7Ip9OLsbB6xaI_f7n3oMDyqGatxQ9BbOPofhGhWso0HEIMXrxT-LUI_dP8F4_-4fA_ci1cJtRDfYD1wsaiMXSUSIBzB9MLNBKZQdZKwG1Q70ImGp8nYR5DscdJx1N6fa2dnBHPL0N-ABOvULxlgpuxTYVZgK7NTRtBOJivYKNDfjwwl_sNuBbkwMLljhOFTPr84d-tvuGPtfnjUahe-F030zWGBm8FJe3wkG3WFEc1mt6xiSyj1A3YkoHhLL5Dz7OCVnjFpIJ_q0N8nBAwMLynCWTf4OMmIvK4XD1eAvTI5fi026hcWNnzEa6u-4xbExOoxx9gj5Q_M3rpp0gFn6yxLASnj4IRzUhsCfZDQGLphs6tWPUDR7EDsYAZh97SnZf0-AT-OPVYTzOy0XtpHOm3xCPVCMg1isKjYMEapZBcrBx0fWucpdFZ4aE9IqHDkuK8GtrUFEu9CPbnIq9lyrTmGuNCWXfTyE_KEtJcavGS2wjhiusWOdRYVhNkux1IUQt_ZfVDLhve5c8mic_-P6Nh5-vmzajMdVZ1rrlEeGalSubXBF5hrEY0YZG8tjnVgUhUGPKCO3iu13eAF3Y6VubiFFiUKrDl9Tk0g3iPTz57PAvgHb41NuMkH6pT6AHc9NG8CF3E9voQcZDyAT6wsCEsg1keIvkQHN8KJ-qe43iVbDAzm4ppaDdLKgGUNRjPvwCGUCcF1-qUBE77D35bGd7lxguaU1lU4HbSXrABpjKGGypt8fFjlnOrNFAYfM7M0boIq6BxbgmeaQ6c-V0ubWmmxj-XV7R7NNHCDV2T9mopq6pojI96lj0R1Zomq66zhS4CDPWgDOqU2GVXsGIXv-MPFT5d7NxBn_ZvpTg9Gyo07QIWHEB7SchNYHoWBLXA2QbOQLaVEEsLc3EiJGTqf-Vk61QuAgWU-CL3zdb0tcUnJ11YBCxkygVYtd5xQYqgp89Q0L_PNzvUpGO18RRQADOna7n8YDTjD38iU-WjOhjwY5M0Hk7yIk8GFTWG7jLkTda4gLr84wpBRT6qpP8Pv9awk3dDIhmDsfCfn6YvKowcoY87enA16j2dwi9k0Om8dB-xvxCRymLWfsjjTJqBZ7YrlB9XHz4R-iVmuSrPz0Q7AXmcesuZXLwR7fsr8IHvFEFwxWWM92PGP7PQPxXvL8CV55TWHMRCz83MJtOAjZofy143A2WgU3qLC3ZfmeTO0mNSDWCplk9c6psIe5NC2IGVhdF1JIzGHSUMuwcTOMDJ5jZpKW8g8Pj6LAZUsrK13J1_E1mhGy6aMvmPJ6-HapBpz_ydY3MTIpInxcSWZ5v3iFY8k03D3plirNR_TN2DvJKZbVf8E_B13jwE-XMKkKYkCQ4fqsgRg4ZlbShnbDdPfWSrx5-6L9igMfmFc0gIjHrgMS55YsJtOlLlH7z2Z2TAbfGr1IuyQlUFwaIUU-iQtLwey6II3h5ex-IbAkUunD9eXP8TMsUdDKnGRszJ3vmBNVXPk0uq7iCWOFjTyGrqaVphWIG_jKpcnZ6HrmjP5dYOId4BIK41HIZAwE6ouw28mF48gbaWFszclDzxKDeLXDfFXbZIIO7bbL6zcK2Bjc-tpsqVOhqmCu1h4k4P6gqZxMTGwIVDW6d3PMlqwJYQyyFmYfvA2pnhlixrJA8HnTa-cioSfXMa9TgC0Z24s4nBaQX0ECz1YFvcHopzC80rylI2Y69UdJ9Z7gFd8oIS60DOS_wYUQT9_iKjfuLV7v7-QS5f--61Ph6KcYM3mBGd4xgLm5f2R3v3jqz3eSJ7pxf_4V5cl99I7EAhNr2LsjUZYKBw4V9ezlsAJoH9xccpOnel6Xc5SK5Ucv1QjcGKOK0O5saLph92zFjWF4L-hLEKwXxnucS1VZRplrXHz0114QJW7WCn2A5bR7RCQn-TAG6IeLqKo9YcWrMbKbS7sqamH9U0RJk18MSa1Gky7WujYL9pggMhwFkiKKH6m9eePNg36R-MYDvErobUlbhD2J7ql_93v4k1q7YxLUlMm-bQn6nB7APaS1PM16K9YuVSosiLyTqkpRl9DWWPnRlyBdScGiqFvoEyMoNidkIahj0SASlVvpg-tHbzUpsnOZ-Slz8GXrhYEFxTD0n5ypbgqxH3E7OX0vLViHswzwEa3Cxvd2gRLgBDnM-8XI5CX18yJGDgQrSIsUmts0Hw9hcW66anvI6QGmVg47_y_A9F6-b0LJ_bYFw5DKimJQV_thyDtmUoc-DYQd6K0IPnCGFtNHaNZqgjFhLz9agxOIjHwd0wAvXl21rnKTSgZx23DEGE6_0Ro3SWDw-5LsWHzClSxyBh5uIUmaZGSiv8LzJXxMt-RO24voQF2H8apXe3xV-_ZFyNllUcs12v0xMBbkULMGTTzRBqsQ3XTAGGHfOwRGOBrjRpJ-bhq5iDkNFhnWzSYAuY5sMZjACa-idatbs3T_7lUYTtAgnuvOBnAwsfdsMpvzOoontuuroymsjbWsY1gNJtuIZGzYZKt0IPZZ6ORh9l4Fd24r2U6_3Dg0pq0In0LFUyEX_Jd4cfHMZl2qsh4uLtbkWPrwJORvO4Q9oI6uQG4y8JNDqeySDVWrYSN2DfF9GiLOXMshq9XA-jaAMaAoeOdgbF9nlS-C0k8d00vy0GCMhXQu8coqqeVEHQXKGT29lOnNE0uGkJBzalpAtjsSpawxKFW0o2ewy_8WNwByMigb901GU4d7mMgH3HZXnsRj3tLf1pFJ8FKbozTYt69Zes2UDch7OAbs367HVsV2u77-TWPviVSLkyvyzvm2yMDHhgOSWhpV_y3VhFZxuZp5FqsTKoHXfL0751lMtB75-36vnOCv8Pdh8lEDf4FLCE7VHyqu2XrNg31hq0OwIm1A1It390a6g5_AklK3p8DPCjq89lWRbXPTa2aheiGe6tJ0bZ8EkUaw9KvSJRGrhe_OWIytPIUuOMmZZA9TVDebScywaP_w&cid=CAASFeRok5wDp7PEjKtogR8xbjYOCRWSpA&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

289d6e0a0907342fcc661d9944f30ab735754993b96f13f5b59ef4f5269b40fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:11:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 191
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9237
x-xss-protection: 0
server: cafe
etag: 9463376652360951579
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 08:11:38 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame A1BD 41 KB
15 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 17 Sep 2021 08:58:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 343003
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sat, 17 Sep 2022 08:58:06 GMT

GET
H2 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/ Frame D1C0 23 KB
9 KB 56ms
15ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B5sWg3OfES1jkDk_eBNXqX2VGYp8cVdpkTe0Ag-k0lJ1VStA5SRB-xN5fSm5kD8cMU1gIow96aWn34HTjSccpaRojgl8odq-DBKqnxo4KzEEZWiAaKT0P3T9ovFxx_5A839v7bw2OKHyoI2omh2nJqPFPYKA&dbm_d=AKAmf-BgBTCsSAB_YQiyl64vU5wWMwOe2KxtwVk8vZldoqxCzs8ENCiS9Ns5esI0DlTy4K0_0tjznNA_bMXRup48zTydg2HnXiJTKX1Vc7fTUZjuc8-y-bgnUSpJwMdyn-0T4D0jrBRiwhyCeVjhQvJMPK6W8O8i3_bnM18RXtGPh0RlHXb9Ui75OucNWjf0nmFKg87C8f2s-TJSVx1YtzyOXzQeuCa5kbHBJEbnBViUdv9fA4l4BDla27YVhuUk9m4PD3pcfSjSXcChpWzvjy7Xss7ahI8-RipT7YkuKUBtJ9L-NQdqscxUdK6Bh6nt_Pwt0_z1bEHTrAaC4vgUdsoLRx_PIOQiRjK3yRIpm-fTjjOcAcxmzUeOYVnDkWNT3pzlRQ9g1cd1wlvg-8lbFeA4bbwD-5s5qOb5V9_PP5UipV5mUA2F5c5mbIDOhjbGABykjBq5wA-qbAtuxLb0AjPzoXSPvvkVrc7t1C7oFeCxogiypG_fnNG4c2aszNwN7KzVB3rhOSSza49uOux427RueqHEU92VRhLjjQ6XuJSSO_x3sM58a6HGlrcLcuzAPYuajraIZ-rppXDMjgK1tTVMw6ma8cDyTJ5TOrheFzFnRpXZzSNfEqYSbzS1H00SbUj5b00jt2VOIwNjJqzz8f1hIq3l89y9FTK9hNU7yYqcTqZFb2UFL6Les07r-8Ubx6zOPe-oIh-aCLL7nTjSMhsXXWaFaEf7cvBti-Cysxf8rCtLTfbu5N-_otvY1COre5bZ7H1ti-Gq3HlKM2s6z9mei3IgIFsqjEYCvBansPEwxo18HDE0weeDFVQo9ZgXA52fk0njnjzsjVIsJrlffFzXsXbl9sN7rMK2hnVuboQ-fSHJHKTdtubeLY0XBr47HaKW92equ0JzmYNh5TRSZglwSGD5VbKBI7JQcTji9BC0OL0d3M8dr0Hr2MoKv8S6FeGtJvgKizAoTbvBaChRA0i8g1_yMcb6Ui1qVHWqf_4zFob0p7MrbevhxLE2WVDKYqCs3S1c-2yqY_KJhXvrfJbo-xBg_HRja3y4XioK7e8EdGeqW-xdO1hJwgbMOhInjIa15i0TkiWNkpB0TTsY40uzr6jIymOjuIhKKrjDlenfMzIxmO4PlfkEHa7ju5RzC9FUbgKpn1fYMl9IpUojLB3W4S1DyChbgNAiDsUvxFb-ICk_WfzZyy7UyiH2gLUymKMBRP5-cOiE3NM1KwP5zmeuqSeRFqg9VqthfcD4Twr0Gx7sjLM10Z0mcAvh5-aBrU0tClY_1IsPfxiFC2ie87xuf7K_KbHXfdwZMScIc_59-e8LjJd86HiyLoX-G4ZBE_NDx5v1mnDBLcK2P64zH1dUnbOmPLGtpb3QLyjrXg6lCJ6wFL28g11_MP-ZXpey6_ETNzRMEfWtNZAmJWRZGQTkdwDhwn78UAUXbMRh1c6Yy4PkIM9O8J0bJfF5D2xoI0QoVRmZDs4W5fwkdGJHe8EbDWC-9wawoB7-QwQsGbEw3wHxZpC53J4WFqHrMDO7USKGDvwGZSJQD3tFmfExFXY9cXPD_9rRcs2yWjAZ8O7HWS9I2w-5DSMgg6Fk_54R_5ltANowslu2ao3cPeAhf0CcnkYTuvu_eqyChhXrZIWWe1pfRYEJoMN61-9ONZ60HmR_3N_uavadhINNd4CA-OQvhDzD_Np2I7z5HWRaAljpP-MFV_ytQOz68eUb8lTyFD9ctDafMFAyP_N3nbZuthQc4F0NfbVXdkQT_E7JeZzwbKHeAQ0mISQPc1waXla5DqV8vHpbEiGx59XmPDFnf34he_h4JInLlISX-nGkKrzSoDrzEwUUC_MhywY25NR9ugCcMFtu_jcrcsmxTJWtcYO2i_B8y-0-JRr5q1D-Bu2zIFszOzQjU_e4Ka5L65J2yqRuphrLUVxPYQ3AkqCDr0ZbMEKOLIC2aK_IH0d7cx5uHFM7iM3UuC5ubE-sIVJeT-4yYoy-yhUdRHqBqaz2lfCSYtKTHJyHmfM3vJumlQ-Ec37rc4maeI-LOYuf9hdsrzakE8vo2ReBEdrATwalkb0kk5lDW55bem9ZzATJBYvc7X4TYNCjYEv8hoPJVV0p0U5HGBIMg97EadxDJvqZdbnNkPovXBD1Z-rKWnzvO8hbETm-FK-WqkuH9vCuaaQ-36mB-Vt8k7Afb0Q9Tlkb5ZI-QNkNejpR_AsCHxp9ps14JJgkqYhaf7RgGbJ5TOJIu5NOGmu9WbQIFAAxpjy8FKc8mghcrjCEguaW0uU5IRw2IZr8p0ore7FExBm7H2dtE0Lr5mm3DHDDsQA18fBAmjdrxdc4WMH3BzCuOb5nIMRnkDYYX-8KP8WtCEpEZo8RVp2d-Hq2l1p6PdsV2zHS3TmpaQIkhqZLk-XNb7xIeg6iBKORCdyiJIfhlluaMmaTJug_CKy98bQv1czCgDfbZSAAtUXBnuCTN8Bk6SWZmHFg_8pPBOK6DmFiFrQXEr1KtS91ZAjECYEA2vyxd2ma87fIa5x7OIq2eN0V2VJn_nM0ZbxS6rLIGFdNLEmBN6rvO1art3iDxF8q97llLkYAH9fK50n_5YhYGV1Tr-7JHO7YYkqYOxvNc313TNETrxYJPqyfqklfO1Yl1OhoSxLKNDrW9pTNQoG3uAuWAq8fyfdTuE0gz5JM8NzFr84bJ6f6e6K3x88VVMvzjTcNSD3crbPTlE1g-lx2aTBVrm2vUF_SWf7XeNuGvMaUDF7hF0gk71MMAvNRDxOQYYkBmkVafe8bV8mgaheKo5G25mq0XgzZ75vazg0EjC6ag2Rzwp9Uv-GQwJgpOOajhzjGB17-gw9OMGLi9s0ccbKcDmpDX9CkLdE2dQU6Y0kyj1bORgZoP406ohCmThEH02Rir95sWIlk1G4-JdhxwLZzhRhyxbsUd8zKKU9YpDN7I4d943k-xzQXBT--gK0wp8vVKnj3UqLxHTnTdVK3zuZxkT8fOq_L6ZlG4cuwXxyL9MJVIO2ziTf3nJ5EIXYNy9h6HvI5p-MLqrVAdt5ZAw&cid=CAASFeRoyFKyTgi7dfAbhU252wYX9cgoHA&rfl=1%2Chttps%253A%252F%252Fpastelink.net%252F%240

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

289d6e0a0907342fcc661d9944f30ab735754993b96f13f5b59ef4f5269b40fd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:11:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 191
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9237
x-xss-protection: 0
server: cafe
etag: 9463376652360951579
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 08:11:38 GMT

GET
H2 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/elements/html/ Frame D1C0 8 KB
3 KB 61ms
21ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210916/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bcb80c86da267703311d2eeb3bdb5af0dedf63589d7d6eee4ed81f4bad7537f6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3143
x-xss-protection: 0
server: cafe
etag: 2416364338287085106
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 05 Oct 2021 08:14:01 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame D1C0 0
592 B 119ms
30ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvDsZ5-3XJslXYljs9wzxNjo_Vcv6EzSTWv65LPKFEJICweMqYmIokNuSbszN6XARP_O5P6fQCE5pwot9BrXBbMVIm2JfA8k9XmncV3VEWk181LSODIpsYU6HmlduyvTEBVsH2mWyfIEjjQXfQKjQVAaDs6-hHRhjsup2QWqJOCozUf92JEzjyJV3bE74TdT09DSmG22u8uwStNsA9F1dBLpI3bUtFquHm9ai15Hyewu-cIofwumqOkki4eNHe6Ih1u8USptxV43Xr9CkSNx91m5p0nmF7GxbvA4W0CFuC4V3r6exP2Tvl7wk_JT96VgVispjtVf0PGSFBTpizRSbYAOBHK8pFX9PJi57aTXRSR01dCq8t7gsz_OM-x0sQ8CGZr6LI7ev-68L5nh7HUn7S-289jC5xfe0bPMhNk8LQrJfEMTQGLo4TxpKUxvGj87NGR19lvTDczKRqr-uyyQG3wPL-zbv9cVOuw4vSGNPmG_DNvp4sdhd16Um880c7RUaz44U6-oBJH6yx-LSdA_cmewf4EjddVDJecMSklKfiYCciEeDVVJkqQkZ8ed6BQWXq6kL6pC2HNbptal1bo1ESltS0JwbRaBEqlkHyQ23jfMigYgc17yhE7KonwDuusk7eO8QVihaEkZNkQMjGS6sGUNeJ0Q4AGyjP6dIx1S3aOZc0XuXjr4gKpJaqk1QB6S3IyKhKAem14DM-a8gaaaGLJ8f4R0T0rxklsIGWN_cD4_TC1va28OYlu0vODefGfGGBWqxB6CNlTzGsWJZdgj8f2w-3oxJt2bsbAR-pwrrQN0DIwoT9a8azfcracE7mMS8Pa2gJ-2iPsTo0QjmPMm7JiA7TCdiJji64ej1n2Hg2A0ByDPZhL-3w2FVXE2fDFWBMa7-siYvMDE2i9eWPL6SN9C4HCGSabmypKyxVd1CIYYDN8ESqqiJt6dikjKnZTp_QOwLHd8wslolg1JJzKVQQLEGDUBFICwn7U94Y8fGolGpvkn0Iezxv-uZQvmGh4fBkS_-eagrfkkbj8gEx4vsFYRiknO2Iyc4Wsbf9F8uxT5w7QBsXdKJgT_jL5uWu0IwZhC7s4BqokvsYJRxXokrPMRTyElDM&sai=AMfl-YQTkQBR30G9tBHsWYoDf-XtSl96mCeYF9Ke0Ifra_ko3VsYJ0ht8Essrls4RU1k8lAi1QOZIM4QrAdLmvNeb3d-CYuSbV08MIIE5h4QQjgbLd9v8szXj27hUQwRp_XCUSDpe0or0W0ON8rzLTI-ugMkCwnSuD4jvHu3SZQ&sig=Cg0ArKJSzFbQC5uX9_EpEAE&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=1&cisv=r20210916.44954&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 21 Sep 2021 08:14:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame D1C0 41 KB
15 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 17 Sep 2021 08:58:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 343003
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sat, 17 Sep 2022 08:58:06 GMT

GET
H2 200 5391881142022654388
s0.2mdn.net/simgad/ Frame D1C0 112 KB
112 KB 37ms
8ms Image
image/jpeg 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/5391881142022654388

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

af3076668a796317b3d346391a5fa1ac62e8d148a3c7325b2898574c84a2ecc1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 08:59:41 GMT
x-content-type-options: nosniff
age: 602108
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 114608
x-xss-protection: 0
last-modified: Wed, 16 Jun 2021 17:23:38 GMT
server: sffe
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 14 Sep 2022 08:59:41 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 05FE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1

43 B
894 B

22ms
19ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhiah6SzATAB&v=APEucNWaD0VINg5xIIE6RuvFedj-QyqWppsfVZWVv1u1KmpJAX3flSFeq9QAn61XZhFjpglbbKg6UakZ_az6VTGlU06rB-ZaXD9JgATBQAbXhW_qSKyzebVn0Ubdo-alzrvpUbEHYAh0mayrxLv8ycGjIb1S08ATaDkWYPkoCRgw6VuCUo_A8_M
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:49 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 21 Sep 2021 08:14:49 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 05FE
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YUmUeT6HQqUnv8Bw1sBqxQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1

43 B
1014 B

16ms
15ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhiah6SzATAB&v=APEucNWaD0VINg5xIIE6RuvFedj-QyqWppsfVZWVv1u1KmpJAX3flSFeq9QAn61XZhFjpglbbKg6UakZ_az6VTGlU06rB-ZaXD9JgATBQAbXhW_qSKyzebVn0Ubdo-alzrvpUbEHYAh0mayrxLv8ycGjIb1S08ATaDkWYPkoCRgw6VuCUo_A8_M
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 21 Sep 2021 08:14:50 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 05FE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1

43 B
1006 B

308ms
14ms

Image
image/gif

185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhiah6SzATAB&v=APEucNWaD0VINg5xIIE6RuvFedj-QyqWppsfVZWVv1u1KmpJAX3flSFeq9QAn61XZhFjpglbbKg6UakZ_az6VTGlU06rB-ZaXD9JgATBQAbXhW_qSKyzebVn0Ubdo-alzrvpUbEHYAh0mayrxLv8ycGjIb1S08ATaDkWYPkoCRgw6VuCUo_A8_M

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
X-Proxy-Origin: 136.243.198.80; 136.243.198.80; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 34544049-04ad-4beb-aad1-a0da9637d806
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 05FE
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMxNTIwMDA2Nzc4NzM4NjA5MA%3D%3D

170 B
188 B

30ms
30ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMxNTIwMDA2Nzc4NzM4NjA5MA%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:49 GMT
X-Proxy-Origin: 136.243.198.80; 136.243.198.80; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 9bb7de38-57a8-467e-a7c0-044e193d8549
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMxNTIwMDA2Nzc4NzM4NjA5MA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 785F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1

43 B
894 B

49ms
26ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNVsTFoLucUKerk_Lv0g7bUN-bf23_SIZJT6LP0wxWGUIbgfQzfFh9Qg6M37tIUogZAT-E_qp1WYHoeuilApVwnqEJpDd60Q3C30oRoOzXdYpHEugjkVCWy7eszzirU0p2VkMpAUFuKvJXk25OFDz83qAhZj6TFgZ22oHuGGiFRSSp7YbFs
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:49 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 21 Sep 2021 08:14:49 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 785F
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YUmUeT6HQqUnv8Bw1sBqxQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1

43 B
894 B

14ms
14ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNVsTFoLucUKerk_Lv0g7bUN-bf23_SIZJT6LP0wxWGUIbgfQzfFh9Qg6M37tIUogZAT-E_qp1WYHoeuilApVwnqEJpDd60Q3C30oRoOzXdYpHEugjkVCWy7eszzirU0p2VkMpAUFuKvJXk25OFDz83qAhZj6TFgZ22oHuGGiFRSSp7YbFs
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 21 Sep 2021 08:14:50 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 785F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1

43 B
1006 B

306ms
12ms

Image
image/gif

185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNVsTFoLucUKerk_Lv0g7bUN-bf23_SIZJT6LP0wxWGUIbgfQzfFh9Qg6M37tIUogZAT-E_qp1WYHoeuilApVwnqEJpDd60Q3C30oRoOzXdYpHEugjkVCWy7eszzirU0p2VkMpAUFuKvJXk25OFDz83qAhZj6TFgZ22oHuGGiFRSSp7YbFs

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
X-Proxy-Origin: 136.243.198.80; 136.243.198.80; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: caa6652f-d6e4-41b3-9273-f6e49c2edabb
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 785F
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMxNTIwMDA2Nzc4NzM4NjA5MA%3D%3D

170 B
188 B

25ms
23ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMxNTIwMDA2Nzc4NzM4NjA5MA%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:49 GMT
X-Proxy-Origin: 136.243.198.80; 136.243.198.80; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: b9bec427-7c43-4140-b7a1-3e208b8a0200
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMxNTIwMDA2Nzc4NzM4NjA5MA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C6FD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1

43 B
894 B

62ms
19ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMvTChCq8cMCGOqWq4UBMAE&v=APEucNUab8DQ5BtpPoWGuyT3s5oPVQPK3yWsfLA_7crF4Ska5TRvthiSmdqYK6w45b56k9h7X2vLeGHhxM3aUAJFkdlgblxVM_OQBvsOp6mTyipAX2IXsV6XTCElwX-AYC8mszpdLIffLjV_6RjLjOZnSwu0C3RPher8p_TnxGK8_PXyr9eC8ts
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:49 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 21 Sep 2021 08:14:49 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C6FD
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YUmUeT6HQqUnv8Bw1sBqxQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1

43 B
1014 B

15ms
15ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMvTChCq8cMCGOqWq4UBMAE&v=APEucNUab8DQ5BtpPoWGuyT3s5oPVQPK3yWsfLA_7crF4Ska5TRvthiSmdqYK6w45b56k9h7X2vLeGHhxM3aUAJFkdlgblxVM_OQBvsOp6mTyipAX2IXsV6XTCElwX-AYC8mszpdLIffLjV_6RjLjOZnSwu0C3RPher8p_TnxGK8_PXyr9eC8ts
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 21 Sep 2021 08:14:50 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame C6FD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1

43 B
1006 B

322ms
28ms

Image
image/gif

185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMvTChCq8cMCGOqWq4UBMAE&v=APEucNUab8DQ5BtpPoWGuyT3s5oPVQPK3yWsfLA_7crF4Ska5TRvthiSmdqYK6w45b56k9h7X2vLeGHhxM3aUAJFkdlgblxVM_OQBvsOp6mTyipAX2IXsV6XTCElwX-AYC8mszpdLIffLjV_6RjLjOZnSwu0C3RPher8p_TnxGK8_PXyr9eC8ts

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
X-Proxy-Origin: 136.243.198.80; 136.243.198.80; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: ac58ddf7-f09b-40ce-9c4a-ac13886413ab
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C6FD
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMxNTIwMDA2Nzc4NzM4NjA5MA%3D%3D

170 B
188 B

30ms
29ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMxNTIwMDA2Nzc4NzM4NjA5MA%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:49 GMT
X-Proxy-Origin: 136.243.198.80; 136.243.198.80; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: e7e9cdf4-3042-4121-bd65-d3688b16201d
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMxNTIwMDA2Nzc4NzM4NjA5MA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 208B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1

43 B
894 B

16ms
13ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhimlbazATAB&v=APEucNVwAw1EcI6aGdacOJtOdwSwaWYvR4ex5scYfhnfufo1dOB0wjTSek2GIhzHyn-Cnp86NrAerOHAemtkCLAO0pFE9hV5Qns9pCjRTv1MIt5qNmcnvqk2-vYgqiBLnJ5omvgc9AlzQG67IA2-BCxCWOkSB6sEfffQdBpTDNB87RhbHpxKuYI
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:49 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 21 Sep 2021 08:14:49 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 208B
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YUmUeT6HQqUnv8Bw1sBqxQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1

43 B
894 B

13ms
13ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhimlbazATAB&v=APEucNVwAw1EcI6aGdacOJtOdwSwaWYvR4ex5scYfhnfufo1dOB0wjTSek2GIhzHyn-Cnp86NrAerOHAemtkCLAO0pFE9hV5Qns9pCjRTv1MIt5qNmcnvqk2-vYgqiBLnJ5omvgc9AlzQG67IA2-BCxCWOkSB6sEfffQdBpTDNB87RhbHpxKuYI
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 21 Sep 2021 08:14:50 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:50 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 208B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1

43 B
1006 B

293ms
39ms

Image
image/gif

185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhimlbazATAB&v=APEucNVwAw1EcI6aGdacOJtOdwSwaWYvR4ex5scYfhnfufo1dOB0wjTSek2GIhzHyn-Cnp86NrAerOHAemtkCLAO0pFE9hV5Qns9pCjRTv1MIt5qNmcnvqk2-vYgqiBLnJ5omvgc9AlzQG67IA2-BCxCWOkSB6sEfffQdBpTDNB87RhbHpxKuYI

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
X-Proxy-Origin: 136.243.198.80; 136.243.198.80; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 96b63113-5f98-41d3-b687-89cb6fcddb68
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 208B
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMyNTgxMDI1MzY4NzExMjg4MA%3D%3D

170 B
188 B

25ms
24ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMyNTgxMDI1MzY4NzExMjg4MA%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
X-Proxy-Origin: 136.243.198.80; 136.243.198.80; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 05c194e5-5036-40d0-a02e-6fc11978fc22
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTMyNTgxMDI1MzY4NzExMjg4MA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 9962
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1

43 B
894 B

19ms
16ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhimlbazATAB&v=APEucNVo7GHDrF585bWh1e_9FefMgj1MSBE7wUj_1fPVNy4Gn845nBWBBDm5nDzIj7me4M4ndagVlTFn_TgsT5gBCRKLqIaro65dQHr6HVlDrGNW3S4gutIo1fQhQFPAkTz_VrqAhKal_V_-MYsSUjhGr6zmgLdPrjL61jCEiTgHnodGD2XpyK0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:49 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 21 Sep 2021 08:14:49 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 9962
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YUmUeT6HQqUnv8Bw1sBqxQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1

43 B
894 B

15ms
15ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhimlbazATAB&v=APEucNVo7GHDrF585bWh1e_9FefMgj1MSBE7wUj_1fPVNy4Gn845nBWBBDm5nDzIj7me4M4ndagVlTFn_TgsT5gBCRKLqIaro65dQHr6HVlDrGNW3S4gutIo1fQhQFPAkTz_VrqAhKal_V_-MYsSUjhGr6zmgLdPrjL61jCEiTgHnodGD2XpyK0
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 21 Sep 2021 08:14:50 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:50 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 9962
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1

43 B
1006 B

267ms
13ms

Image
image/gif

185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhimlbazATAB&v=APEucNVo7GHDrF585bWh1e_9FefMgj1MSBE7wUj_1fPVNy4Gn845nBWBBDm5nDzIj7me4M4ndagVlTFn_TgsT5gBCRKLqIaro65dQHr6HVlDrGNW3S4gutIo1fQhQFPAkTz_VrqAhKal_V_-MYsSUjhGr6zmgLdPrjL61jCEiTgHnodGD2XpyK0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
X-Proxy-Origin: 136.243.198.80; 136.243.198.80; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 79cef0c4-134c-4272-b404-02289890435b
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9962
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMxNTIwMDA2Nzc4NzM4NjA5MA%3D%3D

170 B
188 B

23ms
23ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMxNTIwMDA2Nzc4NzM4NjA5MA%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
X-Proxy-Origin: 136.243.198.80; 136.243.198.80; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 2a5c7a0a-b07a-4ff1-832c-773416edde64
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMxNTIwMDA2Nzc4NzM4NjA5MA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A44D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1

43 B
894 B

36ms
28ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhimlbazATAB&v=APEucNUDRUOxfRlc8NOrlugz3yoXDOSfSF24sOANGpak5vDGOrMYbur9ygaVSInTh0VN3ereqyiNVUZfHfaOqLmZeNmcR-NNHCJKBO-Dtub_Nrq_JRWYTlenvcgxMCKwop3wVxbBVzyXMKQNWkPeMkOgc8MEVAxQSvY6v2E2ZPuNDRQkbKu1OJk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:49 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 21 Sep 2021 08:14:49 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A44D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YUmUeYDqrCn4y2BHDwl.mAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1&google_hm=2

43 B
1014 B

12ms
12ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhimlbazATAB&v=APEucNUDRUOxfRlc8NOrlugz3yoXDOSfSF24sOANGpak5vDGOrMYbur9ygaVSInTh0VN3ereqyiNVUZfHfaOqLmZeNmcR-NNHCJKBO-Dtub_Nrq_JRWYTlenvcgxMCKwop3wVxbBVzyXMKQNWkPeMkOgc8MEVAxQSvY6v2E2ZPuNDRQkbKu1OJk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 21 Sep 2021 08:14:50 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame A44D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1

43 B
1006 B

303ms
38ms

Image
image/gif

185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhimlbazATAB&v=APEucNUDRUOxfRlc8NOrlugz3yoXDOSfSF24sOANGpak5vDGOrMYbur9ygaVSInTh0VN3ereqyiNVUZfHfaOqLmZeNmcR-NNHCJKBO-Dtub_Nrq_JRWYTlenvcgxMCKwop3wVxbBVzyXMKQNWkPeMkOgc8MEVAxQSvY6v2E2ZPuNDRQkbKu1OJk

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
X-Proxy-Origin: 136.243.198.80; 136.243.198.80; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: c5744aa1-8a78-4f38-9ec9-fd44e0bf129b
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A44D
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMxNTIwMDA2Nzc4NzM4NjA5MA%3D%3D

170 B
188 B

24ms
23ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMxNTIwMDA2Nzc4NzM4NjA5MA%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
X-Proxy-Origin: 136.243.198.80; 136.243.198.80; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 664353db-9947-4623-b5a7-bb87c234d665
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMxNTIwMDA2Nzc4NzM4NjA5MA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4B2F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1

43 B
894 B

45ms
30ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhimlbazATAB&v=APEucNUtJ0YcrdTJFoLE2Gazxj8eQAeEd9L071BqGGFvCFqDblQRS8ouIIVNF3O07P5PkEvNmNKiKBjyQgAfOsZYlRJtG6v500rT1d_hryC75o23KEZO4sG5jx1xP34RnLtAgO0vY3wxuVv0O2LpT59ICoC-p-NryS7Sp8JmMfjUfMDg8zyX-gI
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:49 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 21 Sep 2021 08:14:49 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4B2F
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YUmUeYDqrCn4y2BHDwl.mAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1&google_hm=2

43 B
1014 B

13ms
13ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhimlbazATAB&v=APEucNUtJ0YcrdTJFoLE2Gazxj8eQAeEd9L071BqGGFvCFqDblQRS8ouIIVNF3O07P5PkEvNmNKiKBjyQgAfOsZYlRJtG6v500rT1d_hryC75o23KEZO4sG5jx1xP34RnLtAgO0vY3wxuVv0O2LpT59ICoC-p-NryS7Sp8JmMfjUfMDg8zyX-gI
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 21 Sep 2021 08:14:50 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKjn2DzO8vYC9iJjUesAmgU&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 4B2F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1

43 B
1006 B

280ms
14ms

Image
image/gif

185.33.221.89
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOokgEQ4p3QAhimlbazATAB&v=APEucNUtJ0YcrdTJFoLE2Gazxj8eQAeEd9L071BqGGFvCFqDblQRS8ouIIVNF3O07P5PkEvNmNKiKBjyQgAfOsZYlRJtG6v500rT1d_hryC75o23KEZO4sG5jx1xP34RnLtAgO0vY3wxuVv0O2LpT59ICoC-p-NryS7Sp8JmMfjUfMDg8zyX-gI

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
X-Proxy-Origin: 136.243.198.80; 136.243.198.80; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 13942c2b-74b3-4c34-bff1-27e9da94c097
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEHpG8vL63ms56hVvIMODHsA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 4B2F
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMxNTIwMDA2Nzc4NzM4NjA5MA%3D%3D

170 B
188 B

26ms
25ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMxNTIwMDA2Nzc4NzM4NjA5MA%3D%3D

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 21 Sep 2021 08:14:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
X-Proxy-Origin: 136.243.198.80; 136.243.198.80; 719.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 030f3334-82e3-415e-a0f7-4c43a3b4411a
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTMxNTIwMDA2Nzc4NzM4NjA5MA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame D1C0 0
60 B 20ms
17ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 21 Sep 2021 08:14:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK mtrcs_220434.js Show response
s79.mxcdn.net/bb-mx/serve/ Frame 8984 148 KB
57 KB 80ms
9ms Script
text/javascript 2.18.233.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s79.mxcdn.net/bb-mx/serve/mtrcs_220434.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-67.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: c2b1bc33b307788bf6e37f912ae4ad087f43b556b47972d208dc5d50aee53252

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 21 Sep 2021 08:14:49 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Sep 2021 09:38:34 GMT
Server: nginx
ETag: "\W00000579941631871514776"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI COM NAV STA"
Cache-Control: public, max-age=1800
Connection: keep-alive
Content-Type: text/javascript
Content-Length: 57994
Expires: Tue, 21 Sep 2021 08:44:49 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/ Frame 3798 6 KB
2 KB 323ms
9ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b234cfda107f411491f5d69483091b41edc43fd241cb46a908e21024c3a57938

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 2018
date: Tue, 21 Sep 2021 04:46:07 GMT
expires: Wed, 22 Sep 2021 04:46:07 GMT
last-modified: Tue, 31 Aug 2021 16:08:31 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 12523
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8984 0
24 B 46ms
31ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvCTpjn4l8i3P_CwRR-_cB-B6T-rf0XHsRenZzAo7tz3HuTBR_e1pQCaIGibnSguwl-Kc7rB0qyPjVZKVrCEpmhCEdpzrMsaOTWCxdjK3yfEOTF-OOI0OoW0rmj3mX7fMRK1NyMgyqIQY2DFFI9dZl-AWQSzOthHH6m5DwW2Cpj3k1EL6--ay9IBQSz6Ebt7_7tdqtl0dtpP-oBBagS7k7hxbquGQ5TCke33CCQy13pIL6V0-Qx_w1pWDBu5HtOaZpejwCH2C3_FkSnSh9wF-NqKwK1tmK0gg6ZpG8Qsx935pvtdkZAsBTnTk7maPmMvlpgeRnnspj7rAR0bntdDUj15VomxSDGnCM7CpQVjsh2Blprtbzxv_6XEotISa3TSX488hVRJSeV464EhTkyyU4lFuwkG36dApR0NG8pKgn41_2FIJAhxu5RQQo9WwiYcswp_1NwPwHs7qolV346cj1H9RGtur3LTOm0Pbyr9J4ZjrotBMkM13CQFMz7MgwBGJjJ0zshqa1Qpd8LliaSaOHKbzQoUyG4BgA_D1eVqjXeCsh-8hQkU7l7ZWv-DwqMPlivtFz_fa96g-LpTjZwYlDAO2MdR7iPNYjRjLuAb98fgDXB1cXUPB8CZ0Vy7lpERWZyp6FonQDYY-QqFWpTIHfdyZ4GXoBJSJX6Rgedqvrvt9X4owbx-k60YnpLYWssavr0nFl5Qg1FByab6UTPoUuSBZGmpaQbqv6kRNklYC1qyJ9nS0G27IXzMTLOI3TArFh25dL4GAUbzNN4FyQ52vIHJ0iettDcoqb666IZ_PwBUrSWQp-AlTZ7LiXQiTbSTSYGLeyT4V2HE3t-xnzr2ENTF6TY6ZS_y_Qym745pn9uLdGUIE73ZxChU7VvibFbzIMyrcU2K8W3OZYBgtp1w8gUSo-pgxQT01mOQTWZE2a3PTJxBTfn75ZxQQTZB0wdXztLMIZBfF6MpI_qyQGXlWl3AMm-R80S3coW80vBbKz-XT3OlCsL5Bi2GwDSX-Qgp6R7mxfdQhl49D1Sx-qLWSxFOWaliacekIb0LhOTqfeswNlXhYoC4WmdPesjHYxDNra4vTjmgEN92KmtqCLgTbNaCqE2OqBFNFclBhYFSN9mWm8fAHEiPCSJP_uuX7XDt1G2FbHtYxSflSfpicPU&sai=AMfl-YQLARA9fu3B4zjkn-56j6vh5AQNBSjWXG1r3z2A8CBKOpqWfosvmzqHjX6Lr_ljJhDsjLHC8mLdaHNKU-5bLY1ToWBbxtvBT08l7S06fgkkG2u7PBV8oaCVe2hi0Wt3oZoZZRMlEDIJfLp1B-hTfE08ynA9offMnbHLcys&sig=Cg0ArKJSzFU_xnnieBwsEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=184&cbvp=1&cstd=180&cisv=r20210916.91855&adurl=

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 21 Sep 2021 08:14:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK mtrcs_220434.js Show response
s79.mxcdn.net/bb-mx/serve/ Frame FBBB 148 KB
57 KB 71ms
8ms Script
text/javascript 2.18.233.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s79.mxcdn.net/bb-mx/serve/mtrcs_220434.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-67.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: c2b1bc33b307788bf6e37f912ae4ad087f43b556b47972d208dc5d50aee53252

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 21 Sep 2021 08:14:49 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Sep 2021 09:38:34 GMT
Server: nginx
ETag: "\W00000579941631871514776"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI COM NAV STA"
Cache-Control: public, max-age=1800
Connection: keep-alive
Content-Type: text/javascript
Content-Length: 57994
Expires: Tue, 21 Sep 2021 08:44:49 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/ Frame 2148 6 KB
2 KB 316ms
10ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b234cfda107f411491f5d69483091b41edc43fd241cb46a908e21024c3a57938

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 2018
date: Tue, 21 Sep 2021 04:46:07 GMT
expires: Wed, 22 Sep 2021 04:46:07 GMT
last-modified: Tue, 31 Aug 2021 16:08:31 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 12523
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FBBB 0
24 B 32ms
24ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvzGxA3FaNvVyvgSAN4CBtfDFROZ7CGjn1X9FVjox_-tyryI5EMDoEmy2X9DrWHG6cjpbwikn4fMpNA84-ja8AUAL896pfB7f8HMp0Bn3HW3caxhr4Q21tFsbzs-1KFyBTIdw73Nusp9fYApmqeSUTXAupfJ_cILhJ86U5GBX9-gXMwgTRCwdK0uWxf_Dtpc8Z01uUOfXTPrQWxLoGKMy9axdWQGuWLUYd1qAOhO1lbyP_1ve-8YHoc_YgMpafPqt_ZqxuDzCRz3q_Wp3woo_kuTlIpnOPPd-sMVqEf41s0fFzjnR5sSOXQQI6qBwZdGlAzdFHOQfyYSIKc8AFi-Mi3VPFVSNTSzbsl83j38KbuEG6B0A_UdfI0siANvRTKihVZNd66KfIV-emIDF3EfhJ7oi4NXziWcR8i-fWEsBN0Uyn6Z7ejm_8aiVNWCJq4Q1h8dcxM7V7T4f-yh1Pa7ABwoizSUUBeNjIqw9aU012t-EPRKGYEry64v8-Lf6cakBrQnSxcKBP1jLgUekFIq36hvmqmqOkUzrQnXnBAZYnF6acAxTNVrOFkpzYdBtxuW3weVDrJTd1Vl6tsjZTvQGK2OCYDAxxNRTnT3ZPuzIx4XewqQJYAiNS-qWKKag5FHzx4lafkDSWfpIamVEndvtVzmQXvGawap46s5QYkny2tG9vEufpms6zsBlCGORwwY4R30KayEHBrkwzJzyMwfuYh3pJq0Ujd_6JJKnxF8Asd4B8ClId1mZxdTmkCdUyiSoJ2idmNuJIzfJxvqV0QpJIWQ8KIihMly2QTJXf7wqGSQlas8pFHu_Qr-c7znyZDUCpGAveIi1vzxt8vQRiOmjLPzgbouhavQlxjhZduwhBBHvDya9P7pasKKEcvaTmEw2QUvMkvcKlP5CZN71id5bJB7TGdRnbvd1mviLbP3pU5HWiKM2NLkRksgw6tzIGTAbsZh4QbKasQOZ2JTnhXw0oifIkFQT8GQlIdc22WUhdiqCEnOAejXAhGl6eVikhkTA36bx8OFhhb29c0oNCRvLSgA9h5CD9keGApLodNWpyuEfdbatFhP762-4j5sHPE2jB58dxFPwVdTMzjpTJ7H9_A4zNoW-yK742if53Ji_q7BhrzOyzw_8YCBXwdUlcD2APPusZxPjX7XQYvWGCn&sai=AMfl-YTECv9k1RHJluoDwKI47-GLhZorNNa5a8bidaRP5BpN6kpv9lwFhULrpaQIadAbqszudAoQWZZEcbTdaPrnwoiEp3KGPn0qb7c7nSr6VIFCTYfNHqSdT1UG04-0uyEL-sbrqR9GKFVBRx7kyFLVIApifjFLziy-YR7rBps&sig=Cg0ArKJSzOWl6no20sQZEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=181&cbvp=1&cstd=179&cisv=r20210916.06969&adurl=

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 21 Sep 2021 08:14:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK mtrcs_220434.js Show response
s79.mxcdn.net/bb-mx/serve/ Frame 55F7 148 KB
57 KB 64ms
8ms Script
text/javascript 2.18.233.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s79.mxcdn.net/bb-mx/serve/mtrcs_220434.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-67.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: c2b1bc33b307788bf6e37f912ae4ad087f43b556b47972d208dc5d50aee53252

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 21 Sep 2021 08:14:49 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Sep 2021 09:38:34 GMT
Server: nginx
ETag: "\W00000579941631871514776"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI COM NAV STA"
Cache-Control: public, max-age=1800
Connection: keep-alive
Content-Type: text/javascript
Content-Length: 57994
Expires: Tue, 21 Sep 2021 08:44:49 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/9758366/1629983950211/13-IWE-Edition30-Leaderboard-728x90-iRange/ Frame F70A 6 KB
2 KB 311ms
11ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9758366/1629983950211/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc7add01ea1ad0ee504541fec6002fbfc220931c9bd13cdbc1c25699aaf51821

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /9758366/1629983950211/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-length: 2009
date: Mon, 20 Sep 2021 12:29:22 GMT
expires: Tue, 21 Sep 2021 12:29:22 GMT
last-modified: Thu, 26 Aug 2021 13:19:10 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 71128
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 55F7 0
24 B 32ms
31ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsu-kd2nkEdHJ9pX_L1cDI4XKRFAwuAHkXpi_VSBTLwAFgSnkAkaBTYWaFDsrHeCLhBJ2txANX0Iq_2pRj_Dte8HH11nrC-S8uzbL6iNUbSUBskRABA5Uuyc30JYMQjemrJ09aUGnBAXibKbSSpCjPqGi93SqrJj-F6HM0_xgxvMy9fajZMp-JlFAqlcZH7oz4P6-XIpzJ_x33bBH-PIMIz8I7HNgRHPOxqN_vFZ0I-2AfqENeItEXfsVJ4ccwJ48OXxo0YrpYK1ee_eY2EbRYi_oWz_Wd0U1gCPQM7XC8d8yNPHlvCXk_I-J120lG84D4QFnQpjpHHh_XiXRV4ERKsZ0XgN9-03TyMff3IkiZ3yEbSeax0RN6G8ZIlUnI6AGRVQDSUhHt039Z3TyUPITss0Yn1ABr3d3QcXre9S8dBx_2p6Dsw1LZ99o7oiYl_u8g7KZT2kdO7AmNB1ghq2Gflv9i5V1xddnoaW8CJYIw9mNbuwzskyYiTfWvmSVA0AJY9vdndSLsL1cGaypFKXjN__u_4B23I__R8a9vuoSWgAaH-bOrpnuCWkH4H5yrT39vhHo5E9XwTo_3jKB88ByOpMIrUaUrPDF-P5h8FI5Wj83SwmyPanOek9hT6CEDskLYkx5Duq9nQAV3RHPyazBqAB6zIeCAStPCmC9asMd3h6aVvZRJJfSzP5uLsuDDlDFZeBAFKWC2-9hGYciS1l1O7V75EM4o2iF8wTqa_6nQKguO9qhZovidNVlS48K5CTSxgVUR-wc_iX1GUgXIaaNqtj2KbMPPMzgjaWKvgP8QFlv59-rw3KFDLepX7KR6y5QVwoKukzKFf1c3dzX_YdYxAFpsMTU-PzcO9ETqgiB-Z3bkA5SoUyOH0kqYUandwcOqnq4nXAlmuS5H5Pyp00VsFkzPKbJtWIe67sJYClPMLX0BOlwJnYw0XOY_lBK9KZT9HaH--dfGr5_W7boe5kbcrV-AwPsHgQtvgbK82aRmTpqYA8XwHlB4neYEhFPuhmvw7nSHyBLwocGQZXyIoVEXgTE8fsRaDhhTFlAnCh43i-iID2pF7LJFgzmTSr7lkH7nEkz_EsRbvHzLrbKiyvMtOhv7-snUp8KO0ThoCzrDVH-x1f2v3l45AvFnRZ7k_3JSSdwMRRLKCDolU&sai=AMfl-YRNIlPADYzAaN3EJ_6JmuNXnQ-ULK1AHblIJLPpR3N-mY6N91L_jZ-6-ZquIyP-ywgO0jZt4kRRhbDYE2JdhvWvmjIvXaIGNfJvpzA96J0_HODx2NGpB__qPg0usWRQdgEYppgZU6XsS6zWbzcq1Plsvor625bmTXPMp6U&sig=Cg0ArKJSzFPQi3J8hK1-EAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=174&cbvp=1&cstd=172&cisv=r20210916.38816&adurl=

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 21 Sep 2021 08:14:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK mtrcs_220434.js Show response
s79.mxcdn.net/bb-mx/serve/ Frame F74C 148 KB
57 KB 58ms
9ms Script
text/javascript 2.18.233.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s79.mxcdn.net/bb-mx/serve/mtrcs_220434.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-67.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: c2b1bc33b307788bf6e37f912ae4ad087f43b556b47972d208dc5d50aee53252

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 21 Sep 2021 08:14:49 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Sep 2021 09:38:34 GMT
Server: nginx
ETag: "\W00000579941631871514776"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI COM NAV STA"
Cache-Control: public, max-age=1800
Connection: keep-alive
Content-Type: text/javascript
Content-Length: 57994
Expires: Tue, 21 Sep 2021 08:44:49 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/ Frame 6109 6 KB
2 KB 303ms
10ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b234cfda107f411491f5d69483091b41edc43fd241cb46a908e21024c3a57938

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 2018
date: Tue, 21 Sep 2021 04:46:07 GMT
expires: Wed, 22 Sep 2021 04:46:07 GMT
last-modified: Tue, 31 Aug 2021 16:08:31 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 12523
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame F74C 0
24 B 29ms
29ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstLPwgXjemK1PThJotuhXwi33sTuoqwhrlk3WeDqqHkcISKYWZfMYMCgDr3KOL3WnXSK0SQplnH-Xp9bekupBrDxba7V-YzTtAgpZm5nP3-w8tjfAbNUsiAA-wYTxG9ZLiCwL6FEFF_fzXn3LlHPhp276TqPq-fQ0UOX6XYLlTqCNNS5VE822ECmd8SRUrGMSPbvYynE4IOA-ydb0WsPVfRWMkI26LEuZBFC4UmZBrdZhH-gTLtOEduCmB33CNl_TVdx5QjNKdrWncRP5Pw13sj16lktR1168iNfNJ7zcbRW7-QhjjeLIUePvTzrpQKCcM93sc5rl2lYsjuLe7W2Yw7dlioRYLlITPcD00lGJ__OYtWwERMGeiEG9wY7kbaYhx4OYkAQTF4Ncr24E1Ip_O2raHXuSJlE9EHe6hDpCa5b_zm4z2__kewep3wObzH5W8XTZ7tCTGMAiND7pyXI5zrR4peYy_YPM-pmvFRbJuxozk5jXyK6BeviIeOIaq046I40Qs0xXmohv9k4W_V-Yb-y6u_LpJvFtUTSlwq3RzOsQ5T3pYDq5479ELJ-8w96iiz0d2fPzajPnvVJzcnATXuMCTKbFGs4KLpD9DgCvB2Yruw2EKEZz08g9QIwrvwGaI6a_dnMNVtaWMncS07fGxzl7E1fEbVlKE3AQ-E9hfs6IiDGIdbo7e4IserAa0rBR9SBGElxcZIALAjsoMbWvfGVNigyYN6MTf2xbSCQNFwhYbbWiMIeHi95kofCirjdPxNpJfPD6AW3HBpgPSMxBcRRXjTTegrvSyYOQLDRlEyKKkB2KntNfiV2IsBsTUedoGruG8p7PibK8MRjww0sJlBN-W39FSq8fKSb3toDGYQRTZflu6mrXbn41GCN3b1ZKgdlgE7b7bb24U6UAytjzzKkKYMYqfVa0vzwRZOBcccJbKHYT02Yg2GAraplX3Cm2kJ9TDDIWZCvjUuQN5zL6Gz0xr89tGPb_tOQKfEorxt-tbgdu4oiHjo1k7uHllcFUHgOwsBe2uSTaAJ4VZIu9X6Mx3kfKFfvkwV34KBrybUBY0-T7XTjOm5Ewu4rVNm5YY9JwMhEfDUb51j6ShhWQcpvoyfw3o&sai=AMfl-YTsS6fFZPe1pMDlQqLYiS3oQPlb8h5lU7dLc5k7FKooJPjmxbr06puNVrDo1pKRKsc5EFlLOSRIVc3SlTGwBVkYpG08F2tzs7tCMyNSnovZUvSfpltle438d3pKBVnxzsPCyz-P1QbEUMN8kUgsciLaHUCIy7rc1s6mM2E&sig=Cg0ArKJSzBCMVBBqzswoEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=187&cbvp=1&cstd=186&cisv=r20210916.65851&adurl=

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 21 Sep 2021 08:14:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame F74C 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 17 Sep 2021 08:58:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 343003
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sat, 17 Sep 2022 08:58:06 GMT

GET
DATA 200
OK truncated
/ Frame F74C 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bcf1c0cf348c0f8f9ab7dc11cd2d924927601bd807feeb7b9c0c7d4932bd4ad3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 55F7 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 17 Sep 2021 08:58:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 343003
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sat, 17 Sep 2022 08:58:06 GMT

GET
DATA 200
OK truncated
/ Frame 55F7 219 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b84f5c58cf1a9318e52b5e2c44eca1f31cd9ef8bed9b260d2b07eec4035bd9db

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 7005 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 17 Sep 2021 08:58:07 GMT
expires: Sat, 17 Sep 2022 08:58:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 343002
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK 4727t6qteyti Show response
hal9000.redintelligence.net/zone/ Frame A1BD 11 KB
4 KB 26ms
3ms Script
text/html 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/4727t6qteyti?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCDrj2eJRJYcT3IJqHjuwPo8CQwAq1zfmDV_zYuavlDPAuEAEgiYvEUGCVgoCArAfIAQmpAii18guQr7M-qAMBqgS9AU_QHdhKNGcFMgQikHigZp_din9KDgxez2YEkq_mskxtZm9-Mq7ei_K_eO3zY3vcf5cutSjSuhMcyvlnNd6UjrQKbnRcF1sbSIAGh_FhNQJ1VO__ifucDaSTU6QRNAP-xpb9xEyRgnc_wI2CrcaXrLEHsLR0lni679gvOy_2ZFjnD-QayPui70BO0zDE5OFf9aaTghLVN0OOX-dDJN8ElRA4q3uwss7YZFNoqSU5FRhMJLwIKkJUgY2hykbjEsAEqp38vs8B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIiOGAEBABGB2ACgGYCwHICwGADAGwE8Ka2grQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRok5wDp7PEjKtogR8xbjYOCRWSpA%26sig%3DAOD64_3hNg2_hYDHVtBFJSAilhsH5qWGEA%26client%3Dca-pub-1750856239204414%26dbm_c%3DAKAmf-D5dI1cPrOUMXvoj2_UbzYRnb9q0k6YA90nVSEVlHdlMBZ2g8orBm80Z03Rc0zB1PBbuuIGvSmvXQGP-tA_ob-julXtuEfSQ042MCm2aZHykBU4WcDFSoGC53fuGVuQq4_BeprMi2EawuDVTEeWLVqwyzV9Zg%26cry%3D1%26dbm_d%3DAKAmf-DorM7FTtwSjDdQk7a9gFD15Eup0AcU2n2V9x-60vpqQWI99xMATMkXy7VgOdgjZSo1Ja0vozSpxOC-ykOqbhiMy4vQCpo5gaUUR7KyBCerjHqzCdsI1-uI45RFRR_TYkldItYXCEFpUz61Va_8hgvWlu-1kDfxr7KhTuis2LEorCggX8Vd0EPbVTuiOIUzZm9eV2BJe3Vxjvv5-OndRnf6xsTAQELau0iTwQ3rxgvrGe3Xju4_Amev7GqPjRtOPCJ-eKenKEGektu30nLu0vSky0SCepms8dYl7kBAd782S8GSSjqnCB6YwcEQI121pdDEgvjZJDhVDadrCacfqn3XkooXHzqyKnVbfmStZPB4FQghrnWp7xTyZC9BylYY-yEa7QOC3jbYY6YqoBKGuedrzDxNnAEvIdMrAaKiMuxY9mbKuaS3rivOrRqQ6U5Am66X-Tpd%26adurl%3D
Requested by: Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 0adac874e80a50e69566d2c5dc15af943f7cf7230831a49f3f606633549d317e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 21 Sep 2021 08:14:49 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3848
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 0672 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 17 Sep 2021 08:58:07 GMT
expires: Sat, 17 Sep 2022 08:58:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 343002
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 8984 41 KB
15 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 17 Sep 2021 08:58:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 343003
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sat, 17 Sep 2022 08:58:06 GMT

GET
DATA 200
OK truncated
/ Frame 8984 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aae4cdc7181c5db384b9094a7befbcb20e02a8f0da84f37f2ffae38baf17d374

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame D1C0 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 04c38c169137fbc32a374f804ec18a2988c2f97bbfda900b5dcd39bea6069e1f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK mtrcs_220434.js Show response
s79.mxcdn.net/bb-mx/serve/ Frame D605 148 KB
57 KB 11ms
11ms Script
text/javascript 2.18.233.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s79.mxcdn.net/bb-mx/serve/mtrcs_220434.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-233-67.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: c2b1bc33b307788bf6e37f912ae4ad087f43b556b47972d208dc5d50aee53252

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 21 Sep 2021 08:14:50 GMT
Content-Encoding: gzip
Last-Modified: Fri, 17 Sep 2021 09:38:34 GMT
Server: nginx
ETag: "\W00000579941631871514776"
Vary: Accept-Encoding
P3P: policyref="/w3c/p3p.xml", CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI COM NAV STA"
Cache-Control: public, max-age=1800
Connection: keep-alive
Content-Type: text/javascript
Content-Length: 57994
Expires: Tue, 21 Sep 2021 08:44:50 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/ Frame 946F 6 KB
2 KB 122ms
11ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_273.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b234cfda107f411491f5d69483091b41edc43fd241cb46a908e21024c3a57938

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 2018
date: Tue, 21 Sep 2021 04:46:07 GMT
expires: Wed, 22 Sep 2021 04:46:07 GMT
last-modified: Tue, 31 Aug 2021 16:08:31 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 12523
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame D605 0
24 B 33ms
33ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuWvEmE18kIVhLYmtMUPDbBZ8qw79YEdw0uwbHGThFL8O7YJ2Zgo_pkJxPy6OwQqm7dgUhEFy4IMlhvaomIge09jcXTcNlGnxgxB1dWUsti3kXTju9Akie3Tqy9tq5tctMFupuDfS8xOZZiCyPIpselFCHyv8dLgMOIOBDmutpet7pyd7R017ziumgYPJ5yWyYu2FjWYx-duYsz5Yuq0WhkqDBq00pYS2863KYoeNtBZZV2gkVTUl48EssRNaccOmHyu5CbryRX60BhDK-lyp2knM-rT7mcEBgznqTtqF27lKiXjYG5l7PdGPrEtkH3QkIDMMkwmCQEuLRGkMjhw8F8X7pQCyeMlbew7_cy96j3ikySmgu4dCm0QvDRf_cpCJzJnCs0aLj7fMJxrVOfYeDgrMn5Lhb3QkZa15RqlfUK0oAEeKq65O1NaAB5oaPnHXZuXwPPk3utoy1zTQ1JX6OZZdkR6cwRup84Xf8OBB_Zq4R3gBU0520exFkLeXDvuu60UkLg8AwFRr-_4zqA2pt0KCrYxHC7ipsv7q1Yf8mILycL3FTRzoORx-aokwK4OpLwzswvBv1ayjLqO4isd6CWhxo45wN1FENPbqtkRVP9_vENqkQ1rfN3FZegymi0cZpGyDwYYt-BVABW4rLdaaQvlEAqf0g-l9jDe2w5E7Ut1UbEeAmuFR1BtnIQc0vq1FSw2msNnQOJSiU4l8Q6k6_Nl0rYeY34x0sthuv6RNBKlctXw6LTeqr00sbRz2wwP4xW2SlIPh4CF3TcDvCmeP0FHqSCvFms0JVIL-43Wbh1cBYwG-miExK80KvkhWVUDw1Yd1GB73fzlTkm5bqFXu5ZdXFU_JCWNFehx5VVWFntGpbeXEaEgwGcycX-_Th1o7w8jdbzFdy11p2TvrpHVUT6cjMYolcRHCU1PLVNfyAYCphyBlHry3DwWr4NczJOuDUdZ3lqm2pOoyRTdGr6hYeaJVPyHifsxxuxpWXTQFGI7lIfikLdxax9wmGzLdsoL_BkNVqgMnF4_QSajbrWN99Eq97gJcswmymOGMPKnsOml6LHqJhQhnVYTONR0wQyy0u0Dy-QN31FiqcJ09SAJ-9wPx4rRaVOAGp6nBI8ec4X9yTo3SKUggUgAGN-_NBs71vRo7ERTz4jlMYsUR-z&sai=AMfl-YRwXIFiYpJnV1NZHIddwlWoOOuv5IMGk8p9lvCp418HuSmL9CfMCohzu3O_3XxragveSRRtdq617DNzWxCOfdyhrFNku6_OcZwGXkc2my1vrm4UyPycEVIS2uUKf8CY1xxmn9MmNNsBLmtJHoHsLALlQUM70keuiOevHS8&sig=Cg0ArKJSzHC6YeXiYsDKEAE&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=354&cbvp=1&cstd=346&cisv=r20210916.47317&adurl=

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Tue, 21 Sep 2021 08:14:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame FBBB 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 17 Sep 2021 08:58:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 343004
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sat, 17 Sep 2022 08:58:06 GMT

GET
DATA 200
OK truncated
/ Frame FBBB 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3e7315ebea0d6a68618a55aafbd18b60208abdaef9637377c152ed1f4ecee3ea

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame D605 41 KB
15 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 17 Sep 2021 08:58:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 343004
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sat, 17 Sep 2022 08:58:06 GMT

GET
DATA 200
OK truncated
/ Frame D605 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1855673148a9663088114874ad15b37e5df6c425acfcbec30aa6578c68380181

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

request.php Show response
hal900010.redintelligence.net/ Frame A1BD
Redirect Chain

https://hal900010.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=d850c47a1d&subid=&uid=02eb810a5f15cd95&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900010.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=d850c47a1d&subid=&uid=02eb810a5f15cd95&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

2 KB
1 KB

94ms
80ms

Script
application/x-javascript

138.201.63.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900010.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=d850c47a1d&subid=&uid=02eb810a5f15cd95&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCDrj2eJRJYcT3IJqHjuwPo8CQwAq1zfmDV_zYuavlDPAuEAEgiYvEUGCVgoCArAfIAQmpAii18guQr7M-qAMBqgS9AU_QHdhKNGcFMgQikHigZp_din9KDgxez2YEkq_mskxtZm9-Mq7ei_K_eO3zY3vcf5cutSjSuhMcyvlnNd6UjrQKbnRcF1sbSIAGh_FhNQJ1VO__ifucDaSTU6QRNAP-xpb9xEyRgnc_wI2CrcaXrLEHsLR0lni679gvOy_2ZFjnD-QayPui70BO0zDE5OFf9aaTghLVN0OOX-dDJN8ElRA4q3uwss7YZFNoqSU5FRhMJLwIKkJUgY2hykbjEsAEqp38vs8B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIiOGAEBABGB2ACgGYCwHICwGADAGwE8Ka2grQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRok5wDp7PEjKtogR8xbjYOCRWSpA%26sig%3DAOD64_3hNg2_hYDHVtBFJSAilhsH5qWGEA%26client%3Dca-pub-1750856239204414%26dbm_c%3DAKAmf-D5dI1cPrOUMXvoj2_UbzYRnb9q0k6YA90nVSEVlHdlMBZ2g8orBm80Z03Rc0zB1PBbuuIGvSmvXQGP-tA_ob-julXtuEfSQ042MCm2aZHykBU4WcDFSoGC53fuGVuQq4_BeprMi2EawuDVTEeWLVqwyzV9Zg%26cry%3D1%26dbm_d%3DAKAmf-DorM7FTtwSjDdQk7a9gFD15Eup0AcU2n2V9x-60vpqQWI99xMATMkXy7VgOdgjZSo1Ja0vozSpxOC-ykOqbhiMy4vQCpo5gaUUR7KyBCerjHqzCdsI1-uI45RFRR_TYkldItYXCEFpUz61Va_8hgvWlu-1kDfxr7KhTuis2LEorCggX8Vd0EPbVTuiOIUzZm9eV2BJe3Vxjvv5-OndRnf6xsTAQELau0iTwQ3rxgvrGe3Xju4_Amev7GqPjRtOPCJ-eKenKEGektu30nLu0vSky0SCepms8dYl7kBAd782S8GSSjqnCB6YwcEQI121pdDEgvjZJDhVDadrCacfqn3XkooXHzqyKnVbfmStZPB4FQghrnWp7xTyZC9BylYY-yEa7QOC3jbYY6YqoBKGuedrzDxNnAEvIdMrAaKiMuxY9mbKuaS3rivOrRqQ6U5Am66X-Tpd%26adurl%3D&documentReferer=https%3A%2F%2Fpastelink.net%2F&ancestorOrigins=https%3A%2F%2Fpastelink.net&random=7579623489970&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.145 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.145.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: c673928e597fe3f33bff52410461a1bc402b4245b2bc7829286f6def31961d39

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 24496800061776400710612011724010
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 893
Expires: Tue, 21 Sep 2021 09:14:50 +0200

Redirect headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=d850c47a1d&subid=&uid=02eb810a5f15cd95&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCDrj2eJRJYcT3IJqHjuwPo8CQwAq1zfmDV_zYuavlDPAuEAEgiYvEUGCVgoCArAfIAQmpAii18guQr7M-qAMBqgS9AU_QHdhKNGcFMgQikHigZp_din9KDgxez2YEkq_mskxtZm9-Mq7ei_K_eO3zY3vcf5cutSjSuhMcyvlnNd6UjrQKbnRcF1sbSIAGh_FhNQJ1VO__ifucDaSTU6QRNAP-xpb9xEyRgnc_wI2CrcaXrLEHsLR0lni679gvOy_2ZFjnD-QayPui70BO0zDE5OFf9aaTghLVN0OOX-dDJN8ElRA4q3uwss7YZFNoqSU5FRhMJLwIKkJUgY2hykbjEsAEqp38vs8B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIiOGAEBABGB2ACgGYCwHICwGADAGwE8Ka2grQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRok5wDp7PEjKtogR8xbjYOCRWSpA%26sig%3DAOD64_3hNg2_hYDHVtBFJSAilhsH5qWGEA%26client%3Dca-pub-1750856239204414%26dbm_c%3DAKAmf-D5dI1cPrOUMXvoj2_UbzYRnb9q0k6YA90nVSEVlHdlMBZ2g8orBm80Z03Rc0zB1PBbuuIGvSmvXQGP-tA_ob-julXtuEfSQ042MCm2aZHykBU4WcDFSoGC53fuGVuQq4_BeprMi2EawuDVTEeWLVqwyzV9Zg%26cry%3D1%26dbm_d%3DAKAmf-DorM7FTtwSjDdQk7a9gFD15Eup0AcU2n2V9x-60vpqQWI99xMATMkXy7VgOdgjZSo1Ja0vozSpxOC-ykOqbhiMy4vQCpo5gaUUR7KyBCerjHqzCdsI1-uI45RFRR_TYkldItYXCEFpUz61Va_8hgvWlu-1kDfxr7KhTuis2LEorCggX8Vd0EPbVTuiOIUzZm9eV2BJe3Vxjvv5-OndRnf6xsTAQELau0iTwQ3rxgvrGe3Xju4_Amev7GqPjRtOPCJ-eKenKEGektu30nLu0vSky0SCepms8dYl7kBAd782S8GSSjqnCB6YwcEQI121pdDEgvjZJDhVDadrCacfqn3XkooXHzqyKnVbfmStZPB4FQghrnWp7xTyZC9BylYY-yEa7QOC3jbYY6YqoBKGuedrzDxNnAEvIdMrAaKiMuxY9mbKuaS3rivOrRqQ6U5Am66X-Tpd%26adurl%3D&documentReferer=https%3A%2F%2Fpastelink.net%2F&ancestorOrigins=https%3A%2F%2Fpastelink.net&random=7579623489970&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Tue, 21 Sep 2021 09:14:50 +0200

GET
H/1.1 200
OK stat Show response
stat.meetrics.net/ Frame 55F7 82 B
351 B 25ms
1ms Script
application/javascript 46.4.98.42
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://stat.meetrics.net/stat
Requested by: Host: s79.mxcdn.net
URL: https://s79.mxcdn.net/bb-mx/serve/mtrcs_220434.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 46.4.98.42 Rostock, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h569.meetrics.de
Software: nginx /
Resource Hash: 79b208a19742aa53a96b0902c3b88c3434687c4b2453842d82a50c7b4080417e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 21 Sep 2021 08:14:50 GMT
Cache-Control: private, no-cache, must-revalidate
Last-Modified: Tue, 21 Sep 2021 08:14:01 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: application/javascript

GET
H/1.1 200
OK gettag Show response
s79.research.de.com/bb-mxad/ Frame 55F7 0
208 B 24ms
1ms Script
application/octet-stream 148.251.47.75
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s79.research.de.com/bb-mxad/gettag
Requested by: Host: s79.mxcdn.net
URL: https://s79.mxcdn.net/bb-mx/serve/mtrcs_220434.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.251.47.75 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h489.meetrics.de
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 21 Sep 2021 08:14:50 GMT
Cache-control: private,must-revalidate
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: application/octet-stream

GET
H/1.1 200
OK submit
b175.s79.research.de.com/bb-mx/ Frame 55F7 43 B
291 B 28ms
2ms Image
image/gif 88.198.49.67
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b175.s79.research.de.com/bb-mx/submit?/NR/mB0AAA/whFtBo0F0wFz6BvvAyzAihFh2ByjE3wAhjF22Am3BzwA02A5kE4lEyhE1jEy3A3yAuzEhmFlmFyhFtlFunEvvFnsFlzF5uFkpFjhF0pFvuFujEvtFvzEhmFlmFyhFtlFvxAtwAtzA4vAo0FtsFvjEvuF0hFpuFlyFuoE0tFsBF1pyFo0F0wFz6BvvAwhFz0FlsFpuFruBulF0vB+k2FoywAyxAtwA5tAx3AtwA56Az4AtyAywA0zA0tAyuAxyAyuA3tAyyAyzA2lEzzAKp6Fsp3Fx2AzyAyxAywA45Ax1A1BEjwtFuvFulFnqnFluFtVETsBluFL2wFBLl1FC/2xF3CylFx1FlzF0mF1sFszFjyFllFugBm1FssFzjFylFluFluFhiFslFkgBluFnpFulFfjFoyFvtFlfF5wAg3EpuFkvF3fF3lFirFp0Fz0FvyFhnFlpFumFvgB3pFukFv3Ff3FliFrpF0jFhuFjlFshFupFthF0pFvuFmyFhtFlgB3pFukFv3Ff3FliFrpF0yFlxF1lFz0FhuFptFh0FpvFumFyhFtlFgjEzzFf3FliFrpF0gBjwF1fF0gAyhFtfF4gAthF4fFluFnpFulFf5BwBELlnFB/k0FsBxgAwqFpkF9yAywA0zA0mAhkFj9B53A14Az2A2mAjwFpkF9yA2zA1yA3yA3mAzpF0lF91A51Ay3Az5AmwEshFjlF9zAxyA00A44Aw2AmjEpkF9xA12A2wA30Aw2AmzEp6Fl9B3yA44E5wAmjEi9Bx2A10Az4A3wA10AUkzFpBFAAAAAAYLaBaBAPAAAAAAAAAOAAAAGCAAAAAYLaBaBABPoAAAAAAAABQVYAZJAAFAx8Ez8ExBEFA55A22A0BErIvhAPAAAFAAQVYTIvhASksF5EbAAAAAAAAAAAAEAAAQVYAAAAAAAIAy2Az1Ay3Ay3AJAzxAy0A04A4wA2BEHA15A1yA3zA5BEGA3yA44E5wAJAx1A22Aw3A0wA2BEHA53A14Az2A2BEdAAAAAAYLAaBAFAAAIvhAAAfBo0F0wFz6BvvAzwBuyAtkFuuBulF0vB53A14Az2A2vAx2Ay5A54Az5A1wAyxAxvAxzAtJEXFFtFEkpF0pFvuFzwAtMElhFklFyiFvhFykFt3Ay4A45BwtApSFhuFnlFvpEukFl4FuoE0tFsBFCATCFAAAAAAAAAAAAAAGAJGFSBFNFFQtjFYSr4VA
Requested by: Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 88.198.49.67 Munich, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h348.meetrics.de
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: nginx
Content-Type: image/gif
Cache-control: no-cache,no-store,must-revalidate
Connection: keep-alive
Content-Length: 43
Expires: Tue, 21 Sep 2021 08:14:49 GMT

GET
H/1.1 200
OK data
b175.s79.research.de.com/ Frame 55F7 43 B
308 B 27ms
1ms Image
image/gif 88.198.49.67
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b175.s79.research.de.com/data?/NR/mC2AAAl2yFuvFfhFwpFLktFDTkzFARksFAQtjFXZVNSA
Requested by: Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 88.198.49.67 Munich, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h348.meetrics.de
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: image/gif
Cache-control: no-cache,no-store,must-revalidate
Connection: keep-alive
Expires: Tue, 21-Sep-21 08:14:49 GMT

GET
H/1.1 200
OK stat Show response
stat.meetrics.net/ Frame F74C 82 B
351 B 3ms
2ms Script
application/javascript 46.4.98.42
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://stat.meetrics.net/stat
Requested by: Host: s79.mxcdn.net
URL: https://s79.mxcdn.net/bb-mx/serve/mtrcs_220434.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 46.4.98.42 Rostock, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h569.meetrics.de
Software: nginx /
Resource Hash: 79b208a19742aa53a96b0902c3b88c3434687c4b2453842d82a50c7b4080417e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 21 Sep 2021 08:14:50 GMT
Cache-Control: private, no-cache, must-revalidate
Last-Modified: Tue, 21 Sep 2021 08:14:01 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: application/javascript

GET
H/1.1 200
OK gettag Show response
s79.research.de.com/bb-mxad/ Frame F74C 0
208 B 1ms
1ms Script
application/octet-stream 148.251.47.75
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s79.research.de.com/bb-mxad/gettag
Requested by: Host: s79.mxcdn.net
URL: https://s79.mxcdn.net/bb-mx/serve/mtrcs_220434.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.251.47.75 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h489.meetrics.de
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 21 Sep 2021 08:14:50 GMT
Cache-control: private,must-revalidate
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: application/octet-stream

GET
H/1.1 200
OK submit
b170.s79.research.de.com/bb-mx/ Frame F74C 43 B
291 B 23ms
2ms Image
image/gif 144.76.237.196
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b170.s79.research.de.com/bb-mx/submit?/8T5lBSAAA/whFtBo0F0wFz6BvvAyzAihFh2ByjE3wAhjF22Am3BzwA02A5kE4lEyhE1jEy3A3yAuzEhmFlmFyhFtlFunEvvFnsFlzF5uFkpFjhF0pFvuFujEvtFvzEhmFlmFyhFtlFvxAtwAtzA4vAo0FtsFvjEvuF0hFpuFlyFuoE0tFsBF1pyFo0F0wFz6BvvAwhFz0FlsFpuFruBulF0vB+k2FoywAyxAtwA5tAx3AtwA56Az4AtyAywA0zA0tAyuAxyAyuA3tAyyAyzA2lEzzAKp6Fsp3Fx2AzyAyxAywA45Ax2A3BEjwtFuvFulFnqnFluFtVETsBluFL2wFBLl1FC/2xF3CylFx1FlzF0mF1sFszFjyFllFugBm1FssFzjFylFluFluFhiFslFkgBluFnpFulFfjFoyFvtFlfF5wAg3EpuFkvF3fF3lFirFp0Fz0FvyFhnFlpFumFvgB3pFukFv3Ff3FliFrpF0jFhuFjlFshFupFthF0pFvuFmyFhtFlgB3pFukFv3Ff3FliFrpF0yFlxF1lFz0FhuFptFh0FpvFumFyhFtlFgjEzzFf3FliFrpF0gBjwF1fF0gAyhFtfF4gAthF4fFluFnpFulFf5BwBELlnFB/k0FsBxgAwqFpkF9yAywA0zA0mAhkFj9B53A14Az2A2mAjwFpkF9yA2zA1yA3yA3mAzpF0lF91A51Ay3Az5AmwEshFjlF9zAxyA2yAz4A33AmjEpkF9xA13Aw3A2wA50AmzEp6Fl9B3yA44E5wAmjEi9Bx3Aw3Az4A5zAw0AUkzFpBFAAAAAAYLaBaBAPAAAAAAAAAOAAAAGBAAAAAYLaBaBABPKAAAAAAAABLRMAZGAAFAx8Ez8ExBEFA1wAy1AxBErNTzAPBAAFAALRMTNTzASksF5EbAAAAAAAAAAAAEAAALRMAAAAAAAIAy2Az1Ay3Ay3AJAzxAy2AyzA43A3BEHA15A1yA3zA5BEGA3yA44E5wAJAx1A3wA32Aw5A0BEHA53A14Az2A2BEdAAAAAAYLAaBAFAAANTzAAAfBo0F0wFz6BvvAzwBuyAtkFuuBulF0vB53A14Az2A2vAx2AzwA0yA2xAxxAz5AwvAxzAtJEXFFtFEkpF0pFvuFzwAtMElhFklFyiFvhFykFt3Ay4A45BwtApSFhuFnlFvpEukFl4FuoE0tFsBFCATCFAAAAAAAAAAAAAAGAJGFSBFNFFQtjFZgc6VA
Requested by: Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 144.76.237.196 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h371.meetrics.de
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: nginx
Content-Type: image/gif
Cache-control: no-cache,no-store,must-revalidate
Connection: keep-alive
Content-Length: 43
Expires: Tue, 21 Sep 2021 08:14:49 GMT

GET
H/1.1 200
OK data
b170.s79.research.de.com/ Frame F74C 43 B
308 B 21ms
1ms Image
image/gif 144.76.237.196
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b170.s79.research.de.com/data?/8T5lCTAAAl2yFuvFfhFwpFLktFDTkzFARksFAQtjFycVNSA
Requested by: Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 144.76.237.196 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h371.meetrics.de
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: image/gif
Cache-control: no-cache,no-store,must-revalidate
Connection: keep-alive
Expires: Tue, 21-Sep-21 08:14:49 GMT

GET
H/1.1 200
OK stat Show response
stat.meetrics.net/ Frame FBBB 82 B
351 B 1ms
1ms Script
application/javascript 46.4.98.42
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://stat.meetrics.net/stat
Requested by: Host: s79.mxcdn.net
URL: https://s79.mxcdn.net/bb-mx/serve/mtrcs_220434.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 46.4.98.42 Rostock, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h569.meetrics.de
Software: nginx /
Resource Hash: 79b208a19742aa53a96b0902c3b88c3434687c4b2453842d82a50c7b4080417e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 21 Sep 2021 08:14:50 GMT
Cache-Control: private, no-cache, must-revalidate
Last-Modified: Tue, 21 Sep 2021 08:14:01 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: application/javascript

GET
H/1.1 200
OK gettag Show response
s79.research.de.com/bb-mxad/ Frame FBBB 0
208 B 2ms
1ms Script
application/octet-stream 148.251.47.75
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s79.research.de.com/bb-mxad/gettag
Requested by: Host: s79.mxcdn.net
URL: https://s79.mxcdn.net/bb-mx/serve/mtrcs_220434.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.251.47.75 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h489.meetrics.de
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 21 Sep 2021 08:14:50 GMT
Cache-control: private,must-revalidate
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: application/octet-stream

GET
H/1.1 200
OK submit
b199.s79.research.de.com/bb-mx/ Frame FBBB 43 B
291 B 31ms
4ms Image
image/gif 136.243.6.97
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b199.s79.research.de.com/bb-mx/submit?/rgmjBRAAA/whFtBo0F0wFz6BvvAyzAihFh2ByjE3wAhjF22Am3BzwA02A5kE4lEyhE1jEy3A3yAuzEhmFlmFyhFtlFunEvvFnsFlzF5uFkpFjhF0pFvuFujEvtFvzEhmFlmFyhFtlFvxAtwAtzA4vAo0FtsFvjEvuF0hFpuFlyFuoE0tFsBF1pyFo0F0wFz6BvvAwhFz0FlsFpuFruBulF0vB+k2FoywAyxAtwA5tAx3AtwA56Az4AtyAywA0zA0tAyuAxyAyuA3tAyyAyzA2lEzzAKp6Fsp3Fx2AzyAyxAywA45Ax2AzBEjwtFuvFulFnqnFluFtVETsBluFL2wFBLl1FC/2xF3CylFx1FlzF0mF1sFszFjyFllFugBm1FssFzjFylFluFluFhiFslFkgBluFnpFulFfjFoyFvtFlfF5wAg3EpuFkvF3fF3lFirFp0Fz0FvyFhnFlpFumFvgB3pFukFv3Ff3FliFrpF0jFhuFjlFshFupFthF0pFvuFmyFhtFlgB3pFukFv3Ff3FliFrpF0yFlxF1lFz0FhuFptFh0FpvFumFyhFtlFgjEzzFf3FliFrpF0gBjwF1fF0gAyhFtfF4gAthF4fFluFnpFulFf5BwBELlnFB/k0FsBxgAwqFpkF9yAywA0zA0mAhkFj9B53A14Az2A2mAjwFpkF9yA2zA1yA3yA3mAzpF0lF91A51Ay3Az5AmwEshFjlF9zAxyA2yAz4A33AmjEpkF9xA13Aw3A2wA50AmzEp6Fl9B3yA44E5wAmjEi9Bz4Az5A22Ax0Az2AUkzFpBFAAAAAAYLaBaBAPAAAAAAAAAOAAAAGAAAAAAYLaBaBABPKAAAAAAAAB0HDAZGAAFAx8Ez8ExBEFAxyA34A4BErNTzAPAAAFAA0HDTNTzASksF5EbAAAAAAAAAAAAEAAA0HDAAAAAAAIAy2Az1Ay3Ay3AJAzxAy2AyzA43A3BEHA15A1yA3zA5BEGA3yA44E5wAJAx1A3wA32Aw5A0BEHA53A14Az2A2BEdAAAAAAYLAaBAFAAANTzAAAfBo0F0wFz6BvvAzwBuyAtkFuuBulF0vB53A14Az2A2vAx2AzwA0yA2xAxxAz5AwvAxzAtJEXFFtFEkpF0pFvuFzwAtMElhFklFyiFvhFykFt3Ay4A45BwtApSFhuFnlFvpEukFl4FuoE0tFsBFCATCFAAAAAAAAAAAAAAGAJGFSBFNFFQtjFppn5VA
Requested by: Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 136.243.6.97 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h243.meetrics.de
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: nginx
Content-Type: image/gif
Cache-control: no-cache,no-store,must-revalidate
Connection: keep-alive
Content-Length: 43
Expires: Tue, 21 Sep 2021 08:14:49 GMT

GET
H/1.1 200
OK data
b199.s79.research.de.com/ Frame FBBB 43 B
308 B 28ms
1ms Image
image/gif 136.243.6.97
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b199.s79.research.de.com/data?/rgmjCSAAAl2yFuvFfhFwpFLktFDTkzFARksFAQtjFuiVNSA
Requested by: Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 136.243.6.97 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h243.meetrics.de
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: image/gif
Cache-control: no-cache,no-store,must-revalidate
Connection: keep-alive
Expires: Tue, 21-Sep-21 08:14:49 GMT

GET
H/1.1 200
OK stat Show response
stat.meetrics.net/ Frame 8984 82 B
351 B 1ms
1ms Script
application/javascript 46.4.98.42
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://stat.meetrics.net/stat
Requested by: Host: s79.mxcdn.net
URL: https://s79.mxcdn.net/bb-mx/serve/mtrcs_220434.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 46.4.98.42 Rostock, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h569.meetrics.de
Software: nginx /
Resource Hash: 79b208a19742aa53a96b0902c3b88c3434687c4b2453842d82a50c7b4080417e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 21 Sep 2021 08:14:50 GMT
Cache-Control: private, no-cache, must-revalidate
Last-Modified: Tue, 21 Sep 2021 08:14:01 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: application/javascript

GET
H/1.1 200
OK gettag Show response
s79.research.de.com/bb-mxad/ Frame 8984 0
208 B 1ms
1ms Script
application/octet-stream 148.251.47.75
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s79.research.de.com/bb-mxad/gettag
Requested by: Host: s79.mxcdn.net
URL: https://s79.mxcdn.net/bb-mx/serve/mtrcs_220434.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.251.47.75 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h489.meetrics.de
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 21 Sep 2021 08:14:50 GMT
Cache-control: private,must-revalidate
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: application/octet-stream

GET
H/1.1 200
OK submit
b156.s79.research.de.com/bb-mx/ Frame 8984 43 B
291 B 35ms
5ms Image
image/gif 136.243.5.166
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b156.s79.research.de.com/bb-mx/submit?/pdIEBSAAA/whFtBo0F0wFz6BvvAyzAihFh2ByjE3wAhjF22Am3BzwA02A5kE4lEyhE1jEy3A3yAuzEhmFlmFyhFtlFunEvvFnsFlzF5uFkpFjhF0pFvuFujEvtFvzEhmFlmFyhFtlFvxAtwAtzA4vAo0FtsFvjEvuF0hFpuFlyFuoE0tFsBF1pyFo0F0wFz6BvvAwhFz0FlsFpuFruBulF0vB+k2FoywAyxAtwA5tAx3AtwA56Az4AtyAywA0zA0tAyuAxyAyuA3tAyyAyzA2lEzzAKp6Fsp3Fx2AzyAyxAywA45Ax1A5BEjwtFuvFulFnqnFluFtVETsBluFL2wFBLl1FC/2xF3CylFx1FlzF0mF1sFszFjyFllFugBm1FssFzjFylFluFluFhiFslFkgBluFnpFulFfjFoyFvtFlfF5wAg3EpuFkvF3fF3lFirFp0Fz0FvyFhnFlpFumFvgB3pFukFv3Ff3FliFrpF0jFhuFjlFshFupFthF0pFvuFmyFhtFlgB3pFukFv3Ff3FliFrpF0yFlxF1lFz0FhuFptFh0FpvFumFyhFtlFgjEzzFf3FliFrpF0gBjwF1fF0gAyhFtfF4gAthF4fFluFnpFulFf5BwBELlnFB/k0FsBxgAwqFpkF9yAywA0zA0mAhkFj9B53A14Az2A2mAjwFpkF9yA2zA1yA3yA3mAzpF0lF91A51Ay3Az5AmwEshFjlF9zAxyA2yAz4A33AmjEpkF9xA13Aw3A2wA50AmzEp6Fl9B3yA44E5wAmjEi9BzwAw0A45AxyA41AUkzFpBFAAAAAAYLaBaBAPAAAAAAAAAOAAAAGBAAAAAYLaBaBABPKAAAAAAAABU5gAZGAAFAx8Ez8ExBEGAxzA03A0wArNTzAPAAAFAAU5gTNTzASksF5EbAAAAAAAAAAAAEAAAU5gAAAAAAAIAy2Az1Ay3Ay3AJAzxAy2AyzA43A3BEHA15A1yA3zA5BEGA3yA44E5wAJAx1A3wA32Aw5A0BEHA53A14Az2A2BEdAAAAAAYLAaBAFAAANTzAAAfBo0F0wFz6BvvAzwBuyAtkFuuBulF0vB53A14Az2A2vAx2AzwA0yA2xAxxAz5AwvAxzAtJEXFFtFEkpF0pFvuFzwAtMElhFklFyiFvhFykFt3Ay4A45BwtApSFhuFnlFvpEukFl4FuoE0tFsBFCATCFAAAAAAAAAAAAAAGAJGFSBFNFFQtjF8pb6VA
Requested by: Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 136.243.5.166 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h561.meetrics.de
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: nginx
Content-Type: image/gif
Cache-control: no-cache,no-store,must-revalidate
Connection: keep-alive
Content-Length: 43
Expires: Tue, 21 Sep 2021 08:14:49 GMT

GET
H/1.1 200
OK data
b156.s79.research.de.com/ Frame 8984 43 B
308 B 34ms
2ms Image
image/gif 136.243.5.166
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b156.s79.research.de.com/data?/pdIECTAAAl2yFuvFfhFwpFLktFDTkzFARksFAQtjFfdVNSA
Requested by: Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 136.243.5.166 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h561.meetrics.de
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: image/gif
Cache-control: no-cache,no-store,must-revalidate
Connection: keep-alive
Expires: Tue, 21-Sep-21 08:14:49 GMT

GET
H2 200 ukq32vx5_McxUorQ07ipf3ke83RHIIB7Hn7ctuWmSpM.js Show response
pagead2.googlesyndication.com/bg/ Frame ECF3 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/ukq32vx5_McxUorQ07ipf3ke83RHIIB7Hn7ctuWmSpM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba4ab7dafc79fcc731528ad0d3b8a97f791ef3744720807b1e7edcb6e5a64a93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 20:22:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 388344
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13277
x-xss-protection: 0
last-modified: Wed, 15 Sep 2021 09:28:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Fri, 16 Sep 2022 20:22:26 GMT

GET
H/1.1 200
OK stat Show response
stat.meetrics.net/ Frame D605 82 B
351 B 2ms
1ms Script
application/javascript 46.4.98.42
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://stat.meetrics.net/stat
Requested by: Host: s79.mxcdn.net
URL: https://s79.mxcdn.net/bb-mx/serve/mtrcs_220434.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 46.4.98.42 Rostock, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h569.meetrics.de
Software: nginx /
Resource Hash: 79b208a19742aa53a96b0902c3b88c3434687c4b2453842d82a50c7b4080417e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 21 Sep 2021 08:14:50 GMT
Cache-Control: private, no-cache, must-revalidate
Last-Modified: Tue, 21 Sep 2021 08:14:01 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: application/javascript

GET
H/1.1 200
OK gettag Show response
s79.research.de.com/bb-mxad/ Frame D605 0
208 B 1ms
1ms Script
application/octet-stream 148.251.47.75
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://s79.research.de.com/bb-mxad/gettag
Requested by: Host: s79.mxcdn.net
URL: https://s79.mxcdn.net/bb-mx/serve/mtrcs_220434.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 148.251.47.75 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h489.meetrics.de
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Tue, 21 Sep 2021 08:14:50 GMT
Cache-control: private,must-revalidate
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: application/octet-stream

GET
H/1.1 200
OK submit
b66.s79.research.de.com/bb-mx/ Frame D605 43 B
291 B 32ms
4ms Image
image/gif 136.243.33.197
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b66.s79.research.de.com/bb-mx/submit?/T5nSBgAAA/whFtBo0F0wFz6BvvAyzAihFh2ByjE3wAhjF22Am3BzwA02A5kE4lEyhE1jEy3A3yAuzEhmFlmFyhFtlFunEvvFnsFlzF5uFkpFjhF0pFvuFujEvtFvzEhmFlmFyhFtlFvxAtwAtzA4vAo0FtsFvjEvuF0hFpuFlyFuoE0tFsBF1pyFo0F0wFz6BvvAwhFz0FlsFpuFruBulF0vB+k2FoywAyxAtwA5tAx3AtwA56Az4AtyAywA0zA0tAyuAxyAyuA3tAyyAyzA2lEzzAKp6Fsp3Fx2AzyAyxAywA45Ax3AxBEjwtFuvFulFnqnFluFtVETsBluFL2wFBLl1FC/2xF3CylFx1FlzF0mF1sFszFjyFllFugBm1FssFzjFylFluFluFhiFslFkgBluFnpFulFfjFoyFvtFlfF5wAg3EpuFkvF3fF3lFirFp0Fz0FvyFhnFlpFumFvgB3pFukFv3Ff3FliFrpF0jFhuFjlFshFupFthF0pFvuFmyFhtFlgB3pFukFv3Ff3FliFrpF0yFlxF1lFz0FhuFptFh0FpvFumFyhFtlFgjEzzFf3FliFrpF0gBjwF1fF0gAyhFtfF4gAthF4fFluFnpFulFf5BwBELlnFB/k0FsBxgAwqFpkF9yAywA0zA0mAhkFj9B53A14Az2A2mAjwFpkF9yA2zA1yA3yA3mAzpF0lF91A51Ay3Az5AmwEshFjlF9zAxyA2yAz4A33AmjEpkF9xA13Aw3A2wA50AmzEp6Fl9B3yA44E5wAmjEi9By0Az5AxzAx5Aw5AUkzFpBFAAAAAAYLaBaBAPAAAAAAAAAOAAAAGBAAAAAYLaBaBABPXAAAAAAAABSjrAZHAAFAx8Ez8ExBEGAx3A4zA42ArNTzAPAAAFAASjrTNTzASksF5EbAAAAAAAAAAAAEAAASjrAAAAAAAIAy2Az1Ay3Ay3AJAzxAy2AyzA43A3BEHA15A1yA3zA5BEGA3yA44E5wAJAx1A3wA32Aw5A0BEHA53A14Az2A2BEdAAAAAAYLAaBAFAAANTzAAAfBo0F0wFz6BvvAzwBuyAtkFuuBulF0vB53A14Az2A2vAx2AzwA0yA2xAxxAz5AwvAxzAtJEXFFtFEkpF0pFvuFzwAtMElhFklFyiFvhFykFt3Ay4A45BwtApSFhuFnlFvpEukFl4FuoE0tFsBFCATCFAAAAAAAAAAAAAAGAJGFSBFNFFQtjFijO7VA
Requested by: Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 136.243.33.197 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h376.meetrics.de
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: nginx
Content-Type: image/gif
Cache-control: no-cache,no-store,must-revalidate
Connection: keep-alive
Content-Length: 43
Expires: Tue, 21 Sep 2021 08:14:49 GMT

GET
H/1.1 200
OK data
b66.s79.research.de.com/ Frame D605 43 B
308 B 29ms
2ms Image
image/gif 136.243.33.197
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b66.s79.research.de.com/data?/T5nSChAAAl2yFuvFfhFwpFLktFDTkzFARksFAQtjFAgVNSA
Requested by: Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 136.243.33.197 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h376.meetrics.de
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: image/gif
Cache-control: no-cache,no-store,must-revalidate
Connection: keep-alive
Expires: Tue, 21-Sep-21 08:14:49 GMT

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 85D4 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 17 Sep 2021 08:58:07 GMT
expires: Sat, 17 Sep 2022 08:58:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 343003
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 440B 22 KB
8 KB 7ms
7ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 17 Sep 2021 08:58:07 GMT
expires: Sat, 17 Sep 2022 08:58:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 343003
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 6DCD 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 17 Sep 2021 08:58:07 GMT
expires: Sat, 17 Sep 2022 08:58:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 343003
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame DBDF 22 KB
8 KB 12ms
11ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 17 Sep 2021 08:58:07 GMT
expires: Sat, 17 Sep 2022 08:58:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 343003
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 22E5 22 KB
8 KB 10ms
7ms Document
text/html 2a00:1450:4001:813::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 17 Sep 2021 08:58:07 GMT
expires: Sat, 17 Sep 2022 08:58:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 343003
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 3798 60 KB
24 KB 18ms
16ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Sep 2021 08:14:50 GMT

GET
H2 200 script.js Show response
s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/js/ Frame 3798 3 KB
942 B 11ms
8ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/js/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c823a8c62ce53897a22dbea1f0919194df317aec4943d199020a7b3ee316285d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 12:03:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72695
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 837
x-xss-protection: 0
last-modified: Tue, 31 Aug 2021 16:08:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Sep 2021 12:03:15 GMT

GET
H2 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 6109 60 KB
24 KB 27ms
25ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Sep 2021 08:14:50 GMT

GET
H2 200 script.js Show response
s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/js/ Frame 6109 3 KB
898 B 10ms
9ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/js/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c823a8c62ce53897a22dbea1f0919194df317aec4943d199020a7b3ee316285d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 12:03:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72695
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 837
x-xss-protection: 0
last-modified: Tue, 31 Aug 2021 16:08:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Sep 2021 12:03:15 GMT

GET
H2 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 2148 60 KB
24 KB 26ms
24ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Sep 2021 08:14:50 GMT

GET
H2 200 script.js Show response
s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/js/ Frame 2148 3 KB
898 B 10ms
8ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/js/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c823a8c62ce53897a22dbea1f0919194df317aec4943d199020a7b3ee316285d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 12:03:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72695
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 837
x-xss-protection: 0
last-modified: Tue, 31 Aug 2021 16:08:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Sep 2021 12:03:15 GMT

GET
H2 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 946F 60 KB
24 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Sep 2021 08:14:50 GMT

GET
H2 200 script.js Show response
s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/js/ Frame 946F 3 KB
898 B 10ms
8ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/js/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c823a8c62ce53897a22dbea1f0919194df317aec4943d199020a7b3ee316285d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/9758366/1630426111390/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 12:03:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 72695
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 837
x-xss-protection: 0
last-modified: Tue, 31 Aug 2021 16:08:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Sep 2021 12:03:15 GMT

GET
H2 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame F70A 60 KB
24 KB 26ms
24ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9758366/1629983950211/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/9758366/1629983950211/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 21 Sep 2021 08:14:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 21 Sep 2021 08:14:50 GMT

GET
H2 200 script.js Show response
s0.2mdn.net/9758366/1629983950211/13-IWE-Edition30-Leaderboard-728x90-iRange/js/ Frame F70A 3 KB
904 B 10ms
8ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9758366/1629983950211/13-IWE-Edition30-Leaderboard-728x90-iRange/js/script.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9758366/1629983950211/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

76463ed3dda1b42bf09918e5a314970cd18d9d315033459b9eb3178d01438158

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/9758366/1629983950211/13-IWE-Edition30-Leaderboard-728x90-iRange/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 20 Sep 2021 16:15:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57537
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 813
x-xss-protection: 0
last-modified: Thu, 26 Aug 2021 13:19:10 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Tue, 21 Sep 2021 16:15:53 GMT

GET
H/1.1 200
OK data
b175.s79.research.de.com/ Frame 55F7 43 B
308 B 1ms
1ms Image
image/gif 88.198.49.67
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b175.s79.research.de.com/data?/NR/mDXEAA0rvFo0F0wFz6BvvAwhFz0FlsFpuFruBulF0BFLruFBLkqFFlqwFyyAw0Az0AL2vFBlqwFyyAw0Az0ALkmFBTkzFkQLDAAAAAAAYAAAA+DAQAAAAAAAAAXAAAA+DARksFAQtjFm9AQSA
Requested by: Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 88.198.49.67 Munich, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h348.meetrics.de
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: image/gif
Cache-control: no-cache,no-store,must-revalidate
Connection: keep-alive
Expires: Tue, 21-Sep-21 08:14:49 GMT

GET
H2 200 ukq32vx5_McxUorQ07ipf3ke83RHIIB7Hn7ctuWmSpM.js Show response
pagead2.googlesyndication.com/bg/ Frame 7005 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/ukq32vx5_McxUorQ07ipf3ke83RHIIB7Hn7ctuWmSpM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba4ab7dafc79fcc731528ad0d3b8a97f791ef3744720807b1e7edcb6e5a64a93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 20:22:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 388344
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13277
x-xss-protection: 0
last-modified: Wed, 15 Sep 2021 09:28:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Fri, 16 Sep 2022 20:22:26 GMT

GET
H2 200 ukq32vx5_McxUorQ07ipf3ke83RHIIB7Hn7ctuWmSpM.js Show response
pagead2.googlesyndication.com/bg/ Frame 0672 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/ukq32vx5_McxUorQ07ipf3ke83RHIIB7Hn7ctuWmSpM.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ba4ab7dafc79fcc731528ad0d3b8a97f791ef3744720807b1e7edcb6e5a64a93

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 20:22:26 GMT
content-encoding: br
x-content-type-options: nosniff
age: 388344
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13277
x-xss-protection: 0
last-modified: Wed, 15 Sep 2021 09:28:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Fri, 16 Sep 2022 20:22:26 GMT

GET
H/1.1 200
OK data
b170.s79.research.de.com/ Frame F74C 43 B
308 B 2ms
1ms Image
image/gif 144.76.237.196
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b170.s79.research.de.com/data?/8T5lDMEAA0rvFo0F0wFz6BvvAwhFz0FlsFpuFruBulF0BFLruFBLkqFFlqwFyyAw0Az0AL2vFBlqwFyyAw0Az0ALkmFBTkzFkQKDAAAAAAAYAAAAcDAQAAAAAAAAAXAAAAcDARksFAQtjFyREQSA
Requested by: Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 144.76.237.196 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h371.meetrics.de
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: image/gif
Cache-control: no-cache,no-store,must-revalidate
Connection: keep-alive
Expires: Tue, 21-Sep-21 08:14:49 GMT

GET
H/1.1 200
OK data
b199.s79.research.de.com/ Frame FBBB 43 B
308 B 1ms
1ms Image
image/gif 136.243.6.97
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b199.s79.research.de.com/data?/rgmjDDEAA0rvFo0F0wFz6BvvAwhFz0FlsFpuFruBulF0BFLruFBLkqFFlqwFyyAw0Az0AL2vFBlqwFyyAw0Az0ALkmFBTkzFkQvCAAAAAAAYAAAA/CAQAAAAAAAAAXAAAA/CARksFAQtjFtMCQSA
Requested by: Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 136.243.6.97 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h243.meetrics.de
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: image/gif
Cache-control: no-cache,no-store,must-revalidate
Connection: keep-alive
Expires: Tue, 21-Sep-21 08:14:49 GMT

GET
H3

200

activityi;dc_pre=CIKm8O7Pj_MCFRHG1Qod0OUMiQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3931379437298.446 Show response
5994599.fls.doubleclick.net/ Frame EE85
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3931379437298.446?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CIKm8O7Pj_MCFRHG1Qod0OUMiQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3931379437298.446?

391 B
346 B

39ms
25ms

Document
text/html

142.250.185.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CIKm8O7Pj_MCFRHG1Qod0OUMiQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3931379437298.446?

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f6.1e100.net

Software

cafe /

Resource Hash

e014d78428065c41a79261c8763976a7c195c8ee0121f5354f6db45eca386fc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 5994599.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CIKm8O7Pj_MCFRHG1Qod0OUMiQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3931379437298.446?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUn9uge8IjE7aQwCaS5mikZzrspMcc_so8cL06gObtzqZSVT-nsxhjtA_moKS-I
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 21 Sep 2021 08:14:50 GMT
expires: Tue, 21 Sep 2021 08:14:50 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 323
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Tue, 21 Sep 2021 08:14:50 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CIKm8O7Pj_MCFRHG1Qod0OUMiQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=3931379437298.446?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK request_content.php Show response
hal900010.redintelligence.net/ Frame 1826 4 KB
2 KB 5ms
2ms Document
text/html 138.201.63.145
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900010.redintelligence.net/request_content.php?s=24496800061776400710612011724010&a=deda8cd3
Requested by: Host: hal900010.redintelligence.net
URL: https://hal900010.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=d850c47a1d&subid=&uid=02eb810a5f15cd95&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCDrj2eJRJYcT3IJqHjuwPo8CQwAq1zfmDV_zYuavlDPAuEAEgiYvEUGCVgoCArAfIAQmpAii18guQr7M-qAMBqgS9AU_QHdhKNGcFMgQikHigZp_din9KDgxez2YEkq_mskxtZm9-Mq7ei_K_eO3zY3vcf5cutSjSuhMcyvlnNd6UjrQKbnRcF1sbSIAGh_FhNQJ1VO__ifucDaSTU6QRNAP-xpb9xEyRgnc_wI2CrcaXrLEHsLR0lni679gvOy_2ZFjnD-QayPui70BO0zDE5OFf9aaTghLVN0OOX-dDJN8ElRA4q3uwss7YZFNoqSU5FRhMJLwIKkJUgY2hykbjEsAEqp38vs8B4AQDkAYBoAZNgAfr5-heqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwDSCAkIiOGAEBABGB2ACgGYCwHICwGADAGwE8Ka2grQEwDYEwPYFAHQFQGAFwE%26ae%3D1%26num%3D1%26cid%3DCAASFeRok5wDp7PEjKtogR8xbjYOCRWSpA%26sig%3DAOD64_3hNg2_hYDHVtBFJSAilhsH5qWGEA%26client%3Dca-pub-1750856239204414%26dbm_c%3DAKAmf-D5dI1cPrOUMXvoj2_UbzYRnb9q0k6YA90nVSEVlHdlMBZ2g8orBm80Z03Rc0zB1PBbuuIGvSmvXQGP-tA_ob-julXtuEfSQ042MCm2aZHykBU4WcDFSoGC53fuGVuQq4_BeprMi2EawuDVTEeWLVqwyzV9Zg%26cry%3D1%26dbm_d%3DAKAmf-DorM7FTtwSjDdQk7a9gFD15Eup0AcU2n2V9x-60vpqQWI99xMATMkXy7VgOdgjZSo1Ja0vozSpxOC-ykOqbhiMy4vQCpo5gaUUR7KyBCerjHqzCdsI1-uI45RFRR_TYkldItYXCEFpUz61Va_8hgvWlu-1kDfxr7KhTuis2LEorCggX8Vd0EPbVTuiOIUzZm9eV2BJe3Vxjvv5-OndRnf6xsTAQELau0iTwQ3rxgvrGe3Xju4_Amev7GqPjRtOPCJ-eKenKEGektu30nLu0vSky0SCepms8dYl7kBAd782S8GSSjqnCB6YwcEQI121pdDEgvjZJDhVDadrCacfqn3XkooXHzqyKnVbfmStZPB4FQghrnWp7xTyZC9BylYY-yEa7QOC3jbYY6YqoBKGuedrzDxNnAEvIdMrAaKiMuxY9mbKuaS3rivOrRqQ6U5Am66X-Tpd%26adurl%3D&documentReferer=https%3A%2F%2Fpastelink.net%2F&ancestorOrigins=https%3A%2F%2Fpastelink.net&random=7579623489970&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.145 Hockenheim, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.145.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 46611292fec38c9529d301bd35afedd76cfba0a786b97d6ed5865ce69d68f72a

Request headers

Host: hal900010.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Cookie: 8lcfmzhxc8d6_uid=ebc3e63568fbc6a3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/

Response headers

Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Tue, 21 Sep 2021 09:14:50 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1524
Connection: close
Content-Type: text/html; charset=utf-8

GET
DATA 200
OK truncated
/ Frame A1BD 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f4107d35bd03d2a3c891535be57762deb17884568cf66224eb50f66d7fd79adc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 200
OK data
b156.s79.research.de.com/ Frame 8984 43 B
308 B 2ms
1ms Image
image/gif 136.243.5.166
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://b156.s79.research.de.com/data?/pdIEDcEAA0rvFo0F0wFz6BvvAwhFz0FlsFpuFruBulF0BFLruFBLkqFFlqwFyyAw0Az0AL2vFBlqwFyyAw0Az0ALkmFBTkzFkQSCAAAAAAAYAAAAjCAQAAAAAAAAAXAAAAjCARksFAQtjF22EQSA
Requested by: Host: 23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com
URL: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 136.243.5.166 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: h561.meetrics.de
Software: nginx /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 21 Sep 2021 08:14:50 GMT
Server: nginx
Transfer-Encoding: chunked
Content-Type: image/gif
Cache-control: no-cache,no-store,must-revalidate
Connection: keep-alive
Expires: Tue, 21-Sep-21 08:14:49 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8984 0
23 B 18ms
18ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 21 Sep 2021 08:14:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame F74C 0
23 B 19ms
18ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 21 Sep 2021 08:14:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FBBB 0
23 B 17ms
17ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 21 Sep 2021 08:14:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame D605 0
23 B 19ms
19ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://23baa62c70ac66f730469d8e2a5c2772.safeframe.googlesyndication.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Tue, 21 Sep 2021 08:14:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 55F7 0
23 B 18ms
18ms Ping
image/gif 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: pastelink.net
URL: https://pastelink.net/3fu78

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS