pcloak.blob.core.windows.net Open in urlscan Pro
20.60.220.36 Public Scan

Software

nginx/1.23.2 /

Resource Hash

015f01ac1de281b59184590acd3cd394181b4f2d309e08b8d527de820a968420

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 12 May 2023 07:13:48 GMT
AN-X-Request-Uuid: ec7bc35b-4f1b-41c5-a2bf-f6e147b3a62a
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://ye-mek.net
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 478
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 bid-request Show response
a.teads.tv/hb/ Frame 9F42 16 B
386 B 140ms
60ms XHR
application/json 95.101.149.35
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.149.35 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a95-101-149-35.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://ye-mek.net
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Fri, 12 May 2023 07:13:48 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ Frame 9F42 0
212 B 371ms
125ms XHR
text/plain 2620:100:a001::18
AS-CRITEO

General

Check archive.org

Show headers Download Go to

Full URL

https://bidder.criteo.com/cdb?profileId=207&av=35&wv=7.38.0&cb=57553232898&lsavail=0

Requested by

Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::18 , United States, ASN19750 (AS-CRITEO, US),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 12 May 2023 07:13:47 GMT
strict-transport-security: max-age=31536000; preload;
server: Finatra
vary: Origin
access-control-allow-origin: https://ye-mek.net
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ Frame 9F42 360 B
1 KB 84ms
28ms XHR
application/json 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

38.243.102.34.bc.googleusercontent.com

Software

nginx/1.23.2 /

Resource Hash

5c4a38af2471142f60f0034c5b0b5657f718da28011a6ced27e9e3e56183d07e

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Fri, 12 May 2023 07:13:48 GMT
AN-X-Request-Uuid: fcf26990-1ca4-4de7-b61e-39e07173288a
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/json; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://ye-mek.net
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 360
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 zoneview
ng.virgul.com/ Frame 9F42 0
209 B 73ms
73ms Image
text/plain 185.7.176.223
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng.virgul.com/zoneview?c=&mt=1683875627985&v=https%3A%2F%2Fye-mek.net%2F&r=153394@153493:yemek_net&userId=vneta053d54b-47d2-4394-ad52-d3209bb3e68e&tp=&os=&call=&vd=0&ses=0&dim=1600x1200&l=&y=&w=0&ext=,as,rc1,hf1,vv1,gprec%3Dyemek%26rec_ing%3D&info=&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&rdmt=0.22021123157404854
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.223 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://ye-mek.net
date: Fri, 12 May 2023 07:13:48 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H2 200 tag Show response
feed.pghub.io/ Frame E6AF 13 B
257 B 94ms
36ms Document
text/html 34.102.243.38
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://feed.pghub.io/tag?referrer_url=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&page_url=https%3A%2F%2Fye-mek.net%2F&owner=P%26G&bp_id=noktacommedya&ch=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D&initiator=js&data=%7B%22category%22%3A%22site_geneli%22%7D

Requested by

Host: pghub.io
URL: https://pghub.io/js/pandg-sdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.102.243.38 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628

Security Headers

Name	Value
Content-Security-Policy	default-src 'none';img-src https://*.pghub.io https://match.adsrvr.org
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
access-control-max-age: 300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-store
content-security-policy: default-src 'none';img-src https://*.pghub.io https://match.adsrvr.org
content-type: text/html;charset=utf-8
date: Fri, 12 May 2023 07:13:48 GMT
strict-transport-security: max-age=31536000
via: 1.1 google

GET
H2 403 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 67BB 603 B
218 B 47ms
46ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&adk=1812271804&adf=3279755397&plat=1%3A512%2C2%3A512%2C3%3A512%2C4%3A512%2C8%3A512%2C9%3A33288%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C26%3A512%2C27%3A512%2C30%3A1081856%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1683875627775&bpp=4&bdt=848&idt=231&shv=r20230510&mjsv=m202305080101&ptt=9&saldr=aa&nras=1&correlator=4587312634858&frm=24&ife=1&pv=2&ga_vid=1195969361.1683875627&ga_sid=1683875628&ga_hid=1414178609&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=1600&ish=1200&ifk=222437166&scr_x=-12245933&scr_y=-12245933&eid=44773809%2C44759876%2C44759927%2C42532089%2C42532185%2C44759837%2C44788441%2C44789779&oid=2&pvsid=2648781072102199&tmod=300938915&uas=0&nvt=1&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=1&uci=1.j7vueekla53t&fsb=1&dtd=245

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305080101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6593523210010154&plah=ye-mek.net

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 12 May 2023 07:13:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK adagio.js Show response
script.4dex.io/ Frame 9F42 74 KB
23 KB 74ms
31ms Fetch
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed87a83a9df154b61d76e8b9b53bb9d23db3eea194e66bca6b575e3e4f7a57bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Fri, 12 May 2023 07:13:48 GMT
Content-Encoding: br
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 618066
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 23 Nov 2022 15:43:17 GMT
Server: cloudflare
ETag: W/"c56b6332dacf72f135afcd153ae22448"
Vary: Origin, Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9MunTba1KqhR1LkRnofcdCcbTG6bsdqWGV6VpZ%2Fvp1cLv5uJGr5I2BtyJXUeOIIXblZfEQ5fSzkFTqfRI5xYjpY3Vt%2B7Jp04QA3nvegzvXSPneBkfwL0iL%2FfLwK9i45xtRl1o9DYIkxKsT%2B4"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers
Cache-Control: public, max-age=1800
CF-RAY: 7c60dc737af837eb-FRA

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame 9F42 360 KB
121 KB 126ms
40ms Script
text/javascript 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: c1.imgiz.com
URL: https://c1.imgiz.com/player_others/html5/NoktaNpmPlayerApi.js?dts=19489

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f826765655e6a3e039bda8ec43370f2c9247a931e3e33129175e48ca0690b1e2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 122883
x-xss-protection: 0
expires: Fri, 12 May 2023 07:13:48 GMT

GET
H2 200 NoktaPlayer.js Show response
c1.imgiz.com/player_others/html5/ Frame 9F42 399 KB
128 KB 78ms
78ms Script
application/javascript 185.7.176.221
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.imgiz.com/player_others/html5/NoktaPlayer.js?d=5/12/2023
Requested by: Host: c1.imgiz.com
URL: https://c1.imgiz.com/player_others/html5/NoktaNpmPlayerApi.js?dts=19489
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e183dfed35d6921278c39359a5d34fbb9dfaaf4f990ec6d210a7217a95e897db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: gzip
last-modified: Mon, 06 Mar 2023 16:42:16 GMT
server: openresty/1.15.8.3
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=604800
expires: Fri, 19 May 2023 07:13:48 GMT

GET
H2 200 container.html Show response
08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 121B 6 KB
3 KB 22ms
21ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 12 May 2023 07:13:48 GMT
expires: Sat, 11 May 2024 07:13:48 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ Frame 9F42 107 B
165 B 31ms
30ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=ye-mek.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ Frame 9F42 107 B
165 B 31ms
31ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=ye-mek.net

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 9F42 19 KB
9 KB 312ms
311ms XHR
text/plain 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2648781072102199&correlator=1607150091140248&eid=31074171%2C31074474&output=ldjh&gdfp_req=1&vrg=202305090101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_right_tower&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600%7C120x600%7C120x240%7C160x800&fluid=height&ifi=3&adks=3203893797&sfv=1-0-40&prev_scp=hb_format%3Dbanner%26hb_size%3D300x600%26hb_pb%3D0.32%26hb_adid%3D68b7a27169b0e1d%26hb_bidder%3Dsovrn%26hb_format_sovrn%3Dbanner%26hb_size_sovrn%3D300x600%26hb_pb_sovrn%3D0.32%26hb_adid_sovrn%3D68b7a27169b0e1d%26hb_bidder_sovrn%3Dsovrn%26hg_pb%3D0.32&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1683875627587%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvneta053d54b-47d2-4394-ad52-d3209bb3e68e%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D&ppid=vneta053d54b47d24394ad52d3209bb3e68e&sc=1&cdm=ye-mek.net&abxe=1&dt=1683875628379&lmt=1683875628&dlt=1683875626928&idt=966&adxs=1318&adys=150&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=e92lt17uba1f&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=160x-1&msz=160x-1&fws=900&ohw=160&psts=ABHeCvixuf8D95GDcU7BMLHs5N2av7U2OjWj_FCagZKCHyYYQ1lo8facWGQyZb0NtbzIyc2KGyzAOQs0Ywo_ZJUxyA&ga_vid=1195969361.1683875627&ga_sid=1683875628&ga_hid=1414178609&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00b84b6e0b5e6b6017c143a7b927a5de0f2172cf7a8ddb2b2c86d9643ab00340

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8988
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ye-mek.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 9F42 32 KB
16 KB 220ms
219ms XHR
text/plain 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2648781072102199&correlator=2557514680479249&eid=31074171%2C31074474&output=ldjh&gdfp_req=1&vrg=202305090101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_pageskin&enc_prev_ius=%2F0%2F1&prev_iu_szs=1920x1051%7C100x100%7C100x400&ifi=4&adks=3698513385&sfv=1-0-40&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1683875627587%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvneta053d54b-47d2-4394-ad52-d3209bb3e68e%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D&ppid=vneta053d54b47d24394ad52d3209bb3e68e&sc=1&cdm=ye-mek.net&abxe=1&dt=1683875628383&lmt=1683875628&dlt=1683875626928&idt=966&adxs=-12245933&adys=-12245933&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=carkt7qc2002&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=0x0&msz=0x-1&fws=900&ohw=0&psts=ABHeCvixuf8D95GDcU7BMLHs5N2av7U2OjWj_FCagZKCHyYYQ1lo8facWGQyZb0NtbzIyc2KGyzAOQs0Ywo_ZJUxyA&ga_vid=1195969361.1683875627&ga_sid=1683875628&ga_hid=1414178609&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

02f5595ff7049365dadd3a70792382b925323401d409b7f8b1cab3d61ea159dd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15887
x-xss-protection: 0
google-lineitem-id: 6271164171
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138430115743
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ye-mek.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 9F42 20 KB
9 KB 309ms
308ms XHR
text/plain 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2648781072102199&correlator=225213469872534&eid=31074171%2C31074474&output=ldjh&gdfp_req=1&vrg=202305090101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_kategori_sayfalari_728x90_2&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C728x90%7C468x60&fluid=height&ifi=5&adks=345722362&sfv=1-0-40&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1683875627587%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvneta053d54b-47d2-4394-ad52-d3209bb3e68e%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D&ppid=vneta053d54b47d24394ad52d3209bb3e68e&sc=1&cdm=ye-mek.net&abxe=1&dt=1683875628384&lmt=1683875628&dlt=1683875626928&idt=966&adxs=436&adys=1389&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=ogoosbu8ka&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=976x0&msz=996x0&fws=388&ohw=1600&psts=ABHeCvixuf8D95GDcU7BMLHs5N2av7U2OjWj_FCagZKCHyYYQ1lo8facWGQyZb0NtbzIyc2KGyzAOQs0Ywo_ZJUxyA&ga_vid=1195969361.1683875627&ga_sid=1683875628&ga_hid=1414178609&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4e114ad0f73b9f3e1a252a7bfc15c82f169e8d84f6961d20655c19f7e5c0caa5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9557
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ye-mek.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 9F42 56 KB
12 KB 609ms
608ms XHR
text/plain 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2648781072102199&correlator=4306636943134053&eid=31074171%2C31074474&output=ldjh&gdfp_req=1&vrg=202305090101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_left_tower&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600%7C120x600%7C120x240%7C160x800&fluid=height&ifi=6&adks=3299242717&sfv=1-0-40&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1683875627587%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvneta053d54b-47d2-4394-ad52-d3209bb3e68e%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D&ppid=vneta053d54b47d24394ad52d3209bb3e68e&sc=1&cdm=ye-mek.net&abxe=1&dt=1683875628387&lmt=1683875628&dlt=1683875626928&idt=966&adxs=122&adys=150&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=tc75qgi9bhgx&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=160x-1&msz=160x-1&fws=900&ohw=160&psts=ABHeCvixuf8D95GDcU7BMLHs5N2av7U2OjWj_FCagZKCHyYYQ1lo8facWGQyZb0NtbzIyc2KGyzAOQs0Ywo_ZJUxyA&ga_vid=1195969361.1683875627&ga_sid=1683875628&ga_hid=1414178609&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

77017d3007821ab79e69cdd1da0c3b5e72308f78b8b9d1f3a34730de4b144302

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12349
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ye-mek.net
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 9F42 19 KB
9 KB 375ms
374ms XHR
text/plain 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2648781072102199&correlator=3458110225275043&eid=31074171%2C31074474&output=ldjh&gdfp_req=1&vrg=202305090101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_masthead&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C970x250%7C970x90%7C728x90%7C300x250%7C468x60%7C250x250%7C200x200%7C160x160%7C640x205&fluid=height&ifi=7&adks=3050045420&sfv=1-0-40&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1683875627587%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvneta053d54b-47d2-4394-ad52-d3209bb3e68e%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D&ppid=vneta053d54b47d24394ad52d3209bb3e68e&sc=1&cdm=ye-mek.net&abxe=1&dt=1683875628389&lmt=1683875628&dlt=1683875626928&idt=966&adxs=315&adys=158&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=ebbvoqxt1u9d&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=996x0&msz=996x0&fws=388&ohw=1600&psts=ABHeCvixuf8D95GDcU7BMLHs5N2av7U2OjWj_FCagZKCHyYYQ1lo8facWGQyZb0NtbzIyc2KGyzAOQs0Ywo_ZJUxyA&ga_vid=1195969361.1683875627&ga_sid=1683875628&ga_hid=1414178609&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0863d199b018e75865317de60a161721a899ca66ff152136475df3bf0e5204bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8992
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ye-mek.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 9F42 20 KB
9 KB 361ms
360ms XHR
text/plain 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2648781072102199&correlator=3719557582039278&eid=31074171%2C31074474&output=ldjh&gdfp_req=1&vrg=202305090101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_kategori_sayfalari_ust_728x90&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C728x90%7C468x60&fluid=height&ifi=8&adks=456810305&sfv=1-0-40&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1683875627587%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvneta053d54b-47d2-4394-ad52-d3209bb3e68e%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D&ppid=vneta053d54b47d24394ad52d3209bb3e68e&sc=1&cdm=ye-mek.net&abxe=1&dt=1683875628392&lmt=1683875628&dlt=1683875626928&idt=966&adxs=436&adys=751&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=9chtqiz7084l&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=976x0&msz=996x0&fws=388&ohw=1600&psts=ABHeCvixuf8D95GDcU7BMLHs5N2av7U2OjWj_FCagZKCHyYYQ1lo8facWGQyZb0NtbzIyc2KGyzAOQs0Ywo_ZJUxyA&ga_vid=1195969361.1683875627&ga_sid=1683875628&ga_hid=1414178609&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

83bb06fedf748e77418bf8c58cb98297d9e093ae1d018c24d2b377af89023284

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9466
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ye-mek.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ Frame 9F42 19 KB
9 KB 512ms
511ms XHR
text/plain 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=2648781072102199&correlator=1665214272147804&eid=31074171%2C31074474&output=ldjh&gdfp_req=1&vrg=202305090101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_kategori_sayfalari_728x90_repeating&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C728x90%7C468x60&fluid=height&ifi=9&adks=2157304621&sfv=1-0-40&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1683875627587%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvneta053d54b-47d2-4394-ad52-d3209bb3e68e%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D&ppid=vneta053d54b47d24394ad52d3209bb3e68e&sc=1&cdm=ye-mek.net&abxe=1&dt=1683875628394&lmt=1683875628&dlt=1683875626928&idt=966&adxs=436&adys=2027&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=gr9syjk7zl6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=976x0&msz=996x0&fws=388&ohw=1600&psts=ABHeCvixuf8D95GDcU7BMLHs5N2av7U2OjWj_FCagZKCHyYYQ1lo8facWGQyZb0NtbzIyc2KGyzAOQs0Ywo_ZJUxyA&ga_vid=1195969361.1683875627&ga_sid=1683875628&ga_hid=1414178609&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b11986b7afdf2de1efe4081e4438499553d09cae22d8b21109be645d45e523cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9160
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://ye-mek.net
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 121B 24 KB
7 KB 72ms
21ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 06 May 2023 09:20:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 510819
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6402
x-xss-protection: 0
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 05 May 2024 09:20:09 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 121B 136 KB
47 KB 69ms
68ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6593523210010154

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

60a7a84a62766e4ee1b9cd4662372eaf402d99549cf92dcea1ddaa1b136d496d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
Origin: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 47521
x-xss-protection: 0
server: cafe
etag: 14416228618453111518
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 12 May 2023 07:13:48 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 121B 169 KB
53 KB 89ms
36ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 12 May 2023 07:13:48 GMT

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 121B 0
0 58ms
58ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsssRSswmzGd2h3-6I_9zgqTAw7OQ7XNNI6JfHjRGtvb4TCZc9hKbH2gT8oNoWN0ZkOUTXDrLDvlmFENs3IQkO_ks-kSbosnTrnLBm3HCVghiuPJO99SXVLDWEyx-b1w0yZaKIDG6-N4UGBjN6Bcjj6w6HHQkuApVBXd0YsmvBaP1O1W8MedoWCTxll2kGJXZACSFXEzQeXBLyRAkvhBt4xzeY1cIo75uBRqAGXMAF3zVfztRRYxdw8OG71BGJEUe4dj0kEQbn3EPDalu3uu-TWzZa5NUhs7GaQAo0Ft3Ia6ErNNWX88ZoWktWLxiuqMHVEhdRUpCmQGiq8q3XIIfY87TeHSjUkXSZfTawM9u5QMyD3H&sai=AMfl-YQbbdR92V-KW754d1iAktdLOuDXr1a-yTDea_P0SziCbsQSwHeecPhVDTqeuPhBUZoP37IUy1fRBtUP0AoEWpjcrE80zogVq2suxj_v0Po&sig=Cg0ArKJSzA04TvLVOhMbEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 12 May 2023 07:13:48 GMT

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305080101/ Frame 121B 356 KB
120 KB 80ms
80ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202305080101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6593523210010154&plah=08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6593523210010154

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6bab7b7ca4f11f4d8ae815868cc1e93b3b27904e1500147a870fe639852c1add

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 122728
x-xss-protection: 0
server: cafe
etag: 6978169370444658430
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Fri, 12 May 2023 07:13:48 GMT

GET
DATA 200
OK truncated
/ Frame 121B 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 2c436d2ba8f49d08bce6f99abf4b4924338f199f9f972240f50a9c1284f89b40

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame ED5B 42 B
63 B 48ms
47ms Fetch
image/gif 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BO9AI3MgE3rULBoQ3cmcu4sTxpXp9GEEKifR2phUTYWUy58W1owQPZQFuVIuurY4kYeJZSAKmXp2wdWT9b85twNExDelnnHSrRKT3UMrRznfXV7jRuslVy75_GKQjeoovn0_ebXTI2CgoaTEh3Ab2-oJMlHeXGHyvzdrvYyJtMOJ3uI3Q&cry=1&dbm_d=AKAmf-Dv4Qs1aM9iOfft3cJzeEHK8xUzA8M1ZllEg9GC_2eGrAQirTrJ3z6flgL84unvuFKndqkszE_kJNpuo62BxA8bKsZ8ItoCSC8HIAlZrdt2H9sxmeMz0VFdzi-hxR31tjMR-DsRmmGgUQERjUrbBn7PpHF-fKVZIPqExZ_Cq-Js7iNL9i8uBzeydwilXve_gbE2c22wdL4Ilwa9F346BC2V5LGMGIv62XaDKl5Ey3JGpUzPXg3KVnexJQwCIbFGLUQD5n57_Ny2vzxZiI68zx_gt8cVbnV3XyNjRUPIdWilqZZo7qrqzOOlghhEj9nYh3gjtxvrHWZSsycu7LddbIuugZR7S0G_fIIW81VM0HVmqjMARflvorPZ8N5HF5_Ya2ZmOQKV9GgJr6dLWwFXPzR6Hm4hWr7qBUVggrHEKEiBRM315q0wK7Qe-KWISlDrCZoV9kTOUg4H5HbRgUirXuncWKDzO2b8WjzWV99NIxc-Csm8R6lPq4GV7ofnG7zhFHuvB85EyzBP9M3nCNz0VJM9ORWGOg-vnkVqanpwlv1QT2YZIWt41bBPrka2BaT_CxKLjglXDSc6YiJ_T26iN6rvGj6t6NDZH4qfvkkuE5ng72oS1cDg5gl5Dh05KOpFQ3DK0hRWG-os9-wV0tN0YWKhYeA_i5y8OV6xE3gcR_BV3PqBIEPNU-fv7nh3pnnNT9vsg_BUmAgVni1pjkxqVY7j6J0utQeAvuI_9YIC2Qk2ABTqLBgv4mdBU_p--Oks-cr1ymHheRHqW0XdOLq1uMPRaRT9Y0CD30mM2GAsycasrggiWpfvSMqovaL8Y2zh7zogPse0DISl8JMjOo_81OmpK2ZDUfgaeVm3qVPhpiMHTo1rOI2SG5IiKTgYKeBpUAxmXuUVuvXAEAqkHok0J4ByMvpl_eYvOCByUC2Xy5JDnr1fsYpg_g1mV_oXdMhSExyW8-Or6x3Y1qUBNbdMhWezcEgN1uYkzSDtPF9ffpxGLVRbx-FituepD1nlehlRDnK_sEn7NLnzLz5gUXxGSzMEn-iA6oVySF-NB17ryxTcjPttqCxqEhRc5sgEcLNkQ8Mxk6ZmL4wfsY1vCVILwhim4bQbadIBHj3do4F1x66cOG8GQmfLFKk5YOq8omNC5sez4XhPo3we7RtTxl_oN4lfec4J-eHf7GpiuYjmRpavlae5sZ5P6ubRxx3-u1_RYXK8fPzjMmaITpVFyIZW9dA5XQuumA0sadr8G6WgpV3GGr9SZkQT0Gh0qRgOzB3muNXLjuSzPcPkVV_KoYMb-KNFaMaSvRVEXUlkk1LdRHk6I88dN9b0nOrexJF_BiWfdnN0Fr1u-MW79F7i2CNYXug_ZT599SkZaCCtLGyxK4ijDL1JBe6y1w6ZXNILKDUPHsafh3Xg1Yym1IQh9exaRl7cUc2DJu7PK-Y0-_ifp2DmhtN_Bsn-QQ2AsATDXJGhSQssJEvkBgSOiJPNpReGcyvyWFz1jt7YemXFOpW_svGLKVe9DfECG59feb8ikqR72FqQwGx9BEbLJ1jbH14YpBy4j1NOvPeih3B58KBz9ekLs9jSrSvFeW2tBhxd_0hrI1aAyHxfDosltaAweGFpRR4JNcxTeriVHbp2_NKthcNVVVW0hyXw1liaoyorVJgYp_GWVJ73k8d9PBi-Qej3FShfKK8xauW-1HqcIFUXzMRk9TmYZGrU8IO_6YPjNubgP-FXZByEOGHnQDkcSkleGM94L9NwaeNbq0I6FVbAZ3slQZmi7N5rSNfWe5crsm0J21Et-TraZ2gbi0A14mXH3LVSiWj5ln7oqWpoiPesJdTXyKtXjVlvhA8VfGVddQBrXK6wUYO6dz2mnIVb_HjjMJvaeCZ9wLlBrp7BPmrX_XNmO34bQ0NRMLFXW9M-DBhqBBQfGiw8lUJgnnFfU21ZJCoxRz-AM_JLlc1IjZppyrCwcUgMA1Jr6-SwCNkt1H85oRioO--aCsQS0dSwUKzVfbPpZAKn04rR-3gG0ew5wa115LNtHM86fsA94DNxSLZ1cw05vDoMn9HSukxLlX8hyV7z6jJBM3PlUBHURQG69542RmKxqOJ3E-L3dzvH-LFBBmK6FrirTJ3A3EKgf4AUWlqnSQOPw-P1bHfP3G8dqLCfNVPLwDL6F1GP3o9yR_ewAnEK7qqNjLg19ZI6ZvgPhrNchQUQ07Ku73DBPItfrEKORarPIViZERogiBjJF3wpwZJngOATw3pw0M_WsoxGz25loYHq8BPVQJeR1dgYG4E3ed_GkzNEZ5Vto8ZzDFH93ofNMlznHKQQhChwo_3-7yjGRmaQWccZOcv6NeE6MkuUycssQyJo49NbZOnLNUmmo_yXaJVk8SpoZh4S4p42c_2A4uQAtkCzPAD9alYEFnGQZpIJDJaYFQgENN2hd3rumCE0NC7CcvxwdQWtcT_yLPnxLlzuPJQFD0CSWNb5ar9SKLwme-AoK2w-dCs_fvpoVvzLLtqcr5T05bMVdqIayRnjLes2eWdPPlIUL25n5AcG55dUPBXkVutYnYAMEK7YMY82p0LP_2PpPFA-JH9rpzCh6I-ScywJZ3LPd9lrx-19AAkIyIM9M8G8fsfjWe1_bipkdn-xAxa4w58N8f21oaGu2AoJt7ugpeZQ8-clWh72jLmlVahmzV-pYFCPtSBNxLFPOtkc70BiehIosAoaJmxU_FuiO5Beluga6L-DXZY4gJ_epk0ZrxrCp23jZepefdm2NkzdemeRvonSI2X3AegB9hb90Ayf2i-HiHQbnAJjULADczhfcDeDTHS7T3TQL-ZD5h6kIL5dVJOIBxGhCQOC0jg1sedgUjFJyi68LNqDvXxSbpENu8NN4y5kIYVNNUGpU_-j1WANQGAds0OqGfrxQb4Sv2U2Sv0iQg-Rjr85qgcvP_bH7e1o1wVCxLIWkbKrh6cNKNEbYUsiVYK2dKEla2XYQyxQcuBqXLcfiYIBqLc8D24CQ2v3dK-UeM8FXdfAeJC2g2UHtqqhkaQpqWxbK83sY9oHyz86OT_Yp0qvOpqY1_0JK88CuMDutwuiHbTLZrkSWItvd4kMH8DrdIYUkYt73VzZUOSl_Lj_DopXiBUwzjACCCDfLXjzCpIYFBneu_OTbnz_-Np5bQTZEsS7AVTniza-XUkoyUXvDnuul5iFFA0nWiz1SICnhDdKUTrrMZjsLS66HXJ6wbdBDZ_e1PkCzKekRne6yazhJw-orALHbp9LEOX1bqzXUp3EEoBP7CmnjViZWCcQkZLxzdUEMb00uOZGKXeCblMrGDu4D7svS9XqJtNJ4kp92NUowtAf3SetKu1YruplIlRmJZIlEd5oWZQiR-ZKDlYcLwR84yTNsqW0VDMkT3T9H3r8OiUaeWm_M8abAkZwW-GhZZDxO-EsExRj2Lo2tBvu0mRXD98cLW4mZe_pGtbmycKYwmyVvAvOI4OgiAPxSckQJYwCVcHVw0SErtNWRpJWyJiB3psfyGF5GLZb56LMAgFpeyxxKXZ9dFqNoJ5zFsnwuaGK7A_y4IwtILoASOuLFjp-EiVqKSarHSH-200IGhHaXA_cR5Uf0iKI7ERck2YI44oteK-jxERc9CM8_pGT5oLTCoYwiEJCbbmJPqVlrTv_S2bDXJlvYngWOgNK9T7oPQ226wpluCGagf4rHHVjSvPeMXMPa255oEKwwy8OAO-IVIgGR8rhG3oYdtl5FQfM4UHIsbLWjCaDf2nylDinHjJhnIwprNcFTWmOAeC20zeRt96dHJgLSi4zf18iZ9YYX-4dIoFuATSjM25Xk3a6FFViPuqtvq0sw8-bSMlwSVBIqf_6tqpsbP9sgmM66yVNGR7F4Chpvjxyzc0jZnfxYNnuYXcwatqes76Owfkl1vG9wM902SrUcBlqRiwsnHQMa37r879BRyWJDS9IcjI2nGLiw3mzN3QiS3vJB-cDGsmTSoSrrgwFrpVQxeK0-j3lJd55UWkwE2cOj0d6f5fticfmh3ydH73I2LdpWFgZlVBRtMgAAltzHeCVCGau82gQarjxZCBv-azTH_mBtKYxRqK69sh2PaNlBsjDpNeJMdEVwCw3n4Efzco13ESor2b4P30VOW4B5T1Dn9DPJ8mEJ75PuMVnSBO70f3f8MX7Vd-Oz9Neb1Iqjk7FsAkCLwALPf7Bad_XJtSjsPQgbC3KlyfDVWLGqE9jMarwAYQSmMFmGyrq1_7ZoyEREIkCdztEVO-VkLwnyp_F1oXkiD69Pw1hVsnfiEqGkCAy00OiX96WiO7FBsCuVxNVOzTNdQCF0A93rpornmSOuqgcvjhthl-YrrZhQItAE_UilNNaT2rC_BIPQbGK&cid=CAQSOwBygQiDB5ZZSVClcGumwE5pIn_VV7XYB5BFE_32uRy5fJZu8Xa0Y4u_558BB6YhPIcvzsgxDTiLFLR7GAE

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame ED5B 169 KB
52 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 12 May 2023 07:13:48 GMT

GET
H2 200 adview Show response
ng2.virgul.com/ Frame 224C 1 KB
1 KB 271ms
76ms Document
text/html 185.7.176.223
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://ng2.virgul.com/adview?a=60b91f99e4b0b65b3ce7bc5b&t=pageskin:153493&r=153493@site_geneli@yemek_net:site_geneli&l=&mt=1683875627587&userId=vneta053d54b-47d2-4394-ad52-d3209bb3e68e&vmn=60b91f99e4b0b65b3ce7bc5b___1534931456252032
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/adcode/outside.js?dts=19489
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.223 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: 6a6b89640e1cf136f687e85107323fe46d3eb0bf6572903005ba9e6829d2dd27

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://ye-mek.net
content-length: 1129
content-type: text/html
date: Fri, 12 May 2023 07:13:48 GMT
expires: Tue, 04 Jan 2022 10:49:40 GMT
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'
server: openresty/1.15.8.3

GET
H2 200 mobile_sound_on.gif
static.virgul.com/theme/mockups/icons/ Frame 9F42 19 KB
19 KB 74ms
74ms Image
image/gif 185.7.176.223
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.virgul.com/theme/mockups/icons/mobile_sound_on.gif
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.223 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: d3b45b06882fe1aa9b47a8d88df978f19ce55a249840cc1b44eed3974a0fcd6a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 12 May 2023 07:13:48 GMT
last-modified: Fri, 29 Jan 2021 08:57:46 GMT
server: openresty/1.15.8.3
accept-ranges: bytes
content-length: 19674
content-type: image/gif

GET
H2 200 mobile_sound_off.png
static.virgul.com/theme/mockups/icons/ Frame 9F42 18 KB
18 KB 75ms
74ms Image
image/png 185.7.176.223
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.virgul.com/theme/mockups/icons/mobile_sound_off.png
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.223 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: 5aa2370fd272d30acd5cb39f9b191a243d55a2adab6f0d7ff1950c39f028d331

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 12 May 2023 07:13:48 GMT
last-modified: Fri, 29 Jan 2021 08:57:44 GMT
server: openresty/1.15.8.3
accept-ranges: bytes
content-length: 17986
content-type: image/png

GET
H2

206

Philips_utu_DB.mp4
rek-n18.nktcdn.com/data/ads/mockups/philips/ Frame 9F42
Redirect Chain

https://rek.izlesene.com/mockups/philips/Philips_utu_DB.mp4
https://rek-n18.nktcdn.com/data/ads/mockups/philips/Philips_utu_DB.mp4

80 KB
0

454ms
146ms

Media
video/mp4

185.7.176.218
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://rek-n18.nktcdn.com/data/ads/mockups/philips/Philips_utu_DB.mp4
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: H2
Server: 185.7.176.218 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
last-modified: Wed, 19 Apr 2023 06:23:17 GMT
server: openresty/1.15.8.3
x-amz-request-id: tx00000000000000bcab3a5-006453c679-9e2f20a7-default
content-type: video/mp4
Content-Range: bytes 0-2913708/2913709
cache-control: max-age=5184000
Content-Length: 2913709

Redirect headers

location: https://rek-n18.nktcdn.com/data/ads/mockups/philips/Philips_utu_DB.mp4
date: Fri, 12 May 2023 07:13:49 GMT
cache-control: max-age=0
content-type: text/html
server: openresty/1.15.8.3
content-length: 151
expires: Fri, 12 May 2023 07:13:49 GMT

GET
DATA 200
OK truncated
/ Frame ED5B 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 47797ddf9560867d1c7d4c4e37e7b8816ae87b8082d3c2d915b0b3f822fac371

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame ED5B 0
0 103ms
60ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssDhH18369g3gCoT4Gq2exwJU4QtPwFE2Lb0yzJkFPiBOFo6oSqhCzt172Ejlr8djOBc-B3gNEI0aZBq-U3ZAxnnYm4qRHDdyWaqpQlOgqhfq5K6QPtbRjPlqOEtc3Q9ZTZ1EoSMb_zNqdmjk0_vnDftR9Km3ExVZPTmVVpsXb-vPjnl5bKGL2yBuCxFaRiDwjfGJoNFVBZmn9vwGjqp8zl9J_Bwykp4m8GYbntbtUWLXQLnxJ68KypMkwSAKp3-Psi26F7XeVRazaE6sNL7A1kpQtEGYrzhg7l3jOxKYsPBNYUA6zLY8F1igFNFX8HT1qevA-fkRKfMjodmw0N5RnB8PCNhQc&sai=AMfl-YRZehkAWtKSy1YaH5vXsfDCtEfed46RYGNY9pik0Lq6GMPg_3cir_-6BqM5jBqerkPwsnxCs9Zf7_WBxaP-pwdUtRiPh_sTZSAdQmaCQjpIywh6uNsJdpnCF7QXrQ&sig=Cg0ArKJSzLJVvxMKuGdTEAE&uach_m=[UACH]&urlfix=1&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 12 May 2023 07:13:48 GMT

GET
H3 200 container.html Show response
08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 8BC2 6 KB
3 KB 24ms
22ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 12 May 2023 07:13:48 GMT
expires: Sat, 11 May 2024 07:13:48 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ Frame 121B 107 B
122 B 31ms
31ms Script
application/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 121B 107 B
122 B 34ms
34ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DF5E 0
16 B 122ms
121ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&adk=1812271804&adf=3407280060&plat=1%3A520%2C2%3A520%2C3%3A2163200%2C4%3A2163200%2C8%3A512%2C9%3A33288%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C26%3A512%2C27%3A512%2C30%3A1049088%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fye-mek.net%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1683875628505&bpp=9&bdt=106&idt=236&shv=r20230510&mjsv=m202305080101&ptt=9&saldr=aa&nras=1&correlator=7072187039029&frm=8&ife=1&pv=2&ga_vid=394798252.1683875629&ga_sid=1683875629&ga_hid=1845346858&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=33134225&scr_x=-12245933&scr_y=-12245933&eid=44759876%2C44759927%2C44773810%2C44759837%2C44788442%2C44790154%2C21065724&oid=2&pvsid=4387797284332370&tmod=1638594040&uas=0&nvt=1&fsapi=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=1&uci=1.64j4q3c9dm8y&fsb=1&dtd=254

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 12 May 2023 07:13:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 91AB 29 KB
13 KB 189ms
188ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198791085&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1683875628514&bpp=2&bdt=114&idt=259&shv=r20230510&mjsv=m202305080101&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=7072187039029&frm=8&ife=1&pv=1&ga_vid=394798252.1683875629&ga_sid=1683875629&ga_hid=1845346858&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=33134225&scr_x=-12245933&scr_y=-12245933&eid=44759876%2C44759927%2C44773810%2C44759837%2C44788442%2C44790154%2C21065724&oid=2&pvsid=4387797284332370&tmod=1638594040&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.6c0eybry1l1n&fsb=1&dtd=264

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

89a6171a0c1696d59b7e25f7eb79f536d2c3655d70d7e069d9598002540bc788

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 13001
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 12 May 2023 07:13:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame F644 6 KB
3 KB 22ms
21ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 12 May 2023 07:13:48 GMT
expires: Sat, 11 May 2024 07:13:48 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 5ed7638be4b07a92411bbffe
ng2.virgul.com/tck/imp/ Frame 9F42 0
209 B 115ms
76ms Image
text/plain 185.7.176.223
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng2.virgul.com/tck/imp/5ed7638be4b07a92411bbffe?g=1&t=gb&r=153366@site_geneli@yemek_net:site_geneli&l=&c=%2Cas%2Crc0%2Chf1%2Cvv1%2Cgprec%3Dyemek%26rec_ing%3D&info=&mt=1683875627587&userId=vneta053d54b-47d2-4394-ad52-d3209bb3e68e
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.223 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://ye-mek.net
date: Fri, 12 May 2023 07:13:48 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 96CE 624 B
242 B 65ms
63ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEYhLim1AEwAQ&v=APEucNV4oEdkPqo3NyWGzwnvdQpaAuHWPxEux8iVUSX_ncfgVXK38u8PePtArBCoVOO_GKMR_WzhjYa0BIaByU2uF2JR5s_rujNBremT-WHBbn3DzoxZ9lZv2jPV8W_MkRXeRSTP_h-A_XkzukB5e2SyC8Q3i4P2szEJQzkOeynHWBZYC06Ngw0

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 12 May 2023 07:13:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 8BC2 78 KB
27 KB 70ms
69ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 12 May 2023 07:13:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8BC2 42 B
63 B 56ms
54ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AxJQHvaYpkbEWzppWtktPwN3DUg88rwKPELIs1bb62n2nuvaRPlQFhf9BCZUjnQQEjV3Zl7yCdWa2059ju80Zvez_75_gweTARf7owCYQoVzGiT3U

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8BC2 0
20 B 57ms
55ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=11288165321896466040&x=1&ct=76

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/ Frame 8BC2 3 KB
1 KB 26ms
24ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/window_focus_fy2021.js

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 06:25:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2894
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 26 May 2023 06:25:34 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/ Frame 8BC2 19 KB
8 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

01dcaf85f2ae23a30115cf4a663e90b4a507dc688c4c17f9ebddc3cf19fee780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Thu, 11 May 2023 18:04:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 47387
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7937
x-xss-protection: 0
server: cafe
etag: 2499949999788435271
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 May 2023 18:04:01 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 8BC2 0
0 85ms
31ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaR0hFT3vfBvK22yZ7dPnxKQA9erT7ksfoK7Jo7xJDYXhugTELqEYIsOy1JsJiD-_DziN8zuPAvp80DE3UhwgQ4sKZ7vkg
Requested by: Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8BC2 169 KB
52 KB 43ms
42ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 12 May 2023 07:13:48 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 57AD 624 B
242 B 65ms
62ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEYhLim1AEwAQ&v=APEucNUzyGs4oRq6UABSqf-_P_-GoghBq2GCYEDYI2PEhM6pcRT1bqtIVcatclTTWZdpvJQbl4bdzB2OUTn3GqqgZhHp9dGiEURRgwQH5R5v1iH-BMT-vtefSqhs8krInvhcLH8OXsmjwZV24A4R_3m0pxZfWT2rvkhos28c6ZQaJKvVuo1Fc5I

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 12 May 2023 07:13:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame F644 78 KB
27 KB 163ms
161ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 12 May 2023 07:13:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame F644 42 B
63 B 57ms
55ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-ChzFcct4XwhxqeDU-n2NcF_FABWRU4SKSzm37wkZjl5vglFGe72p1iLbuQLpQQUK5lQOSM3zlIHw-AFoqBJXkQ8XKl1vFM-l7f916RWdgkji1qawg

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F644 0
20 B 57ms
55ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=3496467626569839215&x=1&ct=76

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/ Frame F644 3 KB
1 KB 26ms
24ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/window_focus_fy2021.js

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 06:25:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2894
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 26 May 2023 06:25:34 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/ Frame F644 19 KB
8 KB 23ms
21ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

01dcaf85f2ae23a30115cf4a663e90b4a507dc688c4c17f9ebddc3cf19fee780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Thu, 11 May 2023 18:04:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 47387
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7937
x-xss-protection: 0
server: cafe
etag: 2499949999788435271
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 May 2023 18:04:01 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame F644 0
0 62ms
31ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQcfCvD8CpVbZOzTOEG9x4NFkAp92Rgz8GcL50lU1hZQ-GuThA6_U66NH4SWnU1qxzVkxA1teB11vHzwfT2qMOrn2E6Pg
Requested by: Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F644 169 KB
52 KB 49ms
47ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 12 May 2023 07:13:48 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 96CE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJi4y8x-evL_irGqOvv5xOQ&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJi4y8x-evL_irGqOvv5xOQ&google_cver=1&C=1

43 B
632 B

24ms
24ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJi4y8x-evL_irGqOvv5xOQ&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEYhLim1AEwAQ&v=APEucNV4oEdkPqo3NyWGzwnvdQpaAuHWPxEux8iVUSX_ncfgVXK38u8PePtArBCoVOO_GKMR_WzhjYa0BIaByU2uF2JR5s_rujNBremT-WHBbn3DzoxZ9lZv2jPV8W_MkRXeRSTP_h-A_XkzukB5e2SyC8Q3i4P2szEJQzkOeynHWBZYC06Ngw0
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 12 May 2023 07:13:49 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 12 May 2023 07:13:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEJi4y8x-evL_irGqOvv5xOQ&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 96CE
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZF3nLOeHDPsSilRSIOXp7gAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEATi1W6brcymJ2HyWxl4OKM&google_cver=1

43 B
632 B

22ms
22ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEATi1W6brcymJ2HyWxl4OKM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEYhLim1AEwAQ&v=APEucNV4oEdkPqo3NyWGzwnvdQpaAuHWPxEux8iVUSX_ncfgVXK38u8PePtArBCoVOO_GKMR_WzhjYa0BIaByU2uF2JR5s_rujNBremT-WHBbn3DzoxZ9lZv2jPV8W_MkRXeRSTP_h-A_XkzukB5e2SyC8Q3i4P2szEJQzkOeynHWBZYC06Ngw0
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 12 May 2023 07:13:49 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEATi1W6brcymJ2HyWxl4OKM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 96CE
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFBf8v5XrZjTpVPp2yCVOi0&google_cver=1

43 B
1 KB

21ms
21ms

Image
image/gif

37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFBf8v5XrZjTpVPp2yCVOi0&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEYhLim1AEwAQ&v=APEucNV4oEdkPqo3NyWGzwnvdQpaAuHWPxEux8iVUSX_ncfgVXK38u8PePtArBCoVOO_GKMR_WzhjYa0BIaByU2uF2JR5s_rujNBremT-WHBbn3DzoxZ9lZv2jPV8W_MkRXeRSTP_h-A_XkzukB5e2SyC8Q3i4P2szEJQzkOeynHWBZYC06Ngw0

Protocol

HTTP/1.1

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.2 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 12 May 2023 07:13:48 GMT
AN-X-Request-Uuid: 95440a50-41e5-4d64-a3ee-07580e997c43
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFBf8v5XrZjTpVPp2yCVOi0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 96CE
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTc0MDIxMjg5NDcwOTY5MDIyMg%3D%3D

170 B
243 B

51ms
41ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTc0MDIxMjg5NDcwOTY5MDIyMg%3D%3D

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 12 May 2023 07:13:48 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 775a473d-a96c-41ed-8b98-de4f1a9b0878
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTc0MDIxMjg5NDcwOTY5MDIyMg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8BC2 0
20 B 55ms
55ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9574254681292&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8BC2 0
20 B 56ms
55ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9574254681292&version=m202301230201&ct=76&x=1&cor=11288165321896466000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 8BC2 85 KB
36 KB 65ms
64ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CzAidyfWO6wNJ2dYtejBWny4dAQCx3YSb0YOhCY_qBAUI5q0YmVlbRRBG4nOH5MxJsQJ4833DYs7ow97uQT5Sst-VUlB7xO93oNHVvjRSxZrrHYbeg59rFwRolmqUEiiQvwbYiekKIRKBb5ZG4XYvTkyMYUYSsecdhpax4HIvdttH_Blg&dbm_d=AKAmf-BzaUiXIsRceVNH0bqZWj8i1rwS1AlmyuYYnS_53eTUtM50YBAJ9lYFbBRqB1a6C7jTuL7PkjVj90F3oiEFNoLyIOzkqTvEh4SOGLHK6OjrYgyN5VJCl6z3tl2Sqt3grGIzEUSbQYCt6qV9CdX_H8sBy_DUuuQgC2gljnk2L94KEC70MiFpInC0fpg9y54t-S6A3dukg0vL4tolR_57UuehFpqHHpwOXTJgPS0J4ct8qJnyYd97WHL6gl8f1suvogoJLiufL0IRx2s5U91MXo3g5gEFJBP_MGISyNbEHhLZ6C87wYmpqIfBGjvDNmbEPSu1pDfrpjcJorENsfmDT9pJdmjmXZJRsqxhAahrEgdbWA4zKvaVwhfAM94MWzuRhqmaG3OXQkHNWbB7-3hassZI0wKZI2__PFZ0CIdJRg65usyexT_ypbkJPfpcPTqrFhdt05puRBVpjG05hr8hEMKnaJCYmfJkwzygGueJqPfjh1Bu3bPOg4EFi-hWST5v31QElDSqTTqsm6OpYBLxLqwRp566KmOWQXuUBAHhsdUht5dobTD6Hmsn5C-Bc4vNJ0OrkslrtqOhFcal43UPbuHO4iZQMIIkjPHedXu30K1mH1dW3pAA_TA9vPhNRqlEzBrk9HIW2J8-1M4MQxLCFCziBPpIE9U39Xom10uoXm6p2o0v-Ux-n5BB0_SJ6jYXPJpp_NETT-vtvfVMG1cxjhChajdj2Qgzwn5kzKvfaHj9Pkzq87BfXjAl95RNLCuhPRkQtLg0XK8l2aZ8_srCZcOPEblhSi7bU77rFUceB96mjZjyP2OQSXC7O0aN8acLsNTGh6RSRLFopZUDZaYl6msy__wcqG0oRok8ZRNNmxBw9L_Hkn3lykG96GpmvyiqLCTHapj8Qcu-ouFMzbW2adxcFZtu6unN1jsm4GcP1EJLcHKIO-aBadhOx1Ro3khBma38a3HiYOGBPwk9ibgfzUMFnPFZHMoJoNzdQF4aV9WdSAtyTzcd5rDGnEBChVU2BL0D3wCMLnwd_OLt2t7rB4AwNWCQBrYipN3Cfw82eysSknGP5zZUEGjgl-beS9AqrAFJY_ldpEYlT0gz9nd4Kc7ea_pg4rBomNgTvJZUoXX_aCGJaXqE3Lp6cEfn2B1mqbhduywp7wLCEgQkp1_ZKp6NsNPCHq9jPuHq8dRRRPK2mQPuOhf07kH0RymC_ONbrq-Dm3Ei3Tbd6r6g02HjYwBI49nWJpENlMZbXw6c2PfPcBEAJ-1-6vibGLZBil3t8auNeVSWFYoqKPRhPom-FSDTFJV_sDRCzvj_aDo1EVTS6Du0Ck3Wv1DbkBwzxICp_Bi13XnKFmQK_A5YWB4ZNnCM1O2XNH1pp_-kOZbJDlHqeN8tzXWGaP5ICiz3qV9ygICAhvgAIsujfbaVeBrgIKqf0IQa4wlGpCkKOriabnUTePZRbyMgRgMTbI4oBM9wvLFzhobCQskf9FlLjwi58NxqhnlcTmTK-kI1SYChZdXJ6FUuj-cju3QhtKwfKFFqZAwCRwQWwHmtv74Zrbz816rKU92wBOTHhYUuU2bnWexd7huyd5qhoxfmg1hN-lVvibzGQQ9_w1wTSXUH8ax88glsFRm744JXMvw33uUzYLdL5AmidFODWQp5V9VGWWrFHhBph1PDV_LqnF_UVcy-TUkmrHsruXyY4D0PJxGEk0Oofc93Z5PwaiZ7lFjIoUNqSlPElnMICaimv0091xwFCfCbYdsknSUrO6d5Dib_pWY24tiilewnJX4xDPMHv1QJ4r1QRIvkIhkQxltj_L5snt5lVztxeVgEaREfc4hJZ7KhbUv4C_qH33g2lCFfFhlz93Wg3V_nW_YOaiX-5YSn8AJGOi3voZbbSPe17-uAjBQ_Spd2peED7H4_YCgmd8nFZv_y0-8CvxyALck_3MoLgO__09PqNpftVmlStx-3VYRZlv08gxdqbQniaSF80wTRSxT2TS_lqgWC57Fv5kkrv0rCe_EeZhwU71q_k4y9uuSTBdYHxHhfUQIACHzIGZZO1LbYPLCsd98gD2175MCeaMD_TuDzTcF9INuAhhoi9Yx8cqPEjwOpfWWwPj-3Jiq0RYzJdyxVSq2PqmRDVqLUHs7F-_7P2ffFK99FH8UhAb-89ESlRkE70veK5aLGkh0W4z1wWn3DI0BFL9o1FPFUhbSbEY6RIXXAUnEMvQkbfUskpHNMgSES9l-mky0AKbVIcFDE8JOCwN9GJ6rv2Qqn9V1hOUVu_ClLAgpIZm8_n4qRL-6qArvTlkwbLD9oP_xiO9VCaD4HSEknfNL5dM0oGnYQJsYH1WnxHzVGLsJLWCChd9ybmiFoNzjyGh0W1cfKD7dCgLwXfqoPFL6EMSYSTQST1WaYbMcdayvabbWvtOOyvjdWJjRho8hKpLZboj-eHHLvoR6KWt7U6WS05OVM5GJsYK-t4X5xf2uk2JB8OhR9k0TU-vsZToON5XcMY-0AkdFLBny_xFMJPy4EJI82uPYjKM0oI2MK8kPUFrT6YOsdrX8AdJK8bRA8lyclCzrt5qXhm5gt04Z_FsG3EXCLMk-8hdP7_te6ZhagyxCekvE2nqocF2LqQAmFmqwrR71dP0e3Hyc8Fm1Wc6IgTPzmiQ1xELj1QTD-_8gEO56PSSNpLGuwze3BWaCvz2OfPkTwNImsO8KfmRXUJDq01UPpJqfD_lAMrihUnyc-ZF8moVb6V8cCa4j9sp3HnJXLtuVnZl3yVQXyCiKgFpD1Z_ru67mFynkFW6Icb2bnGu1nYd2YO4MxeHehIrBCNaRL9a2o9D8v9he6kHZLEY395woNVkj0yrfoGk6p4Vvd9n0pwFbSvTMW-ZuezbX7i6SebZhHupWjRsN9pu1Jg9s5TEfPK4IbYBTcQKcj1UDuZGMBN0TKewiQY08TyGPROD18RTQ1V6p-Bh1sGZI93iCFzKEWPjBpw0aMsXDmN-pBMh7FpQ6V-xyJpwBHELBZt-ofnzmiyNorHznV68WbRaIqwMvHhdmU2Qx1FSnyKE5WFQ5O9W0ewacHvceBQ2F5N68zRKyKTpW3jd5z-GkP8xSfkYx9XzI-IT2oBFaucUflQKqwpW7AwAmC05SO0MsHgFKXqIzci68x5lntNva5ziHN03ZRn6TLFsftOYd1ak1n5PYKDMfQN3ATT1S3VC8PdGgbOIzT9yMU5Y8GdC0cxK7BXG0--IVDyQ82jH9y6P8fI4rUJgdngylEoaBHX1KIrvLjuA26snzxFGOAGQSajU2tDsLW0J1KksX2WGhh2cuN51F-ScPO4u8FreRYG7fHglFMd5UhIDwm_ifVdvHJlAuY0owcfK4O2Sjb4mMyuN0FWZVM8v2_kLyRxboArXJB0oboiLR7fRwjgLPc-AGl15unfuK4YsqniV-zdLtPXCBXMcvCkEzQMynLgRLnVz_IEbbSAylHq4EBU6UQy0xRrwUaJPPyiUWwcqaU6JpADhjD1LwI3B5NZ6IFC1oiItbJcWdkNxd4SlpvvdMG5DxqDt2oi93Zq5yNT0hbE_gKJXSpUI6MfiQgv1ZdEWZWCug4cBsfxTxPifIsZYzxc6ekM0eNOERBedlDFTMq0IMcgNkYvgdFJIORKo0HkWmaWi546BbBrV3AvG0ltqK3M6eYQxi4NklrhzBxW4OKq8Rmgp8L56VqJruvzdL_8tGdgc8W0VKfB5UbyiR1bCklsmUhMB-7X0bTbpUg_upPLnxzlpr6VzaSup_5IrQh2nY&cid=CAQSOwBygQiDHwZIpUvIPNdW3uWypQxXYrpFuv8kh9q1zjwKc-anhbWzivS8PW9RPbs8XwZTpTRFBqkmJWxEGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=11288165321896466000&adk=212707235&idt=76&cac=0&dtd=30

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6186cdfa3c371aed90c7f2c822df1a8e1db780cffb7a2c4d0fc15874a7237dd3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36354
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 57AD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGo3BY-wWvPTRrI4FN-Avtw&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGo3BY-wWvPTRrI4FN-Avtw&google_cver=1&C=1

43 B
632 B

23ms
23ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEGo3BY-wWvPTRrI4FN-Avtw&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEYhLim1AEwAQ&v=APEucNUzyGs4oRq6UABSqf-_P_-GoghBq2GCYEDYI2PEhM6pcRT1bqtIVcatclTTWZdpvJQbl4bdzB2OUTn3GqqgZhHp9dGiEURRgwQH5R5v1iH-BMT-vtefSqhs8krInvhcLH8OXsmjwZV24A4R_3m0pxZfWT2rvkhos28c6ZQaJKvVuo1Fc5I
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 12 May 2023 07:13:49 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Fri, 12 May 2023 07:13:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=45&external_user_id=CAESEGo3BY-wWvPTRrI4FN-Avtw&google_cver=1&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 0
Expires: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 57AD
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZF3nLOeHDPsSilRSIOXp7gAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEATi1W6brcymJ2HyWxl4OKM&google_cver=1

43 B
632 B

23ms
23ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEATi1W6brcymJ2HyWxl4OKM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEYhLim1AEwAQ&v=APEucNUzyGs4oRq6UABSqf-_P_-GoghBq2GCYEDYI2PEhM6pcRT1bqtIVcatclTTWZdpvJQbl4bdzB2OUTn3GqqgZhHp9dGiEURRgwQH5R5v1iH-BMT-vtefSqhs8krInvhcLH8OXsmjwZV24A4R_3m0pxZfWT2rvkhos28c6ZQaJKvVuo1Fc5I
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 12 May 2023 07:13:49 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEATi1W6brcymJ2HyWxl4OKM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 57AD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEMW8i32YnC2l5_b4mcxu6GU&google_cver=1

43 B
1 KB

24ms
23ms

Image
image/gif

37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEMW8i32YnC2l5_b4mcxu6GU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEYhLim1AEwAQ&v=APEucNUzyGs4oRq6UABSqf-_P_-GoghBq2GCYEDYI2PEhM6pcRT1bqtIVcatclTTWZdpvJQbl4bdzB2OUTn3GqqgZhHp9dGiEURRgwQH5R5v1iH-BMT-vtefSqhs8krInvhcLH8OXsmjwZV24A4R_3m0pxZfWT2rvkhos28c6ZQaJKvVuo1Fc5I

Protocol

HTTP/1.1

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.2 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 12 May 2023 07:13:48 GMT
AN-X-Request-Uuid: ca188579-a256-4f3f-bd02-117258a9cd43
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:48 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEMW8i32YnC2l5_b4mcxu6GU&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 57AD
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTc0MDIxMjg5NDcwOTY5MDIyMg%3D%3D

170 B
232 B

34ms
33ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTc0MDIxMjg5NDcwOTY5MDIyMg%3D%3D

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-3-125-249-165.eu-central-1.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 12 May 2023 07:13:48 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: bd870149-ede5-41b1-b2b1-6547c5665be6
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTc0MDIxMjg5NDcwOTY5MDIyMg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 60b91f99e4b0b65b3ce7bc5b
ng.virgul.com/tck/imp/ Frame 224C 0
212 B 73ms
73ms Image
text/plain 185.7.176.223
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng.virgul.com/tck/imp/60b91f99e4b0b65b3ce7bc5b?userId=vneta053d54b-47d2-4394-ad52-d3209bb3e68e&mt=1683875627587&sdr=&et=&r=153493@site_geneli@yemek_net:site_geneli&l=&info=&t=banner:153493@site_geneli@yemek_net:site_geneli&os=&c=&cs=1683875628861
Requested by: Host: ng2.virgul.com
URL: https://ng2.virgul.com/adview?a=60b91f99e4b0b65b3ce7bc5b&t=pageskin:153493&r=153493@site_geneli@yemek_net:site_geneli&l=&mt=1683875627587&userId=vneta053d54b-47d2-4394-ad52-d3209bb3e68e&vmn=60b91f99e4b0b65b3ce7bc5b___1534931456252032
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.223 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ng2.virgul.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://ng2.virgul.com
date: Fri, 12 May 2023 07:13:48 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H3 200 container.html Show response
08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame EF3D 6 KB
3 KB 22ms
21ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 12 May 2023 07:13:48 GMT
expires: Sat, 11 May 2024 07:13:48 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 04FF 624 B
242 B 76ms
72ms Document
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEYhLim1AEwAQ&v=APEucNUqvf8pR_XMOuOCISh0uhq08tU2-JE2g857SQVJn4n7v2tmxvSrNoqiYI-clvE5IUuzAGfNOMWZYA-fOkJ0Q90g6ThaSPJ1MuVLkiBcjknCFLEsdAnLDWMDgRfTVLMvX7QGkrzuN0AF5JEWnhbEO8Vs2T44Yz6KJn_3eMsNZUlltfNzS88

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Fri, 12 May 2023 07:13:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame EF3D 78 KB
27 KB 74ms
72ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Fri, 12 May 2023 07:13:48 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame EF3D 42 B
63 B 58ms
56ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Ab2PHLOA5h6bPVuEXk9b975SY2Etz6XD96xDibcFC8Fi2wlj3rRxNtRo7bn-K9IynwzznTPqltX87YuOCeGC22Lo73DBnQaAqt0fDtA9wWzD-KzAQ

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EF3D 0
20 B 57ms
55ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=10899176448837953246&x=1&ct=76

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:48 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/ Frame EF3D 3 KB
1 KB 24ms
22ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/window_focus_fy2021.js

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 06:25:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2894
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 26 May 2023 06:25:34 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/ Frame EF3D 19 KB
8 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

01dcaf85f2ae23a30115cf4a663e90b4a507dc688c4c17f9ebddc3cf19fee780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Thu, 11 May 2023 18:04:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 47387
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7937
x-xss-protection: 0
server: cafe
etag: 2499949999788435271
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 May 2023 18:04:01 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame EF3D 0
0 32ms
30ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSH2UCMUkkr6r6-5GRFRezwEQdbSzv9VfY9VcvGZSE3N8qJW7l65cz8VhnTGVrRbwpDcnWGaIVP-YzIDGGaHMS6gspNtQ
Requested by: Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame EF3D 169 KB
52 KB 51ms
49ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 12 May 2023 07:13:48 GMT

GET
H2 200 XassetrGVaWW53.png
ads.w55c.net/t/d/ Frame 91AB 43 KB
44 KB 117ms
27ms Image
image/png 2600:9000:2491:6000:1b:f040:3600:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ads.w55c.net/t/d/XassetrGVaWW53.png?at=0&rtbhost=conf01-europe-west1.rtb.roku.com&btid=RUJGRDhCNkMwNkNCNDlDREUyQjAxMjg2ODE0NDY2MkZ8R0ZacFdzZmRzenwxNjgzODc1NjI4ODk0fDF8WG1FS1o4a2t0eHxYUnpvYlBzTGhWfDMwMjIxMTkzM19FWHw1NDExM3x8fHwuMFB8VVNE&ei=GOOGLE_CONTENTNETWORK&ac=WFM2YVdYQTl2bjpYU2YwU29uZW43fDB8MHxFVVI7&js=0&ob=0&ccw=SUFCOCMwLjc4MjA2MDl8SUFCOC04IzAuNTc4OTIzOXxJQUI4LTcjMC4xNDgyNDM2NQ&ci=Xmwo1n97Q8&psid=NTkzOTA4MTEyNTc&s=https%3A%2F%2Fye-mek.net&ts=1683875628897&c=DE&r=NW&m=0&pc=46236&epid=R0N5ZS1tZWsubmV0&mi=d2Vi&wp_exchange=NWP

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198791085&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1683875628514&bpp=2&bdt=114&idt=259&shv=r20230510&mjsv=m202305080101&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=7072187039029&frm=8&ife=1&pv=1&ga_vid=394798252.1683875629&ga_sid=1683875629&ga_hid=1845346858&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=33134225&scr_x=-12245933&scr_y=-12245933&eid=44759876%2C44759927%2C44773810%2C44759837%2C44788442%2C44790154%2C21065724&oid=2&pvsid=4387797284332370&tmod=1638594040&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.6c0eybry1l1n&fsb=1&dtd=264

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2491:6000:1b:f040:3600:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

96e22a33f827f042ac4b239c21f468a17c87545df3f6b90e100d3a91b253a1e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id: 77muH8mujF9NEC9ipS.55iMMWqUaEtvK
date: Fri, 12 May 2023 07:10:01 GMT
via: 1.1 099a327961f82798658bf21aa210d4a0.cloudfront.net (CloudFront)
strict-transport-security: max-age=2592000; includeSubDomains
x-amz-cf-pop: FRA56-P7
age: 229
x-amz-server-side-encryption: AES256
x-amz-meta-width: 728
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
x-amz-meta-filesize: 44534
x-amz-meta-height: 90
content-length: 44534
last-modified: Wed, 03 May 2023 17:26:36 GMT
server: AmazonS3
etag: "ccf751b21647e448aa5dadd8c05f5ac6"
vary: Accept-Encoding
content-type: image/png
cache-control: must-revalidate
accept-ranges: bytes
x-amz-cf-id: aRms0CHfrWBWuFTl_TpokWhUBzC_3Y-SyQ3sNjX-ZecrXj6ItUSLRQ==

GET
H/1.1 200
OK pixel.php
t.hspvst.com/ Frame 91AB 95 B
916 B 221ms
53ms Image
image/png 154.58.197.185
COGENT-174

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.hspvst.com/pixel.php?id=2677&t=P&cb=2474276183460010
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198791085&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1683875628514&bpp=2&bdt=114&idt=259&shv=r20230510&mjsv=m202305080101&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=7072187039029&frm=8&ife=1&pv=1&ga_vid=394798252.1683875629&ga_sid=1683875629&ga_hid=1845346858&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=33134225&scr_x=-12245933&scr_y=-12245933&eid=44759876%2C44759927%2C44773810%2C44759837%2C44788442%2C44790154%2C21065724&oid=2&pvsid=4387797284332370&tmod=1638594040&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.6c0eybry1l1n&fsb=1&dtd=264
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 154.58.197.185 , Philippines, ASN174 (COGENT-174, US),
Reverse DNS: staticip-hv4m185.hispavista.com
Software: Apache / PHP/5.4.45-1~dotdeb+7.1
Resource Hash: 3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Fri, 12 May 2023 07:13:48 GMT
Server: Apache
X-Powered-By: PHP/5.4.45-1~dotdeb+7.1
Transfer-Encoding: chunked
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Content-Type: image/png
Cache-Control: max-age=315360000
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Keep-Alive: timeout=3, max=1000
Expires: Mon, 09 May 2033 07:13:48 GMT

GET
H2 200 creative_add_on.js Show response
cti.w55c.net/ct/ Frame 91AB 5 KB
3 KB 129ms
23ms Script
text/javascript 192.229.233.53
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://cti.w55c.net/ct/creative_add_on.js?w=728&h=90&zindex=0&ci=Xmwo1n97Q8&ei=GOOGLE_CONTENTNETWORK&ob=0&ai=0DaDXCcU00&epid=R0N5ZS1tZWsubmV0&fiu=WG1FS1o4a2t0eA&s=https%3A%2F%2Fye-mek.net&ciu=XRzobPsLhV&btid=RUJGRDhCNkMwNkNCNDlDREUyQjAxMjg2ODE0NDY2MkZ8R0ZacFdzZmRzenwxNjgzODc1NjI4ODk0fDF8WG1FS1o4a2t0eHxYUnpvYlBzTGhWfDMwMjIxMTkzM19FWHw1NDExM3x8fHwuMFB8VVNE&c=DE&dt=2dt0005&sd=ye-mek.net&cip=1&hmt=1&uidu=CAESEN3iGAa1kuFv-YFE2GvbT9c&spidu=GOOGLE_CONTENTNETWORK&pidu=ye-mek.net&hmpvu=491ec925-2269-4887-8879-7ecce3b74f09&hmtsu=3&odtu=2&mtfu=1&crdmu=728x90&cridu=XRzobPsLhV&

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

192.229.233.53 Granada Hills, United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECS (frb/67DF) /

Resource Hash

6a88e0d82ba2998038cc86adc47bfb48d21e6114e18d97f0ecd05f5df519a95f

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
content-encoding: gzip
strict-transport-security: max-age=2592000; includeSubDomains
last-modified: Wed, 23 Feb 2022 16:57:18 GMT
server: ECS (frb/67DF)
age: 137624
etag: "3321997696"
vary: Accept-Encoding
x-cache: HIT
content-type: text/javascript
cache-control: no-cache, must-revalidate
accept-ranges: bytes
content-length: 2391
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/ Frame 91AB 3 KB
1 KB 28ms
26ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 06:25:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2894
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Fri, 26 May 2023 06:25:34 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/ Frame 91AB 19 KB
8 KB 25ms
23ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230510/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

01dcaf85f2ae23a30115cf4a663e90b4a507dc688c4c17f9ebddc3cf19fee780

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Thu, 11 May 2023 18:04:01 GMT
content-encoding: br
x-content-type-options: nosniff
age: 47387
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7937
x-xss-protection: 0
server: cafe
etag: 2499949999788435271
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 May 2023 18:04:01 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 91AB 0
0 31ms
30ms Image
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTiP4n8yHHkztsyYnSL4E5-mKT4bozKsZHhllCXmsX7IOnUIEmqNjyHdg1TrJ30oGEZJ4ijM49V1vCke5D6kpNyojcEhA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198791085&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1683875628514&bpp=2&bdt=114&idt=259&shv=r20230510&mjsv=m202305080101&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=7072187039029&frm=8&ife=1&pv=1&ga_vid=394798252.1683875629&ga_sid=1683875629&ga_hid=1845346858&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=33134225&scr_x=-12245933&scr_y=-12245933&eid=44759876%2C44759927%2C44773810%2C44759837%2C44788442%2C44790154%2C21065724&oid=2&pvsid=4387797284332370&tmod=1638594040&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.6c0eybry1l1n&fsb=1&dtd=264
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 91AB 169 KB
52 KB 55ms
53ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdc79b8c47c6d5c20def82fa5f6a91e3cbe3057bff3f8b14b5c2c71dc9b57ec4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1683718549123860"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 12 May 2023 07:13:49 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 91AB 0
0 65ms
65ms Fetch
text/html 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CrIPoLOddZMOVMozm6wTUtL_wBLqItI9cnNfu7qkIwI23ARABIABgldKfgrAHggEXY2EtcHViLTY1OTM1MjMyMTAwMTAxNTTIAQmoAwGqBNIBT9COqMcnhQkRtzPRQRxWB5afq0kVOEEjmrjhoWkyXTvq2Lm6z4N6mAaJ1qudwsOcSrz8DHgCyqg93DnEYLR53j06PR-EiG67VcxAN1yRNVcm8ZGIEaO-xgacnSGCAU2uP-NML97HK8mVYAdrKp2bdruSGW8DFJcZ2yoluQWk4RxW5V-GfrG_VeZZfy-qO8hZuX0zYwWbjjHnH6P_zacD2AhxFqbduciy7o7Zd0qhD32oTT7le0XpEbEDrTNBCJ83qjJuiiRy-H8z5Hi71mSU6V3dgAbRyaWX66WWlesBoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQIAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi02NTkzNTIzMjEwMDEwMTU0GAA&sigh=i04wOJiNeaA&uach_m=[UACH]&cid=CAQSKQBygQiDJnoz5Wh3VM0p3opE9j4RSKh_lcOtqPwx4s-js5942RGLuxTDGAE

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198791085&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1683875628514&bpp=2&bdt=114&idt=259&shv=r20230510&mjsv=m202305080101&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=7072187039029&frm=8&ife=1&pv=1&ga_vid=394798252.1683875629&ga_sid=1683875629&ga_hid=1845346858&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=33134225&scr_x=-12245933&scr_y=-12245933&eid=44759876%2C44759927%2C44773810%2C44759837%2C44788442%2C44790154%2C21065724&oid=2&pvsid=4387797284332370&tmod=1638594040&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.6c0eybry1l1n&fsb=1&dtd=264
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 12 May 2023 07:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200 a.gif Show response
i.w55c.net/ Frame 91AB 42 B
582 B 106ms
24ms Fetch
image/gif 3.125.249.165
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://i.w55c.net/a.gif?t=0&rtbhost=conf01-europe-west1.rtb.roku.com&rts=1&btid=RUJGRDhCNkMwNkNCNDlDREUyQjAxMjg2ODE0NDY2MkZ8R0ZacFdzZmRzenwxNjgzODc1NjI4ODk0fDF8WG1FS1o4a2t0eHxYUnpvYlBzTGhWfDMwMjIxMTkzM19FWHw1NDExM3x8fHwuMFB8VVNE&ei=GOOGLE_CONTENTNETWORK&wp_exchange=ZF3nLAAMisMKmvMMAA_aVPEWGPD_RjVqFm1aPg&ac=WFM2YVdYQTl2bjpYU2YwU29uZW43fDB8MHxFVVI7&psid=NTkzOTA4MTEyNTc&js=0&ob=0&ccw=SUFCOCMwLjc4MjA2MDl8SUFCOC04IzAuNTc4OTIzOXxJQUI4LTcjMC4xNDgyNDM2NQ&ci=Xmwo1n97Q8&fiu=WG1FS1o4a2t0eA&fid=XmEKZ8kktx&sd=ye-mek.net&s=https%3A%2F%2Fye-mek.net&ts=1683875628897&dvdp=i.w55c.net/dv.jpg&ai=0DaDXCcU00&c=DE&r=NW&m=0&pc=46236&rnd=2474276183460010&epid=R0N5ZS1tZWsubmV0&ct=b126c92c760c4964ba6058483a07fa14&os=Mm8wMDAy&dc=NzI4NWEyMmNjZmE2NGM1Y2JmMzBmYzExNmQzNGFhNGU&dv=MUxWSXJn&dm=MU1jYU9UR0ZnRw&l=dHJ8fA&ri=2rxtlU&cip=1&alg=TGcwMDA4&v=2&euid=Q0FFU0VOM2lHQWExa3VGdi1ZRkUyR3ZiVDlj&mt=2cmt0001&mi=d2Vi&dt=2dt0005&tz=RXVyb3BlL0Jlcmxpbg&sg=Uyf1BHBVCgICF_Z58ZKhvg&buid=Xdb4DXiaK1Q&hmt=1&hmdp=s.h.w55c.net/2/948461/analytics.gif&hmtiu=9484611643830741015000&uidu=CAESEN3iGAa1kuFv-YFE2GvbT9c&spidu=GOOGLE_CONTENTNETWORK&pidu=ye-mek.net&hmpvu=491ec925-2269-4887-8879-7ecce3b74f09&hmtsu=3&odtu=2&mtfu=1&crdmu=728x90&cridu=XRzobPsLhV&naoh=i.w55c.net/na.gif&ndgh=i.w55c.net/ng.gif

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.125.249.165 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

PixelTracking/v2.0.30-777-g304ac51#rel-ec2-master i-0a1a90ed6ac66fe36@eu-central-1a@dxedge-app-eu-central-1-prod-asg /

Resource Hash

47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 12 May 2023 07:13:48 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PixelTracking/v2.0.30-777-g304ac51#rel-ec2-master i-0a1a90ed6ac66fe36@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Content-Type: image/gif
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 42
Expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F644 0
20 B 56ms
55ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=3815707240819&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F644 0
20 B 56ms
55ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=3815707240819&version=m202301230201&ct=76&x=1&cor=3496467626569839000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame F644 85 KB
36 KB 75ms
74ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A4iKDH2w_IzYNcrY_vc4TVDLlW-vAT9IuP4w4wdkH4CD4pxVZFI7CRiJ5lim-8rVQYeutqVysLnhP7zUwwjoa0a7yOpt-5YmPzCf9_8vmukbazzfFwGNCUPaBfge1NE7iP5QESjmYCnSmaPI6MzkpjZkODSC-rds7bGTDlDPLmDdxFZbU&dbm_d=AKAmf-BwIrBglSSHPdR4jS3TDDsIMuicDaym4QJn_rNQ40AGSTVYjSLiLshQq9SYPidm9Q8DiaVtjkeAVCB-6zuNd9Vn2AaSWN_d2NmDOZ1W1EQtet8w1UOeor8n8ZV_P_eyZPAsTb9FwFPKglPsVC3xshO1uO1pWg4W5XFftCcEJHl8w06LvNssPxUPHefhjj83i-y3JHLa6vkWPBhJjcJ6FRHR0NESvkSuA_hgQ9RQa7LFmfhx_9quwcZXEM27X-y6PJDLd_xFu6rXIWWYZdURxqoBeweMVNzdR8X7YbtFKrfm_OJllnjTtEBjxjICybaI_Cl8t36PlVnBW4x6gG9oKMGl5fHX7pb3xBeXSJRET1mOCj2xSO3HqyWcA87dXMgsmsu33CYiKCLGPRrvg-K_N0rPLGLD9jNnIJy7Vv-9j-u_66DYJZhZlJ1GkfP8Cm6Hu9jmIZpYFJ4ZhD0N7w2vHi4rU4Sgb2eOModZyyMQkCkCqhZsVTjE_bumzJ-Kf4DIoFL5bAe0vJGP1EmuMgSv73pd4FEUHwq8WHX7oE-tkYKMWCCFAZDQxK71PiBmRC_Qx5lV_eRNdHHgLizGbucqqzIkbZSmIzx3V-L0jrvtFOF1DlLDFPoYC1-TIIQiVFiPqO9hdRqNlkAkjFYsz4nzn45us1Rp7QtB2fCKQVk0yoLujgtdPCeUj5Wmyath_4kBRVR0KTudgQiGFMEUcq5pmlr1_grC8BsXfN8SYmmW3Xqo81k6xeG816irXY30aGZ_grgOBIZ16GqCL-8FQp88IAAOe1MZvckGnneoo5fMawHQ3DI75uO6_XPfRf8w4UKopHOeii79o3MSXqfBTgvdgaNr1AK-agjZLLNIXMR1sXZ1s94FJ8AWzkkFzYUCBO5jA_mttvggwlFuc6z9eu7YhOOee8_tK9iAlwUvlXVaY3EMXpAsi7s79fduJYp-WXXVou7DSHUVEEnMlHrJPAxx8YHZLn-Mh_NWbV2jddpYs4DwEUhDY6g0JiuuZVD6Dr_DLDTxzxlDQtOvZcNw949UiF0fegwXtfNQu9zOTgK_ZbsMrYAlJzAvWMAT4z4tH_6GGAcCNZ_Pq_wclHsff398PogOggzmaJkU2gq37odGrLqo4M1R0d-Vt88Z9NoStpfP_wNd0av6B2glVgakHwMafjzAKvxkahwOxYlo6fNyQAfZgBFt52-NhLPlA9uWXctyX2q66pRw_xu775us3pGistlWcj1RzIVGHMAOlcX6ZqUby4KX7FgmUipuGY7aClwcopGODyfDZrSjA1W4OQKL2oKqZy87thMPzEme4vXr_7oXjnOG0pM1rZYUVnrCxHXzxUZH5PJ3HIvHiBul3wZP3vNp1am-YMZIGm8dlEpEa4CnTZnWc8nNT-ByjIS_6v_P_K3vzfjGP7OJXlH_R3hWOUTUxtbW5FJEj8llesaCDfLA7rjAQKQn6R8IwtCr1aBGPiPZYfCivuhfGwtULjjAlqduVaM9L69pnCsuxtbogFrPKAs9YWKoBccPhZooBLtuGAhDvaJyx2LaUUXowldUCWjdLzCXCZeVLULfVkfxD7sc7OnygEBKEVxhAJETp_8k9_e2mZDX_0IuwwV2M0Ja8aFrXu0hbzRHi_dmjpJvV4fluFuaK67CU7GlZIdHoLI_MxUy5v5Ru_tPlkkGbz66EdAOC237MpiMELBj8DkMD_Z-Bo6QLJmx7pmA3fZMKA1OqGWEaYT55K_wC4X6ApFcFi58c4CEooJbe26AZYgbNCplak6p06tibALQCHE-icoNZzeE54ov81HeRPPOXFkjI2M8qW35NAU_8WDkgChMLE1nQEUxzfg4z3f7EyawtSdybAwS8AuOwYFr8kjNhK1TBIYHte56ZUeqeIBl92__NKFk3gsGAgAaJyVES8U85NkljkBhK7a4ZKT_6gRqxR-W7ht-s50YE6GWE2PfYn-0dA9TFhflcnpKZYw3XNNeF45DeiLaZ72K_k92QbVOjpVIybCrIivSZMb2oNoPkvfNe22qrzLwn8hG4GDJAmdeJfWPbAutjSTaLLS60e5EeRhQHu8dcc7QgEkl3YCSUPhriVOA4zNK1DB57wxO4OLvRVlVV3Ocg64zA5wSukjR6ufwktQueuHjWTLxyQoZnomKGRQvAYABWuD3e0SDtNzN2y_tEHp9tRSOJ9dWAjedNLPbD4w0b2PVAxB4KMkmWCJ4r_S4QCuWu_JM_MvAC5zBYtxcHTKxVJkVd9TMTemHovxD9uxyy0HXCqBnFX58K9djzX4m6UIgJdIOE8aH4DjfTk4vhbEEPQkVu7Idn1VFyvo9SdN2i4K1bW_ughvYJ6Ck43cvzsdD9jROTXJB9Dg_kcUANyxCqOg_8uae42uROyoVZB_luvlLZXvwjtQ5HH_SkorEG_Py-kqwhCOLJIOUKgSCwiz4trHTrA7wkvxJDSlwG_IAVfUby6LpukxCSFeVhMunlyQa3OHa7JzFjJOdC_G28m_8zREBq6qbJk-LgmlA4QjfJH0CgjxtXrSgTuCCCBFV8WQ8axpvHQtox3BMdCRyx5sG47ISyk2yFHM0aYhRDy2l0FMPb1AcjtE9A83QNfunH2mvERDyKiN1gKLPUUM0aAu2zqVJFd068OtoAim3vYj4UTdYJyaF5g9I0w0gOH625zZh6ns45QNkDlHErGK3T9CwtrRPoRaVlyE2STeoPZ_m39mkfvy-vt9w_qo3OYyLkuNRhT6TmGRwGINtLp9_xtAoKpsMLrbwN6206di7nlfvsQGkYDmkPrSER62PY3n93NVK9r1mPwH-n8SRcmtqNIog0hxt5Un62JUoqfMBl9RO941ToGv1fPTju2FbAos4qMoHk4EG-lug_q22NYiYVGzEY3Z6nwfKHeHvAzCCqkINwHJZVVA27VHRg8YBjnC5QQ0jBgdMpLmJUQ71WDnU3ML9lB8acHLHWDNk6tqc1pi8nv2uP5bfMeswEjyyrQoM4Yxar00Nt4gAbF5Ol-eZNkzaZ6YQeP-5Y29TYlOd8jJuyYT671fEL6vn-5dQJSvALR4KLTYq8VMySKa89exLCftFJRDuZ3bHfOpNmi9cqdVv3EavUeGWjQ1LPHo9z5q4etXO7IpyLSIELSiOeUC2KVS47bhWL-Pgrlq2YBfSt7rphf_ipH2o-hJgK1x4mDfuX3jc_1QQpk9_Qr72exWhAiMyiPyyeAjYk3eefsVdCE2ajVIz_uxWiDnKB4L6b7wp2F0jVtyXwuswgo1PF-oPmiHXDDXesgBDLKPGrB7rO2wm20o9-P0GbaR2xGzGDSHBYSlZdTdOpL850sYuwZrcFRdxbfzihF6uEEcYKEXqHCa0BJssObZKW-Ml3KaC_OMvXL7I3xnm5hhkfZekYY7zXwn-_ZUFZUyKnkUm0kpoXrz7VB4t074FL8oyEoT_khbSxuDHHiZCG567yfIklW_32oc_r28FDyCntAqwQldzVxqRn4I-hNS6J3pRGWFznSl0766efJTYf3_xZWyTYOWdg_-H96W_6xKLQ7UTviAjHlfqCb3x4PCAlFQE2odAdImp_txcCdCYfZv6G9EAUCfbiAPhqrLJPei12aqLRCTqiilTsJ55TWcpgJPenQvI1qcwpBuY2nsEpS-dfpFBZyH7cJyfs121uHUXK_4ZlybpRMWHV_Gr3rUwFuiOiTwOXPDMcvsBMbob8-gBog7Rv_mcl0-RHH9MsJjQQPlGnxk5WjOhzVABMnN1lGLfkrwFOG-swnN4d1o&cid=CAQSOwBygQiD9VkOzmOMKZAPpjBsPIzrI7jp1s97ZmuMrEGGNjr1jGN-VrtERkUWkhFAZsY-mjRq41IAQbViGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=3496467626569839000&adk=3587751834&idt=170&cac=0&dtd=10

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e0a2e59733d6e88bc887e607fad372e4a59e36c08fa9a7b71e15ba1b8bd4fb51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36430
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 8BC2 106 KB
37 KB 90ms
23ms Script
text/javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
Origin: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Thu, 11 May 2023 09:27:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 78396
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 12 May 2023 09:27:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230510/r20110914/elements/html/ Frame 8BC2 11 KB
4 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230510/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CzAidyfWO6wNJ2dYtejBWny4dAQCx3YSb0YOhCY_qBAUI5q0YmVlbRRBG4nOH5MxJsQJ4833DYs7ow97uQT5Sst-VUlB7xO93oNHVvjRSxZrrHYbeg59rFwRolmqUEiiQvwbYiekKIRKBb5ZG4XYvTkyMYUYSsecdhpax4HIvdttH_Blg&dbm_d=AKAmf-BzaUiXIsRceVNH0bqZWj8i1rwS1AlmyuYYnS_53eTUtM50YBAJ9lYFbBRqB1a6C7jTuL7PkjVj90F3oiEFNoLyIOzkqTvEh4SOGLHK6OjrYgyN5VJCl6z3tl2Sqt3grGIzEUSbQYCt6qV9CdX_H8sBy_DUuuQgC2gljnk2L94KEC70MiFpInC0fpg9y54t-S6A3dukg0vL4tolR_57UuehFpqHHpwOXTJgPS0J4ct8qJnyYd97WHL6gl8f1suvogoJLiufL0IRx2s5U91MXo3g5gEFJBP_MGISyNbEHhLZ6C87wYmpqIfBGjvDNmbEPSu1pDfrpjcJorENsfmDT9pJdmjmXZJRsqxhAahrEgdbWA4zKvaVwhfAM94MWzuRhqmaG3OXQkHNWbB7-3hassZI0wKZI2__PFZ0CIdJRg65usyexT_ypbkJPfpcPTqrFhdt05puRBVpjG05hr8hEMKnaJCYmfJkwzygGueJqPfjh1Bu3bPOg4EFi-hWST5v31QElDSqTTqsm6OpYBLxLqwRp566KmOWQXuUBAHhsdUht5dobTD6Hmsn5C-Bc4vNJ0OrkslrtqOhFcal43UPbuHO4iZQMIIkjPHedXu30K1mH1dW3pAA_TA9vPhNRqlEzBrk9HIW2J8-1M4MQxLCFCziBPpIE9U39Xom10uoXm6p2o0v-Ux-n5BB0_SJ6jYXPJpp_NETT-vtvfVMG1cxjhChajdj2Qgzwn5kzKvfaHj9Pkzq87BfXjAl95RNLCuhPRkQtLg0XK8l2aZ8_srCZcOPEblhSi7bU77rFUceB96mjZjyP2OQSXC7O0aN8acLsNTGh6RSRLFopZUDZaYl6msy__wcqG0oRok8ZRNNmxBw9L_Hkn3lykG96GpmvyiqLCTHapj8Qcu-ouFMzbW2adxcFZtu6unN1jsm4GcP1EJLcHKIO-aBadhOx1Ro3khBma38a3HiYOGBPwk9ibgfzUMFnPFZHMoJoNzdQF4aV9WdSAtyTzcd5rDGnEBChVU2BL0D3wCMLnwd_OLt2t7rB4AwNWCQBrYipN3Cfw82eysSknGP5zZUEGjgl-beS9AqrAFJY_ldpEYlT0gz9nd4Kc7ea_pg4rBomNgTvJZUoXX_aCGJaXqE3Lp6cEfn2B1mqbhduywp7wLCEgQkp1_ZKp6NsNPCHq9jPuHq8dRRRPK2mQPuOhf07kH0RymC_ONbrq-Dm3Ei3Tbd6r6g02HjYwBI49nWJpENlMZbXw6c2PfPcBEAJ-1-6vibGLZBil3t8auNeVSWFYoqKPRhPom-FSDTFJV_sDRCzvj_aDo1EVTS6Du0Ck3Wv1DbkBwzxICp_Bi13XnKFmQK_A5YWB4ZNnCM1O2XNH1pp_-kOZbJDlHqeN8tzXWGaP5ICiz3qV9ygICAhvgAIsujfbaVeBrgIKqf0IQa4wlGpCkKOriabnUTePZRbyMgRgMTbI4oBM9wvLFzhobCQskf9FlLjwi58NxqhnlcTmTK-kI1SYChZdXJ6FUuj-cju3QhtKwfKFFqZAwCRwQWwHmtv74Zrbz816rKU92wBOTHhYUuU2bnWexd7huyd5qhoxfmg1hN-lVvibzGQQ9_w1wTSXUH8ax88glsFRm744JXMvw33uUzYLdL5AmidFODWQp5V9VGWWrFHhBph1PDV_LqnF_UVcy-TUkmrHsruXyY4D0PJxGEk0Oofc93Z5PwaiZ7lFjIoUNqSlPElnMICaimv0091xwFCfCbYdsknSUrO6d5Dib_pWY24tiilewnJX4xDPMHv1QJ4r1QRIvkIhkQxltj_L5snt5lVztxeVgEaREfc4hJZ7KhbUv4C_qH33g2lCFfFhlz93Wg3V_nW_YOaiX-5YSn8AJGOi3voZbbSPe17-uAjBQ_Spd2peED7H4_YCgmd8nFZv_y0-8CvxyALck_3MoLgO__09PqNpftVmlStx-3VYRZlv08gxdqbQniaSF80wTRSxT2TS_lqgWC57Fv5kkrv0rCe_EeZhwU71q_k4y9uuSTBdYHxHhfUQIACHzIGZZO1LbYPLCsd98gD2175MCeaMD_TuDzTcF9INuAhhoi9Yx8cqPEjwOpfWWwPj-3Jiq0RYzJdyxVSq2PqmRDVqLUHs7F-_7P2ffFK99FH8UhAb-89ESlRkE70veK5aLGkh0W4z1wWn3DI0BFL9o1FPFUhbSbEY6RIXXAUnEMvQkbfUskpHNMgSES9l-mky0AKbVIcFDE8JOCwN9GJ6rv2Qqn9V1hOUVu_ClLAgpIZm8_n4qRL-6qArvTlkwbLD9oP_xiO9VCaD4HSEknfNL5dM0oGnYQJsYH1WnxHzVGLsJLWCChd9ybmiFoNzjyGh0W1cfKD7dCgLwXfqoPFL6EMSYSTQST1WaYbMcdayvabbWvtOOyvjdWJjRho8hKpLZboj-eHHLvoR6KWt7U6WS05OVM5GJsYK-t4X5xf2uk2JB8OhR9k0TU-vsZToON5XcMY-0AkdFLBny_xFMJPy4EJI82uPYjKM0oI2MK8kPUFrT6YOsdrX8AdJK8bRA8lyclCzrt5qXhm5gt04Z_FsG3EXCLMk-8hdP7_te6ZhagyxCekvE2nqocF2LqQAmFmqwrR71dP0e3Hyc8Fm1Wc6IgTPzmiQ1xELj1QTD-_8gEO56PSSNpLGuwze3BWaCvz2OfPkTwNImsO8KfmRXUJDq01UPpJqfD_lAMrihUnyc-ZF8moVb6V8cCa4j9sp3HnJXLtuVnZl3yVQXyCiKgFpD1Z_ru67mFynkFW6Icb2bnGu1nYd2YO4MxeHehIrBCNaRL9a2o9D8v9he6kHZLEY395woNVkj0yrfoGk6p4Vvd9n0pwFbSvTMW-ZuezbX7i6SebZhHupWjRsN9pu1Jg9s5TEfPK4IbYBTcQKcj1UDuZGMBN0TKewiQY08TyGPROD18RTQ1V6p-Bh1sGZI93iCFzKEWPjBpw0aMsXDmN-pBMh7FpQ6V-xyJpwBHELBZt-ofnzmiyNorHznV68WbRaIqwMvHhdmU2Qx1FSnyKE5WFQ5O9W0ewacHvceBQ2F5N68zRKyKTpW3jd5z-GkP8xSfkYx9XzI-IT2oBFaucUflQKqwpW7AwAmC05SO0MsHgFKXqIzci68x5lntNva5ziHN03ZRn6TLFsftOYd1ak1n5PYKDMfQN3ATT1S3VC8PdGgbOIzT9yMU5Y8GdC0cxK7BXG0--IVDyQ82jH9y6P8fI4rUJgdngylEoaBHX1KIrvLjuA26snzxFGOAGQSajU2tDsLW0J1KksX2WGhh2cuN51F-ScPO4u8FreRYG7fHglFMd5UhIDwm_ifVdvHJlAuY0owcfK4O2Sjb4mMyuN0FWZVM8v2_kLyRxboArXJB0oboiLR7fRwjgLPc-AGl15unfuK4YsqniV-zdLtPXCBXMcvCkEzQMynLgRLnVz_IEbbSAylHq4EBU6UQy0xRrwUaJPPyiUWwcqaU6JpADhjD1LwI3B5NZ6IFC1oiItbJcWdkNxd4SlpvvdMG5DxqDt2oi93Zq5yNT0hbE_gKJXSpUI6MfiQgv1ZdEWZWCug4cBsfxTxPifIsZYzxc6ekM0eNOERBedlDFTMq0IMcgNkYvgdFJIORKo0HkWmaWi546BbBrV3AvG0ltqK3M6eYQxi4NklrhzBxW4OKq8Rmgp8L56VqJruvzdL_8tGdgc8W0VKfB5UbyiR1bCklsmUhMB-7X0bTbpUg_upPLnxzlpr6VzaSup_5IrQh2nY&cid=CAQSOwBygQiDHwZIpUvIPNdW3uWypQxXYrpFuv8kh9q1zjwKc-anhbWzivS8PW9RPbs8XwZTpTRFBqkmJWxEGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=11288165321896466000&adk=212707235&idt=76&cac=0&dtd=30

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a9b847c681a24b03ba8acc0b4dcd8aab9acf8c4d3131be784d488e2402d57427

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Thu, 11 May 2023 18:09:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 47075
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4122
x-xss-protection: 0
server: cafe
etag: 11429739870029468282
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 May 2023 18:09:14 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230510/r20110914/ Frame 8BC2 28 KB
11 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230510/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ce7aa9a76e1ef06e22d13a5c8678b9b7440f5b1f854ecb62b447ad383927abb6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Thu, 11 May 2023 18:13:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46798
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10883
x-xss-protection: 0
server: cafe
etag: 6886435266232968791
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 May 2023 18:13:51 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 04FF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEATi1W6brcymJ2HyWxl4OKM&google_cver=1

43 B
766 B

25ms
25ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEATi1W6brcymJ2HyWxl4OKM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEYhLim1AEwAQ&v=APEucNUqvf8pR_XMOuOCISh0uhq08tU2-JE2g857SQVJn4n7v2tmxvSrNoqiYI-clvE5IUuzAGfNOMWZYA-fOkJ0Q90g6ThaSPJ1MuVLkiBcjknCFLEsdAnLDWMDgRfTVLMvX7QGkrzuN0AF5JEWnhbEO8Vs2T44Yz6KJn_3eMsNZUlltfNzS88
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 12 May 2023 07:13:49 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEATi1W6brcymJ2HyWxl4OKM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 04FF
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZF3nLOeHDPsSilRSIOXp7wAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEATi1W6brcymJ2HyWxl4OKM&google_cver=1

43 B
766 B

23ms
23ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEATi1W6brcymJ2HyWxl4OKM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEYhLim1AEwAQ&v=APEucNUqvf8pR_XMOuOCISh0uhq08tU2-JE2g857SQVJn4n7v2tmxvSrNoqiYI-clvE5IUuzAGfNOMWZYA-fOkJ0Q90g6ThaSPJ1MuVLkiBcjknCFLEsdAnLDWMDgRfTVLMvX7QGkrzuN0AF5JEWnhbEO8Vs2T44Yz6KJn_3eMsNZUlltfNzS88
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 12 May 2023 07:13:49 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEATi1W6brcymJ2HyWxl4OKM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 04FF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEDHzu-oQ061ff_5EnX7J6sg&google_cver=1

43 B
1 KB

21ms
21ms

Image
image/gif

37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEDHzu-oQ061ff_5EnX7J6sg&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLfi9QIQ0YXj8wEYhLim1AEwAQ&v=APEucNUqvf8pR_XMOuOCISh0uhq08tU2-JE2g857SQVJn4n7v2tmxvSrNoqiYI-clvE5IUuzAGfNOMWZYA-fOkJ0Q90g6ThaSPJ1MuVLkiBcjknCFLEsdAnLDWMDgRfTVLMvX7QGkrzuN0AF5JEWnhbEO8Vs2T44Yz6KJn_3eMsNZUlltfNzS88

Protocol

HTTP/1.1

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.23.2 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 12 May 2023 07:13:49 GMT
AN-X-Request-Uuid: 6816b251-7b7f-47e8-8db7-dfc927d605af
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEDHzu-oQ061ff_5EnX7J6sg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 04FF
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTc0MDIxMjg5NDcwOTY5MDIyMg%3D%3D

170 B
188 B

32ms
32ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTc0MDIxMjg5NDcwOTY5MDIyMg%3D%3D

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 12 May 2023 07:13:49 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: ebbf1a15-ddfd-4a69-88ba-84ca2a490d03
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MTc0MDIxMjg5NDcwOTY5MDIyMg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EF3D 0
20 B 55ms
55ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9444926743&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EF3D 0
20 B 56ms
56ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9444926743&version=m202301230201&ct=76&x=1&cor=10899176448837954000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame EF3D 74 KB
35 KB 69ms
69ms Script
text/javascript 2a00:1450:4001:800::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AzOV3fesjxZyThNb6T-iVKFzB_5-FiRzmvE3BNBUtlPGG50mHfWqz-0EZNCDnNkXnf7BH43RQBb16PxCCFOhpHzzhz_j4Ym-kFHW4gwnw6Z3HvMolG6Ug4YTDeVCUeIhn2W8Dp3V0iXbbd00AzPa1u9DXotOMvlwforf_c3ETwu5YJSc8&dbm_d=AKAmf-AIH6jHsXYatMRP21G8z5owKgAC6zliZMZe3_l5AOJ4gQ8jmi1iZecbYxeA4-OWs0iWl43qgnFlW3V2s-drGKnVdIKSg4f3wpY-WEWtvpXH_Is6LbMVFzuMhWbfgtoq2Qq1wJbcknNbSkXTxctf6NLNv9yNLA-ZHOQ4gMVr7W0GCum7PdiNeYEUFqZVpysVJW_OTL7l00katFmqKEIi4f_Jd_m3E8f_A9T5-PGiCL6deQQ8rJk7CL0GFa72elhvNiqT6BJe2u2biNwevagh0THUc_TVeTrnsYraTR-DUXBGsRSAYd9AlJpUbjOUm5sqVm7kxQYc5RwnLzg5TEBv7LQIB4vfMZQ0ATaIvYSKb2sZr_dapI-XVBcjY25EZC-1cmIcB9rHroqNOvYhyWAoh95lnJN_ohe6veg9SsCis8ln21CArQ1gtp_Steyl0L5aQnO2Gv7UsQVk4JqKNRl89HqnP9IjnlMnS89u42Vt1eXALoCH2Lj3sTChTD4LJ-A3_3d4GtxH7uAVCducSq0EdLiu_m-dWdp-TnrOlpAblmbbBjXKmAfXqP8GqyhCQV16aiElhykhWNqv7k2NpCFXeFcBFNiR1dV3lfSfhNDYfhB1RRy76_LPsZIOLwHf6ldRlm4hPU-12T-fwPy-41Z16uBtYsx2gTvLbBEySPityG-1FKWsAaLBwccA619NM_O1nbopwCB7eZl_LuZOwqARZs2pTBgPCSU4jWVLuTgzX8LFl0FoSiwGcIP1Jy2ilNaK1TorXJdkAjbg0uOgqGCtTqdQhv6x3nrATFgQlHxyF8GeeQGdiBEYWvJnoUpomrk8CZcGupLJ0ZayFcw53e4asccAPY1dgUM662GjipVAK77UZPbUwTByhSj4XKIDtfO62Z3PlawQCzo-_O6WyC01n4h7capYcM_tIN9rkyB9vmM500XKf0JtJyXIWfHmr4A0W4ucnpoBVCmrrQhPj0V_qGJw-Txi4tk1KfN24qWCfZRA9IO8-0FI0-HjIQI0blC17DBKYupxbHjOmjGPE5WJCX8rHda0H0mS7_I_pGc4xZv_4ltEzvDf78FD_94moYTgJfyDxHNiEX28U8ZXXaEyQE9vKm1n4G9TQzfR4N6N1HhY-6J7lGbtewOg-jUWEDLL2IqShBJE8RHW9oQ8glbhOPvE8BUpnKh2IrrykQB-7PKEtq5SKuysr_vSpVF4DkLXozUq05VACfiEtKe6mTbrSCkgd8nR2SrziK3hcTcjavs2uNgarQg87WlhtON4Ckxwa3X1gegB01cfUzhQMCtudlo4zMmcwd7-IQGTCkkgcXMi2er0K5DM6Jd_XTN4K4tLkT3Eh5L7SPU7Vu4dwAM0Tniry5ONeA2Xa6mY4UOCSZPuLhQ3MyRXRJrLjuMqYo_aBYbaW6yz4fP_uUQu5bBx-qvnTW2CKquB81mOHe0jmmjDKgL3_f8hug6i_tV_j6NKmGmrOkCc1_xEF6nfrej1SDRTAv7GGYG8DDWRHoKn5ZLxFvCawaWPc66XYIyht2wsBgcBB2ZkabtfIeJ1P_FCEHhdI9DUS31VlYIUr6i7PzgphN1bslMlAsaSCEf8cGHhL-KOUQO85M-gHP7_EJS5OLXc7-IeGzy45TAQro6JjFX8p1qLDTvAonoL6rBGYZ67NFfJSAndCyftaMXj97RlIEB9Lj1BpgXkmRaN_6bSK0uxs0ySXo6Btb6phCqLbvc3bo5dQVSpPDokcK43WETttS8IDutf3_wbW4yyGo-9VP9uvsvPWf2vaLEGQIwQpm-KnVIEPcoFd6VzjKDVNZguSdKmBKj1AaWXFYEWMs27-TERjiEPKg0IZZZx8K_6B-jks9oDtnChb9d5cEP5sLdh1LRG-Mmd04VRUsMsZxSQh--J53vZJMdKhXyIvm29WFUXm1gGxHcoP7dkw74pRileskmqrMw4MBYPUeRLkLQDR-IdYqM7iayKHRJ-jVrSysnKGtBcH5iFmqfr1YPK2FEkxID_klCGL8zUzqrvI6MoePCnibdlrASUMiSAj6NObZbSpKx3kmjNGUN1FgGkkH5jI8FdGiYYbAvTs7NXLRLbkzFYoSgNgcFY0HB4r1iRRDUnypljCemgeAlQfYXDPbRRbZLsZKOJ4JwPRZ6N90eYYygYqwWSapvcg7LYJF9yGjIODjfJc09TDthoUk7eYzPUrFsIL7uQbZti00GMhMARIFcpPZD_U3Y4SNR0D60UJnegAw2eaMff1wzjPs0IpxvFEmgwdnyf2w_KPkaxXSwf_-p5RX4hJH4xjSsc59YP5uy_fRdC3f6B4lVkJveADjkAZAtUvM8e8TvoTitu6YPMbj0ZafrhG6ZGCwqZG7LeAqtDDDInXh1647yQiB_aF-V2BDRSfLU6KsQjG2aBDXAabsdaf5vEepJ8W-F-Y33OFy3DCfkUiMl5Elvw33ZzSDMy9CBohi1uFRrcQE-rJVh9GoL1u2RhDSW7VdffwMsP0dmjbch8ZgA60bjNd1OJSKejIALE3C7mydTK3nM8FamRRP0kpIDQ72YtoTi47W8HNa4YGGxhQxQvRTZrLrI5P9XMwXkD7oy3N1eL4oRfcp3Y3q2QUgi1mMHKktD4PNNJEla759aFqIIRAsZn3nq3oK5wuvlAXUoG4vB9L9qXSQlAMb0uqUo29v-x-LBv48nZlyuuBTWAX3DGRxXuz86hNGLpkJiGWQsvMkYLrjJF2SlJQ0WMZi_DqetrWvmMOwF3qpvK06OQ5F7gG0lMKL7X9WfDFO1uaBUWTJZwgT4Gk-EK_HPdEZuxSlNiF_GhWjBl5FasECQ8THeE0LjimhnHJNuq5BYqKDqHQmZLqA2NWEiIBvmyhY8mP3YuzsnAEPnLODwQwgdInlxzKyP7Jy4aOc87PCYebwGXET4pMi8nSOqhChzn0KZxQfYkhBoDUDRL3DeQRd7lmtoim6ATI3lx6tlseoIKoSHbk3dd995TjhOS021f-RXk-Jz0yHxRjxHGD7NYpvJmtiaWPn0H_k0pkk0WfxZ0Zy1EkOSSX9cqKwu4HmfOSjPHZKzEZhRVZ_VzyrlabaNBbBLYB_U-SiXMD2jGngfR_qGPHq0kJVffErnu6AFtmj1EnXAfNMRzBKd1h6rB7J2_kuQ-FXvY0ni04r8eGDL3PImyLI5RJatJxKgeUaC7Mh_mD7lDxx9-gsOaOlb3ONlV76mMgDjpIUw2IvISSUi6Rnj6x8CR2ZgaKgzAieIfD2NQC4I-nGrDR8tYH9_BzMCaPE9r3Q6-A6oJuYchEDuIsXhc91JE_RYE-glR6b2Rf6OjLoim5OxnS5iSg9riJ0QlqP00vlbglrgEldmEifBtaya3fsgePcY-MZoqfnvl_UfmsxO_KJvnNG8lWYEAnzZSZvna-S-MBhYriDmDHeKgA1boShht3RYlWf-odIGeRAJCubZ9H1MsRuhOsFJLrxz2DuUB4DI4Itxe-QULJAETDGIYk87AvyvayPh9fMbWkyHNM7mTfdLTO0MPtSkMNp0WX7_Uv6lwvcpl8jenbo9_FhAwduqivBgd1AHnl7GG9sSo8TM9_wfbUGLZhrQZ5INTi30iixdeQiJNojlWH-ICn36IakWPUA9JF8HAXTb3U_-V_ZdtSs_bO7Slcfh2gWdmIk-hZ0At9AWnI42fLwmRslnIzhVu3XjIPGVN_LmcLyEDq9P9sFHtEmE5dSacEdsd1z7hSIlPRfYSTmDlwrL9IyEQsNy-FcrQ3T2vvqLM7OtdixU3__sYYf0W89ENFkwUjtHS&cid=CAQSOwBygQiDl8dNwd3GfehETPwvQSSVAQlxwhk63eQ1nJ0jeHOz8XpQaADAF0hu5a2sjjX9R_9h-1hfmFVcGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=10899176448837954000&adk=578009112&idt=78&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

20c4aaf37220e8710036e4029f1c6099b09e384315e19a45ef2e0559e2b375a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35914
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 8BC2 41 KB
15 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Thu, 11 May 2023 19:31:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 42123
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 10 May 2024 19:31:46 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 8039 1 KB
643 B 22ms
21ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 57361
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 May 2023 15:17:48 GMT
etag: 48472445140208031
expires: Fri, 12 May 2023 15:17:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 8BC2 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e76bfab32011dde372b854e7159a28a261f1f8d40929419e520d705253df47a0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame F644 106 KB
37 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
Origin: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Thu, 11 May 2023 09:27:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 78396
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 12 May 2023 09:27:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230510/r20110914/elements/html/ Frame F644 11 KB
4 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230510/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A4iKDH2w_IzYNcrY_vc4TVDLlW-vAT9IuP4w4wdkH4CD4pxVZFI7CRiJ5lim-8rVQYeutqVysLnhP7zUwwjoa0a7yOpt-5YmPzCf9_8vmukbazzfFwGNCUPaBfge1NE7iP5QESjmYCnSmaPI6MzkpjZkODSC-rds7bGTDlDPLmDdxFZbU&dbm_d=AKAmf-BwIrBglSSHPdR4jS3TDDsIMuicDaym4QJn_rNQ40AGSTVYjSLiLshQq9SYPidm9Q8DiaVtjkeAVCB-6zuNd9Vn2AaSWN_d2NmDOZ1W1EQtet8w1UOeor8n8ZV_P_eyZPAsTb9FwFPKglPsVC3xshO1uO1pWg4W5XFftCcEJHl8w06LvNssPxUPHefhjj83i-y3JHLa6vkWPBhJjcJ6FRHR0NESvkSuA_hgQ9RQa7LFmfhx_9quwcZXEM27X-y6PJDLd_xFu6rXIWWYZdURxqoBeweMVNzdR8X7YbtFKrfm_OJllnjTtEBjxjICybaI_Cl8t36PlVnBW4x6gG9oKMGl5fHX7pb3xBeXSJRET1mOCj2xSO3HqyWcA87dXMgsmsu33CYiKCLGPRrvg-K_N0rPLGLD9jNnIJy7Vv-9j-u_66DYJZhZlJ1GkfP8Cm6Hu9jmIZpYFJ4ZhD0N7w2vHi4rU4Sgb2eOModZyyMQkCkCqhZsVTjE_bumzJ-Kf4DIoFL5bAe0vJGP1EmuMgSv73pd4FEUHwq8WHX7oE-tkYKMWCCFAZDQxK71PiBmRC_Qx5lV_eRNdHHgLizGbucqqzIkbZSmIzx3V-L0jrvtFOF1DlLDFPoYC1-TIIQiVFiPqO9hdRqNlkAkjFYsz4nzn45us1Rp7QtB2fCKQVk0yoLujgtdPCeUj5Wmyath_4kBRVR0KTudgQiGFMEUcq5pmlr1_grC8BsXfN8SYmmW3Xqo81k6xeG816irXY30aGZ_grgOBIZ16GqCL-8FQp88IAAOe1MZvckGnneoo5fMawHQ3DI75uO6_XPfRf8w4UKopHOeii79o3MSXqfBTgvdgaNr1AK-agjZLLNIXMR1sXZ1s94FJ8AWzkkFzYUCBO5jA_mttvggwlFuc6z9eu7YhOOee8_tK9iAlwUvlXVaY3EMXpAsi7s79fduJYp-WXXVou7DSHUVEEnMlHrJPAxx8YHZLn-Mh_NWbV2jddpYs4DwEUhDY6g0JiuuZVD6Dr_DLDTxzxlDQtOvZcNw949UiF0fegwXtfNQu9zOTgK_ZbsMrYAlJzAvWMAT4z4tH_6GGAcCNZ_Pq_wclHsff398PogOggzmaJkU2gq37odGrLqo4M1R0d-Vt88Z9NoStpfP_wNd0av6B2glVgakHwMafjzAKvxkahwOxYlo6fNyQAfZgBFt52-NhLPlA9uWXctyX2q66pRw_xu775us3pGistlWcj1RzIVGHMAOlcX6ZqUby4KX7FgmUipuGY7aClwcopGODyfDZrSjA1W4OQKL2oKqZy87thMPzEme4vXr_7oXjnOG0pM1rZYUVnrCxHXzxUZH5PJ3HIvHiBul3wZP3vNp1am-YMZIGm8dlEpEa4CnTZnWc8nNT-ByjIS_6v_P_K3vzfjGP7OJXlH_R3hWOUTUxtbW5FJEj8llesaCDfLA7rjAQKQn6R8IwtCr1aBGPiPZYfCivuhfGwtULjjAlqduVaM9L69pnCsuxtbogFrPKAs9YWKoBccPhZooBLtuGAhDvaJyx2LaUUXowldUCWjdLzCXCZeVLULfVkfxD7sc7OnygEBKEVxhAJETp_8k9_e2mZDX_0IuwwV2M0Ja8aFrXu0hbzRHi_dmjpJvV4fluFuaK67CU7GlZIdHoLI_MxUy5v5Ru_tPlkkGbz66EdAOC237MpiMELBj8DkMD_Z-Bo6QLJmx7pmA3fZMKA1OqGWEaYT55K_wC4X6ApFcFi58c4CEooJbe26AZYgbNCplak6p06tibALQCHE-icoNZzeE54ov81HeRPPOXFkjI2M8qW35NAU_8WDkgChMLE1nQEUxzfg4z3f7EyawtSdybAwS8AuOwYFr8kjNhK1TBIYHte56ZUeqeIBl92__NKFk3gsGAgAaJyVES8U85NkljkBhK7a4ZKT_6gRqxR-W7ht-s50YE6GWE2PfYn-0dA9TFhflcnpKZYw3XNNeF45DeiLaZ72K_k92QbVOjpVIybCrIivSZMb2oNoPkvfNe22qrzLwn8hG4GDJAmdeJfWPbAutjSTaLLS60e5EeRhQHu8dcc7QgEkl3YCSUPhriVOA4zNK1DB57wxO4OLvRVlVV3Ocg64zA5wSukjR6ufwktQueuHjWTLxyQoZnomKGRQvAYABWuD3e0SDtNzN2y_tEHp9tRSOJ9dWAjedNLPbD4w0b2PVAxB4KMkmWCJ4r_S4QCuWu_JM_MvAC5zBYtxcHTKxVJkVd9TMTemHovxD9uxyy0HXCqBnFX58K9djzX4m6UIgJdIOE8aH4DjfTk4vhbEEPQkVu7Idn1VFyvo9SdN2i4K1bW_ughvYJ6Ck43cvzsdD9jROTXJB9Dg_kcUANyxCqOg_8uae42uROyoVZB_luvlLZXvwjtQ5HH_SkorEG_Py-kqwhCOLJIOUKgSCwiz4trHTrA7wkvxJDSlwG_IAVfUby6LpukxCSFeVhMunlyQa3OHa7JzFjJOdC_G28m_8zREBq6qbJk-LgmlA4QjfJH0CgjxtXrSgTuCCCBFV8WQ8axpvHQtox3BMdCRyx5sG47ISyk2yFHM0aYhRDy2l0FMPb1AcjtE9A83QNfunH2mvERDyKiN1gKLPUUM0aAu2zqVJFd068OtoAim3vYj4UTdYJyaF5g9I0w0gOH625zZh6ns45QNkDlHErGK3T9CwtrRPoRaVlyE2STeoPZ_m39mkfvy-vt9w_qo3OYyLkuNRhT6TmGRwGINtLp9_xtAoKpsMLrbwN6206di7nlfvsQGkYDmkPrSER62PY3n93NVK9r1mPwH-n8SRcmtqNIog0hxt5Un62JUoqfMBl9RO941ToGv1fPTju2FbAos4qMoHk4EG-lug_q22NYiYVGzEY3Z6nwfKHeHvAzCCqkINwHJZVVA27VHRg8YBjnC5QQ0jBgdMpLmJUQ71WDnU3ML9lB8acHLHWDNk6tqc1pi8nv2uP5bfMeswEjyyrQoM4Yxar00Nt4gAbF5Ol-eZNkzaZ6YQeP-5Y29TYlOd8jJuyYT671fEL6vn-5dQJSvALR4KLTYq8VMySKa89exLCftFJRDuZ3bHfOpNmi9cqdVv3EavUeGWjQ1LPHo9z5q4etXO7IpyLSIELSiOeUC2KVS47bhWL-Pgrlq2YBfSt7rphf_ipH2o-hJgK1x4mDfuX3jc_1QQpk9_Qr72exWhAiMyiPyyeAjYk3eefsVdCE2ajVIz_uxWiDnKB4L6b7wp2F0jVtyXwuswgo1PF-oPmiHXDDXesgBDLKPGrB7rO2wm20o9-P0GbaR2xGzGDSHBYSlZdTdOpL850sYuwZrcFRdxbfzihF6uEEcYKEXqHCa0BJssObZKW-Ml3KaC_OMvXL7I3xnm5hhkfZekYY7zXwn-_ZUFZUyKnkUm0kpoXrz7VB4t074FL8oyEoT_khbSxuDHHiZCG567yfIklW_32oc_r28FDyCntAqwQldzVxqRn4I-hNS6J3pRGWFznSl0766efJTYf3_xZWyTYOWdg_-H96W_6xKLQ7UTviAjHlfqCb3x4PCAlFQE2odAdImp_txcCdCYfZv6G9EAUCfbiAPhqrLJPei12aqLRCTqiilTsJ55TWcpgJPenQvI1qcwpBuY2nsEpS-dfpFBZyH7cJyfs121uHUXK_4ZlybpRMWHV_Gr3rUwFuiOiTwOXPDMcvsBMbob8-gBog7Rv_mcl0-RHH9MsJjQQPlGnxk5WjOhzVABMnN1lGLfkrwFOG-swnN4d1o&cid=CAQSOwBygQiD9VkOzmOMKZAPpjBsPIzrI7jp1s97ZmuMrEGGNjr1jGN-VrtERkUWkhFAZsY-mjRq41IAQbViGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=3496467626569839000&adk=3587751834&idt=170&cac=0&dtd=10

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a9b847c681a24b03ba8acc0b4dcd8aab9acf8c4d3131be784d488e2402d57427

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Thu, 11 May 2023 18:09:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 47075
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4122
x-xss-protection: 0
server: cafe
etag: 11429739870029468282
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 May 2023 18:09:14 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230510/r20110914/ Frame F644 28 KB
11 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230510/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ce7aa9a76e1ef06e22d13a5c8678b9b7440f5b1f854ecb62b447ad383927abb6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Thu, 11 May 2023 18:13:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46798
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10883
x-xss-protection: 0
server: cafe
etag: 6886435266232968791
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 May 2023 18:13:51 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame F644 41 KB
15 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Thu, 11 May 2023 19:31:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 42123
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 10 May 2024 19:31:46 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 18E9 1 KB
643 B 24ms
23ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 57361
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 May 2023 15:17:48 GMT
etag: 48472445140208031
expires: Fri, 12 May 2023 15:17:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame FE3A 22 KB
8 KB 23ms
23ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 172503
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 10 May 2023 07:18:46 GMT
expires: Thu, 09 May 2024 07:18:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame F644 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 68007176df5ef70d7ec11cb5e38fc89747248fd9a7af1ab11a2aa51e20211fce

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8039
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEIpLav3D4RmQHOmMLIqgDqs&google_cver=1&google_push=ATf1kGPih1a1LrUhBfdMnU4u8DsKEdLYctbJauMHk9B2aTDpKqnNGEYs04yEHlSJoaLqpmrUGUSjyPrbOc-fgQUp3zUZXEO9H5qA
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=69E41AC40F32434298C79ABCBC4EE3DE&google_push=ATf1kGPih1a1LrUhBfdMnU4u8DsKEdLYctbJauMHk9B2aTDpKqnNGEYs04yEHlSJoaLqpmrUGUSjyPrbOc-fgQU...

170 B
188 B

37ms
35ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=69E41AC40F32434298C79ABCBC4EE3DE&google_push=ATf1kGPih1a1LrUhBfdMnU4u8DsKEdLYctbJauMHk9B2aTDpKqnNGEYs04yEHlSJoaLqpmrUGUSjyPrbOc-fgQUp3zUZXEO9H5qA

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 12 May 2023 07:13:49 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=69E41AC40F32434298C79ABCBC4EE3DE&google_push=ATf1kGPih1a1LrUhBfdMnU4u8DsKEdLYctbJauMHk9B2aTDpKqnNGEYs04yEHlSJoaLqpmrUGUSjyPrbOc-fgQUp3zUZXEO9H5qA
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Thu, 11 May 2023 07:13:49 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8039
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEDYJogyAtFsEbMotPvwlqgk&google_cver=1&google_push=ATf1kGP-AHRoi5_6hnY7SYWYOG53kJqQTZ8KVRAJ0atJ76Z1l8rlYGtHzM-1b7_z1Fihrxq_-g2QKjGgzWj...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ATf1kGP-AHRoi5_6hnY7SYWYOG53kJqQTZ8KVRAJ0atJ76Z1l8rlYGtHzM-1b7_z1Fihrxq_-g2QKjGgzWjW_MBALconlP9zOgA&google_hm=yxTPFXxITMKyyrFoVnLDmbg

170 B
188 B

38ms
31ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ATf1kGP-AHRoi5_6hnY7SYWYOG53kJqQTZ8KVRAJ0atJ76Z1l8rlYGtHzM-1b7_z1Fihrxq_-g2QKjGgzWjW_MBALconlP9zOgA&google_hm=yxTPFXxITMKyyrFoVnLDmbg

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ATf1kGP-AHRoi5_6hnY7SYWYOG53kJqQTZ8KVRAJ0atJ76Z1l8rlYGtHzM-1b7_z1Fihrxq_-g2QKjGgzWjW_MBALconlP9zOgA&google_hm=yxTPFXxITMKyyrFoVnLDmbg
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 8039 43 B
363 B 93ms
29ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DPUSH_DATA&google_gid=CAESEBQCIqxpqz0EykSxGFlKsSc&google_cver=1&google_push=ATf1kGOHJXcAlzanDUjn-hVqfGoKzeVJTI89f-8FZCLS8AW58ED69MEoCOuje5b_wkjic_IUwKwDPnnvsJfmuyUQPWrRHIGXXbbQ

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 191329
expires: Fri, 12 May 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8039
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=mBqurFgRTcKQrA6cg4hnxQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

31ms
31ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=mBqurFgRTcKQrA6cg4hnxQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGMIhHZt4b2NXal8tZnx9uW0ItFn6yQEqSYbqc_1eHVohQFKIaMuOVeTzSPCYeTMWHfpzIoDdAC-z97E0omZRfGBNqhdmh3O

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=mBqurFgRTcKQrA6cg4hnxQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGMIhHZt4b2NXal8tZnx9uW0ItFn6yQEqSYbqc_1eHVohQFKIaMuOVeTzSPCYeTMWHfpzIoDdAC-z97E0omZRfGBNqhdmh3O
date: Fri, 12 May 2023 07:13:47 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8039
Redirect Chain

https://match.360yield.com/match/ebda?google_gid=CAESEGUqfhqQWoK1eQ6MYA85c1w&google_cver=1&google_push=ATf1kGPVQwkDtvyuHFe0xzImb_vOErn2iKN2fSeuzT85m3l9J8lLfWwiF3ortteGi5wvBV8CTFPFO795QNvbSU-sMIn1AL...
https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEGUqfhqQWoK1eQ6MYA85c1w&google_cver=1&google_push=ATf1kGPVQwkDtvyuHFe0xzImb_vOErn2iKN2fSeuzT85m3l9J8lLfWwiF3ortteGi5wvBV8CTFPFO795QNvbSU-s...
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=kwvJpEhZQsiZ8BP7zEu7qw&google_push=ATf1kGPVQwkDtvyuHFe0xzImb_vOErn2iKN2fSeuzT85m3l9J8lLfWwiF3ortteGi5wvBV8CTFPFO795QNvbSU-...

170 B
188 B

32ms
32ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=kwvJpEhZQsiZ8BP7zEu7qw&google_push=ATf1kGPVQwkDtvyuHFe0xzImb_vOErn2iKN2fSeuzT85m3l9J8lLfWwiF3ortteGi5wvBV8CTFPFO795QNvbSU-sMIn1ALIfHzx7

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=kwvJpEhZQsiZ8BP7zEu7qw&google_push=ATf1kGPVQwkDtvyuHFe0xzImb_vOErn2iKN2fSeuzT85m3l9J8lLfWwiF3ortteGi5wvBV8CTFPFO795QNvbSU-sMIn1ALIfHzx7
access-control-allow-origin: *
date: Fri, 12 May 2023 07:13:49 GMT
content-type: text/plain
content-length: 0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8039
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEK...
https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=ATf1kGPO9bse9GV0HRcuyl88uLkKOONAPoLbRT8sSUjfk10svYDwj1kqaQXwiZV8tiGwUW3HxX7TuT7CBBQFmRlBM36ovirqDtMM&redir=https%3A%2F%2Fcm.g.doubl...
https://sync.targeting.unrulymedia.com/csync/RX-aaa96378-137a-4b01-8d45-67d34c274f62-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DATf1kGPO9bse9GV0HRcuyl88u...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGPO9bse9GV0HRcuyl88uLkKOONAPoLbRT8sSUjfk10svYDwj1kqaQXwiZV8tiGwUW3HxX7TuT7CBBQFmRlBM36ovirqDtMM&google_hm=A6qpY3gTeksBjUVn00wnT2I

170 B
188 B

34ms
34ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGPO9bse9GV0HRcuyl88uLkKOONAPoLbRT8sSUjfk10svYDwj1kqaQXwiZV8tiGwUW3HxX7TuT7CBBQFmRlBM36ovirqDtMM&google_hm=A6qpY3gTeksBjUVn00wnT2I

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGPO9bse9GV0HRcuyl88uLkKOONAPoLbRT8sSUjfk10svYDwj1kqaQXwiZV8tiGwUW3HxX7TuT7CBBQFmRlBM36ovirqDtMM&google_hm=A6qpY3gTeksBjUVn00wnT2I
date: Fri, 12 May 2023 07:13:49 GMT
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RXaaa96378137a4b018d4567d34c274f62003
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8039
Redirect Chain

https://secure.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=${BASE64_UID_ENC}&google_gid=CAESEM9vEOoREgyl0WzBtv6boY0&google_cver=1&google_push=ATf1kGM8lAn44tWF6...
https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MTc0MDIxMjg5NDcwOTY5MDIyMg%3D%3D&google_gid=CAESEM9vEOoREgyl0WzBtv6boY0&google_cver=1&google_push=ATf1kGM8lAn44tWF6jy-8946fzTGvcbQYR...

170 B
188 B

33ms
32ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MTc0MDIxMjg5NDcwOTY5MDIyMg%3D%3D&google_gid=CAESEM9vEOoREgyl0WzBtv6boY0&google_cver=1&google_push=ATf1kGM8lAn44tWF6jy-8946fzTGvcbQYRN-cWM8BrZJ7wjnmrFoT-aORzXk-RcJdHW_ipsJOKG_LLWNAqmEcAsJMAJTs4MgATEIHg

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 12 May 2023 07:13:49 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 8e856f85-b971-41e3-a758-fd934808686d
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MTc0MDIxMjg5NDcwOTY5MDIyMg%3D%3D&google_gid=CAESEM9vEOoREgyl0WzBtv6boY0&google_cver=1&google_push=ATf1kGM8lAn44tWF6jy-8946fzTGvcbQYRN-cWM8BrZJ7wjnmrFoT-aORzXk-RcJdHW_ipsJOKG_LLWNAqmEcAsJMAJTs4MgATEIHg
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 8039 0
12 B 32ms
30ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KDI1MyfwOczNtncQxW03E_IH5xf9pMsAmCbIf-UYJU5XpmcOlPBus1FGaQFQcvXsi4M5cR3g

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-18-203-131-238.eu-west-1.compute.amazonaws.com

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK analytics.js Show response
s.h.w55c.net/2/948461/ Frame 91AB 6 KB
3 KB 256ms
47ms Script
text/javascript 18.203.131.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.h.w55c.net/2/948461/analytics.js?dt=9484611597092707615000&pd=avt&di=https%3A%2F%2Fye-mek.net&ui=&ap=&sr=GOOGLE_CONTENTNETWORK&pp=ye-mek.net&ti=&pv=491ec925-2269-4887-8879-7ecce3b74f09&to=3&de=2&md=1&si=&dm=728x90&pi=XRzobPsLhV&gt=DE&ac=Xmwo1n97Q8

Requested by

Host: cti.w55c.net
URL: https://cti.w55c.net/ct/creative_add_on.js?w=728&h=90&zindex=0&ci=Xmwo1n97Q8&ei=GOOGLE_CONTENTNETWORK&ob=0&ai=0DaDXCcU00&epid=R0N5ZS1tZWsubmV0&fiu=WG1FS1o4a2t0eA&s=https%3A%2F%2Fye-mek.net&ciu=XRzobPsLhV&btid=RUJGRDhCNkMwNkNCNDlDREUyQjAxMjg2ODE0NDY2MkZ8R0ZacFdzZmRzenwxNjgzODc1NjI4ODk0fDF8WG1FS1o4a2t0eHxYUnpvYlBzTGhWfDMwMjIxMTkzM19FWHw1NDExM3x8fHwuMFB8VVNE&c=DE&dt=2dt0005&sd=ye-mek.net&cip=1&hmt=1&uidu=CAESEN3iGAa1kuFv-YFE2GvbT9c&spidu=GOOGLE_CONTENTNETWORK&pidu=ye-mek.net&hmpvu=491ec925-2269-4887-8879-7ecce3b74f09&hmtsu=3&odtu=2&mtfu=1&crdmu=728x90&cridu=XRzobPsLhV&

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

18.203.131.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

61de8dcf7ab8f26adb474fe5e3a8280dc757e503ce597d9add72c22a67e47940

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 12 May 2023 07:13:49 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Accept-Ch: Viewport-Width, Viewport-Height, Width, DPR, RTT, ECT, Device-Memory, Downlink, Save-Data
Vary: *
Content-Type: text/javascript; charset=utf-8
Cache-Control: no-cache, no-store, must-revalidate, no-transform, private, max-age=0
Timing-Allow-Origin: *
Content-Length: 2889
Expires: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/11799348657721538044/ Frame 11BF 4 KB
1 KB 69ms
24ms Document
text/html 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11799348657721538044/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4cf33c16b5adc3b87b595f4e86e3d09c25bb499fa2e24a7f9d683adc30c04fef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 138750
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1505
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 10 May 2023 16:41:19 GMT
expires: Thu, 09 May 2024 16:41:19 GMT
last-modified: Wed, 26 Oct 2022 05:46:51 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8BC2 0
0 142ms
68ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssVxEnRKU_hfKK6yKElmqAKSDsZOR3rAz4qKDjmjgp1R5LLoFmV-fyQgROqL75WTaOfDX9vD_Dhrshk0YMRrwXDn1TFXg5C1LDCZ8unIz5fVATtGEw9ns5yFWPZWw0t-4uzIT7ebliwWhUAEWpM4R4nYL_-S4oDWajGeT6TKwXQHULbWWpm7twYlAAyj2vc0PtTOkqYvPL--W979mNR9S5IS-2HPKG7O3xBGSwFacoxaOFrw5vjMiYJfns_iQ_7SKEYwLWKrFh6WKdprqdQAJQ9VFIyyqI5dqOkEDvnRH1lk53BvhXuJ48iaUinv-lNsPeuGDkhrjSFXQJnUuadLcywNbAGRuxQ_mm3xNHH68igLPjUlXUVXi62Sb87T0JBuKF6PSqpJ2R_BGFkAUHg2dKjd6B43yYnm0Kce8AnIANN1yVSsxSJKa8sJy-Zi3uJdiGQSEPj1HDcGJh5whmcqrfDx6sUvn5xaYYg8c8zjp-VBvN5U8cWQMYOJYI-FG3txuTjLOkq1lkyL13sGjdbd1VeDUusxxXNg4AsAXAJic_sVPWXdeREelOnjN2zK4hOqQDzbeueG9ORHBRC4tfrCJQ2u65KhtPc4fGJPol8CsVjAAjReKkyaIchl-9UwYgClYoLyA-CBWmXItKx9cWDz3VbHO47KY_M4P-fjftEFg5hUkuc3g5kJJWl_cljvkQ0C7cNUHdoA6ZwjixXWGp4mEn7gszwkIGA1D2rmCYANIYR4ryR2MYnRZtLfNKD4rl_452AotCFiQGzTJ0TFQFk0l0bDnlJP0gvnxWsGZAeYEM3DxQF2YTmtPOpqtCHa8VV-P69UClaL9-XSDO-KDoqXqGbbZNTqPzUPc524S281rCT24C_UZPXAEBXQD_asOTMmZASDIT3RFD9glvjH6rLu4H7uVjksE2SQQt1f9o8qgaY-Hy4sJ0nYaj8oj9vEesP-NDfuS8P58ABnSlO2TblAkJsUsiz0I-6NdHoJ8mAQa_FC7r0smQr-jgiBvlUZ32v0IlVgbBZrY_kmA4YD9o7uJSyQVcdiWXqZYW_Wv7Jmrb7pMjQO4YUbyEM8Dw94OEPNJLO5Iek3Sdv0qLx35JG8tx01fYzwOcQVcpNq1dxyq0Z1RxWwDT7QhJOTQ4WCkG1AEmRQzu9m1yr_GU7Wklezq4bqFAQoy2NttdNuqH1Hl7l4INiaWqdPBgW4cUu69Gv30-qcQ5woTQFU-k0PTqk7rVSBZyFtotb0wnQTB4ywUL32Vy4HCTvmGHm-XRQ4_14O1zveiWcL2-zr5D2PjGvyhrpSgTRHPlDzVtizfyaiGvllxeaa67DkB1FDHpz8A47HsUlMMtkaUrcZEQ&sai=AMfl-YQBKCX_KSiavcU5WGR6D60PCWaZ6-BWoZgX-kiQfVdynz4xEtI69S-dR_4FOm4dBCDSHNW-EnI9aEyxoVdoVechHG9hfUKJVeL5kgDTZRxTVKQDBI219N668mmdd-ZZsx7blw4-H7EJFa5LJBtQWucDUJGzhsEuc444uHuJHjrTXUkaxa-LdDho5E9sSZ854vIs_tdgPrhdWn3RmTuuTkcSy88DakrTsmTsPw83_I4sJuOEcTGFCsU612ts4pBHST5v&sig=Cg0ArKJSzKubwxt4dYslEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=192&cbvp=1&cstd=188&cisv=r20230510.31947&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 12 May 2023 07:13:49 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 12 May 2023 07:13:49 GMT

GET
H/1.1

200
OK

px.gif
d.adtriba.com/ Frame 8BC2
Redirect Chain

https://d.adtriba.com/collect?atb_ptid=f65079e0&atb_dcaid=202210_es_hunger_dv_pros_347628237&atb_dpuid=di_dv&gdpr=&gdpr_consent=
https://d.adtriba.com/px.gif

42 B
227 B

33ms
23ms

Image
image/gif

18.158.240.157
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adtriba.com/px.gif
Requested by: Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: HTTP/1.1
Server: 18.158.240.157 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-240-157.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Fri, 12 May 2023 07:13:49 GMT
Cache-Control: public, max-age=86400
Server: nginx/1.16.1
Connection: keep-alive
Content-Length: 42
Content-Type: image/gif

Redirect headers

Date: Fri, 12 May 2023 07:13:49 GMT
Last-Modified: Fri, 12 May 2023 07:13:49 GMT
Server: nginx/1.16.1
P3P: CP="This is not a P3P policy! See https://www.adtriba.com/privacy-policy.html for more info."
Location: /px.gif
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 01:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E004 1 KB
643 B 22ms
21ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 57361
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 May 2023 15:17:48 GMT
etag: 48472445140208031
expires: Fri, 12 May 2023 15:17:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 91AB 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0d33244b00924701f9d195c2a47d38c2d8c991ce25fffc62dfe2847ff166d5ce

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230510/r20110914/ Frame EF3D 28 KB
11 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230510/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AzOV3fesjxZyThNb6T-iVKFzB_5-FiRzmvE3BNBUtlPGG50mHfWqz-0EZNCDnNkXnf7BH43RQBb16PxCCFOhpHzzhz_j4Ym-kFHW4gwnw6Z3HvMolG6Ug4YTDeVCUeIhn2W8Dp3V0iXbbd00AzPa1u9DXotOMvlwforf_c3ETwu5YJSc8&dbm_d=AKAmf-AIH6jHsXYatMRP21G8z5owKgAC6zliZMZe3_l5AOJ4gQ8jmi1iZecbYxeA4-OWs0iWl43qgnFlW3V2s-drGKnVdIKSg4f3wpY-WEWtvpXH_Is6LbMVFzuMhWbfgtoq2Qq1wJbcknNbSkXTxctf6NLNv9yNLA-ZHOQ4gMVr7W0GCum7PdiNeYEUFqZVpysVJW_OTL7l00katFmqKEIi4f_Jd_m3E8f_A9T5-PGiCL6deQQ8rJk7CL0GFa72elhvNiqT6BJe2u2biNwevagh0THUc_TVeTrnsYraTR-DUXBGsRSAYd9AlJpUbjOUm5sqVm7kxQYc5RwnLzg5TEBv7LQIB4vfMZQ0ATaIvYSKb2sZr_dapI-XVBcjY25EZC-1cmIcB9rHroqNOvYhyWAoh95lnJN_ohe6veg9SsCis8ln21CArQ1gtp_Steyl0L5aQnO2Gv7UsQVk4JqKNRl89HqnP9IjnlMnS89u42Vt1eXALoCH2Lj3sTChTD4LJ-A3_3d4GtxH7uAVCducSq0EdLiu_m-dWdp-TnrOlpAblmbbBjXKmAfXqP8GqyhCQV16aiElhykhWNqv7k2NpCFXeFcBFNiR1dV3lfSfhNDYfhB1RRy76_LPsZIOLwHf6ldRlm4hPU-12T-fwPy-41Z16uBtYsx2gTvLbBEySPityG-1FKWsAaLBwccA619NM_O1nbopwCB7eZl_LuZOwqARZs2pTBgPCSU4jWVLuTgzX8LFl0FoSiwGcIP1Jy2ilNaK1TorXJdkAjbg0uOgqGCtTqdQhv6x3nrATFgQlHxyF8GeeQGdiBEYWvJnoUpomrk8CZcGupLJ0ZayFcw53e4asccAPY1dgUM662GjipVAK77UZPbUwTByhSj4XKIDtfO62Z3PlawQCzo-_O6WyC01n4h7capYcM_tIN9rkyB9vmM500XKf0JtJyXIWfHmr4A0W4ucnpoBVCmrrQhPj0V_qGJw-Txi4tk1KfN24qWCfZRA9IO8-0FI0-HjIQI0blC17DBKYupxbHjOmjGPE5WJCX8rHda0H0mS7_I_pGc4xZv_4ltEzvDf78FD_94moYTgJfyDxHNiEX28U8ZXXaEyQE9vKm1n4G9TQzfR4N6N1HhY-6J7lGbtewOg-jUWEDLL2IqShBJE8RHW9oQ8glbhOPvE8BUpnKh2IrrykQB-7PKEtq5SKuysr_vSpVF4DkLXozUq05VACfiEtKe6mTbrSCkgd8nR2SrziK3hcTcjavs2uNgarQg87WlhtON4Ckxwa3X1gegB01cfUzhQMCtudlo4zMmcwd7-IQGTCkkgcXMi2er0K5DM6Jd_XTN4K4tLkT3Eh5L7SPU7Vu4dwAM0Tniry5ONeA2Xa6mY4UOCSZPuLhQ3MyRXRJrLjuMqYo_aBYbaW6yz4fP_uUQu5bBx-qvnTW2CKquB81mOHe0jmmjDKgL3_f8hug6i_tV_j6NKmGmrOkCc1_xEF6nfrej1SDRTAv7GGYG8DDWRHoKn5ZLxFvCawaWPc66XYIyht2wsBgcBB2ZkabtfIeJ1P_FCEHhdI9DUS31VlYIUr6i7PzgphN1bslMlAsaSCEf8cGHhL-KOUQO85M-gHP7_EJS5OLXc7-IeGzy45TAQro6JjFX8p1qLDTvAonoL6rBGYZ67NFfJSAndCyftaMXj97RlIEB9Lj1BpgXkmRaN_6bSK0uxs0ySXo6Btb6phCqLbvc3bo5dQVSpPDokcK43WETttS8IDutf3_wbW4yyGo-9VP9uvsvPWf2vaLEGQIwQpm-KnVIEPcoFd6VzjKDVNZguSdKmBKj1AaWXFYEWMs27-TERjiEPKg0IZZZx8K_6B-jks9oDtnChb9d5cEP5sLdh1LRG-Mmd04VRUsMsZxSQh--J53vZJMdKhXyIvm29WFUXm1gGxHcoP7dkw74pRileskmqrMw4MBYPUeRLkLQDR-IdYqM7iayKHRJ-jVrSysnKGtBcH5iFmqfr1YPK2FEkxID_klCGL8zUzqrvI6MoePCnibdlrASUMiSAj6NObZbSpKx3kmjNGUN1FgGkkH5jI8FdGiYYbAvTs7NXLRLbkzFYoSgNgcFY0HB4r1iRRDUnypljCemgeAlQfYXDPbRRbZLsZKOJ4JwPRZ6N90eYYygYqwWSapvcg7LYJF9yGjIODjfJc09TDthoUk7eYzPUrFsIL7uQbZti00GMhMARIFcpPZD_U3Y4SNR0D60UJnegAw2eaMff1wzjPs0IpxvFEmgwdnyf2w_KPkaxXSwf_-p5RX4hJH4xjSsc59YP5uy_fRdC3f6B4lVkJveADjkAZAtUvM8e8TvoTitu6YPMbj0ZafrhG6ZGCwqZG7LeAqtDDDInXh1647yQiB_aF-V2BDRSfLU6KsQjG2aBDXAabsdaf5vEepJ8W-F-Y33OFy3DCfkUiMl5Elvw33ZzSDMy9CBohi1uFRrcQE-rJVh9GoL1u2RhDSW7VdffwMsP0dmjbch8ZgA60bjNd1OJSKejIALE3C7mydTK3nM8FamRRP0kpIDQ72YtoTi47W8HNa4YGGxhQxQvRTZrLrI5P9XMwXkD7oy3N1eL4oRfcp3Y3q2QUgi1mMHKktD4PNNJEla759aFqIIRAsZn3nq3oK5wuvlAXUoG4vB9L9qXSQlAMb0uqUo29v-x-LBv48nZlyuuBTWAX3DGRxXuz86hNGLpkJiGWQsvMkYLrjJF2SlJQ0WMZi_DqetrWvmMOwF3qpvK06OQ5F7gG0lMKL7X9WfDFO1uaBUWTJZwgT4Gk-EK_HPdEZuxSlNiF_GhWjBl5FasECQ8THeE0LjimhnHJNuq5BYqKDqHQmZLqA2NWEiIBvmyhY8mP3YuzsnAEPnLODwQwgdInlxzKyP7Jy4aOc87PCYebwGXET4pMi8nSOqhChzn0KZxQfYkhBoDUDRL3DeQRd7lmtoim6ATI3lx6tlseoIKoSHbk3dd995TjhOS021f-RXk-Jz0yHxRjxHGD7NYpvJmtiaWPn0H_k0pkk0WfxZ0Zy1EkOSSX9cqKwu4HmfOSjPHZKzEZhRVZ_VzyrlabaNBbBLYB_U-SiXMD2jGngfR_qGPHq0kJVffErnu6AFtmj1EnXAfNMRzBKd1h6rB7J2_kuQ-FXvY0ni04r8eGDL3PImyLI5RJatJxKgeUaC7Mh_mD7lDxx9-gsOaOlb3ONlV76mMgDjpIUw2IvISSUi6Rnj6x8CR2ZgaKgzAieIfD2NQC4I-nGrDR8tYH9_BzMCaPE9r3Q6-A6oJuYchEDuIsXhc91JE_RYE-glR6b2Rf6OjLoim5OxnS5iSg9riJ0QlqP00vlbglrgEldmEifBtaya3fsgePcY-MZoqfnvl_UfmsxO_KJvnNG8lWYEAnzZSZvna-S-MBhYriDmDHeKgA1boShht3RYlWf-odIGeRAJCubZ9H1MsRuhOsFJLrxz2DuUB4DI4Itxe-QULJAETDGIYk87AvyvayPh9fMbWkyHNM7mTfdLTO0MPtSkMNp0WX7_Uv6lwvcpl8jenbo9_FhAwduqivBgd1AHnl7GG9sSo8TM9_wfbUGLZhrQZ5INTi30iixdeQiJNojlWH-ICn36IakWPUA9JF8HAXTb3U_-V_ZdtSs_bO7Slcfh2gWdmIk-hZ0At9AWnI42fLwmRslnIzhVu3XjIPGVN_LmcLyEDq9P9sFHtEmE5dSacEdsd1z7hSIlPRfYSTmDlwrL9IyEQsNy-FcrQ3T2vvqLM7OtdixU3__sYYf0W89ENFkwUjtHS&cid=CAQSOwBygQiDl8dNwd3GfehETPwvQSSVAQlxwhk63eQ1nJ0jeHOz8XpQaADAF0hu5a2sjjX9R_9h-1hfmFVcGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=10899176448837954000&adk=578009112&idt=78&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ce7aa9a76e1ef06e22d13a5c8678b9b7440f5b1f854ecb62b447ad383927abb6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Thu, 11 May 2023 18:13:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 46798
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10883
x-xss-protection: 0
server: cafe
etag: 6886435266232968791
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 May 2023 18:13:51 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230510/r20110914/elements/html/ Frame EF3D 11 KB
4 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230510/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a9b847c681a24b03ba8acc0b4dcd8aab9acf8c4d3131be784d488e2402d57427

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Thu, 11 May 2023 18:09:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 47075
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4122
x-xss-protection: 0
server: cafe
etag: 11429739870029468282
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 25 May 2023 18:09:14 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame EF3D 0
0 105ms
66ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstJAqvab02a00TY7FTfmkOTph1_NAr7C3lX0eHN_kSIVPC4sxgCAs-S9a721hQOiuAAUeJwiMsBd9-uoNmkBkugfXamNPRRt0GWkVbJaHoxpsh_nyCOEc6s9Li7dowF664YzT2wdGhe4Lr1DmWrYWRJVOSqqUlwFRWtmXs4y3VKjW6wodsoV33wsrWnmq_48912t4bnUSwcBPSWRo78fusvxCJiptRCQ07DA0NjBtFsvGBZ3AO2EXXH1iUh40lwccNXQnL2LFbF84UshTuFJpazHWyyvPIoqosqv8zr39nyixStXw4uGl-Bq_Q_6eRdrlMtbFqVwdX7Bc9qzOOZ0vxNuxIUi5DZ7i3Uia92iwzzFBmRUnNfKpX1PGmDCAeByRsOvkMnxqJFOuNJ3wNuuSugEJR2e6IwbELExsZUEHMNObbFrCTGpTdC_FcupGapiTiB55OlrbOUZZ-WNzfhcq95Ekxw9dSvGIM79oXKnZoahpepnid9n9RxCdzlUpfgn6VK_HEBp7qXAW1yL_yE8aYcuFL7K72xl3HqfijLuGAj3mM0i3PX2f4C9jiZcHLSdZnxBmEdtP4XDS2MG1SZHL0ql-YaYaTc_IYiah6cXH0-vwcjU6lIY3sS2dFnZd1JYROwxUP4uTl8AM8Isg4E6eVnIyGq1icWUZjmelOQCj4QA31RxRtppOdJ68QdpED7zuM3lBLDf7kV4_Sa9ATenVQHoAdl6pB5mPGgkAuQEro3jx9ziL9eas1qkLUmJsTJs4ChgLP2ec-RMe1ezbGIqQl1l3GwmTSuTgGQgiqB3yEFMcXBCUZ4xFOuJTfOXVwfAiIKJ8y8UtKjmxRJq6ZZx6DPpH4_zkDP4O6oy4wjQS4xA-8EAVYYY14MNuyO2cE9U0iC1_WtEIaGE8iSLk9aFK2jr8UYnB4Wuu-Vz-Pb9nuzyGQnkO-Phc_N7KL21MJQPgO9ROLqaanHv3etGNYNnsDgKGiij1FmBOsyqj3rzRq5mlESIVijkrIcw0zkeohUNDwlBUm266Kmup9mJmROpfkYDlowTNSbdr_UuJyTOS4tLUzawm4NNdh72QXoroyiUPhavdxYnfxPzJKUH8tb0MEGy_CT_yMiU8IWErALSRuPjTLof1aq1fepcEn4kXQiM2JUb_X4keY8c5Z9lHWWA2MdEJP8BzrIOuM4NTMKtGMHKvnRScUZRlF0zmcLKUVW8FGL5M0ih8hIHSHWYNtMGOITsMfiwrQ0TtOZuH-KrPPXubtpQrGgfG4HmXOsW2r0CXTKCIU4gOTpm1CNYhcwEQTAhyFycoBxGh7UGkx3Nr3o_X9Qbnfbc7BnwDqLbyGDGJHhD6rKzxh0SuHtpZr8RyE&sai=AMfl-YQf9-8WPwrqeCLXA5bJYu8ssmqcOsBxPzZkGSlCyAV813OVHS0d5OFUyyD2f02aJIehr0La7fZwz96cKpAn7Gp0HM6zkOqtLq_4FgtJUFz1pFzMIXK1vGh8M_nkb5yKvLCoCZDHhJGzizOnzSztB5L0zrxtQqi4bv2tsrBL-WSswlztchve1NnjHEmyIIJsFHU31jy2t8NdGMlzuUFZCMj9mXu2fVibNKd1g_iG75aauXhpKwTJCIJRdaarGcw3YrgZ&sig=Cg0ArKJSzIsDOhgj2SkwEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=2&cbvp=1&cstd=0&cisv=r20230510.13589&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 12 May 2023 07:13:49 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 12 May 2023 07:13:49 GMT

GET
H/1.1

200
OK

px.gif
d.adtriba.com/ Frame EF3D
Redirect Chain

https://d.adtriba.com/collect?atb_ptid=f65079e0&atb_dcaid=202210_es_hunger_dv_pros_347628237&atb_dpuid=di_dv&gdpr=&gdpr_consent=
https://d.adtriba.com/px.gif

42 B
227 B

22ms
21ms

Image
image/gif

18.158.240.157
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adtriba.com/px.gif
Requested by: Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: HTTP/1.1
Server: 18.158.240.157 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-240-157.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Fri, 12 May 2023 07:13:49 GMT
Cache-Control: public, max-age=86400
Server: nginx/1.16.1
Connection: keep-alive
Content-Length: 42
Content-Type: image/gif

Redirect headers

Date: Fri, 12 May 2023 07:13:49 GMT
Last-Modified: Fri, 12 May 2023 07:13:49 GMT
Server: nginx/1.16.1
P3P: CP="This is not a P3P policy! See https://www.adtriba.com/privacy-policy.html for more info."
Location: /px.gif
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 01:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame EF3D 41 KB
15 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Thu, 11 May 2023 19:31:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 42123
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 10 May 2024 19:31:46 GMT

GET
H3 200 10768712183287262174
s0.2mdn.net/simgad/ Frame EF3D 39 KB
39 KB 29ms
23ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/10768712183287262174

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

066bbfcc0791d1dde12ec5f2d7fc1d5c6bccac6ebc91302ca4e903a2178cca34

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 06 May 2023 09:28:42 GMT
x-content-type-options: nosniff
age: 510307
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 40031
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:42:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 05 May 2024 09:28:42 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/2643589595411275818/ Frame A6D1 4 KB
1 KB 26ms
25ms Document
text/html 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2643589595411275818/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

934e4c5bf691cb219893679833277e4f7e475523532e0d123afe9b154507e76b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 520535
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 1505
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sat, 06 May 2023 06:38:14 GMT
expires: Sun, 05 May 2024 06:38:14 GMT
last-modified: Wed, 26 Oct 2022 05:45:16 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame F644 0
0 91ms
65ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuHPC8xsJmqI-f6n9UHLF1icBP_UfnYchiizTZlxXrJlnIGkcfFLX0p0PFvu5BRHl0BFJfUnVn0UnqzW8vxtMsvtwOioYWo3GHgAkqJix6j3HO7iWhMr0YYX_aKxSNxbwDRUuREaPVNAYw1sA-TQskSmeA9ViBrpiwqZQLjvTgw5BRROj6DNMnQ4bD544X5m4hBVoHF-ryFe8YMESpZga7dIYqKsws6uVT-8LbGw34zzIg0VpU2Pnru2ikxY77wNzfBso7ZfTy55lIBlITFSKUDvzpnmqjiKbo-0eBYpnItiq5UAEThwooiHrDLwnoWvoloZCGOa_43K4p-Xq0tLzVn0bt2sDuwaYfax__5B8NikzlER25AN1GEGXYAG5BVpgybvn3EZh5FYYM76R7T_MKWcMu6gUVoNTyU94Sf4H2hapTLULLsLu2jDtzIAzvslL6NTqUn2YjSn1WL_en-TXk8-31YjSd23Bzc92k-Frs09HquEbeEkjnPHLJ_aOahNpTO5N4SBr6RZuR-4hXhbUkATvngFf0n3ZozEDXQOTUGHzFOgJf7yi81UqquGUtLi-Y12Nts0XZFxiU1qsuOXo8TdMW4jAiaonHDotl-lqSTGzDNFDQs0DCMiuQc2AzC2N6bx9aLDmPO1PpXwUj461o8Z1kAlTy4w62irPnEwdUq-6K3MKn7LJ6ephCGaiZbzw4IcDUJ92RWxm57BNOJlLwuVE9XRhqo9kXOtGfDYcnM9VoWNN-_jO1S3uUZ7mZD2kbuGaqkXrCU_7Ua3hqdoq9B670ZnGQq5Rf95m2SXxNt4PtMcyWeuTt6ZKaToFOTDGv5Vl39HQ9yumlVwTmarpVvadxsaQ-Mfmojo4BKC91cZSF-oGQVQtnOCCnOwZ-cugjdmnOS-OLVgeVBhDb0yOOJ7EFLo4yao7MU5By2s3WlmlIh0L1h1Qjl12QQLh2NTN1AvN-YwoIjFVuhzMYBm09CmFuWvFqGH4FJ01Qk2ub0C_IjoV1hDPbPzCE4UFGj3U47VzCR3s2xxyVhR0cWuugfk0UrcJ4OlXM63xszytsJ7wn2_-Ct28Geh-SNmvKWEsfwtZ83IXl5QQM9Y98cuJ6Ih6-U7qyJHtqDvxu4IY3LqtxrtCJKdo28L99UHESn_36CJ0Qjqfgt835l84zu_t6ZLHW6lDHIEx_zTO9qA7fTZeNiM3dYptyPqEMTz1NaD8uliAGpfehGxV0FP4DHKEVNC-0yEUxXzlipiLBL1SKbRPS3-5jRl4Js4bE1RJ1ysHE15JMAAkrO95104hIJM0vNEse8-XAmvE6k2-m1pJUhhVxp2vfXgTtjFs5G6QhiZ8krOEzXH5VNjVs7&sai=AMfl-YQUT5qTUPcrua_qLQXq79_yc9RXQBmgdQapkhAOm0Z7qhI4aNFabcx0-2p0JRzR-yAPGEeIQ9ddDMJwzOk-ifXR_qfy0ooTTiLcseyFF4x0KIJSZ3B2QRWSMWPz3Eop4_AVjMaDP1igQiuhxd7MJ_mmqp3wr0hJccFSlYAisbH955xfEZl6KvcwOLeJwSG4y74HP2XnkXzr2ALXeJY9nRlcVeKqEp93nLym74u1NUHVaoWc5llRc0cgq6EbSoa-pY1b&sig=Cg0ArKJSzEkSEraj1j7YEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=144&cbvp=1&cstd=142&cisv=r20230510.78318&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Fri, 12 May 2023 07:13:49 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 12 May 2023 07:13:49 GMT

GET
H/1.1

200
OK

px.gif
d.adtriba.com/ Frame F644
Redirect Chain

https://d.adtriba.com/collect?atb_ptid=f65079e0&atb_dcaid=202210_es_hunger_dv_pros_347628237&atb_dpuid=di_dv&gdpr=&gdpr_consent=
https://d.adtriba.com/px.gif

42 B
227 B

23ms
23ms

Image
image/gif

18.158.240.157
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.adtriba.com/px.gif
Requested by: Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: HTTP/1.1
Server: 18.158.240.157 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-158-240-157.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.1 /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Fri, 12 May 2023 07:13:49 GMT
Cache-Control: public, max-age=86400
Server: nginx/1.16.1
Connection: keep-alive
Content-Length: 42
Content-Type: image/gif

Redirect headers

Date: Fri, 12 May 2023 07:13:49 GMT
Last-Modified: Fri, 12 May 2023 07:13:49 GMT
Server: nginx/1.16.1
P3P: CP="This is not a P3P policy! See https://www.adtriba.com/privacy-policy.html for more info."
Location: /px.gif
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 01:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 5F58 22 KB
8 KB 29ms
22ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 172503
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 10 May 2023 07:18:46 GMT
expires: Thu, 09 May 2024 07:18:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 18E9
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEDgdpVbzgkFATWwYLu1VtC4&google_cver=1&google_push=ATf1kGODwTxsusAYMrDJNqHX_Yge4feK3VsLWNi_0vyljAtGCBTdwLNm12eBoSQDOXROUwuuntOJ-R34Ta2hx1W4MBcLKr4Bh5Tt
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=OTE3MDYyMzMwMTMxMjg3NDAzMw==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEFj5IAPE7JmaGf3Fst9Lrgo&google_cver=1

43 B
398 B

51ms
28ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEFj5IAPE7JmaGf3Fst9Lrgo&google_cver=1
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 12 May 2023 07:13:48 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEFj5IAPE7JmaGf3Fst9Lrgo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame 18E9 35 B
465 B 81ms
23ms Image
image/gif 2620:116:800d:21:5ed4:8d5d:fed7:f5ef
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESELFlzyi2YzoGdKCL3WRXSHQ&google_cver=1&google_push=ATf1kGOSY_U_7Y9TPU4o_soBOl7nxnDZwfRhIbiWeyR5oFzvyvTFoAfrXkJwpt-beimN1PRV1PhFZkPF0KFZo3Z-bCF0SWblXXNDPQ

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:5ed4:8d5d:fed7:f5ef , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 18E9
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEIRV2Q0F2djuBNZXTFZgRmE&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ZGZmMHgzV0UxUFhtWWw1&google_gid=CAESEIRV2Q0F2djuBNZXTFZgRmE&google_cver=1&google_push=ATf1kGO5sb7znNe44VsX48xcjaoeHcW2-HCdNCHBIsK3d0u...

170 B
188 B

33ms
33ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ZGZmMHgzV0UxUFhtWWw1&google_gid=CAESEIRV2Q0F2djuBNZXTFZgRmE&google_cver=1&google_push=ATf1kGO5sb7znNe44VsX48xcjaoeHcW2-HCdNCHBIsK3d0unVh8KEfDIyD2R3Z-tEBZwmNxQIyk1-8xgWJXrETizDgmZDOKf2JtqOA

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Fri, 12 May 2023 07:13:48 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-777-g304ac51#rel-ec2-master i-0943143fd00beb9c6@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=ZGZmMHgzV0UxUFhtWWw1&google_gid=CAESEIRV2Q0F2djuBNZXTFZgRmE&google_cver=1&google_push=ATf1kGO5sb7znNe44VsX48xcjaoeHcW2-HCdNCHBIsK3d0unVh8KEfDIyD2R3Z-tEBZwmNxQIyk1-8xgWJXrETizDgmZDOKf2JtqOA
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 18E9
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEEoYdhf2Cf3lRIZqTAIeHww&google_cver=1&google_push=ATf1kGO3f3YFbX3KG4GxcKQkm6ey65a90vy8OlCw1S0iAcAOLsNLUTrUQU-J-j8a1YtVqsHgDSi8Im_k2PVm_geXi_rzA5PeLg-L&...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEEoYdhf2Cf3lRIZqTAIeHww&google_cver=1&google_push=ATf1kGO3f3YFbX3KG4GxcKQkm6ey65a90vy8OlCw1S0iAcAOLsNLUTrUQU-J-j8a1YtVqsHgDSi8Im_k2PVm_geXi_rzA5PeLg-...

43 B
414 B

213ms
212ms

Image
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEEoYdhf2Cf3lRIZqTAIeHww&google_cver=1&google_push=ATf1kGO3f3YFbX3KG4GxcKQkm6ey65a90vy8OlCw1S0iAcAOLsNLUTrUQU-J-j8a1YtVqsHgDSi8Im_k2PVm_geXi_rzA5PeLg-L&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DATf1kGO3f3YFbX3KG4GxcKQkm6ey65a90vy8OlCw1S0iAcAOLsNLUTrUQU-J-j8a1YtVqsHgDSi8Im_k2PVm_geXi_rzA5PeLg-L%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: H2
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7c60dc7c99e792b1-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 1489
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEEoYdhf2Cf3lRIZqTAIeHww&google_cver=1&google_push=ATf1kGO3f3YFbX3KG4GxcKQkm6ey65a90vy8OlCw1S0iAcAOLsNLUTrUQU-J-j8a1YtVqsHgDSi8Im_k2PVm_geXi_rzA5PeLg-L&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DATf1kGO3f3YFbX3KG4GxcKQkm6ey65a90vy8OlCw1S0iAcAOLsNLUTrUQU-J-j8a1YtVqsHgDSi8Im_k2PVm_geXi_rzA5PeLg-L%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7c60dc7b58fb92b1-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 18E9 70 B
265 B 146ms
46ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESECvrLay1PSxhuE4yGRiAMY8&google_cver=1&google_push=ATf1kGMllWIsMT1PnNO17qx2-QkVkiyS_7fc2c3_OcqsVJ488nnm7ddVIP8DHnHnwDYgGeA3_Rv80_tk_ujwgSC2wFe8QnUTOr8iZg
Requested by: Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 18E9 43 B
362 B 34ms
28ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DPUSH_DATA&google_gid=CAESENcccr_m5gVaNCJRdKXQ28I&google_cver=1&google_push=ATf1kGOGh7ePhvsmiSeKlE1vbzroHr7EqBKY2thLQPZSxd0W-BSK1-A7xfkPce8Lgq_vXKVpMV632J5B8h6Tvxn0wsmoxdDlrMA50Q

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:48 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 317678
expires: Fri, 12 May 2023 00:00:00 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame 18E9 43 B
350 B 89ms
32ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEH3xdG2C-Qj310vnAZ3-2yQ&google_cver=1&google_push=ATf1kGOkMaebEtKzKPLvJdLRcE6qvwQPNU4Q97mDiYmFonvEfjwdw-rPlGyYNqHwK3IV7QTKg8pohGpDmh_IcLS-iFeUGJB64NvbJQ
Requested by: Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:48 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: tng79ef1m1g5s68opico6efujno67klr

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 18E9 0
12 B 33ms
29ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KVAyiv3M3Bl1OvDM5eyAaq4LZ2MXaa4O-1A5zfRFRtk60W451kckOV5G4DN6LuOV_t5kU6

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 styles.css
s0.2mdn.net/sadbundle/11799348657721538044/ Frame 11BF 830 B
430 B 22ms
22ms Stylesheet
text/css 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11799348657721538044/styles.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11799348657721538044/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

92f5cc44b682dd86b0c7a777f990dbd1d8a8ce8a64076ae84199fcb9bedcdcb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11799348657721538044/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 06 May 2023 22:41:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 462740
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 401
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:46:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 05 May 2024 22:41:29 GMT

GET
H3 200 tweenmax_1.19.0_643d6911392a3398cb1607993edabfa7_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 11BF 109 KB
37 KB 31ms
30ms Script
text/javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_1.19.0_643d6911392a3398cb1607993edabfa7_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11799348657721538044/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

36c0ec05d79bd9d3164effc3eca0f1962cd6f82bb1f41cb212e080910be24153

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11799348657721538044/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37530
x-xss-protection: 0
last-modified: Tue, 06 Sep 2016 20:51:14 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 12 May 2023 07:13:49 GMT

GET
H3 200 main.js Show response
s0.2mdn.net/sadbundle/11799348657721538044/ Frame 11BF 4 KB
1 KB 23ms
22ms Script
application/x-javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11799348657721538044/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11799348657721538044/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

520d28f0b4f96f76a15119e65355d3ee6cfccd7518520e3194fd1585eb12e6b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11799348657721538044/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 06 May 2023 21:02:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 468670
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1399
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:46:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 05 May 2024 21:02:39 GMT

GET
H3 200 A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js Show response
pagead2.googlesyndication.com/bg/ Frame FE3A 37 KB
14 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03a0e4a85c470c697b9cab256a97ff2704a034b9394b9d67c4aaf6c5d421b5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 05:49:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5035
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14779
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 11 May 2024 05:49:54 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E004
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEBAXAQImgBxV6_BMcRNElQc&google_cver=1&google_push=ATf1kGOJcvNs7SOA-duUgxkfLtzClPogzluRXaWsNjarGSVhAGqSrMZNjXdQrrfLdSn8KZk3pmsZ0ksbvQFmaOiI...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGOJcvNs7SOA-duUgxkfLtzClPogzluRXaWsNjarGSVhAGqSrMZNjXdQrrfLdSn8KZk3pmsZ0ksbvQFmaOiIQ5bptwFHjSBHFmo

170 B
188 B

32ms
32ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGOJcvNs7SOA-duUgxkfLtzClPogzluRXaWsNjarGSVhAGqSrMZNjXdQrrfLdSn8KZk3pmsZ0ksbvQFmaOiIQ5bptwFHjSBHFmo

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 12 May 2023 07:13:49 GMT
Server: MT3 851 9bd98ae master cdg-pixel-x28 config_version:"unknown"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGOJcvNs7SOA-duUgxkfLtzClPogzluRXaWsNjarGSVhAGqSrMZNjXdQrrfLdSn8KZk3pmsZ0ksbvQFmaOiIQ5bptwFHjSBHFmo
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 12 May 2023 07:13:48 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E004
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEA-c1bunoqvT2vP6JVQtnSI&google_cver=1&google_push=ATf1kGMzSKeuYsk1UErXosldB-vqOtAJuK_sPHQgJj8pD0sw-DB6crMLZRoej5XztZdukO565pdgTKF7R6n...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ATf1kGMzSKeuYsk1UErXosldB-vqOtAJuK_sPHQgJj8pD0sw-DB6crMLZRoej5XztZdukO565pdgTKF7R6n4su7d6QtwOPfqqlcW4lM&google_hm=yxTPFXxITMKyyrFoV...

170 B
188 B

32ms
32ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ATf1kGMzSKeuYsk1UErXosldB-vqOtAJuK_sPHQgJj8pD0sw-DB6crMLZRoej5XztZdukO565pdgTKF7R6n4su7d6QtwOPfqqlcW4lM&google_hm=yxTPFXxITMKyyrFoVnLDmbg

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=ATf1kGMzSKeuYsk1UErXosldB-vqOtAJuK_sPHQgJj8pD0sw-DB6crMLZRoej5XztZdukO565pdgTKF7R6n4su7d6QtwOPfqqlcW4lM&google_hm=yxTPFXxITMKyyrFoVnLDmbg
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E004
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEBl51XH-xih1DywBxauG1qY&google_cver=1&google_push=ATf1kGOb2ZvhTMlYRj9rQeiYT8wo79tUdLRanh7rUGlqL9sRloS5nwgdddEHnoT6vBsRXvUEZ1XFj38Edw5Y55K1...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=6Yt0YjJTQxmsn9CWhEyoPA2&google_push=ATf1kGOb2ZvhTMlYRj9rQeiYT8wo79tUdLRanh7rUGlqL9sRloS5nwgdddEHnoT6vBsRXvUEZ1XFj38Edw5Y55K11FY0-8_YJA3-xfs

170 B
188 B

34ms
34ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=6Yt0YjJTQxmsn9CWhEyoPA2&google_push=ATf1kGOb2ZvhTMlYRj9rQeiYT8wo79tUdLRanh7rUGlqL9sRloS5nwgdddEHnoT6vBsRXvUEZ1XFj38Edw5Y55K11FY0-8_YJA3-xfs

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 12 May 2023 07:13:49 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=6Yt0YjJTQxmsn9CWhEyoPA2&google_push=ATf1kGOb2ZvhTMlYRj9rQeiYT8wo79tUdLRanh7rUGlqL9sRloS5nwgdddEHnoT6vBsRXvUEZ1XFj38Edw5Y55K11FY0-8_YJA3-xfs
x-host: tde-deliveryengine-production-68bf66644b-xcrw7
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E004
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEGbHi5P7KcqF_pWj87itvvo&google_cver=1&google_push=ATf1kGPpKugb-L6IiOp_o64PmjnBrGBGz564sQCJP_ssXynXv5Ux9VgO9s8znTlfbo5grVNpf7VeBb74iEdjWaHlkjHJ...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEGbHi5P7KcqF_pWj87itvvo&google_cver=1&google_push=ATf1kGPpKugb-L6IiOp_o64PmjnBrGBGz564sQCJP_ssXynXv5Ux9VgO9s8znTlfbo5grVNpf7VeBb74iEdjWa...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGPpKugb-L6IiOp_o64PmjnBrGBGz564sQCJP_ssXynXv5Ux9VgO9s8znTlfbo5grVNpf7VeBb74iEdjWaHlkjHJ_LHH_a14sQ&google_hm=8Ux7x1z6RrmjZ7ediWrg2A==

170 B
188 B

33ms
32ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGPpKugb-L6IiOp_o64PmjnBrGBGz564sQCJP_ssXynXv5Ux9VgO9s8znTlfbo5grVNpf7VeBb74iEdjWaHlkjHJ_LHH_a14sQ&google_hm=8Ux7x1z6RrmjZ7ediWrg2A==

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGPpKugb-L6IiOp_o64PmjnBrGBGz564sQCJP_ssXynXv5Ux9VgO9s8znTlfbo5grVNpf7VeBb74iEdjWaHlkjHJ_LHH_a14sQ&google_hm=8Ux7x1z6RrmjZ7ediWrg2A==
date: Fri, 12 May 2023 07:13:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E004
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEIiPadBqG7WZhEINk2a1Umk&google_cver=1&google_push=ATf1kGMSOZkLPTZlfW2PcnuYE_I0ukIaY7mEEEpFraZZf9DIKskQOEbF7iVUdRwqrwvrBn1IZzGlKSEZKmqintlTBn_1i8G...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGMSOZkLPTZlfW2PcnuYE_I0ukIaY7mEEEpFraZZf9DIKskQOEbF7iVUdRwqrwvrBn1IZzGlKSEZKmqintlTBn_1i8GRc9zsIw&google_hm=eS1UaWwuVFRoRTJwSElO...

170 B
188 B

34ms
34ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGMSOZkLPTZlfW2PcnuYE_I0ukIaY7mEEEpFraZZf9DIKskQOEbF7iVUdRwqrwvrBn1IZzGlKSEZKmqintlTBn_1i8GRc9zsIw&google_hm=eS1UaWwuVFRoRTJwSElOQUdrRVhYX2pTdERZejVqbDJyWX5B

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 12 May 2023 07:13:49 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGMSOZkLPTZlfW2PcnuYE_I0ukIaY7mEEEpFraZZf9DIKskQOEbF7iVUdRwqrwvrBn1IZzGlKSEZKmqintlTBn_1i8GRc9zsIw&google_hm=eS1UaWwuVFRoRTJwSElOQUdrRVhYX2pTdERZejVqbDJyWX5B
content-length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame E004 43 B
362 B 32ms
30ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DPUSH_DATA&google_gid=CAESEPeU8oTEQOqSBB4Awb9I0Aw&google_cver=1&google_push=ATf1kGMh5I8WDKusyEMT8Zet6RZRFIYByjHlEYEw_760nIq_2y5dHNu6EOcH5Tv4UTAx5n3p74V5WKGzyQi-l-ZCKp2G2K0xEPH4tuI

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 285186
expires: Fri, 12 May 2023 00:00:00 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame E004 43 B
134 B 77ms
32ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEBzx7Dci8jr6gIadIpZwRA4&google_cver=1&google_push=ATf1kGM43rvplI2OxFHA-xUK-8pm6d6iMu1HsX24N2S4fTfrOMSnjCGSCzIqYDvhmW0GUARWYkkVRwbzlV9F9j0HzJ4zss6e7d9qzP0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198791085&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1683875628514&bpp=2&bdt=114&idt=259&shv=r20230510&mjsv=m202305080101&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=7072187039029&frm=8&ife=1&pv=1&ga_vid=394798252.1683875629&ga_sid=1683875629&ga_hid=1845346858&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=33134225&scr_x=-12245933&scr_y=-12245933&eid=44759876%2C44759927%2C44773810%2C44759837%2C44788442%2C44790154%2C21065724&oid=2&pvsid=4387797284332370&tmod=1638594040&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.6c0eybry1l1n&fsb=1&dtd=264
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:48 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: lr83o1sr5ncmo8kqus6l029maug3cb0e

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame E004 0
12 B 31ms
30ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LiP8ZbEf8wf4k3144iPk8CpquhYVOj300quN3GZwEPVWUhgZQ7s8D4ZhDadn4ssxzM2SLv

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 styles.css
s0.2mdn.net/sadbundle/2643589595411275818/ Frame A6D1 829 B
431 B 23ms
22ms Stylesheet
text/css 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2643589595411275818/styles.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2643589595411275818/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c3294ef598667c6169398d34721280ddbc9dffcba5bc3ac190357374f841347

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2643589595411275818/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Wed, 10 May 2023 18:22:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 132666
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 402
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:45:16 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 09 May 2024 18:22:43 GMT

GET
H3 200 tweenmax_1.19.0_643d6911392a3398cb1607993edabfa7_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame A6D1 109 KB
37 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_1.19.0_643d6911392a3398cb1607993edabfa7_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2643589595411275818/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

36c0ec05d79bd9d3164effc3eca0f1962cd6f82bb1f41cb212e080910be24153

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2643589595411275818/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37530
x-xss-protection: 0
last-modified: Tue, 06 Sep 2016 20:51:14 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 12 May 2023 07:13:49 GMT

GET
H3 200 main.js Show response
s0.2mdn.net/sadbundle/2643589595411275818/ Frame A6D1 4 KB
1 KB 24ms
23ms Script
application/x-javascript 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2643589595411275818/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2643589595411275818/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f66701275896763806723b24a98618b5ae17e48da67fea9132b98f31aaab60ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2643589595411275818/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 06 May 2023 09:29:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 510270
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1399
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:45:16 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 05 May 2024 09:29:19 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame DFC6 1 KB
643 B 23ms
22ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 57361
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 May 2023 15:17:48 GMT
etag: 48472445140208031
expires: Fri, 12 May 2023 15:17:48 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame EF3D 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ad899f1b1f18501cc694e0a7046183eb779931af7b2aed082a2b59edc56794e3

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame EF3D 0
0 61ms
60ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstJAqvab02a00TY7FTfmkOTph1_NAr7C3lX0eHN_kSIVPC4sxgCAs-S9a721hQOiuAAUeJwiMsBd9-uoNmkBkugfXamNPRRt0GWkVbJaHoxpsh_nyCOEc6s9Li7dowF664YzT2wdGhe4Lr1DmWrYWRJVOSqqUlwFRWtmXs4y3VKjW6wodsoV33wsrWnmq_48912t4bnUSwcBPSWRo78fusvxCJiptRCQ07DA0NjBtFsvGBZ3AO2EXXH1iUh40lwccNXQnL2LFbF84UshTuFJpazHWyyvPIoqosqv8zr39nyixStXw4uGl-Bq_Q_6eRdrlMtbFqVwdX7Bc9qzOOZ0vxNuxIUi5DZ7i3Uia92iwzzFBmRUnNfKpX1PGmDCAeByRsOvkMnxqJFOuNJ3wNuuSugEJR2e6IwbELExsZUEHMNObbFrCTGpTdC_FcupGapiTiB55OlrbOUZZ-WNzfhcq95Ekxw9dSvGIM79oXKnZoahpepnid9n9RxCdzlUpfgn6VK_HEBp7qXAW1yL_yE8aYcuFL7K72xl3HqfijLuGAj3mM0i3PX2f4C9jiZcHLSdZnxBmEdtP4XDS2MG1SZHL0ql-YaYaTc_IYiah6cXH0-vwcjU6lIY3sS2dFnZd1JYROwxUP4uTl8AM8Isg4E6eVnIyGq1icWUZjmelOQCj4QA31RxRtppOdJ68QdpED7zuM3lBLDf7kV4_Sa9ATenVQHoAdl6pB5mPGgkAuQEro3jx9ziL9eas1qkLUmJsTJs4ChgLP2ec-RMe1ezbGIqQl1l3GwmTSuTgGQgiqB3yEFMcXBCUZ4xFOuJTfOXVwfAiIKJ8y8UtKjmxRJq6ZZx6DPpH4_zkDP4O6oy4wjQS4xA-8EAVYYY14MNuyO2cE9U0iC1_WtEIaGE8iSLk9aFK2jr8UYnB4Wuu-Vz-Pb9nuzyGQnkO-Phc_N7KL21MJQPgO9ROLqaanHv3etGNYNnsDgKGiij1FmBOsyqj3rzRq5mlESIVijkrIcw0zkeohUNDwlBUm266Kmup9mJmROpfkYDlowTNSbdr_UuJyTOS4tLUzawm4NNdh72QXoroyiUPhavdxYnfxPzJKUH8tb0MEGy_CT_yMiU8IWErALSRuPjTLof1aq1fepcEn4kXQiM2JUb_X4keY8c5Z9lHWWA2MdEJP8BzrIOuM4NTMKtGMHKvnRScUZRlF0zmcLKUVW8FGL5M0ih8hIHSHWYNtMGOITsMfiwrQ0TtOZuH-KrPPXubtpQrGgfG4HmXOsW2r0CXTKCIU4gOTpm1CNYhcwEQTAhyFycoBxGh7UGkx3Nr3o_X9Qbnfbc7BnwDqLbyGDGJHhD6rKzxh0SuHtpZr8RyE&sai=AMfl-YQf9-8WPwrqeCLXA5bJYu8ssmqcOsBxPzZkGSlCyAV813OVHS0d5OFUyyD2f02aJIehr0La7fZwz96cKpAn7Gp0HM6zkOqtLq_4FgtJUFz1pFzMIXK1vGh8M_nkb5yKvLCoCZDHhJGzizOnzSztB5L0zrxtQqi4bv2tsrBL-WSswlztchve1NnjHEmyIIJsFHU31jy2t8NdGMlzuUFZCMj9mXu2fVibNKd1g_iG75aauXhpKwTJCIJRdaarGcw3YrgZ&sig=Cg0ArKJSzIsDOhgj2SkwEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=76&vt=11&dtpt=74&dett=2&cstd=0&cisv=r20230510.13589&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 12 May 2023 07:13:49 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 6505 22 KB
8 KB 23ms
22ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 172503
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 10 May 2023 07:18:46 GMT
expires: Thu, 09 May 2024 07:18:46 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js Show response
pagead2.googlesyndication.com/bg/ Frame 5F58 37 KB
14 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03a0e4a85c470c697b9cab256a97ff2704a034b9394b9d67c4aaf6c5d421b5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 05:49:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5035
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14779
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 11 May 2024 05:49:54 GMT

GET
H3 200 bg.jpg
s0.2mdn.net/sadbundle/11799348657721538044/ Frame 11BF 54 KB
54 KB 23ms
23ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11799348657721538044/bg.jpg

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a0711e8b40705bfe578257b7ccd102e309411c0cec6ac0722ec487d827733388

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11799348657721538044/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 06 May 2023 21:15:07 GMT
x-content-type-options: nosniff
age: 467922
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54848
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:46:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 05 May 2024 21:15:07 GMT

GET
H3 200 band.png
s0.2mdn.net/sadbundle/11799348657721538044/ Frame 11BF 5 KB
5 KB 25ms
24ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11799348657721538044/band.png

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

607c41758097d2b8429fa6d3c628610701802c4a9ba8dec3901257491bf3cb7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11799348657721538044/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 06 May 2023 22:56:53 GMT
x-content-type-options: nosniff
age: 461816
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4859
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:46:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 05 May 2024 22:56:53 GMT

GET
H3 200 text2.png
s0.2mdn.net/sadbundle/11799348657721538044/ Frame 11BF 6 KB
6 KB 26ms
25ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11799348657721538044/text2.png

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e97639114954ac5d65f5065c56d92d777ed1592dd283b3009959fa5473218cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11799348657721538044/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 05 May 2023 22:15:26 GMT
x-content-type-options: nosniff
age: 550703
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6323
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:46:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 04 May 2024 22:15:26 GMT

GET
H3 200 text3.png
s0.2mdn.net/sadbundle/11799348657721538044/ Frame 11BF 5 KB
5 KB 26ms
25ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11799348657721538044/text3.png

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8d70f5e3076126b0f029c2842e0f3374e5d02070a295f5d25e2c4a0c7c823ff1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11799348657721538044/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 06 May 2023 06:38:38 GMT
x-content-type-options: nosniff
age: 520511
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5214
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:46:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 05 May 2024 06:38:38 GMT

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/11799348657721538044/ Frame 11BF 2 KB
2 KB 27ms
26ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11799348657721538044/cta.png

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d6c6699a632aac7b20247601a044bcb1151bcf638d9b435ef4c29aac1d911b3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11799348657721538044/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 05 May 2023 10:21:58 GMT
x-content-type-options: nosniff
age: 593511
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2416
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:46:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 04 May 2024 10:21:58 GMT

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/11799348657721538044/ Frame 11BF 3 KB
3 KB 27ms
26ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11799348657721538044/logo.png

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca5186c45c8b98fd128a56f0778172c5088be7086f94ab4d9c0fc0657081f29e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11799348657721538044/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 06 May 2023 21:27:00 GMT
x-content-type-options: nosniff
age: 467209
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2635
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:46:51 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 05 May 2024 21:27:00 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8BC2 0
0 60ms
59ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssVxEnRKU_hfKK6yKElmqAKSDsZOR3rAz4qKDjmjgp1R5LLoFmV-fyQgROqL75WTaOfDX9vD_Dhrshk0YMRrwXDn1TFXg5C1LDCZ8unIz5fVATtGEw9ns5yFWPZWw0t-4uzIT7ebliwWhUAEWpM4R4nYL_-S4oDWajGeT6TKwXQHULbWWpm7twYlAAyj2vc0PtTOkqYvPL--W979mNR9S5IS-2HPKG7O3xBGSwFacoxaOFrw5vjMiYJfns_iQ_7SKEYwLWKrFh6WKdprqdQAJQ9VFIyyqI5dqOkEDvnRH1lk53BvhXuJ48iaUinv-lNsPeuGDkhrjSFXQJnUuadLcywNbAGRuxQ_mm3xNHH68igLPjUlXUVXi62Sb87T0JBuKF6PSqpJ2R_BGFkAUHg2dKjd6B43yYnm0Kce8AnIANN1yVSsxSJKa8sJy-Zi3uJdiGQSEPj1HDcGJh5whmcqrfDx6sUvn5xaYYg8c8zjp-VBvN5U8cWQMYOJYI-FG3txuTjLOkq1lkyL13sGjdbd1VeDUusxxXNg4AsAXAJic_sVPWXdeREelOnjN2zK4hOqQDzbeueG9ORHBRC4tfrCJQ2u65KhtPc4fGJPol8CsVjAAjReKkyaIchl-9UwYgClYoLyA-CBWmXItKx9cWDz3VbHO47KY_M4P-fjftEFg5hUkuc3g5kJJWl_cljvkQ0C7cNUHdoA6ZwjixXWGp4mEn7gszwkIGA1D2rmCYANIYR4ryR2MYnRZtLfNKD4rl_452AotCFiQGzTJ0TFQFk0l0bDnlJP0gvnxWsGZAeYEM3DxQF2YTmtPOpqtCHa8VV-P69UClaL9-XSDO-KDoqXqGbbZNTqPzUPc524S281rCT24C_UZPXAEBXQD_asOTMmZASDIT3RFD9glvjH6rLu4H7uVjksE2SQQt1f9o8qgaY-Hy4sJ0nYaj8oj9vEesP-NDfuS8P58ABnSlO2TblAkJsUsiz0I-6NdHoJ8mAQa_FC7r0smQr-jgiBvlUZ32v0IlVgbBZrY_kmA4YD9o7uJSyQVcdiWXqZYW_Wv7Jmrb7pMjQO4YUbyEM8Dw94OEPNJLO5Iek3Sdv0qLx35JG8tx01fYzwOcQVcpNq1dxyq0Z1RxWwDT7QhJOTQ4WCkG1AEmRQzu9m1yr_GU7Wklezq4bqFAQoy2NttdNuqH1Hl7l4INiaWqdPBgW4cUu69Gv30-qcQ5woTQFU-k0PTqk7rVSBZyFtotb0wnQTB4ywUL32Vy4HCTvmGHm-XRQ4_14O1zveiWcL2-zr5D2PjGvyhrpSgTRHPlDzVtizfyaiGvllxeaa67DkB1FDHpz8A47HsUlMMtkaUrcZEQ&sai=AMfl-YQBKCX_KSiavcU5WGR6D60PCWaZ6-BWoZgX-kiQfVdynz4xEtI69S-dR_4FOm4dBCDSHNW-EnI9aEyxoVdoVechHG9hfUKJVeL5kgDTZRxTVKQDBI219N668mmdd-ZZsx7blw4-H7EJFa5LJBtQWucDUJGzhsEuc444uHuJHjrTXUkaxa-LdDho5E9sSZ854vIs_tdgPrhdWn3RmTuuTkcSy88DakrTsmTsPw83_I4sJuOEcTGFCsU612ts4pBHST5v&sig=Cg0ArKJSzKubwxt4dYslEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=356&vt=11&dtpt=164&dett=3&cstd=188&cisv=r20230510.31947&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 12 May 2023 07:13:49 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame DFC6 0
104 B 225ms
88ms Image
text/plain 2a02:fa8:8806:16::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEDggJ1w_aLMqC7BOyiHdbu8&google_cver=1&google_push=ATf1kGOskyhPBuahLv0VVymcBL2Dos50xwvmoTuK1towTXc9S5QHNgix_X7SPkTvhnnQz2nx0XuMqI2xop8z8MKaenhCPKSUMkU
Requested by: Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:16::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DFC6
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEDXtKSRhhIQyWnUAkqs0ORk&google_cver=1&google_push=ATf1kGO7J81od5PhXCMy093Cz0fNneZEWxBCI8On47HyRIz5hfrtzp8QcVImzQ3OPgYqTaoP2XMbmuIQVSyMGM_6...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGO7J81od5PhXCMy093Cz0fNneZEWxBCI8On47HyRIz5hfrtzp8QcVImzQ3OPgYqTaoP2XMbmuIQVSyMGM_6yntotqdB9ilB

170 B
188 B

34ms
33ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGO7J81od5PhXCMy093Cz0fNneZEWxBCI8On47HyRIz5hfrtzp8QcVImzQ3OPgYqTaoP2XMbmuIQVSyMGM_6yntotqdB9ilB

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Fri, 12 May 2023 07:13:49 GMT
Server: MT3 851 9bd98ae master cdg-pixel-x12 config_version:"unknown"
Content-Type: image/gif
Access-Control-Allow-Origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=ATf1kGO7J81od5PhXCMy093Cz0fNneZEWxBCI8On47HyRIz5hfrtzp8QcVImzQ3OPgYqTaoP2XMbmuIQVSyMGM_6yntotqdB9ilB
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 0
Expires: Fri, 12 May 2023 07:13:48 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DFC6
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESECOEGreAVPymI8Vl-00BOSU&google_cver=1&google_push=ATf1kGMIRQ_xrN84jCAo0bc7DbGYmbBIIqV0etm4gtTT_e1anDMBOsTqQQh4HhXxXP6J_fHo-fy3TR82BaAAchaj9aOe5e3gJvNm
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=69E41AC40F32434298C79ABCBC4EE3DE&google_push=ATf1kGMIRQ_xrN84jCAo0bc7DbGYmbBIIqV0etm4gtTT_e1anDMBOsTqQQh4HhXxXP6J_fHo-fy3TR82BaAAcha...

170 B
188 B

35ms
34ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=69E41AC40F32434298C79ABCBC4EE3DE&google_push=ATf1kGMIRQ_xrN84jCAo0bc7DbGYmbBIIqV0etm4gtTT_e1anDMBOsTqQQh4HhXxXP6J_fHo-fy3TR82BaAAchaj9aOe5e3gJvNm

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 12 May 2023 07:13:49 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=69E41AC40F32434298C79ABCBC4EE3DE&google_push=ATf1kGMIRQ_xrN84jCAo0bc7DbGYmbBIIqV0etm4gtTT_e1anDMBOsTqQQh4HhXxXP6J_fHo-fy3TR82BaAAchaj9aOe5e3gJvNm
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Thu, 11 May 2023 07:13:49 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DFC6
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEM1p2tiC4tusaFy5qxNOeiI&google_cver=1&google_push=ATf1kGMBkBGvenb3DCuIuCXyaFG6rUUK3eHDaNUuvjiuTh70yqNhVyuUs352-Ltbixmh78fmCEoNSofUhLNAaF...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzIzMjE5MDc1NzA5NzM3MTgwMA%3D%3D&google_push=ATf1kGMBkBGvenb3DCuIuCXyaFG6rUUK3eHDaNUuvjiuTh70yqNhVyuUs352-Ltbixmh78fmCEoNSofUhLNAaFA6Nh...

170 B
188 B

33ms
33ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzIzMjE5MDc1NzA5NzM3MTgwMA%3D%3D&google_push=ATf1kGMBkBGvenb3DCuIuCXyaFG6rUUK3eHDaNUuvjiuTh70yqNhVyuUs352-Ltbixmh78fmCEoNSofUhLNAaFA6Nhv5nYgMywk

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzIzMjE5MDc1NzA5NzM3MTgwMA%3D%3D&google_push=ATf1kGMBkBGvenb3DCuIuCXyaFG6rUUK3eHDaNUuvjiuTh70yqNhVyuUs352-Ltbixmh78fmCEoNSofUhLNAaFA6Nhv5nYgMywk
Date: Fri, 12 May 2023 07:13:49 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DFC6
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEPPCpM0ywyST_HD3mAyq0Is&google_cver=1&google_push=ATf1kGN8n1mOOT8f9tdf0wL5lslPz8rC5ylkCElGwvbpNvoSLeGIVut5QWIfiRlTQPrO5Vxib2Pk2MBc...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEPPCpM0ywyST_HD3mAyq0Is&google_cver=1&google_push=ATf1kGN8n1mOOT8f9tdf0wL5lslPz8rC5ylkCElGwvbpNvoSLeGIVut5QWIfiRlTQPrO5Vxib2P...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDA4ODkwODEzODczNjM1NDgxMQ&google_push=ATf1kGN8n1mOOT8f9tdf0wL5lslPz8rC5ylkCElGwvbpNvoSLeGIVut5QWIfiRlTQPrO5Vxib2Pk2M...

170 B
188 B

33ms
32ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDA4ODkwODEzODczNjM1NDgxMQ&google_push=ATf1kGN8n1mOOT8f9tdf0wL5lslPz8rC5ylkCElGwvbpNvoSLeGIVut5QWIfiRlTQPrO5Vxib2Pk2MBcr6cp0Yk2U-Hwh0n0BYhi

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NDA4ODkwODEzODczNjM1NDgxMQ&google_push=ATf1kGN8n1mOOT8f9tdf0wL5lslPz8rC5ylkCElGwvbpNvoSLeGIVut5QWIfiRlTQPrO5Vxib2Pk2MBcr6cp0Yk2U-Hwh0n0BYhi
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DFC6
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEF17QCMJpLv9kAsO6NRWK6Q&google_cver=1&google_push=ATf1kGMs0Y9CRPe_YO4RxEz0zLna7i9OyH_jAF4SwgSRNJ5GDR3wUEA00WRcbXHsqOSdAmzw-Za...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEhLODJNMkItVS1INDhX&google_push=ATf1kGMs0Y9CRPe_YO4RxEz0zLna7i9OyH_jAF4SwgSRNJ5GDR3wUEA00WRcbXHsqOSdAmzw-ZatQhdO32UCt25Dt1o8-Cz9Qhw0

170 B
188 B

31ms
31ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEhLODJNMkItVS1INDhX&google_push=ATf1kGMs0Y9CRPe_YO4RxEz0zLna7i9OyH_jAF4SwgSRNJ5GDR3wUEA00WRcbXHsqOSdAmzw-ZatQhdO32UCt25Dt1o8-Cz9Qhw0

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEhLODJNMkItVS1INDhX&google_push=ATf1kGMs0Y9CRPe_YO4RxEz0zLna7i9OyH_jAF4SwgSRNJ5GDR3wUEA00WRcbXHsqOSdAmzw-ZatQhdO32UCt25Dt1o8-Cz9Qhw0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: c1913d0f161dfd12bb229b87994a2d1d
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DFC6
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEIS_bQN8vxr1e70MmGoQw58&google_cver=1&google_push=ATf1kGPmdHlLxGDRcH4KXp_oMAlZlV-D_k14UbviIYETeKUyhrXjBmPiH0z3VKjF5FF1xURNJB...
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEIS_bQN8vxr1e70MmGoQw58&google_cver=1&google_push=ATf1kGPmdHlLxGDRcH4KXp_oMAlZlV-D_k14UbviIYETeKUyhrXjBmPiH0z3VKjF5FF1xURNJB...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1kZkpYRlFKRTJ1SHpCSkkwWUNsbFJYZXRfbFVaeWIuN35B&google_push=ATf1kGPmdHlLxGDRcH4KXp_oMAlZlV-D_k14UbviIYETeKUyhrXjBmPiH...

170 B
188 B

33ms
33ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1kZkpYRlFKRTJ1SHpCSkkwWUNsbFJYZXRfbFVaeWIuN35B&google_push=ATf1kGPmdHlLxGDRcH4KXp_oMAlZlV-D_k14UbviIYETeKUyhrXjBmPiH0z3VKjF5FF1xURNJB500hqXWFXaHcElF0aSNNQbgU15Qw

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS1kZkpYRlFKRTJ1SHpCSkkwWUNsbFJYZXRfbFVaeWIuN35B&google_push=ATf1kGPmdHlLxGDRcH4KXp_oMAlZlV-D_k14UbviIYETeKUyhrXjBmPiH0z3VKjF5FF1xURNJB500hqXWFXaHcElF0aSNNQbgU15Qw
date: Fri, 12 May 2023 07:13:49 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame DFC6 0
12 B 30ms
29ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K3IiwD0NjZoNPAL5UaTn7Ae8ylQoJVblPMoXy-2hb5OM9oVkZEDCq5WBmBa9ss7__ewijf9w

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 bg.jpg
s0.2mdn.net/sadbundle/2643589595411275818/ Frame A6D1 31 KB
32 KB 25ms
23ms Image
image/jpeg 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2643589595411275818/bg.jpg

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c970c612c80d853bb998750b1cccf9aedbb8bb1108406a525c61b7a0e6b19a46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2643589595411275818/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 06 May 2023 08:27:13 GMT
x-content-type-options: nosniff
age: 513996
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 32240
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:45:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 05 May 2024 08:27:13 GMT

GET
H3 200 band.png
s0.2mdn.net/sadbundle/2643589595411275818/ Frame A6D1 3 KB
3 KB 27ms
24ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2643589595411275818/band.png

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

147154470a9824945cb7ec7b51309b8d52066bc8c27bacafeb2d0a49a65d26e7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2643589595411275818/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 06 May 2023 20:01:55 GMT
x-content-type-options: nosniff
age: 472314
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3410
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:45:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 05 May 2024 20:01:55 GMT

GET
H3 200 text2.png
s0.2mdn.net/sadbundle/2643589595411275818/ Frame A6D1 6 KB
6 KB 26ms
24ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2643589595411275818/text2.png

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e97639114954ac5d65f5065c56d92d777ed1592dd283b3009959fa5473218cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2643589595411275818/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 06 May 2023 21:25:19 GMT
x-content-type-options: nosniff
age: 467310
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6323
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:45:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 05 May 2024 21:25:19 GMT

GET
H3 200 text3.png
s0.2mdn.net/sadbundle/2643589595411275818/ Frame A6D1 5 KB
5 KB 27ms
24ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2643589595411275818/text3.png

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

209756ca5d587e33595747af61be5d7a42c1e20a78dc02d9526186c46bbbe0c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2643589595411275818/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 05 May 2023 22:15:41 GMT
x-content-type-options: nosniff
age: 550688
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4639
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:45:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sat, 04 May 2024 22:15:41 GMT

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/2643589595411275818/ Frame A6D1 2 KB
2 KB 29ms
27ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2643589595411275818/cta.png

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d6c6699a632aac7b20247601a044bcb1151bcf638d9b435ef4c29aac1d911b3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2643589595411275818/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 06 May 2023 19:58:44 GMT
x-content-type-options: nosniff
age: 472505
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2416
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:45:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 05 May 2024 19:58:44 GMT

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/2643589595411275818/ Frame A6D1 3 KB
3 KB 27ms
25ms Image
image/png 2a00:1450:4001:82b::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2643589595411275818/logo.png

Requested by

Host: 08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com
URL: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca5186c45c8b98fd128a56f0778172c5088be7086f94ab4d9c0fc0657081f29e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2643589595411275818/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 06 May 2023 09:29:19 GMT
x-content-type-options: nosniff
age: 510270
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2635
x-xss-protection: 0
last-modified: Wed, 26 Oct 2022 05:45:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 05 May 2024 09:29:19 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame F644 0
0 62ms
59ms Fetch
image/gif 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuHPC8xsJmqI-f6n9UHLF1icBP_UfnYchiizTZlxXrJlnIGkcfFLX0p0PFvu5BRHl0BFJfUnVn0UnqzW8vxtMsvtwOioYWo3GHgAkqJix6j3HO7iWhMr0YYX_aKxSNxbwDRUuREaPVNAYw1sA-TQskSmeA9ViBrpiwqZQLjvTgw5BRROj6DNMnQ4bD544X5m4hBVoHF-ryFe8YMESpZga7dIYqKsws6uVT-8LbGw34zzIg0VpU2Pnru2ikxY77wNzfBso7ZfTy55lIBlITFSKUDvzpnmqjiKbo-0eBYpnItiq5UAEThwooiHrDLwnoWvoloZCGOa_43K4p-Xq0tLzVn0bt2sDuwaYfax__5B8NikzlER25AN1GEGXYAG5BVpgybvn3EZh5FYYM76R7T_MKWcMu6gUVoNTyU94Sf4H2hapTLULLsLu2jDtzIAzvslL6NTqUn2YjSn1WL_en-TXk8-31YjSd23Bzc92k-Frs09HquEbeEkjnPHLJ_aOahNpTO5N4SBr6RZuR-4hXhbUkATvngFf0n3ZozEDXQOTUGHzFOgJf7yi81UqquGUtLi-Y12Nts0XZFxiU1qsuOXo8TdMW4jAiaonHDotl-lqSTGzDNFDQs0DCMiuQc2AzC2N6bx9aLDmPO1PpXwUj461o8Z1kAlTy4w62irPnEwdUq-6K3MKn7LJ6ephCGaiZbzw4IcDUJ92RWxm57BNOJlLwuVE9XRhqo9kXOtGfDYcnM9VoWNN-_jO1S3uUZ7mZD2kbuGaqkXrCU_7Ua3hqdoq9B670ZnGQq5Rf95m2SXxNt4PtMcyWeuTt6ZKaToFOTDGv5Vl39HQ9yumlVwTmarpVvadxsaQ-Mfmojo4BKC91cZSF-oGQVQtnOCCnOwZ-cugjdmnOS-OLVgeVBhDb0yOOJ7EFLo4yao7MU5By2s3WlmlIh0L1h1Qjl12QQLh2NTN1AvN-YwoIjFVuhzMYBm09CmFuWvFqGH4FJ01Qk2ub0C_IjoV1hDPbPzCE4UFGj3U47VzCR3s2xxyVhR0cWuugfk0UrcJ4OlXM63xszytsJ7wn2_-Ct28Geh-SNmvKWEsfwtZ83IXl5QQM9Y98cuJ6Ih6-U7qyJHtqDvxu4IY3LqtxrtCJKdo28L99UHESn_36CJ0Qjqfgt835l84zu_t6ZLHW6lDHIEx_zTO9qA7fTZeNiM3dYptyPqEMTz1NaD8uliAGpfehGxV0FP4DHKEVNC-0yEUxXzlipiLBL1SKbRPS3-5jRl4Js4bE1RJ1ysHE15JMAAkrO95104hIJM0vNEse8-XAmvE6k2-m1pJUhhVxp2vfXgTtjFs5G6QhiZ8krOEzXH5VNjVs7&sai=AMfl-YQUT5qTUPcrua_qLQXq79_yc9RXQBmgdQapkhAOm0Z7qhI4aNFabcx0-2p0JRzR-yAPGEeIQ9ddDMJwzOk-ifXR_qfy0ooTTiLcseyFF4x0KIJSZ3B2QRWSMWPz3Eop4_AVjMaDP1igQiuhxd7MJ_mmqp3wr0hJccFSlYAisbH955xfEZl6KvcwOLeJwSG4y74HP2XnkXzr2ALXeJY9nRlcVeKqEp93nLym74u1NUHVaoWc5llRc0cgq6EbSoa-pY1b&sig=Cg0ArKJSzEkSEraj1j7YEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=281&vt=11&dtpt=137&dett=3&cstd=142&cisv=r20230510.78318&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-18-203-131-238.eu-west-1.compute.amazonaws.com

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 12 May 2023 07:13:49 GMT

GET
H3 200 A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js Show response
pagead2.googlesyndication.com/bg/ Frame 6505 37 KB
14 KB 24ms
21ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03a0e4a85c470c697b9cab256a97ff2704a034b9394b9d67c4aaf6c5d421b5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 05:49:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5035
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14779
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 11 May 2024 05:49:54 GMT

POST
H/1.1 200
OK postback Show response
s.h.w55c.net/2/2.92.0/948461/Af6BIb0MEAMpoGIm/ Frame 91AB 0
145 B 185ms
46ms XHR
text/plain 18.203.131.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.h.w55c.net/2/2.92.0/948461/Af6BIb0MEAMpoGIm/postback?oz_pl=1&pd=avt&md=1&pi=XRzobPsLhV&pv=491ec925-2269-4887-8879-7ecce3b74f09&de=2&si=&ac=Xmwo1n97Q8&ci=948461&dt=9484611597092707615000&di=https%3A%2F%2Fye-mek.net&pp=ye-mek.net&ap=&sr=GOOGLE_CONTENTNETWORK&dm=728x90&gt=DE&ui=&ti=&to=3&psv=2.92.0&_x=1
Requested by: Host: s.h.w55c.net
URL: https://s.h.w55c.net/2/948461/analytics.js?dt=9484611597092707615000&pd=avt&di=https%3A%2F%2Fye-mek.net&ui=&ap=&sr=GOOGLE_CONTENTNETWORK&pp=ye-mek.net&ti=&pv=491ec925-2269-4887-8879-7ecce3b74f09&to=3&de=2&md=1&si=&dm=728x90&pi=XRzobPsLhV&gt=DE&ac=Xmwo1n97Q8
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 18.203.131.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-131-238.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 12 May 2023 07:13:49 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H/1.1 200
OK main.js Show response
s.h.w55c.net/2/2.92.0/ Frame 91AB 176 KB
55 KB 48ms
47ms Script
text/javascript 18.203.131.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://s.h.w55c.net/2/2.92.0/main.js

Requested by

Host: s.h.w55c.net
URL: https://s.h.w55c.net/2/948461/analytics.js?dt=9484611597092707615000&pd=avt&di=https%3A%2F%2Fye-mek.net&ui=&ap=&sr=GOOGLE_CONTENTNETWORK&pp=ye-mek.net&ti=&pv=491ec925-2269-4887-8879-7ecce3b74f09&to=3&de=2&md=1&si=&dm=728x90&pi=XRzobPsLhV&gt=DE&ac=Xmwo1n97Q8

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

18.203.131.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0310d06b42963760d784418ad04a7ccd0de2c3e325f289edea62ef95c696a661

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Fri, 12 May 2023 07:13:49 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: br
Accept-Ch: Viewport-Width, Viewport-Height, Width, DPR, RTT, ECT, Device-Memory, Downlink, Save-Data
Vary: Origin, Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: public, no-transform, immutable, max-age=999999999
Timing-Allow-Origin: *
Content-Length: 55694
Expires: Mon, 18 Jan 2055 06:13:40 GMT

GET
H2 200 publishertag.prebid.135.js Show response
static.criteo.net/js/ld/ Frame 9F42 89 KB
29 KB 151ms
71ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.135.js

Requested by

Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

20678c305b50c0988193d64cb34f41e2dcb6f2fa48353106436ea301e07ce70a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 24 Feb 2023 07:57:32 GMT
server: nginx
etag: W/"63f86dec-16386"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 13 May 2023 07:13:49 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FE3A 0
20 B 59ms
58ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BWlrdLOddZLrCOPys9u8P4uW8uAsAAAAAOAHgBAI&bg=!OTqlOm7NAAYldGN0BXQ7ADkAdvg8WsBGy_BlV7tnRLUBbT3k2PZ6mFzI3ANVQVbcncDbUXH_DaEYnTgyPXea1zUn7rck6K69TkICAAAAtVIAAAADaAEHmQMGw8RPFlWQYBdzWWqnVuRYTBgHWvN-UzfqFyF5z7J9apelyNZl322nYWg2xB4VsAKKj3Yyyz7Sif1tghE9nF5__5CDNl9EWDqXajTC_begvC0ShdrouC5QF1laTve3ulB-xkHe__GoPdyf5n_DWc3mKL4ftLPZny98JovpinJTC5_zqG6F13AKodFj2l1TtQ-BQKHBVjPulQMMWicguhUNPSCVxjrO4a8t2B_lw_wba_Hpb4Alm7CbbsinGYun0ymGUL3_NIi39-c0VqwZlE9AdiEJOOOPJNPE-kmtDHc07z0JmX4lgSozG1Iee_vU3mFeV9mnPGd708m1KlycGarZZQY5YuqN0nb3bWXjFOuJK8wLWpfe_b641p_zNBHH754dPbllI9-H_-VMin2ftmS12nZABDf3VNafGxuofQwuNn1It5-oEIOs0FoiNyBOXGIOj0ubLd1iBIO2Gnm5yo2g0-QTSJcGRPcKY9_enymcjX2JIpq9Wf7ngSyPlCcujI7PLM-n7X0i3yBWD7S-WzBiVZxGZzGheEZ3UdiuWBnDRM6yKUprEOpByG1Zzsi5Np2gWKY13vCLsxwu1TalVjsg52WRuanx_bjlLLx6SD11ZaSXEcviJ2muhH9z98cYrZy1qAK6b0dT4CLqlBCZXJEkvbhuIpF7il4-g4LqB-tyiWNUB-JDSRaHZla1IQeqNWmp11TTc5xGQ4vZ5GZyxwbBV490WBMqjxFw9Us87xnScL-x9Wp7OigrUV4s6iz3EhT8jqrov4-APuBNvUdF8pEQUK_aT4Y7ngAPf1Gnq7hVcHR1G_Ct0Pb4_jJGy47bh30T7izx2_ZCKBxyNU-suyrUUXSKEF45wA7KC7EwsBesqvLZ0Lmb9vnT1HCrOWorFl_yaUSooXT2DBRKO3ihJbW3AbtN2Q3E03kYU-Ve9-MCkkcWI6gX31LmDqPw1Uqfo46OVqyyoVd8HJLubmBblt0AjnnKS39_FOgUej3Er1VCXKxzpTL9JNoH2-7ycNl8BJO6aV1NGPzV

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5F58 0
20 B 59ms
58ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BC3U3LeddZJnUAcPB9u8PzYWMiA4AAAAAOAHgBAI&bg=!QEOlQxfNAAYldGN0BXQ7ADkAdvg8WjxST4FKXaW8hwvDNJEfvotBzUs7EkiqZkNO6RHVXYIZGv5JNnrc1Kaqr6Hc_EjYCSknhwYCAAAAq1IAAAADaAEHmQMRm8PLQiqk4zUNHH_VmCDiQ6FYFBryabYdddjBCgvbH3EOtNkUqsyGmt8hX4pCXSsoEnLHG7bEkoSJlhSakvRgSXEnur38X7sQWKt8C19hNdbzFr2I4ijbDkC5OJMiqA1Kmkvkeh437aRsWjJeCfi0wKGv5qHjw47I_J9nnv2EUafQE_wjMgDZKOUrwP6xPbiOCFOgba_1kINnZwPkySc0YjMS-pkkvNknX5yt8XMrPNHXt4kGgo3eHxz2nwsmrwUyd1a1yoYwNkTIt8nwluWWJ59zgzmQcXdrpDLsOE7PDAvPsKqCC0Ub_e68rTCahZeTgSgPPpNLXSRrT-0mPEbYfXW31lUFecz7xROv2AZ_DVS8YN_OiT7-TdRb2-isaFfs1XVsH7tA0GZ742szspi2hWe8apPF3iwPq_1FR8Wqgj8gNyiI9GLsrnVM2tiu1_GK_hKSnV3zPukmC7xseKOn7GJob622C1C0XqFfxuLPs7CmZLkrcIY_xrhCmn242jJvrW3GQB_ab9L-f23OVEUFL_ljEKwQBKlS8T-HzRP8eLwEjqjc8FsprFr9f8BQxC9ikQ6lFwzhUTjUJ3KQd5Ej4Jc34e7XR1qX5rh1_3sNN05_vtE5flqWSbmxQ_dsgb0urvwkhr3AuRRN8MhcHBLS3BA4Zsf7FIWt-df6G1FndRzeggTO6Nxr5l_t_IrRtUe8ekzmDsIh9Jh8-5f5A-P4B4nnb-HhzidmP_i8i-70Z3gpJ4h4DpJkwYJQ0bQMxbIoJIskgbYsXsCs77_GUcGZCx6DxPiVqbU0xvN1W94HeWuUGn9ipSBflHEdJqkV8GB8QZzjrMPXQisR1GZmz8BYao0e7nYFqzay-rJYLWyKwEltjKUkZhDBPzfQ7Q1540Ls99YVclpBar65SBzIv34wo-ObRwu2iprsm-h0PTu6NZ3YIVkUwsrlM65ZpqiAK23ATg4Sw1HIytZlKZSm-Go1XkHciHOQOAENxc6Yc6RAwDHMyNFcyjZvR9CXLmpsng7yAWqVIrnCnTGoXst72xQauuQ

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6505 0
20 B 58ms
58ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B2a11LeddZJGSBf279u8PooOUgAsAAAAAOAHgBAI&bg=!CAulC1_NAAYldGN0BXQ7ADkAdvg8WgI4zv3Cxp12W-FHlo-rLZeYXe94_4qISGKlXUwVX7c7O5aY4hU-RwHmLJHEhXzKs1iGQHYCAAAAeVIAAAADaAEHmQMHxOC8kYuDQ6bnG7ED1uUgVaEgbiohPRt4uczFqNUXN7Xa-Sbal2Kig1RIbEuYH_LXLZqEKbiOyNWzKMV3FSKpvuN8qECcEj0xch_GtdlNVSriR4oXhJWwk5NquwoURjrzTnoCAHLzvQqGKsEMvySUxO-H27rBxGO9_Vm8kjg8dMPdJ6y4PM4k13npWz0m1hqNVT_5L6ORU2DzBvqvhDM5zb6Zg7XB9dOqFXxncTfHoVSsK_MqOCng3acuwM2N1gBCI9-3k7ELxialU-G0hd3JwHGdE5BOK4JpRF5IMQzvcQ9-hD1Ep36mDMhOvEQIBJnP40vAyb97I8b3NYXRwXEFOM0eEYbVjPXrEDIZ7D7hlF7And0YO17ZppfeauExjgNrvmwVnjTOLVo3_WEuqK-agt-JrCoi7pN7fL0403Jy9Vu3Ik12LLz-KijThzwS5dMEqmacMJ8_7GBIww-UW1DxUW1oQ9IldZ2xivK076m-ghglCWvV6q-P7YqNU0JhvO5Hyzd8N8tNDKs2-5VJAsNgwCZ9J1RN8IQU7JYO3orHupldagCHvNW4UzsEJSAmX3gC4-Iq3xS_7BEF5mmfsDa23q53_Cqq_UBknjiU8V7z8-h2dEVi8Es6xZ9zhYeUCdPqGcClsZAvruY49iq80_0CtVmoAF4cjwzgZsAvBskgls7jfLwa9DvV_BO98dQgf24XxBdss8s4ckQH0pr_a79JV0J0YTYo64SaltGXO9Lg2ctg1t5EjtW_yRoqAnB6n325eGO-n0JAcKvLa-q7_in2BcjaV_3SvFXyiAT975bka-TsFf3jEYqACcQfZDmSTKQ_KuM9LOHchtO5LDpxHTKnd--lkBhbc_zW6puNp0eboxe-9V0SoA2IOij7orNGyqENXPwhjkDilxl5jjx-u_zzCI43w_KRtLB0BJhLTEiZPmkUE2o9pTp96YywjvnohZ9_QuXbXjWos1DyQhw9dO5AQvF3d2i1PyQeDAetlGDwvDqHaK86BFGA7DJrLSNgJqAbYVWW-KH65Q

Requested by

Host: ye-mek.net
URL: https://ye-mek.net/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK postback Show response
s.h.w55c.net/2/2.92.0/948461/Af6BIb0MEAMpoGIm/ Frame 91AB 0
145 B 50ms
46ms XHR
text/plain 18.203.131.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.h.w55c.net/2/2.92.0/948461/Af6BIb0MEAMpoGIm/postback?oz_pl=1&pd=avt&md=1&pi=XRzobPsLhV&pv=491ec925-2269-4887-8879-7ecce3b74f09&de=2&si=&ac=Xmwo1n97Q8&ci=948461&dt=9484611597092707615000&di=https%3A%2F%2Fye-mek.net&pp=ye-mek.net&ap=&sr=GOOGLE_CONTENTNETWORK&dm=728x90&gt=DE&ui=&ti=&to=3&psv=2.92.0&_x=1
Requested by: Host: s.h.w55c.net
URL: https://s.h.w55c.net/2/948461/analytics.js?dt=9484611597092707615000&pd=avt&di=https%3A%2F%2Fye-mek.net&ui=&ap=&sr=GOOGLE_CONTENTNETWORK&pp=ye-mek.net&ti=&pv=491ec925-2269-4887-8879-7ecce3b74f09&to=3&de=2&md=1&si=&dm=728x90&pi=XRzobPsLhV&gt=DE&ac=Xmwo1n97Q8
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 18.203.131.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-131-238.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 12 May 2023 07:13:49 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H3 200 view
securepubads.g.doubleclick.net/pcs/ Frame 121B 0
0 60ms
60ms Fetch
image/gif 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuFPXRqSPGaEAmsqWfTJsstl8-zwy8zKWatX5FQmzFM25HbBYYCEakav_pyt9pLGmbGEgAftsyCMpXeNW2A8JaEwFduX41-ZOK16mtV6JCgkaVXLJ3jAxHyqc9fbDccrarn4C7MXuvECN8SLh7FE_3heGSwYp17Ps0trotZ826D35P2cPhsEmWPsLcOVFzfqnNBVNMnyp2v1awa6nIWlLV4qPIekk7TowYfgiz-5P3gcIIZlourEjBrHvYQly6hpH4fyOVP1qlYUKQprTWASZ2chHexGlmKAr6dQnyq_NuqaG2hpreWwrrzj4_a1cjLWfaTQtz6gwPmQzwXCihVZ7R2mCRedLUuNG_aHVGEds9O7G9ozh4&sai=AMfl-YTxqna_SfHA0sG1QaC56g7aD9F7oU1vWqWpH6KiQAWpZsADqezrlpMkqay2ilqSa5m7m_4lJW-9-WtLWESN7Pnqy3VuiOeGUzHH17kRwjw&sig=Cg0ArKJSzKDfq7SWrVhpEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 12 May 2023 07:13:49 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 121B 14 KB
11 KB 73ms
73ms XHR
application/json 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230510&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5df07b7c868c5df78b09c4e3028f497a2fab2b5cb7ca4163a75948ad685f89b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11003
x-xss-protection: 0

GET
H2 200 5ed76f76e4b07a92411bc03a
ng2.virgul.com/tck/imp/ Frame 9F42 0
209 B 74ms
73ms Image
text/plain 185.7.176.223
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng2.virgul.com/tck/imp/5ed76f76e4b07a92411bc03a?g=1&t=gb&r=153377@site_geneli@yemek_net:site_geneli&l=&c=%2Cas%2Crc0%2Chf1%2Cvv1%2Cgprec%3Dyemek%26rec_ing%3D&info=&mt=1683875627587&userId=vneta053d54b-47d2-4394-ad52-d3209bb3e68e
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.223 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://ye-mek.net
date: Fri, 12 May 2023 07:13:49 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

POST
H/1.1 200
OK postback Show response
s.h.w55c.net/2/2.92.0/948461/Af6BIb0MEAMpoGIm/ Frame 91AB 0
145 B 84ms
46ms XHR
text/plain 18.203.131.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.h.w55c.net/2/2.92.0/948461/Af6BIb0MEAMpoGIm/postback?pd=avt&md=1&pi=XRzobPsLhV&pv=491ec925-2269-4887-8879-7ecce3b74f09&de=2&si=&ac=Xmwo1n97Q8&ci=948461&dt=9484611597092707615000&di=https%3A%2F%2Fye-mek.net&pp=ye-mek.net&ap=&sr=GOOGLE_CONTENTNETWORK&dm=728x90&gt=DE&ui=&ti=&to=3&sid=Af6BIb0MEAMpoGIm&oz_sc=916c559863f5dbe8fad17624&oz_df=1683875629660&oz_l=1203&cv=3
Requested by: Host: s.h.w55c.net
URL: https://s.h.w55c.net/2/2.92.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 18.203.131.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-131-238.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 12 May 2023 07:13:49 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ Frame 9F42 89 KB
29 KB 143ms
71ms XHR
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.prebid.js

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.135.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

20678c305b50c0988193d64cb34f41e2dcb6f2fa48353106436ea301e07ce70a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 24 Feb 2023 07:57:32 GMT
server: nginx
etag: W/"63f86dec-16386"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 13 May 2023 07:13:49 GMT

GET
H2 206 Philips_utu_DB.mp4
rek-n18.nktcdn.com/data/ads/mockups/philips/ Frame 9F42 29 KB
30 KB 142ms
142ms Media
video/mp4 185.7.176.218
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://rek-n18.nktcdn.com/data/ads/mockups/philips/Philips_utu_DB.mp4
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.218 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: a9baef98a9f2b4098a8e9e4c62b30f1d89054be3b7dbca5058a7f13fe95a1887

Request headers

Referer: https://ye-mek.net/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Range: bytes=2883584-

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
last-modified: Wed, 19 Apr 2023 06:23:17 GMT
server: openresty/1.15.8.3
x-amz-request-id: tx00000000000000bcab3a5-006453c679-9e2f20a7-default
content-type: video/mp4
Content-Range: bytes 2883584-2913708/2913709
cache-control: max-age=5184000
Content-Length: 30125

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame ED5B 42 B
64 B 67ms
66ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstebMGtFu_TUsVSls5iua3puJOpDty_rhw1csd2f8wp58xMhMWIe9fdpSzj3Mx2_9uTve_Z1Jgomsvi7zdHZ-WmTc5yTNbQvtU0RYy6u-WC0pu0jn5a4vhBxT8oPBQJMVxDZOabAJaf09iEQPXpv52Tx67u1v0r9RUzfmLnZmpbSzTbCcUNKock5Mc7C6xHsWvtJz59_pd819TcIIheKErZowek36AVM6kXRYc&sai=AMfl-YTWd_ZB-mDhDg9vjXCrb4QnW-5PaoiKqjqRbtIlrP9jix-d2q2qTkb5JvWfV_fFGs8vS4JYVCspZKtbarm-rVai7Lz33CUrTd5mQdASyym5nXBbQV3AiNfr5xE&sig=Cg0ArKJSzD4Bbiwy66oBEAE&id=lidar2&mcvt=1000&p=0,0,100,100&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230510&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=19&adk=3698513385&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1683875628622&rpt=79&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
BLOB 200
OK 308b6369-4373-4742-a108-bbb1c4b0d9be
https://googleads.g.doubleclick.net/ Frame B5D1 185 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://googleads.g.doubleclick.net/308b6369-4373-4742-a108-bbb1c4b0d9be
Requested by: Host: ye-mek.net
URL: https://ye-mek.net/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 848fe19ed492948709b881f504ce2eb6274baa694606ca88eb9b2990a2460caf

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Length: 185
Content-Type: application/javascript

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 121B 17 KB
6 KB 43ms
43ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 12 May 2023 07:13:49 GMT

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/ra-51c60ec002340f16/ Frame 9F42 6 KB
1 KB 74ms
66ms Script
application/javascript 23.206.208.114
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/ra-51c60ec002340f16/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.206.208.114 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-206-208-114.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 80a6bc8e05e84df98ca33712aaf3b520db8e4eb53cb97429d0a3f72fdb8bb35b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
content-encoding: gzip
etag: 2086319854--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public, max-age=51, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 1267

GET
H2 200 300lo.json Show response
m.addthis.com/live/red_lojson/ Frame 9F42 88 B
248 B 199ms
175ms Script
application/javascript 23.206.208.114
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://m.addthis.com/live/red_lojson/300lo.json?si=645de72bbdbd6758&bkl=0&bl=1&pdt=364&sid=645de72bbdbd6758&pub=ra-51c60ec002340f16&rev=v8.28.8-wp&ln=tr&pc=men&cb=0&ab=-&dp=ye-mek.net&dr=pcloak.blob.core.windows.net&fp=&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=4&gen=100&chr=UTF-8&colc=1683875629752&jsl=129&skipb=1&callback=addthis.cbs.jsonp__2546686038219210
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.206.208.114 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-206-208-114.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 547c7fef6a681d674ddff147a155d7ecc48d582b5cb2eabbf50feb253c4b7233

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
cache-control: max-age=0, no-cache, no-store, no-transform
content-disposition: attachment; filename=1.txt
content-length: 88
content-type: application/javascript;charset=utf-8

GET sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame F389 0
0

GET
H2 200 sh.f48a1a04fe8dbf021b4cda1d.html Show response
s7.addthis.com/static/ Frame 2A34 71 KB
26 KB 36ms
36ms Document
text/html 23.206.208.114
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.208.114 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-208-114.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

7b6bfa13f0778c40bb2a00af9819bea2f07afcb4d071e7e4f436196953a5db4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: public, max-age=86313600
content-encoding: gzip
content-length: 26421
content-type: text/html
date: Fri, 12 May 2023 07:13:49 GMT
etag: W/"5f971164-11adc"
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
p3p: CP="NON ADM OUR DEV IND COM STA"
server: nginx/1.15.8
strict-transport-security: max-age=15724800; includeSubDomains
timing-allow-origin: *
vary: Accept-Encoding
x-host: s7.addthis.com

GET
H2 200 client.tr.min.json Show response
s7.addthis.com/l10n/ Frame 9F42 3 KB
2 KB 104ms
39ms XHR
application/json 23.206.208.114
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/l10n/client.tr.min.json

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.208.114 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-208-114.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

1f5a2a979149a9192bb49e10899322a37fbfda94dd47567b029823950adc0e2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
date: Fri, 12 May 2023 07:13:49 GMT
last-modified: Tue, 10 Sep 2019 15:15:17 GMT
server: nginx/1.15.8
etag: W/"5d77be05-d99"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: public, s-maxage=604800
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 1685

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 9F42 15 KB
11 KB 72ms
72ms XHR
application/json 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=m202305090101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bd1c00de84bbbdbbd015a619b69a05f50fbb5be6b09f8d2385737460a092f72b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11251
x-xss-protection: 0

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame 3D9C 15 KB
6 KB 887ms
627ms Document
text/html 2620:100:a001::c

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertag&topUrl=pcloak.blob.core.windows.net

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.prebid.135.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:a001::c -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

386d466b8bdd0cda283c79718d2aec07f38b9f9ed81eebe6d5266bb20cd42c10

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 12 May 2023 07:13:50 GMT
server: Kestrel
server-processing-duration-in-ticks: 1123325
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame EF36 13 KB
5 KB 25ms
22ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1608
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 12 May 2023 06:47:01 GMT
expires: Sat, 11 May 2024 06:47:01 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 228A 783 B
536 B 33ms
31ms Document
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

4fde1d44e25d5e2a98453f5411d31b235eee117933782d63cbe349f6e5ac9c65

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-89I19kon_P6OTpjwOGpAHA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 514
content-security-policy: script-src 'report-sample' 'nonce-89I19kon_P6OTpjwOGpAHA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 12 May 2023 07:13:49 GMT
expires: Fri, 12 May 2023 07:13:49 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 9F42 17 KB
6 KB 46ms
46ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305090101/pubads_impl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 12 May 2023 07:13:49 GMT

GET
H2 200 layers.fa6cd1947ce26e890d3d.js Show response
s7.addthis.com/static/ Frame 9F42 263 KB
76 KB 32ms
32ms Script
application/javascript 23.206.208.114
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.fa6cd1947ce26e890d3d.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.208.114 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-208-114.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

6121ca306ad1045453d52517b8f436eb5a68055c82aefa46a9a77de36996a3df

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
date: Fri, 12 May 2023 07:13:49 GMT
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
server: nginx/1.15.8
etag: W/"5f971164-41cf5"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86313600
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77617

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 228A 0
0 55ms
55ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230510&jk=4387797284332370&rc=
Requested by: Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 200 A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js Show response
pagead2.googlesyndication.com/bg/ Frame EF36 37 KB
14 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03a0e4a85c470c697b9cab256a97ff2704a034b9394b9d67c4aaf6c5d421b5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 05:49:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5035
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14779
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 11 May 2024 05:49:54 GMT

POST
H/1.1 200
OK postback Show response
s.h.w55c.net/2/2.92.0/948461/Af6BIb0MEAMpoGIm/ Frame 91AB 0
145 B 47ms
46ms XHR
text/plain 18.203.131.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.h.w55c.net/2/2.92.0/948461/Af6BIb0MEAMpoGIm/postback?pd=avt&md=1&pi=XRzobPsLhV&pv=491ec925-2269-4887-8879-7ecce3b74f09&de=2&si=&ac=Xmwo1n97Q8&ci=948461&dt=9484611597092707615000&di=https%3A%2F%2Fye-mek.net&pp=ye-mek.net&ap=&sr=GOOGLE_CONTENTNETWORK&dm=728x90&gt=DE&ui=&ti=&to=3&sid=Af6BIb0MEAMpoGIm&oz_sc=916c559863f5dbe8fad17624&oz_df=1683875629862&oz_l=5789&cv=3
Requested by: Host: s.h.w55c.net
URL: https://s.h.w55c.net/2/2.92.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 18.203.131.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-131-238.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 12 May 2023 07:13:49 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H2 206 Philips_utu_DB.mp4
rek-n18.nktcdn.com/data/ads/mockups/philips/ Frame 9F42 3 MB
0 73ms
73ms Media
video/mp4 185.7.176.218
SH

General

Check archive.org

Show headers Download Go to

Full URL: https://rek-n18.nktcdn.com/data/ads/mockups/philips/Philips_utu_DB.mp4
Requested by: Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.218 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash

Request headers

Referer: https://ye-mek.net/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Range: bytes=65536-

Response headers

date: Fri, 12 May 2023 07:13:49 GMT
last-modified: Wed, 19 Apr 2023 06:23:17 GMT
server: openresty/1.15.8.3
x-amz-request-id: tx00000000000000bcab3a5-006453c679-9e2f20a7-default
content-type: video/mp4
Content-Range: bytes 65536-2913708/2913709
cache-control: max-age=5184000
Content-Length: 2848173

GET
DATA 200
OK truncated
/ Frame 9F42 443 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5876d235b697479a9e5f476a33115aea1ddc21fd4b4740dd7180398c6224fdba

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 140.61020b6c086bdb8bc696.js Show response
s7.addthis.com/static/ Frame 9F42 2 KB
1009 B 42ms
42ms Script
application/javascript 23.206.208.114
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/140.61020b6c086bdb8bc696.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.208.114 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-208-114.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

25a50f8e41994e7addc8b761fd99f5f8560128909835a388edf76026c7a4c4f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
date: Fri, 12 May 2023 07:13:49 GMT
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
server: nginx/1.15.8
etag: "5f971164-688"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86313600
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 770

GET
H2 200 143.3d8bb49f121080f7c65c.js Show response
s7.addthis.com/static/ Frame 9F42 625 B
644 B 41ms
41ms Script
application/javascript 23.206.208.114
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/143.3d8bb49f121080f7c65c.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.206.208.114 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-206-208-114.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

2dfa62171c6667988d674799a042b576b12881c34464cb9a78ff2138ed3faa94

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
date: Fri, 12 May 2023 07:13:49 GMT
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
server: nginx/1.15.8
etag: W/"5f971164-271"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=86313600
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 404

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 363F 13 KB
5 KB 24ms
22ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1608
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 12 May 2023 06:47:01 GMT
expires: Sat, 11 May 2024 06:47:01 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame D834 783 B
535 B 31ms
30ms Document
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

72dcb59b8278f98ab2444ffda3f43b2a76bc9baebe60836c046eb6c4f147e139

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-GAXctU0n26H9FEx20iAyJA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-GAXctU0n26H9FEx20iAyJA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Fri, 12 May 2023 07:13:49 GMT
expires: Fri, 12 May 2023 07:13:49 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame EF36 0
10 B 23ms
22ms Image
text/plain 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?4QAfZQ
Requested by: Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:50 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame D834 0
0 59ms
59ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_m202305090101&jk=2648781072102199&rc=
Requested by: Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

GET
H3 200 A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js Show response
pagead2.googlesyndication.com/bg/ Frame 363F 37 KB
14 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/A6DkqFxHDGl7nKslapf_JwSgNLk5S51nxKr2xdQhtdg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03a0e4a85c470c697b9cab256a97ff2704a034b9394b9d67c4aaf6c5d421b5d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 05:49:54 GMT
content-encoding: br
x-content-type-options: nosniff
age: 5036
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14779
x-xss-protection: 0
last-modified: Mon, 08 May 2023 09:28:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sat, 11 May 2024 05:49:54 GMT

POST
H/1.1 200
OK postback Show response
s.h.w55c.net/2/2.92.0/948461/Af6BIb0MEAMpoGIm/ Frame 91AB 0
145 B 48ms
48ms XHR
text/plain 18.203.131.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.h.w55c.net/2/2.92.0/948461/Af6BIb0MEAMpoGIm/postback?pd=avt&md=1&pi=XRzobPsLhV&pv=491ec925-2269-4887-8879-7ecce3b74f09&de=2&si=&ac=Xmwo1n97Q8&ci=948461&dt=9484611597092707615000&di=https%3A%2F%2Fye-mek.net&pp=ye-mek.net&ap=&sr=GOOGLE_CONTENTNETWORK&dm=728x90&gt=DE&ui=&ti=&to=3&sid=Af6BIb0MEAMpoGIm&oz_sc=916c559863f5dbe8fad17624&oz_df=1683875630030&oz_l=2859&cv=3
Requested by: Host: s.h.w55c.net
URL: https://s.h.w55c.net/2/2.92.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 18.203.131.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-131-238.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 12 May 2023 07:13:49 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 363F 0
10 B 22ms
22ms Image
text/plain 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?s4TQ7Q
Requested by: Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:50 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F644 42 B
64 B 65ms
65ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstfucGlRPNHF4jSIXiI3neCUsWTI8a5y-93laLBSzv3JZ0Sh9arBxPpIwVA6VV6Mj9iX3gEwPgIogV7yioSVv3F5sc9_qu7za7lspB0vip6qAlcy0NH6tiPZ4KhipnBDjfHfRNltg&sai=AMfl-YQfasUo1Kn9KRxpv3hDOXyf5n-4efoauWCKgvHPROvEF04AhOtqmL67a-tI28PbOcF-_9NTHTpUQA8AO3Rwtxi2qsFkq_oq1fIZeqBHS1CdOUbzjY3qAZ6u-nQ&sig=Cg0ArKJSzF5CEYogiMA9EAE&cid=CAQSOwBygQiD9VkOzmOMKZAPpjBsPIzrI7jp1s97ZmuMrEGGNjr1jGN-VrtERkUWkhFAZsY-mjRq41IAQbViGAE&id=lidar2&mcvt=1000&p=0,0,90,728&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230510&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=456810305&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1683875628784&rpt=389&met=ce&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK postback Show response
s.h.w55c.net/2/2.92.0/948461/Af6BIb0MEAMpoGIm/ Frame 91AB 0
145 B 46ms
46ms XHR
text/plain 18.203.131.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.h.w55c.net/2/2.92.0/948461/Af6BIb0MEAMpoGIm/postback?pd=avt&md=1&pi=XRzobPsLhV&pv=491ec925-2269-4887-8879-7ecce3b74f09&de=2&si=&ac=Xmwo1n97Q8&ci=948461&dt=9484611597092707615000&di=https%3A%2F%2Fye-mek.net&pp=ye-mek.net&ap=&sr=GOOGLE_CONTENTNETWORK&dm=728x90&gt=DE&ui=&ti=&to=3&sid=Af6BIb0MEAMpoGIm&oz_sc=916c559863f5dbe8fad17624&oz_df=1683875630182&oz_l=73&cv=3
Requested by: Host: s.h.w55c.net
URL: https://s.h.w55c.net/2/2.92.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 18.203.131.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-131-238.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 12 May 2023 07:13:49 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
BLOB 200
OK c004d8ad-1f57-42ff-a1d8-11f428d5afae
https://googleads.g.doubleclick.net/ Frame 91AB 802 B
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://googleads.g.doubleclick.net/c004d8ad-1f57-42ff-a1d8-11f428d5afae
Requested by: Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 28960a9aa0071776192259a5836f4d2c1acc9e978c1f3f1a8f3a7e5bc67a65ea

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Length: 802
Content-Type

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8BC2 0
20 B 56ms
56ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=9574254681292&version=m202301230201&ct=76&x=1&cor=11288165321896466000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame EF3D 0
20 B 61ms
61ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=9444926743&version=m202301230201&ct=76&x=1&cor=10899176448837954000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F644 0
20 B 56ms
55ms Ping
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=3815707240819&version=m202301230201&ct=76&x=1&cor=3496467626569839000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 5ed7702fe4b07a92411bc03e
ng2.virgul.com/tck/imp/ Frame 9F42 0
209 B 233ms
232ms Image
text/plain 185.7.176.223
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng2.virgul.com/tck/imp/5ed7702fe4b07a92411bc03e?g=1&t=gb&r=153378@site_geneli@yemek_net:site_geneli&l=&c=%2Cas%2Crc0%2Chf1%2Cvv1%2Cgprec%3Dyemek%26rec_ing%3D&info=&mt=1683875627587&userId=vneta053d54b-47d2-4394-ad52-d3209bb3e68e
Requested by: Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.223 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://ye-mek.net
date: Fri, 12 May 2023 07:13:50 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 121B 0
0 64ms
64ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230510&jk=4387797284332370&bg=!2Nul24_NAAYldGN0BXQ7ADkAdvg8Woae5fIsbNGOGoFlYmDeNqwTWnachIZyf2AdPympnuWejpASHzJhuYyN4uomtX6U3oWkvBICAAAAsFIAAAADaAEHCgA4Rn-7v5joejk0l1BhjexFQFwTJG0Iz3GPaVItr0bNJDTQnTwkuvb9BbfR7rxuYNX9M-NnG5tA1lWZAwY0dwnO7PMMnHhOfxi38y8WA1ziYitOLuVa7I9ifwT8mpSRJgV6gegkCBmHEYHUov4Bi1t8tJSLm7YF24ckc12HZR06RRy9uc0YsevOOgimeuTbsRRAQMwHMzKgYLwBVgCGdKHpg9PO_Gnv5FLgggDM6dbUtIVs61LzpqIDOayDBRKS_V17TO9CLgSgkJMeCIt5P0Na6zVRjosym60iF450TE7q7ooXigI7AanDnWhFTwzCJSQ7NI0gbs1T7BXiqdJcfLsTm1kMhr5ZKG-_00ZIHangfV8v_CDYY2ktm_WXTaNdn1lKhEewFLFP9SPczbTEYhKsB5ICsjSMOgG9n22oRSdjqFrWYg0VZJl7mgRyZKfv51LiPDbVMPb8Vr0nO8p8adFFdx2hpGLwORkXglJFn21e_I9X3G6EYUPRi4nmZYY1RbpIQWZErS1Qlvv06l6S4MMLKo9FtvTyK_M0YfVKe_2mamgXIbjO4XWw-sel1aPc6xrPFObvJ51koImWgFCQwyf1s-TuV4JAcolq6BSOZ_SUfd_gNZWdb93qnum7aiNwbsG068c0BW6lSqYNJugVlzOgOKM5xkIfuB9IHQFt9gWorpr3qPgUDqgX9JntLofZ-ZfOzMfWg0kXXZXlWqoHScGlcTuBIIkZCTdzn2en_o3fUWjjZXlLwBePTrsFWfYSQV6YkX1xvUN_JfRZP5YqPH7PEDCeXV_-SPUDjnJRnFkSEG0SrMhxJmGdohL-sZaQNWzqWTw8xfFx9xY7Djg-HugMkJxvjLP71zz8nMG-0uIGiaIVDrTWDl36lD21Tp47Fs78gAv_pK-OLPHI0H7LR1p3bFYwmbxKPPtCYGvzbATvqn9TLUq2VRZD8v90-9gthKHtzlsTY0WWWHfh5eN9ewZ5oGoWac4207PLBUYY_o4V5kYVqOWKNBTWnImuIYXl4RQvVNv10MmgU5WKJDGm6IGF2euSd2J1whATcqd7iBmwl7iobiFh6i0qj1Hm2hCWDv38sXUr69nCj8TuBTjfUdF8Mao
Requested by: Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://08a42f2cd77c2fd4075bf90823149cd9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

POST
H/1.1 200
OK postback Show response
s.h.w55c.net/2/2.92.0/948461/Af6BIb0MEAMpoGIm/ Frame 91AB 0
145 B 50ms
50ms XHR
text/plain 18.203.131.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.h.w55c.net/2/2.92.0/948461/Af6BIb0MEAMpoGIm/postback?pd=avt&md=1&pi=XRzobPsLhV&pv=491ec925-2269-4887-8879-7ecce3b74f09&de=2&si=&ac=Xmwo1n97Q8&ci=948461&dt=9484611597092707615000&di=https%3A%2F%2Fye-mek.net&pp=ye-mek.net&ap=&sr=GOOGLE_CONTENTNETWORK&dm=728x90&gt=DE&ui=&ti=&to=3&sid=Af6BIb0MEAMpoGIm&oz_sc=916c559863f5dbe8fad17624&oz_df=1683875630622&oz_l=950&cv=3
Requested by: Host: s.h.w55c.net
URL: https://s.h.w55c.net/2/2.92.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 18.203.131.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-131-238.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 12 May 2023 07:13:50 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H2

200

sid Show response
mug.criteo.com/ Frame 3D9C
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertag&domain=ye-mek.net&sn=ChromeSyncframe&so=0&topUrl=pcloak.blob.core.windows.net&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=doY0AXxkOVlRRjVvbDNWYloyV2NaWTVzTXM0Y1Npc2Q0cHNLQWxheVZMVlVBSk4yVGZiYjBOSjkrRWhsOUQyNnNxUk9OUFdnelp1UUxLU3dkUGN6R3ROb0M3S3hxd1NHWnpldWhrS3VYSk42REhNSGxkWVM2YTBjUlA4YV...

433 B
655 B

202ms
36ms

Fetch
application/json

178.250.7.13

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=doY0AXxkOVlRRjVvbDNWYloyV2NaWTVzTXM0Y1Npc2Q0cHNLQWxheVZMVlVBSk4yVGZiYjBOSjkrRWhsOUQyNnNxUk9OUFdnelp1UUxLU3dkUGN6R3ROb0M3S3hxd1NHWnpldWhrS3VYSk42REhNSGxkWVM2YTBjUlA4YVJwdjRoemh2K3ZoNEJyWVF2QzQydjREdm45RWtKVE1ENnVQc3B5b2tFN2U0NVozY3hqcm1kNHA1WGZTU2pJa3NPWEFROXVVcWlHZVNUL29IUk5UVS9pT0U5UEMyOGJNdHhMS240S0QvWnV3U2hMR2V1VGM5ZkdycG14R25nY1Z6RTJTdFVqUXQwbVozYVhVNWdLQ0hzMHoyNDhPQzBzaHg2TGkwOFpCV3ZtR1Zjb3BRNGo4ND18&cppv=2

Requested by

Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html

Protocol

Server

178.250.7.13 -, , ASN (),

Reverse DNS

Software

Kestrel /

Resource Hash

2557dcf9b148401623099948dc0a62d62adbafdd94f6c339695ed98f0622af9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:50 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1374604
expires: 0

Redirect headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:49 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=doY0AXxkOVlRRjVvbDNWYloyV2NaWTVzTXM0Y1Npc2Q0cHNLQWxheVZMVlVBSk4yVGZiYjBOSjkrRWhsOUQyNnNxUk9OUFdnelp1UUxLU3dkUGN6R3ROb0M3S3hxd1NHWnpldWhrS3VYSk42REhNSGxkWVM2YTBjUlA4YVJwdjRoemh2K3ZoNEJyWVF2QzQydjREdm45RWtKVE1ENnVQc3B5b2tFN2U0NVozY3hqcm1kNHA1WGZTU2pJa3NPWEFROXVVcWlHZVNUL29IUk5UVS9pT0U5UEMyOGJNdHhMS240S0QvWnV3U2hMR2V1VGM5ZkdycG14R25nY1Z6RTJTdFVqUXQwbVozYVhVNWdLQ0hzMHoyNDhPQzBzaHg2TGkwOFpCV3ZtR1Zjb3BRNGo4ND18&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 398142
content-length: 0
expires: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 9F42 0
0 59ms
58ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_m202305090101&jk=2648781072102199&bg=!qKulq__NAAYldGN0BXQ7ADkAdvg8WrqlaowNy-ANibVwloH8m9vVRu9qlx1MEa1AF9Pp2rdgtOM0VdNOip9-ZBkI1Vkk-BIi4FkCAAAAXFIAAAADaAEHmQLa5jhIrz1N5gD4_qWgLu24UVauBrIrDgWqgDWYz_e-HhiEotmKbfHDgABCF91h8xiNwZdZMC2bfO_SuedoeTdW4arsdP7AOw6FbN1uRKIitvTtMxIJKsnOUVzA7uxpv5Z2zN7ihTp1Kuz-3qh-_JE490sfmf4UgnnGKXHm9AdXwRo4MCtJWAWBNP5ExvDKtv4tJ7hVwqPLG_Tu7_tVZlGdR1LU1FLIDRYm5FcF7QVB4E41Tn8NMlvkPEt7YBWUrwyDj3ucXHrCSkc5i1mjwyS4VcWK-7pe9Y5jp2VvlG-58GyIUdn-5r04op5FJKh6uUZoYIeri_b4Ca-GGgGaXFaknoBBVZs8Raz4eznaqnae5xUJGAV0Lt89AZlydXeuwthfD7cA5OaP-FJsmAUpN0J0WJnXNtxl0T7quoYp2rhs3C4xTnLqQM0xO-W5AmMAzViinZt93i22zxrOwoc-Y1Vk4FEpOnJraypY0_gb8fDn--MXmvu0NpHwSvkcJT6kzrkj10EVTqAKhLOvp8oUhBU7wV8fTGSGbv0srirTgH-O5cA6IRnzzJRJy9nfjnLVtQT7CvcHv-jxxwCA4TJuP0HjmT_A8S_ESBIKEPWEYSwkiif8R_GkZ7HdwaJyQSOWYuUM2sldXo7LAZsvD-bhRxFHv5Q86IC8Var17WFYUHef4ieKbk1nU8Rk5yyVDyqIqHJtCLpPkkC8bYwvX2QrDm15k8CR2BlLP0xESH7VcS0Tp0jSlAn9DQssbrr6VqpTkZWtKdMwRYi5del9kfqFLHDqJoysXQr0IexbBEjGxwvcBgLegBru3C1g-XsPxAPNE5lu6e81KP_lPwHj5k1JPm2wif3RMPmeOsbiZx0lDGSkJsQOqY8BvGTsib8QIuvbQAIUjyytP8JvcNcNhrKykM50IKohDjAAxKPuYwibBt6Hc_cl4ch7DDk4MIZQgNbBoIDfQqxC1Xo0nHUmtg
Requested by: Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

POST
H/1.1 200
OK postback Show response
s.h.w55c.net/2/2.92.0/948461/Af6BIb0MEAMpoGIm/ Frame 91AB 0
145 B 48ms
48ms XHR
text/plain 18.203.131.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.h.w55c.net/2/2.92.0/948461/Af6BIb0MEAMpoGIm/postback?pd=avt&md=1&pi=XRzobPsLhV&pv=491ec925-2269-4887-8879-7ecce3b74f09&de=2&si=&ac=Xmwo1n97Q8&ci=948461&dt=9484611597092707615000&di=https%3A%2F%2Fye-mek.net&pp=ye-mek.net&ap=&sr=GOOGLE_CONTENTNETWORK&dm=728x90&gt=DE&ui=&ti=&to=3&sid=Af6BIb0MEAMpoGIm&oz_sc=916c559863f5dbe8fad17624&oz_df=1683875630782&oz_l=7505&cv=3
Requested by: Host: s.h.w55c.net
URL: https://s.h.w55c.net/2/2.92.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 18.203.131.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-131-238.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 12 May 2023 07:13:50 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H2 200 5ed76f76e4b07a92411bc03a
ng.virgul.com/tck/i_vb2/ Frame 9F42 0
209 B 76ms
73ms Image
text/plain 185.7.176.223
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng.virgul.com/tck/i_vb2/5ed76f76e4b07a92411bc03a?l=&r=153377@site_geneli@yemek_net:site_geneli&cs=1683875630852&userId=vneta053d54b-47d2-4394-ad52-d3209bb3e68e
Requested by: Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.223 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://ye-mek.net
date: Fri, 12 May 2023 07:13:50 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H2 200 60b91f99e4b0b65b3ce7bc5b
ng.virgul.com/tck/i_vb2/ Frame 9F42 0
209 B 77ms
74ms Image
text/plain 185.7.176.223
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng.virgul.com/tck/i_vb2/60b91f99e4b0b65b3ce7bc5b?l=&r=153493@site_geneli@yemek_net:site_geneli&cs=1683875630852&userId=vneta053d54b-47d2-4394-ad52-d3209bb3e68e
Requested by: Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x6uf5z9e3262.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.223 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://ye-mek.net
date: Fri, 12 May 2023 07:13:50 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

POST
H/1.1 200
OK postback Show response
s.h.w55c.net/2/2.92.0/948461/Af6BIb0MEAMpoGIm/ Frame 91AB 0
145 B 47ms
46ms XHR
text/plain 18.203.131.238
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s.h.w55c.net/2/2.92.0/948461/Af6BIb0MEAMpoGIm/postback?pd=avt&md=1&pi=XRzobPsLhV&pv=491ec925-2269-4887-8879-7ecce3b74f09&de=2&si=&ac=Xmwo1n97Q8&ci=948461&dt=9484611597092707615000&di=https%3A%2F%2Fye-mek.net&pp=ye-mek.net&ap=&sr=GOOGLE_CONTENTNETWORK&dm=728x90&gt=DE&ui=&ti=&to=3&sid=Af6BIb0MEAMpoGIm&oz_sc=916c559863f5dbe8fad17624&oz_df=1683875630948&oz_l=492&cv=3
Requested by: Host: s.h.w55c.net
URL: https://s.h.w55c.net/2/2.92.0/main.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 18.203.131.238 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-203-131-238.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 12 May 2023 07:13:50 GMT
Timing-Allow-Origin: *
Content-Length: 0
Vary: Origin

GET
H2 200 rid Show response
match.adsrvr.org/track/ Frame 9F42 63 B
385 B 48ms
47ms XHR
application/json 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=pubmatic&fmt=json
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: e123c89304102743bb55fb39dc2cdb0e1d8af399a7bc27e1b702ec15577dc996

Request headers

Referer: https://ye-mek.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

date: Fri, 12 May 2023 07:13:51 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://ye-mek.net
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 63
expires: Sun, 11 Jun 2023 07:13:51 GMT

GET check.html
biddr.brealtime.com/ Frame 1972 0
0

GET
H2 200 user_sync.html Show response
ads.pubmatic.com/AdServer/js/ Frame DA77 16 KB
6 KB 88ms
20ms Document
text/html 23.35.236.201

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159432
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.35.236.201 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: 72a64af6c85d8ab9bb2b508571c6a70080750c4891634dcbe36cb95737ca0f48

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=97853
content-encoding: gzip
content-length: 5554
content-type: text/html
date: Fri, 12 May 2023 07:13:51 GMT
expires: Sat, 13 May 2023 10:24:44 GMT
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: Apache
vary: Accept-Encoding

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame A6B8 52 KB
17 KB 90ms
22ms Document
text/html 151.101.65.108

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.108 -, , ASN (),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 3099
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Fri, 12 May 2023 07:13:51 GMT
ETag: W/"623de86a-cf34"
Expires: Wed, 03 May 2023 06:21:12 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 1020, 24664
X-Served-By: cache-lga13626-LGA, cache-fra-eddf8230048-FRA
X-Timer: S1683875631.463550,VS0,VE0

GET
H/1.1 204
No Content beacon
ap.lijit.com/ Frame F151 0
0 39ms
39ms Document
text/plain 216.52.2.16
SINGLEHOP-LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/beacon?informer=13442375
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 216.52.2.16 , United States, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
Date: Fri, 12 May 2023 07:13:51 GMT
Expires: Fri, 20 Mar 2009 00:00:00 GMT
P3P: CP="CUR ADM OUR NOR STA NID"
Pragma: no-cache
X-Sovrn-Pod: ad_ap3ams1

GET
H/1.1 200
OK usync.html Show response
eus.rubiconproject.com/ Frame 7C3F 281 B
554 B 85ms
24ms Document
text/html 23.201.255.110

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.html
Requested by: Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.201.255.110 -, , ASN (),
Reverse DNS
Software: Apache/2.2.15 (CentOS) /
Resource Hash: 3fdf2ee487005f6505d00cc9d7a3757a1942d56bcaea69929cbd5ba110494390

Request headers

Referer: https://ye-mek.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 233
Content-Type: text/html; charset=UTF-8
Date: Fri, 12 May 2023 07:13:51 GMT
ETag: "403b9-119-5ec73a0a33d00"
Last-Modified: Wed, 02 Nov 2022 02:30:44 GMT
Server: Apache/2.2.15 (CentOS)
Vary: Accept-Encoding

GET
H2 200 5ed7706de4b07a92411bc042
ng2.virgul.com/tck/imp/ Frame 9F42 0
209 B 75ms
74ms Image
text/plain 185.7.176.223
SH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ng2.virgul.com/tck/imp/5ed7706de4b07a92411bc042?g=1&t=gb&r=153379@site_geneli@yemek_net:site_geneli&l=&c=%2Cas%2Crc0%2Chf1%2Cvv1%2Cgprec%3Dyemek%26rec_ing%3D&info=&mt=1683875627587&userId=vneta053d54b-47d2-4394-ad52-d3209bb3e68e
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.7.176.223 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software: openresty/1.15.8.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ye-mek.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

access-control-allow-origin: https://ye-mek.net
date: Fri, 12 May 2023 07:13:51 GMT
access-control-allow-credentials: true
expires: Tue, 04 Jan 2022 10:49:40 GMT
server: openresty/1.15.8.3
content-length: 0
p3p: CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'

GET
H2 200 PugMaster Show response
image6.pubmatic.com/AdServer/ Frame DA77 3 KB
3 KB 36ms
35ms Script
text/html 185.64.190.78
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://image6.pubmatic.com/AdServer/PugMaster?sec=1&async=1&kdntuid=1&rnd=26057201&p=159432&s=0&a=0&ptask=ALL&np=0&fp=0&rp=0&mpc=0&spug=1&coppa=0&gdpr=0&gdpr_consent=&us_privacy=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.78 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: a2c9562327669da2c1398e3024e24ec27279e1dae7817b9d014b9aa10ccf554b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
date: Fri, 12 May 2023 07:13:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H/1.1 200
OK usync.js Show response
eus.rubiconproject.com/ Frame 7C3F 34 KB
10 KB 25ms
25ms Script
text/html 23.201.255.110

General

Check archive.org

Show headers Download Go to

Full URL: https://eus.rubiconproject.com/usync.js
Requested by: Host: eus.rubiconproject.com
URL: https://eus.rubiconproject.com/usync.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.201.255.110 -, , ASN (),
Reverse DNS
Software: Apache/2.2.15 (CentOS) / PHP/5.3.3
Resource Hash: c8846180af4c5402d3a9eccff27202a85c7235d96e826a3648254d684abc6daf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/usync.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Date: Fri, 12 May 2023 07:13:51 GMT
Content-Encoding: gzip
Last-Modified: Thu, 11 May 2023 12:27:44 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
p3p: CP="NOI CURa ADMa DEVa TAIa OUR # BUS IND UNI COM NAV INT"
Cache-Control: max-age=18838
Connection: keep-alive
Content-Length: 10020
Expires: Fri, 12 May 2023 12:27:49 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame A6B8 0
859 B 22ms
21ms Script
text/html 37.252.172.123
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.172.123 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

186.62.91.34.bc.googleusercontent.com

Software

nginx/1.23.2 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 12 May 2023 07:13:51 GMT
AN-X-Request-Uuid: 93c930c7-9db0-45b2-ad1c-465588105867
Server: nginx/1.23.2
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame 9F9E
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=3&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fsimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA%3D%3D%26piggybackCookie%...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:532e645d-e72d-4b00-8111-9e7618c3c741&gdpr=0&gdpr_consent=

42 B
405 B

115ms
37ms

Document
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:532e645d-e72d-4b00-8111-9e7618c3c741&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 12 May 2023 07:13:51 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Access-Control-Allow-Origin: *
Cache-Control: no-cache
Connection: keep-alive
Content-Length: 0
Content-Type: image/gif
Date: Fri, 12 May 2023 07:13:51 GMT
Expires: Fri, 12 May 2023 07:13:50 GMT
Keep-Alive: timeout=360
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Server: MT3 851 9bd98ae master cdg-pixel-x33 config_version:"unknown"
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM2MiZ0bD0xMjk2MDA==&piggybackCookie=uid:532e645d-e72d-4b00-8111-9e7618c3c741&gdpr=0&gdpr_consent=

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame 34BA
Redirect Chain

https://p.rfihub.com/cm?pub=224&in=1&getuid=https%3A//image2.pubmatic.com/AdServer/Pug%3Fvcode%3Dbz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw%26piggybackCookie%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=5134455419138778665

42 B
195 B

34ms
33ms

Document
image/gif

185.64.189.110

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=5134455419138778665
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 12 May 2023 07:13:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

Content-Length: 0
Date: Fri, 12 May 2023 07:13:51 GMT
Location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw&piggybackCookie=5134455419138778665
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame D696
Redirect Chain

https://dis.criteo.com/dis/usersync.aspx?r=3&p=4&cp=pubmaticUS&cu=1&&gdpr=0&gdpr_consent=&url=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCooki...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=

42 B
245 B

115ms
35ms

Document
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 12 May 2023 07:13:51 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

cache-control: no-cache
content-length: 0
cross-origin-resource-policy: cross-origin
date: Fri, 12 May 2023 07:13:50 GMT
expires: Fri, 12 May 2023 00:00:00 GMT
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&gdpr=0&gdpr_consent=
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
pragma: no-cache
server: Kestrel
server-processing-duration-in-ticks: 1182482
strict-transport-security: max-age=31536000; preload;
x-errorlevel: 0

GET
H2

200

Pug Show response
image2.pubmatic.com/AdServer/ Frame CBEB
Redirect Chain

https://d5p.de17a.com/getuid/pubmatic?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://d5p.de17a.com/getuid/pubmatic;c?https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=$UID
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=3584376253566737382

42 B
276 B

29ms
29ms

Document
image/gif

185.64.189.110

General

Check archive.org

Show headers Download Go to

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=3584376253566737382
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 12 May 2023 07:13:51 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

content-length: 0
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3NDUmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=3584376253566737382
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H2

200

Pug Show response
simage2.pubmatic.com/AdServer/ Frame A4A0
Redirect Chain

https://ib.adnxs.com/getuid?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=$UID&gdpr=0&gdpr_consent=
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=1740212894709690222&gdpr=0&gdpr_consent=

42 B
297 B

115ms
36ms

Document
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=1740212894709690222&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: 1866961a029c65376fefb7f2ba1e6187e09ff50ea58d97dedfd72c197947d002

Request headers

Referer: https://ads.pubmatic.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-store, no-cache, private
content-length: 42
content-type: image/gif; charset=utf-8
date: Fri, 12 May 2023 07:13:50 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server: nginx

Redirect headers

AN-X-Request-Uuid: ea60bc4b-8e6c-41f5-b89d-ffe0502a3697
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Access-Control-Allow-Credentials: true
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=utf-8
Date: Fri, 12 May 2023 07:13:51 GMT
Expires: Sat, 15 Nov 2008 16:00:00 GMT
Location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=1740212894709690222&gdpr=0&gdpr_consent=
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Pragma: no-cache
Server: nginx/1.23.2
X-Proxy-Origin: 84.19.175.184; 84.19.175.184; 868.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
X-XSS-Protection: 0

GET
H2

200

user_sync.html
ads.pubmatic.com/AdServer/js/ Frame DA77
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=mBqurFgRTcKQrA6cg4hnxQ%3D%3D&gdpr=0&gdpr_consent=
https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=

16 KB
16 KB

23ms
23ms

Image
text/html

23.35.236.201

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159432
Protocol: H2
Server: 23.35.236.201 -, , ASN (),
Reverse DNS
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:51 GMT
content-encoding: gzip
last-modified: Fri, 16 Dec 2022 06:36:49 GMT
server: Apache
vary: Accept-Encoding
content-type: text/html
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
cache-control: max-age=97853
accept-ranges: bytes
content-length: 5554
expires: Sat, 13 May 2023 10:24:44 GMT

Redirect headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:51 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ads.pubmatic.com/AdServer/js/user_sync.html?p=156578&predirect=&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 404 qmap
sync.crwdcntrl.net/ Frame DA77 49 B
265 B 141ms
45ms Image
image/gif 34.249.208.98

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.crwdcntrl.net/qmap?c=240&tp=PUBM&tpid=981AAEAC-5811-4DC2-90AC-0E9C838867C5&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.249.208.98 -, , ASN (),
Reverse DNS
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:51 GMT
server: Jetty(9.4.38.v20210224)
content-type: image/gif
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.45.14.38
content-length: 49
expires: 0

GET
H2

204

ids
idsync.frontend.weborama.fr/ Frame DA77
Redirect Chain

https://cr.frontend.weborama.fr/cr?key=pubmatic&gdpr=0&gdpr_consent=
https://cr.frontend.weborama.fr/cr?key=pubmatic&gdpr=0&gdpr_consent=&bounce=1&random=1086327568
https://image6.pubmatic.com/AdServer/UCookieSetPug?rd=https%3A%2F%2Fidsync.frontend.weborama.fr%2Fids%3Fkey%3Dpubmatic%26value%3D%23PM_USER_ID&gdpr=0
https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=981AAEAC-5811-4DC2-90AC-0E9C838867C5

0
284 B

89ms
30ms

Image
text/plain

34.111.131.239

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=981AAEAC-5811-4DC2-90AC-0E9C838867C5
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159432
Protocol: H2
Server: 34.111.131.239 -, , ASN (),
Reverse DNS
Software: Weborama Collect Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:51 GMT
via: 1.1 google
last-modified: Fri, 12 May 2023 07:13:51 GMT
server: Weborama Collect Frontend
vary: Origin
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 03 Jul 2001 06:00:00 GMT

Redirect headers

location: https://idsync.frontend.weborama.fr/ids?key=pubmatic&value=981AAEAC-5811-4DC2-90AC-0E9C838867C5
date: Fri, 12 May 2023 07:13:51 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H2

200

p
a.audrte.com/ Frame DA77
Redirect Chain

https://a.audrte.com/match?gdpr=0&gdpr_consent=&p=M1717054901&uid=981AAEAC-5811-4DC2-90AC-0E9C838867C5
https://cm.g.doubleclick.net/pixel?google_nid=ar101281&google_hm=NWltTmQ1Y1VnLThRQ1dacktvQ01KT01qZw==&google_redir=http%3A%2F%2Fa.audrte.com%2Fddp%3Fred%3DeyJ1IjoiaHR0cDovL2EuYXVkcnRlLmNvbTo4MC9wIi...
https://a.audrte.com/ddp?red=eyJ1IjoiaHR0cDovL2EuYXVkcnRlLmNvbTo4MC9wIiwiZCI6W3sibmFtZSI6ImFkZm9ybSJ9XX0%3D&gdpr=0&gdpr_consent=
https://dmp.adform.net/serving/cookie/match/?party=1003&r=eyJ1IjoiaHR0cDovL2EuYXVkcnRlLmNvbTo4MC9wIiwiZCI6W119&gdpr=0&gdpr_consent=
https://a.audrte.com/a?adform_uid=4088908138736354811&r=eyJ1IjoiaHR0cDovL2EuYXVkcnRlLmNvbTo4MC9wIiwiZCI6W119
https://a.audrte.com/p

68 B
464 B

204ms
203ms

Image
image/png

18.66.122.70

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://a.audrte.com/p
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159432
Protocol: H2
Server: 18.66.122.70 -, , ASN (),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:52 GMT
via: 1.1 1aa52a2a71a599aaf6b3df3a9c53b268.cloudfront.net (CloudFront)
server: nginx/1.18.0
x-amz-cf-pop: FRA60-P2
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST, GET, OPTIONS
content-type: image/png
access-control-allow-origin: *
x-cache: Miss from cloudfront
access-control-allow-credentials: true
content-length: 68
x-amz-cf-id: 0De-i-D-QUmSkRfFyg935-Hr1pvktF6TRAshszHqyCV8Z_UOEhIw-Q==

Redirect headers

date: Fri, 12 May 2023 07:13:51 GMT
via: 1.1 1aa52a2a71a599aaf6b3df3a9c53b268.cloudfront.net (CloudFront)
server: nginx/1.18.0
x-amz-cf-pop: FRA60-P2
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST, GET, OPTIONS
x-cache: Miss from cloudfront
location: http://a.audrte.com:80/p
access-control-allow-origin: *
access-control-allow-credentials: true
content-length: 0
x-amz-cf-id: LXz_WPA-WCuN9IXhGmL0FCkIoTnkWqjVq9vx07Q9b_vky9Bwnd_U6g==

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame DA77
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_hm=OTgxQUFFQUMtNTgxMS00REMyLTkwQUMtMEU5QzgzODg2N0M1&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=

42 B
95 B

95ms
31ms

Image
image/gif

185.64.189.110

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159432
Protocol: H2
Server: 185.64.189.110 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 12 May 2023 07:13:51 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:51 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjImdGw9MTI5NjAw&gdpr=0&gdpr_consent=
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame DA77
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=pubmatic&google_cm&google_sc&gdpr=0&gdpr_consent=
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJU246iTr4QzwImBr3H9Kqo&google_cver=1

42 B
528 B

94ms
30ms

Image
image/gif

185.64.189.110

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJU246iTr4QzwImBr3H9Kqo&google_cver=1
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159432
Protocol: H2
Server: 185.64.189.110 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 12 May 2023 07:13:50 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:51 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=CAESEJU246iTr4QzwImBr3H9Kqo&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubmatic
um.simpli.fi/ Frame DA77 43 B
409 B 30ms
29ms Image
image/gif 34.91.62.186
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://um.simpli.fi/pubmatic?https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9ODA2JnRsPTUxODQwMA==&piggybackCookie=uid:$UID&gdpr=0&gdpr_consent=

Requested by

Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159432

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

34.91.62.186 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

Software

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:51 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
last-modified: Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-methods: GET, POST, OPTIONS
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 43
expires: Thu, 11 May 2023 07:13:51 GMT

GET
H2

200

Pug
simage2.pubmatic.com/AdServer/ Frame DA77
Redirect Chain

https://c1.adform.net/serving/cookie/match?party=14&redirect=https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&piggybackCookie=[PLACE%20YOUR%20PIGGYBACK%20COO...
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=4088908138736354811

42 B
243 B

110ms
36ms

Image
image/gif

185.64.190.80

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=4088908138736354811
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159432
Protocol: H2
Server: 185.64.190.80 -, , ASN (),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Fri, 12 May 2023 07:13:50 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:51 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NzUmdGw9NDMyMDA=&gdpr=0&gdpr_consent=&piggybackCookie=4088908138736354811
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame DA77 70 B
264 B 47ms
46ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by: Host: ads.pubmatic.com
URL: https://ads.pubmatic.com/AdServer/js/user_sync.html?kdntuid=1&p=159432
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.pubmatic.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 12 May 2023 07:13:51 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 7C3F
Redirect Chain

https://token.rubiconproject.com/token?pid=2974&pt=n&a=1
https://pr-bh.ybp.yahoo.com/sync/rubicon/ZjfNv5IYaNVK4sskfpVJyQ?csrc=
https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-ShXVhx1E2oLTkeDekjkrMOaBgNR2yA9OfOrpcg--~A

0
239 B

38ms
24ms

Image
image/gif

69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-ShXVhx1E2oLTkeDekjkrMOaBgNR2yA9OfOrpcg--~A
Protocol: HTTP/1.1
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: c1913d0f161dfd12bb229b87994a2d1d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

date: Fri, 12 May 2023 07:13:51 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://pixel.rubiconproject.com/tap.php?v=31950&nid=2974&put=y-ShXVhx1E2oLTkeDekjkrMOaBgNR2yA9OfOrpcg--~A
content-length: 0

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame 7C3F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_cm&google_sc
https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEJyz_7F6ido4XyB1k3_XrPk&google_cver=1

0
239 B

26ms
26ms

Image
image/gif

69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEJyz_7F6ido4XyB1k3_XrPk&google_cver=1
Protocol: HTTP/1.1
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: c1913d0f161dfd12bb229b87994a2d1d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:51 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.rubiconproject.com/tap.php?v=7751&nid=2249&expires=30&put=CAESEJyz_7F6ido4XyB1k3_XrPk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 326
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

setuid
px.ads.linkedin.com/ Frame 7C3F
Redirect Chain

https://token.rubiconproject.com/token?pid=36584
https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LHK82M2B-U-H48W

0
649 B

223ms
168ms

Image
text/plain

2620:1ec:21::14

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LHK82M2B-U-H48W
Protocol: H2
Server: 2620:1ec:21::14 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 07:13:51 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 1A3439A0ED1F40DFA5A6E537E7574533 Ref B: DUS30EDGE0720 Ref C: 2023-05-12T07:13:51Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAX7edjiIVj4TrlGVF7oIQ==

Redirect headers

Location: https://px.ads.linkedin.com/setuid?partner=rubiconDb&dbredirect=true&ruxId=LHK82M2B-U-H48W
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: c1913d0f161dfd12bb229b87994a2d1d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ecm3
s.amazon-adsystem.com/ Frame 7C3F
Redirect Chain

https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=
https://s.amazon-adsystem.com/dcm?pid=50cd21b7-d8d7-4615-9fb9-a2be831f8488&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=GhTxcln3TcCnSvnevFYnwQ&rk=usync-na
https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=GhTxcln3TcCnSvnevFYnwQ

43 B
479 B

112ms
111ms

Image
image/gif

52.46.128.147

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=GhTxcln3TcCnSvnevFYnwQ

Protocol

HTTP/1.1

Server

52.46.128.147 -, , ASN (),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 12 May 2023 07:13:52 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: SG7EDSKMV3XXQDRP18WX
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://s.amazon-adsystem.com/ecm3?ex=rubiconprojectHMT&id=GhTxcln3TcCnSvnevFYnwQ
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: c1913d0f161dfd12bb229b87994a2d1d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 rubicon
match.adsrvr.org/track/cmf/ Frame 7C3F 70 B
264 B 48ms
46ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/rubicon
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Fri, 12 May 2023 07:13:51 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7C3F
Redirect Chain

https://token.rubiconproject.com/token?pid=25470
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_cm&google_hm=TEhLODJNMkItVS1INDhX
https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEJskVG08LAYCFzPkfAGuyzA&google_cver=1
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEhLODJNMkItVS1INDhX&google_push=

170 B
188 B

36ms
34ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEhLODJNMkItVS1INDhX&google_push=

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 12 May 2023 07:13:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEhLODJNMkItVS1INDhX&google_push=
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: c1913d0f161dfd12bb229b87994a2d1d
Expires: 0

GET
H/1.1

200
OK

ecm3
aax-eu.amazon-adsystem.com/s/ Frame 7C3F
Redirect Chain

https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=
https://aax-eu.amazon-adsystem.com/s/dcm?pid=a38a8ddf-19a7-4ab8-ba05-0a61de92a7e5&id=&dcc=t
https://pixel.rubiconproject.com/token?pid=2179&pt=n&puid=e5EPSTEKTBGSZSTpyWmZ8A&rk=usync-other
https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=e5EPSTEKTBGSZSTpyWmZ8A

43 B
720 B

141ms
140ms

Image
image/gif

67.220.228.201

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=e5EPSTEKTBGSZSTpyWmZ8A

Protocol

HTTP/1.1

Server

67.220.228.201 -, , ASN (),

Reverse DNS

Software

Server /

Resource Hash

c21e2c1246fe45a6750ae6208db2b5965ff6ed63eb80d2ecec3be9c83813428e

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://eus.rubiconproject.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 12 May 2023 07:13:52 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: N2P962HW95TD3TDRCVQW
Vary: Content-Type,Accept-Encoding,User-Agent
Content-Type: image/gif
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 43
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://aax-eu.amazon-adsystem.com/s/ecm3?ex=rubiconprojectHMT&id=e5EPSTEKTBGSZSTpyWmZ8A
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: c1913d0f161dfd12bb229b87994a2d1d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 7C3F
Redirect Chain

https://token.rubiconproject.com/token?pid=2249&pt=n
https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MjlmODA2NjQ0ZDdjY2JmYWVmZjUzZTJhZDJlN2FjM2JmZTM5ZDVmMw

170 B
188 B

32ms
32ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rubicon&google_hm=MjlmODA2NjQ0ZDdjY2JmYWVmZjUzZTJhZDJlN2FjM2JmZTM5ZDVmMw

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS