demonic-empire.shivtr.com Open in urlscan Pro
45.33.21.148 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://demonic-empire.shivtr.com/
Submission: On March 06 via api (March 6th 2024, 4:53:50 am UTC) from US — Scanned from DE

Summary HTTP 150 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 21 IPs in 3 countries across 13 domains to perform 150 HTTP transactions. The main IP is 45.33.21.148, located in Richardson, United States and belongs to AKAMAI-LINODE-AP Akamai Connected Cloud, SG. The main domain is demonic-empire.shivtr.com.
TLS certificate: Issued by R3 on February 27th 2024. Valid for: 3 months.

This is the only time demonic-empire.shivtr.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
6	45.33.21.148 45.33.21.148	63949 (AKAMAI-LI...) (AKAMAI-LINODE-AP Akamai Connected Cloud)
45	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
24	52.216.78.214 52.216.78.214	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:480... 2a02:26f0:480:587::523	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	46.105.124.43 46.105.124.43	16276 (OVH) (OVH)
3	13.33.187.68 13.33.187.68	16509 (AMAZON-02) (AMAZON-02)
1	192.0.77.2 192.0.77.2	2635 (AUTOMATTIC) (AUTOMATTIC)
12	2a00:1450:400... 2a00:1450:4001:828::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:80f::200a	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:830::2001	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:82f::2003	15169 (GOOGLE) (GOOGLE)
2	2a02:2638:3::12 2a02:2638:3::12	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
14	2a02:2638:3::3 2a02:2638:3::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	178.250.1.6 178.250.1.6	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
4	2a02:2638:3::1a 2a02:2638:3::1a	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2a02:2638:d::c 2a02:2638:d::c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2a02:2638:3::9 2a02:2638:3::9	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
12	2a02:2638:3::10 2a02:2638:3::10	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2a00:1450:400... 2a00:1450:4001:82f::2004	15169 (GOOGLE) (GOOGLE)
150	21

6 45.33.21.148 (Richardson, United States)

ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG)
PTR: li975-148.members.linode.com

demonic-empire.shivtr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.shivtr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

45 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 52.216.78.214 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com

s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:480:587::523 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

res.cloudinary.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.105.124.43 (France)

ASN16276 (OVH, FR)
PTR: ns3056850.ip-46-105-124.eu

www.wowfan.cz	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.33.187.68 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-33-187-68.fra60.r.cloudfront.net

wow.zamimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i1.wp.com

i0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:828::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:830::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:82f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:3::12 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

ads.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a02:2638:3::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.1.6 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

cat.nl3.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:2638:3::1a (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

csm.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:d::c (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.fr3.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:3::9 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.nl3.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a02:2638:3::10 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

imageproxy.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
52	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 104 tpc.googlesyndication.com — Cisco Umbrella Rank: 161	777 KB
30	criteo.net static.criteo.net — Cisco Umbrella Rank: 677 csm.eu.criteo.net — Cisco Umbrella Rank: 9677 imageproxy.eu.criteo.net — Cisco Umbrella Rank: 10026	166 KB
24	amazonaws.com s3.amazonaws.com	136 KB
12	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 35	157 KB
9	gstatic.com www.gstatic.com fonts.gstatic.com	109 KB
6	criteo.com ads.eu.criteo.com — Cisco Umbrella Rank: 9660 cat.nl3.eu.criteo.com — Cisco Umbrella Rank: 10817 rtb.fr3.eu.criteo.com — Cisco Umbrella Rank: 17106 rtb.nl3.eu.criteo.com — Cisco Umbrella Rank: 15045	74 KB
6	shivtr.com demonic-empire.shivtr.com static.shivtr.com	213 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 30	3 KB
3	zamimg.com wow.zamimg.com — Cisco Umbrella Rank: 97652	321 KB
1	google.com www.google.com — Cisco Umbrella Rank: 2	1 KB
1	wp.com i0.wp.com — Cisco Umbrella Rank: 3604	169 KB
1	wowfan.cz www.wowfan.cz	99 KB
1	cloudinary.com res.cloudinary.com — Cisco Umbrella Rank: 2409	32 KB
150	13

	Domain	Requested by
45	pagead2.googlesyndication.com	demonic-empire.shivtr.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com
24	s3.amazonaws.com	demonic-empire.shivtr.com static.shivtr.com
14	static.criteo.net	ads.eu.criteo.com
12	imageproxy.eu.criteo.net
12	googleads.g.doubleclick.net	pagead2.googlesyndication.com googleads.g.doubleclick.net demonic-empire.shivtr.com
7	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
5	www.gstatic.com	googleads.g.doubleclick.net demonic-empire.shivtr.com
5	static.shivtr.com	demonic-empire.shivtr.com
4	csm.eu.criteo.net	ads.eu.criteo.com
4	fonts.gstatic.com	fonts.googleapis.com
4	fonts.googleapis.com	googleads.g.doubleclick.net demonic-empire.shivtr.com
3	wow.zamimg.com	demonic-empire.shivtr.com wow.zamimg.com
2	cat.nl3.eu.criteo.com	ads.eu.criteo.com
2	ads.eu.criteo.com	demonic-empire.shivtr.com googleads.g.doubleclick.net
1	www.google.com	tpc.googlesyndication.com
1	rtb.nl3.eu.criteo.com
1	rtb.fr3.eu.criteo.com	demonic-empire.shivtr.com
1	i0.wp.com	demonic-empire.shivtr.com
1	www.wowfan.cz	demonic-empire.shivtr.com
1	res.cloudinary.com	demonic-empire.shivtr.com
1	demonic-empire.shivtr.com
150	21

This site contains links to these domains. Also see Links.

Domain
armory.warmane.com
shivtr.com

Subject Issuer	Validity	Valid
*.shivtr.com R3	`2024-02-27` - `2024-05-27`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
s3.amazonaws.com Amazon RSA 2048 M01	`2024-02-08` - `2025-01-11`	a year	crt.sh
*.cloudinary.com Go Daddy Secure Certificate Authority - G2	`2023-12-18` - `2025-01-13`	a year	crt.sh
wowfan.cz R3	`2024-02-27` - `2024-05-27`	3 months	crt.sh
*.zamimg.com Amazon RSA 2048 M01	`2023-09-21` - `2024-10-18`	a year	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2023-11-28` - `2024-12-28`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh
*.eu.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-08` - `2024-05-06`	3 months	crt.sh
*.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-17` - `2024-05-17`	3 months	crt.sh
*.nl3.eu.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-06` - `2024-05-03`	3 months	crt.sh
*.eu.criteo.net DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-28` - `2024-05-31`	3 months	crt.sh
*.fr3.eu.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-10` - `2024-05-05`	3 months	crt.sh
www.google.com GTS CA 1C3	`2024-02-19` - `2024-05-13`	3 months	crt.sh

This page contains 18 frames:

Primary Page: https://demonic-empire.shivtr.com/
Frame ID: 93FBCE7B882249805776A60B8BC07F3C
Requests: 52 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20240304/r20190131/zrt_lookup_nohtml_fy2021.html
Frame ID: 80C935933191B5E3907D90F03190EE09
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2367108048287515&output=html&adk=1812271804&adf=3025194257&lmt=1709700823&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=260x810_l%7C260x810_r&format=0x0&url=https%3A%2F%2Fdemonic-empire.shivtr.com%2F&pra=5&wgl=1&easpi=0&asro=0&aseiel=1~2~4~6~8~9~10~11~12~13~14~15~16~17&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1709700823583&bpp=7&bdt=830&idt=278&shv=r20240304&mjsv=m202402290101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5743391807227&frm=20&pv=2&ga_vid=1350388314.1709700824&ga_sid=1709700824&ga_hid=847034209&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C95325257%2C44795921%2C95325752%2C95325974%2C95320376%2C95324160%2C95325784%2C95326935&oid=2&pvsid=2068325300587508&tmod=748581815&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=305
Frame ID: 4A2B9F9372B12AC7DD6E1E4CE61257E3
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2367108048287515&output=html&h=90&slotname=2876344136&adk=4229348686&adf=4046715466&pi=t.ma~as.2876344136&w=728&lmt=1709700823&format=728x90&url=https%3A%2F%2Fdemonic-empire.shivtr.com%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1709700823590&bpp=1&bdt=837&idt=308&shv=r20240304&mjsv=m202402290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5743391807227&frm=20&pv=1&ga_vid=1350388314.1709700824&ga_sid=1709700824&ga_hid=847034209&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=293&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C95325257%2C44795921%2C95325752%2C95325974%2C95320376%2C95324160%2C95325784%2C95326935&oid=2&pvsid=2068325300587508&tmod=748581815&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=314
Frame ID: ABB0C5CA46656AE3C582DD62C243B06A
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2367108048287515&output=html&h=280&adk=3809598800&adf=1604629528&pi=t.aa~a.1182920990~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1709700824&rafmt=1&to=qs&pwprc=9183188665&format=1200x280&url=https%3A%2F%2Fdemonic-empire.shivtr.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1709700824564&bpp=2&bdt=1811&idt=-M&shv=r20240304&mjsv=m202402290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=2&correlator=5743391807227&frm=20&pv=1&ga_vid=1350388314.1709700824&ga_sid=1709700824&ga_hid=847034209&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1737&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C95325257%2C44795921%2C95325752%2C95325974%2C95320376%2C95324160%2C95325784%2C95326935&oid=2&pvsid=2068325300587508&tmod=748581815&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=9
Frame ID: A830299235C651818D586A14306CE858
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2367108048287515&output=html&h=90&adk=1152246153&adf=513501529&pi=t.aa~a.2817085865~rp.3&w=1000&fwrn=4&fwrnh=100&lmt=1709700824&rafmt=1&to=qs&pwprc=9183188665&format=1000x90&url=https%3A%2F%2Fdemonic-empire.shivtr.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1709700824564&bpp=1&bdt=1811&idt=0&shv=r20240304&mjsv=m202402290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C1200x280&nras=3&correlator=5743391807227&frm=20&pv=1&ga_vid=1350388314.1709700824&ga_sid=1709700824&ga_hid=847034209&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=300&ady=1637&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C95325257%2C44795921%2C95325752%2C95325974%2C95320376%2C95324160%2C95325784%2C95326935&oid=2&pvsid=2068325300587508&tmod=748581815&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=15
Frame ID: 1A9FDE128F2EF5C569A84625EC1F3E4B
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20240304/r20110914/zrt_lookup_nohtml_fy2021.html
Frame ID: F9C5B0366885302BCA5B5AC249000A4F
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20240304/r20110914/zrt_lookup_nohtml_fy2021.html
Frame ID: 6A17BD824D6F61D11FEEA9F38E1BB5F0
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20240304/r20110914/zrt_lookup_nohtml_fy2021.html
Frame ID: 6546EF849ED0BE841112D891BD7C645E
Requests: 8 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Poppins%3A400%2C600
Frame ID: C95DBB9DF25946D786BF377B7DA50A4D
Requests: 7 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Zef21wAN9ckH_ZuhAA3X0IKoON1BoPBG26WV2w&u=%7C%2Bw%2BsJbBej4oyb1zHQ7FbJ3Ai92A%2BeAHhprrw4ERZUS8%3D%7C&c1=jWCgqsKSUoWKRvDssmEQ3dRte9oWhU873PslWXxlgwqBkwvNjl8q6e-4vOkZyr-tuWKbg6CJmKWOyQl4xhWEpmV2nJHJuXlGgiWEq9cM7a-8O7zYkRCTdWgTqnXsTnnbkyC6HzUTlUAEU9xtfgSmaqC-MfrodTiJXfrIJuGJx8NLMXHt05u0Y4sTdAz2FQgs1X0SYdjGQPtKp1eMF1bFuUov2m2NpeYkKslFmISlZP1-NWBU4ThoWXCOyNDacBH0Oh0owpiznSoDR2n0NhAHw0VhEuvY46GRsYS_6BBY34NtwT9PfIKL95ParOM8QjGItfqivx3V-0ogip2Olexp44ejC7rk_f7SKDKXIdY3h9sZuTpOrgv7nLtZCVcw4_B-kNIGZWF0fVQRMQFSKnxMWIurhFXEmPivUNRWOQQdvvuTI8CM2hpZ0j5eW83u7HvFUOUfStWiMwinMBcXe_9P-2LlMGUmsbibGhLnEPyjGhwKLj6yYcYvz25QL5YRV2dpZiAQnRt2_4UpsXawSB_cdQmv7NO7n5O-UmbIpr998FS-ThYMqzmVaj3BWOo7MTd7Qls_ab_SKPsm12K7XsywrJC6iIqQ4h99lD5MI_4Ht-GodwsYb7XtDyMEl3s7BWlpzOUeZgrmYNn-fa9mUaGcyw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCkE-O1_bnZcnrN6G39u8P0K-3QMme0rFc1Z2R93DAjbcBEAEgAGCVgoCAmAeCARdjYS1wdWItMjM2NzEwODA0ODI4NzUxNcgBCakCH1NzF942sj6oAwHIAwKqBNYBT9DvhK5q2WArRR7KBiO0-FFM73OBHHhYGSfHDFvG6TnCI4y9-EEPrzq7Znazzct8Ez8pZ2euSUXa1CjC5dbKwHw_KcmaYJz9qYfhy5s826q3vUOo34SsdjbKUpR0BhVL8XkWgVJIddS6OMtOAEs7pBttaudQq2ONso7a8aIrGdS-aPwTN66-uMVqMGAdPG5mFOp9aoUQs8nTKKRwdCzkePAVyDuLp9NQK8IayC1UMe5PSkx8O8CjuZRq79FkY4qEJaHho9PQZUZWL503cNox-uh9ZpqnMoAG_4XPw_jnr_dHoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAqgHrb6xAtgHANIIKQiR4YBwEAEyB-uLgOC_gA06CYBAgICAgICUKEi9_cE6WICToPLr3oQD-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1EyHj-zVb-7AoTV5VRKwKbke1K0A%26client%3Dca-pub-2367108048287515%26adurl%3D
Frame ID: ED8F2CEC39A3AD45A003B3527A708BFB
Requests: 11 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/window_focus_fy2021.js
Frame ID: CF3B35065EE43B7732B366CA8C08728A
Requests: 7 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Zef21wAN9coH_ZuhAA3X0EWvFd_Qj8pufazauQ&u=%7C%2Bw%2BsJbBej4o5%2BlnN0POBkebnuRz17ltqXDuDpCbIda8%3D%7C&c1=jWCgqsKSUoWKRvDssmEQ3dRte9oWhU873PslWXxlgwqBkwvNjl8q6e-4vOkZyr-tuWKbg6CJmKWOyQl4xhWEpmV2nJHJuXlGVbQKOBzD9N3WsSoSaoPOG6J9AO7Y8FBsqWd7x8jd-78c849e_mfN3-HRxVnriK6hTIblzE-A9qxi36xcIYc1rWDVPD7Aq10yHd1IuwopainJGSZmkIviTom-IwrPitFD5f157Gpk6Cwrm1cvNzouQxYKGZQ0yoEhnWF-TeBqAS_A8LzKRT37AmkGXg11H5Q-uC4Xpg7MExkGxqHhONVk9yWLAYSJqJ2AH3_pLu2DLr1_26PF6_vG21Fikl98UqhadNqwOSHfje5hfRIkjwcgn6znhc5ZJnpMWTfRLDib5RGsOGzZtwH8K6ahaRoV76w0M4HEXPriv7vWSEwlD9apFLJ-WPd5wakfONIoRJWif4OZXqqkI0B7Tp0fy7RcqA4TGMVwwibvl6HculGONFOj3UhgvV9434gJRZbyeHoRLsFCYlVhiel2_vLKEqu-KadET1wr5_T9QDThY9uhpPVp3XB7ydziRHlpAtzdvLVo57Ssf92zbRCArnBT2ld0gQNUQE4DUdbP7br2W1GK5hWciTnKfMgCqngkpuEPa5wIMYE&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCOilO1_bnZcrrN6G39u8P0K-3QMme0rFcxYyL4JoBwI23ARABIABglYKAgJgHggEXY2EtcHViLTIzNjcxMDgwNDgyODc1MTXIAQmpAh9TcxfeNrI-qAMByAMCqgTWAU_QBorzKW4Z4nEqy5F922Ds8XKsknFyWhzan2ZKBqiFOk1ZaheIWANksSmp6w1JMoCJZsotspCKFB0aqOa7qIW8brHqn1Ga3JcoHU8O53WMtPfrQ4i9G_9JcD71hpCIQO489W762stGLe1UEXyrTsSOHqyYsUE9GP3MJN4PVka2nZsB03206-RFydNWfBuBjt-IIiKKefWq4EuoHiQGlyfpJXvAtlHj8j4P4lMPV-UuWVQBQBDAknFM2Q7r3pAv3-mpDYNpS5OlCBxOAl9N3XWzGK91T52ABsDmwvjNiYTb8gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7ECqAetvrEC2AcA0ggpCJHhgHAQATIH64uA4L-ADToJgECAgICAgJQoSL39wTpYgJOg8uvehAP6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1igwS17NIfLhOkwT2VeKikeC8hNw%26client%3Dca-pub-2367108048287515%26adurl%3D
Frame ID: 400FD2E20ABB0F54286F3A18A816C25E
Requests: 23 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/neFZPoS4RqR4jfdTFmgUuiCC8zWeQsTNscPgsnGRUhI.js
Frame ID: 78887B3BF6BF78432A0A8F5EA7E7B610
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/neFZPoS4RqR4jfdTFmgUuiCC8zWeQsTNscPgsnGRUhI.js
Frame ID: A40541E032D46655A2F14CB1F644705B
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/neFZPoS4RqR4jfdTFmgUuiCC8zWeQsTNscPgsnGRUhI.js
Frame ID: FA3F137D4E9B008C2B8E335E73ADF82D
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: E7992F82D10D0D9612AA967928FC778C
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: CAA039AE16F1144DF75D7915ABDAF967
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Demonic Empire

Detected technologies

Cloudinary (CDN) Expand

Overall confidence: 80%
Detected patterns

<img[^>]+\.cloudinary\.com

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Page Statistics

150
Requests

100 %
HTTPS

70 %
IPv6

13
Domains

21
Subdomains

21
IPs

3
Countries

2258 kB
Transfer

5780 kB
Size

4
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: http://armory.warmane.com/guild/Demonic+Empire/Icecrown/summary/
Title: Armory

Search URL Search Domain Scan URL

URL: http://shivtr.com/
Title: Guild Hosting

Search URL Search Domain Scan URL

URL: http://shivtr.com/terms
Title: Terms of Use

Search URL Search Domain Scan URL

URL: http://shivtr.com/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: http://shivtr.com/legal
Title: Legal

Search URL Search Domain Scan URL

URL: http://shivtr.com/security
Title: Security

Search URL Search Domain Scan URL

URL: http://shivtr.com/help
Title: Help

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

150 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
demonic-empire.shivtr.com/ 13 KB
4 KB 539ms
213ms Document
text/html 45.33.21.148
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL

https://demonic-empire.shivtr.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

45.33.21.148 Richardson, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),

Reverse DNS

li975-148.members.linode.com

Software

Caddy /

Resource Hash

a87130e14586c4efd63f5bb61764ee8c26b2353892c185446ef25ca23827a8bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000
cache-control: max-age=0, private, must-revalidate
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 06 Mar 2024 04:53:42 GMT
etag: W/"a87130e14586c4efd63f5bb61764ee8c"
referrer-policy: strict-origin-when-cross-origin
server: Caddy
strict-transport-security: max-age=31536000
vary: Accept-Encoding
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-request-id: 44b85e47-b76e-425e-b11b-7c26cb47bb75
x-runtime: 0.066636
x-xss-protection: 1; mode=block

GET
H2 200 guild-dc2bc810ec06e8d0c90d72531a06dc285eec9409f9d88120e8b05f5a606674ce.css
static.shivtr.com/assets/manifests/ 218 KB
38 KB 172ms
148ms Stylesheet
text/css 45.33.21.148
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.shivtr.com/assets/manifests/guild-dc2bc810ec06e8d0c90d72531a06dc285eec9409f9d88120e8b05f5a606674ce.css
Requested by: Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.33.21.148 Richardson, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: li975-148.members.linode.com
Software: Caddy /
Resource Hash: dc86183c64a971df266cf43382fe00a3b1c600ec6107714e06597192164b82b5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:42 GMT
content-encoding: gzip
last-modified: Sun, 02 Jul 2023 20:26:50 GMT
server: Caddy
etag: "rx6rgq4s2q"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000

GET
H2 200 614089-1687777479.css
static.shivtr.com/css-cache/site_themes/ 30 KB
5 KB 170ms
147ms Stylesheet
text/css 45.33.21.148
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.shivtr.com/css-cache/site_themes/614089-1687777479.css
Requested by: Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.33.21.148 Richardson, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: li975-148.members.linode.com
Software: Caddy /
Resource Hash: bd777b49e978d13efd23e3c33717d52238ff7f3d31d5085f7a2069f6de94c48f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:42 GMT
content-encoding: gzip
last-modified: Mon, 03 Jul 2023 11:04:39 GMT
server: Caddy
etag: "rx7w3rnem"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000

GET
H2 200 guild-518b27752212c843cdda21c5e01ffe7de2d0bd28f7100cd01bf329100e3b7457.js Show response
static.shivtr.com/assets/ 608 KB
166 KB 315ms
292ms Script
text/javascript 45.33.21.148
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to

Full URL: https://static.shivtr.com/assets/guild-518b27752212c843cdda21c5e01ffe7de2d0bd28f7100cd01bf329100e3b7457.js
Requested by: Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.33.21.148 Richardson, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: li975-148.members.linode.com
Software: Caddy /
Resource Hash: 9e2e766b44b4bd31a6887776e57d5a5f502237e48cf90ded21436cfb6addf0be

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:42 GMT
content-encoding: gzip
last-modified: Sun, 02 Jul 2023 20:26:50 GMT
server: Caddy
etag: "rx6rgqdcmv"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 147 KB
51 KB 119ms
62ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a8696976a432d2a4a4e0e19717ec37aba6ff16ee796270d134dca7ae7feecda6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:43 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51208
x-xss-protection: 0
server: cafe
etag: 11022144644319905159
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
link: <https://googleads.g.doubleclick.net>; rel="preconnect"; crossorigin
expires: Wed, 06 Mar 2024 04:53:43 GMT

GET
H2 200 favicon.png
static.shivtr.com/s3/missing/ 382 B
462 B 168ms
146ms Image
image/png 45.33.21.148
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.shivtr.com/s3/missing/favicon.png
Requested by: Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.33.21.148 Richardson, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: li975-148.members.linode.com
Software: Caddy /
Resource Hash: 830870bb74c6a4a16f3c0c49a7934378a8c26fe68fa8bf280e7d1b2a5ddc0f12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:42 GMT
last-modified: Wed, 28 Jun 2023 04:24:58 GMT
server: Caddy
etag: "rwy49mam"
content-type: image/png
access-control-allow-origin: *
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
content-length: 382

GET
H2 200 home-e4bd7164f7a26fa97379195030ab18fcc8c7a11a5ad318b4065f8e5166b3191b.png
static.shivtr.com/assets/mobile/toolbar/ 250 B
291 B 313ms
291ms Image
image/png 45.33.21.148
AKAMAI-LINODE-AP ...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.shivtr.com/assets/mobile/toolbar/home-e4bd7164f7a26fa97379195030ab18fcc8c7a11a5ad318b4065f8e5166b3191b.png
Requested by: Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 45.33.21.148 Richardson, United States, ASN63949 (AKAMAI-LINODE-AP Akamai Connected Cloud, SG),
Reverse DNS: li975-148.members.linode.com
Software: Caddy /
Resource Hash: 86c06c5c4747bb6da8d7594ed31b1494459d202ba31ede706bf8f741acedc9b3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:42 GMT
last-modified: Sun, 02 Jul 2023 20:26:50 GMT
server: Caddy
etag: "rx6rgq6y"
content-type: image/png
access-control-allow-origin: *
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000
content-length: 250

GET
H/1.1 200
OK out.png
s3.amazonaws.com/cloudfront.shivtr.com/game_classes/17/ 1 KB
2 KB 393ms
156ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/game_classes/17/out.png?1356759142
Requested by: Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: d75a105ae665367fed5c8b4f861ef14368df2ddc603b7777140164b0d57c333a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:44 GMT
x-amz-version-id: null
Last-Modified: Sat, 29 Dec 2012 05:32:24 GMT
Server: AmazonS3
x-amz-request-id: K2PKRRC8J22D7GH3
ETag: "b349535acc00a6991ef2fb4df319d70a"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 1233
x-amz-id-2: zpEbNM6hSerH99lp8/qR7piLxMEy2820A9vJDZ98wQY0hv/qyQ4Qvq076CJpoV77Yem73//lBCs=
Expires: Tue, 08 Jan 2013 05:22:39 GMT

GET
H/1.1 200
OK out.png
s3.amazonaws.com/cloudfront.shivtr.com/game_classes/22/ 1 KB
2 KB 336ms
125ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/game_classes/22/out.png?1356759148
Requested by: Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 54cc0e7807cf8bdf5d48a2930fbcd3b5a30b0dae8cc3bbab2efcee6fad1a092d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:44 GMT
x-amz-version-id: null
Last-Modified: Sat, 29 Dec 2012 05:32:30 GMT
Server: AmazonS3
x-amz-request-id: K2PZAD6CWDN54QF4
ETag: "e6796325284cc94e9c47abfafd14f1cf"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 1192
x-amz-id-2: HDdBgZ5Fatj7fOM1bYWAXxCANgyl3dn+EbczOe1FgnjgkgQ8EncJXrY7VQtxevYzePOnLYSFnuM=
Expires: Tue, 08 Jan 2013 05:22:39 GMT

GET
H/1.1 200
OK out.png
s3.amazonaws.com/cloudfront.shivtr.com/game_classes/14/ 1 KB
2 KB 160ms
160ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/game_classes/14/out.png?1356759154
Requested by: Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: ff4094a2d0a0df94d358f9363bafe98fb4ed45601b46456651bb7ae23a48f625

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:44 GMT
x-amz-version-id: null
Last-Modified: Sat, 29 Dec 2012 05:32:35 GMT
Server: AmazonS3
x-amz-request-id: K2PVAVN6XCAD8SKJ
ETag: "f8e2fc8f735480d867ad95834fbd6924"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 1097
x-amz-id-2: yjIqLEVoo6u6MHhYll5wMmfxQyt+Desdvc1JKTjifFKESWnrIpk3QClpGSScpUVSO3M0HNl97k8=
Expires: Tue, 08 Jan 2013 05:22:39 GMT

GET
H/1.1 200
OK out.png
s3.amazonaws.com/cloudfront.shivtr.com/game_classes/19/ 1 KB
2 KB 136ms
134ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/game_classes/19/out.png?1356759160
Requested by: Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 7088d6c86fda7a1dbd11ce4ec06ab4cf62f816203c1a68092d8b87bb847d2ec7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:44 GMT
x-amz-version-id: null
Last-Modified: Sat, 29 Dec 2012 05:32:41 GMT
Server: AmazonS3
x-amz-request-id: K2PM0RZ6DTPFVNPQ
ETag: "08eaa3fe5ce8ec8c0118f5badcf2e38c"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 1219
x-amz-id-2: MJp1oBC02DSAHLyW8BVD+wvgyu/74wVspIEV62sa20ARP8x2VtcMwyNpScrOc+2ZuTQDEziqDH8=
Expires: Tue, 08 Jan 2013 05:22:39 GMT

GET
H/1.1 200
OK out.png
s3.amazonaws.com/cloudfront.shivtr.com/game_classes/13/ 1 KB
2 KB 618ms
120ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/game_classes/13/out.png?1356759171
Requested by: Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 38444148a2237a29af423edbe716ea9587872041585593d569fa13206db7a80e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:44 GMT
x-amz-version-id: null
Last-Modified: Sat, 29 Dec 2012 05:32:52 GMT
Server: AmazonS3
x-amz-request-id: K2PYBRBC4HHAFW3G
ETag: "522333c5b6abf6697e0894a433613b82"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 1237
x-amz-id-2: PoT+n248mprEaZQVuU0XRmiAkGAkx7SSKyZJsO2LloBwVecIBQVlawI7rolz4gM8U88FCtsRWok=
Expires: Tue, 08 Jan 2013 05:22:39 GMT

GET
H/1.1 200
OK out.png
s3.amazonaws.com/cloudfront.shivtr.com/game_classes/16/ 1 KB
2 KB 658ms
121ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/game_classes/16/out.png?1356759178
Requested by: Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 0101f1a2e65d66a8af54470ef2853f727dbaed3caf9aabaa522c9c46880f7e58

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:45 GMT
x-amz-version-id: null
Last-Modified: Sat, 29 Dec 2012 05:32:59 GMT
Server: AmazonS3
x-amz-request-id: JK4Y3PCMMZDQP38T
ETag: "3fa41138fa5d03f5edd315ba0eaf4a4e"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 1221
x-amz-id-2: S+SsXcs4/Q+/CXavsyRxKvs3RFcT6qEkE6X8auqHfPQNSpBz+OtlWxIRfmi9YYY1Lf9OZGXnaxA=
Expires: Tue, 08 Jan 2013 05:22:39 GMT

GET
H/1.1 200
OK out.png
s3.amazonaws.com/cloudfront.shivtr.com/game_classes/15/ 1 KB
2 KB 931ms
350ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/game_classes/15/out.png?1356759184
Requested by: Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 8a4acdbc5956c3196a8c4327078b5364d58362446a3620aa375085c0b4a4411d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:45 GMT
x-amz-version-id: null
Last-Modified: Sat, 29 Dec 2012 05:33:05 GMT
Server: AmazonS3
x-amz-request-id: JK4X0PY5MVACS9FX
ETag: "1baa44b20b606bacfa0507ae4b1d3c90"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 1247
x-amz-id-2: MWg05iQwcZ6G+L9zs39hHdN1fv6C7BZo2vjQ0oPmPNANdqBmPswiNYh2aIm+pD+vHtheMAouXIM=
Expires: Tue, 08 Jan 2013 05:22:39 GMT

GET
H/1.1 200
OK out.png
s3.amazonaws.com/cloudfront.shivtr.com/game_classes/18/ 1 KB
2 KB 931ms
313ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/game_classes/18/out.png?1356759190
Requested by: Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: a24b219c5dd7b0c9efdb2ffb85e250809341705b37781e9b00435f9b8c5e2e3f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:45 GMT
x-amz-version-id: null
Last-Modified: Sat, 29 Dec 2012 05:33:11 GMT
Server: AmazonS3
x-amz-request-id: JK4P8Q520R2HT036
ETag: "dee117fe859968bfadeff49c57963aad"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 1232
x-amz-id-2: D7TqEzZwO43opPWxlmVqDZjpAcsTTFXnT450d3XS2IYaNW4JMMCUt57z78EnTCIfm9w8fKwk/M8=
Expires: Tue, 08 Jan 2013 05:22:39 GMT

GET
H/1.1 200
OK out.png
s3.amazonaws.com/cloudfront.shivtr.com/game_classes/20/ 1 KB
2 KB 305ms
304ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/game_classes/20/out.png?1356759196
Requested by: Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: d6eade1ffe31d8226156f5c00fb48810841b02e60dd16f190205b162e8f73dc2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:45 GMT
x-amz-version-id: null
Last-Modified: Sat, 29 Dec 2012 05:33:18 GMT
Server: AmazonS3
x-amz-request-id: JK4TC5F158H97HSH
ETag: "d6cfb94525c3d56d1d4220f50a282006"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 1283
x-amz-id-2: XDNo0YdVAxRGfrSLyrk/1rPRJwzwkb5+a0g72/Vs+W40uQUVDITAG1AfITa7kKAP59eR2PQBwxc=
Expires: Tue, 08 Jan 2013 05:22:39 GMT

GET
H/1.1 200
OK out.png
s3.amazonaws.com/cloudfront.shivtr.com/game_classes/12/ 1 KB
2 KB 277ms
276ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/game_classes/12/out.png?1356759203
Requested by: Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 160f9c28c35e4390cd35e90cf1ccb3d80a58de14da97300d738b4e65cf54c7aa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:45 GMT
x-amz-version-id: null
Last-Modified: Sat, 29 Dec 2012 05:33:24 GMT
Server: AmazonS3
x-amz-request-id: JK4SEB231ZCCEPRA
ETag: "cfae4b32504ea00fbd74e4d8ecdd3a52"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 1192
x-amz-id-2: QOX0HY3QQiAobC85HYNHOSn8To1eArmnCdVYQkCB7O4m+k3ws7BED8FznhxoXBU3i1lKq20NHFw=
Expires: Tue, 08 Jan 2013 05:22:39 GMT

GET
H2 200 loadscreen-icecrown-citadel-full_lueuqz.jpg
res.cloudinary.com/mesorchoo/image/upload/c_crop,dpr_auto,f_auto,q_auto,w_1200/v1588050970/mesorchoo.com/artwork/instances/ 32 KB
32 KB 345ms
225ms Image
image/webp 2a02:26f0:480:587::523
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://res.cloudinary.com/mesorchoo/image/upload/c_crop,dpr_auto,f_auto,q_auto,w_1200/v1588050970/mesorchoo.com/artwork/instances/loadscreen-icecrown-citadel-full_lueuqz.jpg

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:480:587::523 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Cloudinary /

Resource Hash

95177cb9a19bb527f7ba16b9f0d2ff334091efc9c01ecd2bef69435fd3be7126

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:43 GMT
strict-transport-security: max-age=604800
x-content-type-options: nosniff
content-disposition: inline; filename="loadscreen-icecrown-citadel-full_lueuqz.webp"
server-timing: cld-akam;dur=199;cpu=27;start=2024-03-06T04:53:43.547Z;desc=miss,rtt;dur=21,cloudinary;dur=82;start=2024-03-06T04:53:43.616Z
content-length: 32394
last-modified: Tue, 28 Apr 2020 05:45:12 GMT
server: Cloudinary
etag: "46a1aa1daa83765dd2bd82bab390fa07"
vary: Accept,User-Agent,Save-Data,DPR,Sec-CH-DPR
content-type: image/webp
access-control-allow-origin: *
access-control-expose-headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error,X-Content-Type-Options
cache-control: private, no-transform, immutable, max-age=2592000
content-dpr: 1
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 ruby.jpg
www.wowfan.cz/pic/uploaded/ 99 KB
99 KB 468ms
30ms Image
image/jpeg 46.105.124.43
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.wowfan.cz/pic/uploaded/ruby.jpg
Requested by: Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 46.105.124.43 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3056850.ip-46-105-124.eu
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash: ee3affa7a75a5dab262c3796ec8926c8852a2040a013cf9421e284e88ce0930e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:43 GMT
last-modified: Fri, 30 Dec 2016 21:24:49 GMT
server: nginx/1.10.3 (Ubuntu)
accept-ranges: bytes
etag: "5866d0a1-18b12"
content-length: 101138
content-type: image/jpeg

GET
H2 200 138506-trial-of-the-champion.jpg
wow.zamimg.com/uploads/screenshots/normal/ 219 KB
219 KB 116ms
51ms Image
image/jpeg 13.33.187.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://wow.zamimg.com/uploads/screenshots/normal/138506-trial-of-the-champion.jpg

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.187.68 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-187-68.fra60.r.cloudfront.net

Software

Resource Hash

9301f07ce28c09e87781be0f793b1eec60e04eb986e7b58bb99aeecfc1b7669a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 20 Feb 2024 00:15:05 GMT
strict-transport-security: max-age=15724800; includeSubDomains
via: 1.1 d818b372f81cbe23bb149df5877c444a.cloudfront.net (CloudFront)
last-modified: Fri, 08 Feb 2013 03:23:53 GMT
x-amz-cf-pop: FRA60-P9
age: 1312718
etag: "51146fc9-36ac8"
x-cache: Hit from cloudfront
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 223944
x-amz-cf-id: 2z-1De0hsnDFmytxR6YgJTfHNj1Gf-hRuWQySA9V_Q8MJQh3yyBy-g==
expires: Thu, 21 Mar 2024 00:15:05 GMT

GET
H2 200 Yogg-Saron_Blizzard_com.jpg
i0.wp.com/images3.wikia.nocookie.net/wowwiki/images/3/38/ 169 KB
169 KB 90ms
22ms Image
image/webp 192.0.77.2
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i0.wp.com/images3.wikia.nocookie.net/wowwiki/images/3/38/Yogg-Saron_Blizzard_com.jpg

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

i1.wp.com

Software

nginx /

Resource Hash

74c3eeecd923e56f2d4796ea18d4acd478cc329cdbdca2e51b55573a69f301c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:43 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
content-length: 172906
x-nc: HIT hhn 2
last-modified: Fri, 23 Jun 2023 18:39:24 GMT
server: nginx
etag: "74cf938b738300d3"
vary: Accept
access-control-allow-methods: GET, HEAD
content-type: image/webp
access-control-allow-origin: *
cache-control: public, max-age=63115200
timing-allow-origin: *
link: <http://images3.wikia.nocookie.net/wowwiki/images/3/38/Yogg-Saron_Blizzard_com.jpg>; rel="canonical"
expires: Mon, 23 Jun 2025 06:39:24 GMT

GET
H2 200 power.js Show response
wow.zamimg.com/widgets/ 180 KB
58 KB 77ms
26ms Script
text/javascript 13.33.187.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://wow.zamimg.com/widgets/power.js

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.187.68 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-187-68.fra60.r.cloudfront.net

Software

Resource Hash

e207f1d35c0fab195c596ef48599a9f52b4297050a4ee95c82eb98d4035f0350

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:32:47 GMT
content-encoding: gzip
via: 1.1 d818b372f81cbe23bb149df5877c444a.cloudfront.net (CloudFront)
strict-transport-security: max-age=15724800; includeSubDomains
last-modified: Tue, 05 Mar 2024 23:29:25 GMT
x-amz-cf-pop: FRA60-P9
age: 1256
etag: W/"65e7aad5-2d166"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age=3600
x-amz-cf-id: nQw5aqx9mEnMB6iGiJmq5Hn1qtuagxBAsoawCOsS34EnMSd4lek5pA==
expires: Wed, 06 Mar 2024 05:32:47 GMT

GET
H/1.1 200
OK 3930056.jpg
s3.amazonaws.com/cloudfront.shivtr.com/theme_images/ 105 KB
106 KB 458ms
214ms Image
image/jpeg 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/theme_images/3930056.jpg?1548602383
Requested by: Host: static.shivtr.com
URL: https://static.shivtr.com/css-cache/site_themes/614089-1687777479.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 8026b77a36d1a7e20e512f163552d9b6634d5437c0fb7b18d6aeb0650cb92ca7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:44 GMT
x-amz-version-id: ClPnM4XHJqHQtpQpGfsGAAZOyAVA8AYG
Last-Modified: Sun, 27 Jan 2019 15:19:44 GMT
Server: AmazonS3
x-amz-request-id: K2PP2611GGXFC70M
ETag: "bc0594e47c957793e78027cfc1414289"
Content-Type: image/jpeg
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 107952
x-amz-id-2: t8z6+vKiAuz6q6nibKr0VpJ1kBNgdseA31E4yNivOVKfeYkDh8iqYa5gmgaB5C/3Z1JuZBgfvT8=
Expires: Sat, 27 Jul 2019 12:11:45 GMT

GET
H/1.1 200
OK 532207.png
s3.amazonaws.com/cloudfront.shivtr.com/theme_images/ 2 KB
2 KB 565ms
125ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/theme_images/532207.png?1383940811
Requested by: Host: static.shivtr.com
URL: https://static.shivtr.com/css-cache/site_themes/614089-1687777479.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 920a3defda6e075bd5ce32ebb4def4352b165fade37338fb91758aaedc1fc098

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:44 GMT
x-amz-version-id: null
Last-Modified: Fri, 08 Nov 2013 20:00:12 GMT
Server: AmazonS3
x-amz-request-id: K2PQX7TCR15AD3WT
ETag: "d6a1d3e270f4da6d5893fa7b94728025"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 1915
x-amz-id-2: dvOHdrD1+vtMjJJwufIwe64/G+H/MZ2aTS4NrUbuTgo+mZKoURwEVDKyjQPzsIReUOEj0RSSRGk=
Expires: Mon, 05 May 2014 23:11:24 GMT

GET
H/1.1 200
OK 532208.png
s3.amazonaws.com/cloudfront.shivtr.com/theme_images/ 2 KB
2 KB 614ms
149ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/theme_images/532208.png?1383940812
Requested by: Host: static.shivtr.com
URL: https://static.shivtr.com/css-cache/site_themes/614089-1687777479.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 4d03b6e90b232fb83c1da9981b5cb4012063ad310ccf71e33b5e8fd1fe2d8fb9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:44 GMT
x-amz-version-id: null
Last-Modified: Fri, 08 Nov 2013 20:00:13 GMT
Server: AmazonS3
x-amz-request-id: K2PPYT9D3QET9FF4
ETag: "4930ddbe02b550ef85bcc1d0c03c4a5a"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 1971
x-amz-id-2: uKquiCaY+XHhrEkv7rt88Z1UI4Fs9DbAjt9ofWuVTkUjGfbFwRIJ1mYskCdkv+oko1o/MxrdF6c=
Expires: Mon, 05 May 2014 23:11:17 GMT

GET
H/1.1 200
OK 532205.png
s3.amazonaws.com/cloudfront.shivtr.com/theme_images/ 199 B
650 B 465ms
122ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/theme_images/532205.png?1383940810
Requested by: Host: static.shivtr.com
URL: https://static.shivtr.com/css-cache/site_themes/614089-1687777479.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: a45b9f8f42c2dba06a065e38d99ff5521de332c3197f9fb4ab8801ab4970e041

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:44 GMT
x-amz-version-id: null
Last-Modified: Fri, 08 Nov 2013 20:00:11 GMT
Server: AmazonS3
x-amz-request-id: K2PMGY39JS4XSFXD
ETag: "b793897a973fe7efd6aed16f8809898b"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 199
x-amz-id-2: PnqEXE9B79ioTRdHSqiRSE13PG7KIB/NgSdgYNiCyYFm5I0d/gd53uncm2zlG1HL/Y/t5SER9fA=
Expires: Mon, 05 May 2014 23:11:17 GMT

GET
H/1.1 200
OK 532206.png
s3.amazonaws.com/cloudfront.shivtr.com/theme_images/ 515 B
966 B 347ms
146ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/theme_images/532206.png?1383940811
Requested by: Host: static.shivtr.com
URL: https://static.shivtr.com/css-cache/site_themes/614089-1687777479.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 2fd319c7809baaf44380af89d4d6cc83eead0773f5942ac01b8b5931c7abc336

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:44 GMT
x-amz-version-id: null
Last-Modified: Fri, 08 Nov 2013 20:00:12 GMT
Server: AmazonS3
x-amz-request-id: K2PP8DP8RWAMRK4A
ETag: "f5922a2b5d1fc74d17afe68c9fa5222c"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 515
x-amz-id-2: 6xcAEe0WIGJZfhcXFjcDVyLGPRoj0i7tNgKLR/bxNzd6SY96J4lRpBMEdIdoxmmYYX4ZUOefz6k=
Expires: Mon, 05 May 2014 23:10:52 GMT

GET
H/1.1 200
OK 532216.png
s3.amazonaws.com/cloudfront.shivtr.com/theme_images/ 1 KB
2 KB 642ms
266ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/theme_images/532216.png?1383940816
Requested by: Host: static.shivtr.com
URL: https://static.shivtr.com/css-cache/site_themes/614089-1687777479.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 748d77ecc9866e292c4ae69636ea30b6fb1e6af8d88a8059e0af2176429648c4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:44 GMT
x-amz-version-id: null
Last-Modified: Fri, 08 Nov 2013 20:00:17 GMT
Server: AmazonS3
x-amz-request-id: K2PMFMHDRBT2QZ0Y
ETag: "54fcfdf44787e7ebb805284cb89208e1"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 1317
x-amz-id-2: z6M05rrJ2vLLdA1abYqAs35/4zeSQzRHP4Ogh0NI5e9dYKxmloSwHSiPufXbFnWkCa1PQus5hKA=
Expires: Mon, 05 May 2014 23:10:52 GMT

GET
H/1.1 200
OK 532217.png
s3.amazonaws.com/cloudfront.shivtr.com/theme_images/ 1 KB
2 KB 520ms
152ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/theme_images/532217.png?1383940817
Requested by: Host: static.shivtr.com
URL: https://static.shivtr.com/css-cache/site_themes/614089-1687777479.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 240ac5cfe833b81f6607a9f702f7b30bc7383485fe86af4cd21b7c6d9cd2e3e8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:44 GMT
x-amz-version-id: null
Last-Modified: Fri, 08 Nov 2013 20:00:18 GMT
Server: AmazonS3
x-amz-request-id: K2PNQ93Q05219E57
ETag: "177bfb2a48dfcd9a39ff8f3d2fe61c33"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 1395
x-amz-id-2: Mc1J7gKpZrB4wseNckCA04AJqoflZlhBPlFR6BcE3+J/Z8nB1/CoT66YyeaudFIJKiu7rVzXWg8=
Expires: Mon, 05 May 2014 23:11:24 GMT

GET
H/1.1 200
OK 532215.png
s3.amazonaws.com/cloudfront.shivtr.com/theme_images/ 207 B
658 B 368ms
166ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/theme_images/532215.png?1383940816
Requested by: Host: static.shivtr.com
URL: https://static.shivtr.com/css-cache/site_themes/614089-1687777479.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 7c328c382892475e77d0d96832bfa0b35612da6a9705f013d588ef0393c04b88

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:44 GMT
x-amz-version-id: null
Last-Modified: Fri, 08 Nov 2013 20:00:17 GMT
Server: AmazonS3
x-amz-request-id: K2PN120RT855ZN90
ETag: "0ce032c0be41099a5ace5b7039c3f1bb"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 207
x-amz-id-2: rZJy7T5RJckv2GGNULqZBdLFxgf533sQjL9CcUGkMs43Kou57uLP/L0gMoreoiLjpKlIqPT0Uac=
Expires: Mon, 05 May 2014 23:11:17 GMT

GET
H/1.1 200
OK 532210.png
s3.amazonaws.com/cloudfront.shivtr.com/theme_images/ 115 B
566 B 440ms
252ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/theme_images/532210.png?1383940812
Requested by: Host: static.shivtr.com
URL: https://static.shivtr.com/css-cache/site_themes/614089-1687777479.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: b033555869a4e4bbf069af142ba979c054fcff8d0f4d83b14d99a71b9ab07ca2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:44 GMT
x-amz-version-id: null
Last-Modified: Fri, 08 Nov 2013 20:00:13 GMT
Server: AmazonS3
x-amz-request-id: K2PME55WPF9MW3ZG
ETag: "1b4f940be0a40f3f4ae32b79b4c8a418"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 115
x-amz-id-2: /9dD9ztyE31xpwSjowafuSEacaJT3S3wDGyrqB5xH+M5gHPwVPmxrewYnm1f8sd+yDDgy3WCL4U=
Expires: Mon, 05 May 2014 23:10:52 GMT

GET
H/1.1 200
OK 532211.png
s3.amazonaws.com/cloudfront.shivtr.com/theme_images/ 117 B
568 B 343ms
141ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/theme_images/532211.png?1383940814
Requested by: Host: static.shivtr.com
URL: https://static.shivtr.com/css-cache/site_themes/614089-1687777479.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 5e97fba31c1c44783c4852e361c7be30f2282ddcd4eb99dceb3ee9ca0aa94331

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:44 GMT
x-amz-version-id: null
Last-Modified: Fri, 08 Nov 2013 20:00:15 GMT
Server: AmazonS3
x-amz-request-id: K2PZHRKY9XHXNRZY
ETag: "7ba893c24882fc773894c658a5890c33"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 117
x-amz-id-2: BSmuXz6XSK1FX3p9BqXpSvW4IhrPtx7UMk9YZgKxCuigrKbSBZqu23iEPSK67pLswUQSL3QUMNU=
Expires: Mon, 05 May 2014 23:11:24 GMT

GET
H/1.1 200
OK 532209.png
s3.amazonaws.com/cloudfront.shivtr.com/theme_images/ 108 B
559 B 244ms
122ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/theme_images/532209.png?1383940812
Requested by: Host: static.shivtr.com
URL: https://static.shivtr.com/css-cache/site_themes/614089-1687777479.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 4817af49d2bea29e98e801b84209ed1623aeb8d5e90d1ca362b7966166fb5824

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:44 GMT
x-amz-version-id: null
Last-Modified: Fri, 08 Nov 2013 20:00:13 GMT
Server: AmazonS3
x-amz-request-id: K2PJNHZ3XPA35PS5
ETag: "1104b117d715aa58327a3a44467b49b9"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 108
x-amz-id-2: MVz5G4Co4ZXwOBwG2mDsgRZUeW4o2aYOPNXXt2CjMi8feb1IgYDUzcoVls31cn4eBiuL+11exR0=
Expires: Mon, 05 May 2014 23:11:24 GMT

GET
H/1.1 200
OK 532213.png
s3.amazonaws.com/cloudfront.shivtr.com/theme_images/ 147 B
598 B 187ms
135ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/theme_images/532213.png?1383940814
Requested by: Host: static.shivtr.com
URL: https://static.shivtr.com/css-cache/site_themes/614089-1687777479.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 444c4c7901307178ed2d1362b09d15f689d48c3a4bed4e7513431ce155dc5778

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:44 GMT
x-amz-version-id: null
Last-Modified: Fri, 08 Nov 2013 20:00:15 GMT
Server: AmazonS3
x-amz-request-id: K2PZ83PGV6ZH8M1E
ETag: "d7170d3aa6b438e090ecff1acacb540e"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 147
x-amz-id-2: W1wbbw05oUP6tY1zJEYnaBzTx64Yqloe2ak0IPtVBz8/atzrB5uaMyW6tVNiJnY91E1hbRvVIBc=
Expires: Mon, 05 May 2014 23:10:52 GMT

GET
H/1.1 200
OK 532214.png
s3.amazonaws.com/cloudfront.shivtr.com/theme_images/ 144 B
595 B 375ms
172ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/theme_images/532214.png?1383940816
Requested by: Host: static.shivtr.com
URL: https://static.shivtr.com/css-cache/site_themes/614089-1687777479.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 85e41af2f1124000f87c8a5caab08cd7568e2eeda71879c623fea4fbce4c469d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:44 GMT
x-amz-version-id: null
Last-Modified: Fri, 08 Nov 2013 20:00:17 GMT
Server: AmazonS3
x-amz-request-id: K2PQ5EBRY87BSFR1
ETag: "3f1d53e8dee0438ffac5f80923889582"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 144
x-amz-id-2: d+lCl2LhcgG5nic+ddE9mCaWQhoWV0D1L0/8BrrXdKnbNMXs4diIYzKzRFEsYEyq/FQLpevmFG4=
Expires: Mon, 05 May 2014 23:11:24 GMT

GET
H/1.1 200
OK 532212.png
s3.amazonaws.com/cloudfront.shivtr.com/theme_images/ 154 B
605 B 481ms
134ms Image
image/png 52.216.78.214
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.amazonaws.com/cloudfront.shivtr.com/theme_images/532212.png?1383940814
Requested by: Host: static.shivtr.com
URL: https://static.shivtr.com/css-cache/site_themes/614089-1687777479.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 52.216.78.214 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 0635d732c479b8b327cc7ef699d1983cf37dd191c0cb911134d7be5d595a2bb9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Date: Wed, 06 Mar 2024 04:53:44 GMT
x-amz-version-id: null
Last-Modified: Fri, 08 Nov 2013 20:00:15 GMT
Server: AmazonS3
x-amz-request-id: K2PKB19D1121E2WW
ETag: "9e1acdf4639abbc765ccea573e6335c3"
Content-Type: image/png
Cache-Control: max-age=864000
Accept-Ranges: bytes
Content-Length: 154
x-amz-id-2: KNxEgFPJ7Ee7AkH2/etsUn6UQ1AZMfp/rO8lkNUhjFYUdogVkvf8xzUthv613PrtivnoEsKTiiU=
Expires: Mon, 05 May 2014 23:11:17 GMT

GET
H2 200 universal.css
wow.zamimg.com/css/ 649 KB
44 KB 34ms
33ms Stylesheet
text/css 13.33.187.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://wow.zamimg.com/css/universal.css?19

Requested by

Host: wow.zamimg.com
URL: https://wow.zamimg.com/widgets/power.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.33.187.68 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-33-187-68.fra60.r.cloudfront.net

Software

Resource Hash

7109bd81801a56e6a2aa9671eade8495fea7107e38553c1800caf303dde5bb34

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 03:04:53 GMT
content-encoding: gzip
via: 1.1 d818b372f81cbe23bb149df5877c444a.cloudfront.net (CloudFront)
strict-transport-security: max-age=15724800; includeSubDomains
last-modified: Tue, 05 Mar 2024 23:29:31 GMT
x-amz-cf-pop: FRA60-P9
age: 6530
etag: W/"65e7aadb-a2488"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/css
cache-control: max-age=10800
x-amz-cf-id: T6hEh9v6447T147CLQ0ebzg3Zn8fV-AjG8pC4Q2AZ9Off_227I1irw==
expires: Wed, 06 Mar 2024 06:04:53 GMT

GET
DATA 200
OK truncated
/ 82 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7e41ca21e421f129d3881e345f990027b66c0ab3c5580e549575f9393d117cbd

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type: image/webp

GET
H2 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402290101/ 405 KB
137 KB 77ms
76ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402290101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-2367108048287515&plah=demonic-empire.shivtr.com&aplac=true

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7e40e9568b9cda5fa38f6cb2623a68d2ba5410cf50ccc7206fa2daa8182f8b36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:43 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 140470
x-xss-protection: 0
server: cafe
etag: 3570886079619747311
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 04:53:43 GMT

GET
H2 200 zrt_lookup_nohtml_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240304/r20190131/ Frame 80C9 9 KB
4 KB 87ms
21ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240304/r20190131/zrt_lookup_nohtml_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df7a397b8ce58f6251a395e02608b4f620e934a958bdfe6702c6f2033593eed0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://demonic-empire.shivtr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 34920
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4155
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Mar 2024 19:11:43 GMT
etag: 5035419970550746386
expires: Tue, 19 Mar 2024 19:11:43 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4A2B 345 KB
63 KB 480ms
479ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2367108048287515&output=html&adk=1812271804&adf=3025194257&lmt=1709700823&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&plas=260x810_l%7C260x810_r&format=0x0&url=https%3A%2F%2Fdemonic-empire.shivtr.com%2F&pra=5&wgl=1&easpi=0&asro=0&aseiel=1~2~4~6~8~9~10~11~12~13~14~15~16~17&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1709700823583&bpp=7&bdt=830&idt=278&shv=r20240304&mjsv=m202402290101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5743391807227&frm=20&pv=2&ga_vid=1350388314.1709700824&ga_sid=1709700824&ga_hid=847034209&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C95325257%2C44795921%2C95325752%2C95325974%2C95320376%2C95324160%2C95325784%2C95326935&oid=2&pvsid=2068325300587508&tmod=748581815&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=305

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402290101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-2367108048287515&plah=demonic-empire.shivtr.com&aplac=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d07e63487d8893ea65f1cb4da7973d1a538857717ad8dba6c8fed1cb588a4298

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://demonic-empire.shivtr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 64270
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Mar 2024 04:53:44 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 53ms
53ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&tn=DIV&id=status_bar_position&ign=false&pw=1600&ph=1200&x=0&y=0

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Mar 2024 04:53:43 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame ABB0 113 KB
39 KB 444ms
443ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2367108048287515&output=html&h=90&slotname=2876344136&adk=4229348686&adf=4046715466&pi=t.ma~as.2876344136&w=728&lmt=1709700823&format=728x90&url=https%3A%2F%2Fdemonic-empire.shivtr.com%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1709700823590&bpp=1&bdt=837&idt=308&shv=r20240304&mjsv=m202402290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5743391807227&frm=20&pv=1&ga_vid=1350388314.1709700824&ga_sid=1709700824&ga_hid=847034209&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=293&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C95325257%2C44795921%2C95325752%2C95325974%2C95320376%2C95324160%2C95325784%2C95326935&oid=2&pvsid=2068325300587508&tmod=748581815&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=314

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

af7a8d497304bd6b298030b06e50a4dc2e1e41fa7c2c6859affa77c92f068abf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://demonic-empire.shivtr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 39770
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Mar 2024 04:53:44 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css
fonts.googleapis.com/ Frame ABB0 4 KB
1 KB 100ms
30ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2367108048287515&output=html&h=90&slotname=2876344136&adk=4229348686&adf=4046715466&pi=t.ma~as.2876344136&w=728&lmt=1709700823&format=728x90&url=https%3A%2F%2Fdemonic-empire.shivtr.com%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1709700823590&bpp=1&bdt=837&idt=308&shv=r20240304&mjsv=m202402290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5743391807227&frm=20&pv=1&ga_vid=1350388314.1709700824&ga_sid=1709700824&ga_hid=847034209&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=293&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C95325257%2C44795921%2C95325752%2C95325974%2C95320376%2C95324160%2C95325784%2C95326935&oid=2&pvsid=2068325300587508&tmod=748581815&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=314

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

396bd1ab182a204c8c227c5d6aef6cbe3a3481500e816635b408da715695dfa1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 06 Mar 2024 04:53:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 06 Mar 2024 03:33:08 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 06 Mar 2024 04:53:44 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/ Frame ABB0 2 KB
822 B 26ms
25ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 01:23:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 12588
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Mar 2024 01:23:56 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/ Frame ABB0 23 KB
9 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8a33861cdc370b2db8442132658b06069640881bc90f369feca9b30c77e5f460

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 21:40:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25973
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8947
x-xss-protection: 0
server: cafe
etag: 12299188824252842506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Mar 2024 21:40:51 GMT

GET
H3 200 window_focus_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/ Frame ABB0 3 KB
1 KB 28ms
25ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 21:40:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25973
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Mar 2024 21:40:51 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/ Frame ABB0 20 KB
8 KB 30ms
26ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

535487d55c5cbf22bf933588a42e38efdc60bcbd42591420ed217db20cf423c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 00:58:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14140
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8212
x-xss-protection: 0
server: cafe
etag: 9277691884081322989
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Mar 2024 00:58:04 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame ABB0 207 KB
63 KB 36ms
32ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2aa131b334742b75fe3de815997b21d4783cea50a210783c0e243fb7d9d6eac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:40:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 773
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64050
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 05:40:51 GMT

GET
H2 200 eea50308dcf9de2b0c0fe89d3b5a5e83.js Show response
www.gstatic.com/mysidia/ Frame ABB0 36 KB
15 KB 83ms
23ms Script
text/javascript 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/eea50308dcf9de2b0c0fe89d3b5a5e83.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a86d26e0a9759e5d6b482f102d7cade65f3dbe4792972bd59caa9966b9ff568b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 04:05:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 175706
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15206
x-xss-protection: 0
last-modified: Wed, 28 Feb 2024 00:55:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 02 Jun 2024 04:05:18 GMT

GET
H2 200 6592766407814317453
tpc.googlesyndication.com/simgad/9119114932533656539/ Frame ABB0 14 KB
15 KB 81ms
21ms Image
image/jpeg 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9119114932533656539/6592766407814317453

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a36f65ba8424df56787d94cb8096a1e3943dd479df81d2f8892bbede37a96c85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Wed, 05 Mar 2025 08:51:24 GMT
date: Tue, 05 Mar 2024 08:51:24 GMT
x-content-type-options: nosniff
age: 72140
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14727
x-xss-protection: 0
last-modified: Sat, 18 Nov 2023 15:28:50 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 14763004658117789537
tpc.googlesyndication.com/simgad/2914349705548515401/ Frame ABB0 3 KB
3 KB 86ms
27ms Image
image/png 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/2914349705548515401/14763004658117789537?w=100&h=100&tw=1&q=75

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

37d5b07c436cfe35ab0ea2083b687e03cf6df5f288863c988f997e258b2a9751

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Tue, 04 Mar 2025 19:22:13 GMT
date: Mon, 04 Mar 2024 19:22:13 GMT
x-content-type-options: nosniff
age: 120691
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2705
x-xss-protection: 0
last-modified: Tue, 12 Dec 2023 15:45:05 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402290101/ 166 KB
56 KB 64ms
64ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202402290101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

61e9b17329f13fbae525515109fc97760f3d0b74684b075f09234fe6a3860a63

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:44 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57312
x-xss-protection: 0
server: cafe
etag: 7913099234616924241
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 04:53:44 GMT

GET
DATA 200
OK truncated
/ Frame ABB0 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 53487ad0a5a88b197291a6e37f5b5236b6b70684eb1b37e8aa9050bdfc4d058e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 54ms
53ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=4286354064884401&num=0&dvc=0&eid=44759875%2C44759926%2C44759837%2C95325257%2C44795921%2C95325752%2C95325974%2C95320376%2C95324160%2C95325784%2C95326935

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Mar 2024 04:53:44 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 56ms
54ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=4286354064884401&num=1&dvc=0&eid=44759875%2C44759926%2C44759837%2C95325257%2C44795921%2C95325752%2C95325974%2C95320376%2C95324160%2C95325784%2C95326935

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Mar 2024 04:53:44 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 55ms
53ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=4286354064884401&num=2&dvc=0&eid=44759875%2C44759926%2C44759837%2C95325257%2C44795921%2C95325752%2C95325974%2C95320376%2C95324160%2C95325784%2C95326935

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Mar 2024 04:53:44 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 57ms
55ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=4286354064884401&num=3&dvc=0&eid=44759875%2C44759926%2C44759837%2C95325257%2C44795921%2C95325752%2C95325974%2C95320376%2C95324160%2C95325784%2C95326935

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Mar 2024 04:53:44 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 57ms
56ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=4286354064884401&num=4&dvc=0&eid=44759875%2C44759926%2C44759837%2C95325257%2C44795921%2C95325752%2C95325974%2C95320376%2C95324160%2C95325784%2C95326935

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Mar 2024 04:53:44 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 57ms
56ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=4286354064884401&num=5&dvc=0&eid=44759875%2C44759926%2C44759837%2C95325257%2C44795921%2C95325752%2C95325974%2C95320376%2C95324160%2C95325784%2C95326935

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Mar 2024 04:53:44 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 57ms
56ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_exclusion_zone&typ=noex&cor=3164153554034957&num=0&dvc=0&eid=44759875%2C44759926%2C44759837%2C95325257%2C44795921%2C95325752%2C95325974%2C95320376%2C95324160%2C95325784%2C95326935

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Mar 2024 04:53:44 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A830 113 KB
39 KB 274ms
273ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2367108048287515&output=html&h=280&adk=3809598800&adf=1604629528&pi=t.aa~a.1182920990~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1709700824&rafmt=1&to=qs&pwprc=9183188665&format=1200x280&url=https%3A%2F%2Fdemonic-empire.shivtr.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1709700824564&bpp=2&bdt=1811&idt=-M&shv=r20240304&mjsv=m202402290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=2&correlator=5743391807227&frm=20&pv=1&ga_vid=1350388314.1709700824&ga_sid=1709700824&ga_hid=847034209&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1737&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C95325257%2C44795921%2C95325752%2C95325974%2C95320376%2C95324160%2C95325784%2C95326935&oid=2&pvsid=2068325300587508&tmod=748581815&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=9

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4886f61c850f335aa921f14e1d6203403c69dd7a8dcfbbb5974f92f698a192bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://demonic-empire.shivtr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 39541
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Mar 2024 04:53:44 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 1A9F 574 B
323 B 113ms
112ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2367108048287515&output=html&h=90&adk=1152246153&adf=513501529&pi=t.aa~a.2817085865~rp.3&w=1000&fwrn=4&fwrnh=100&lmt=1709700824&rafmt=1&to=qs&pwprc=9183188665&format=1000x90&url=https%3A%2F%2Fdemonic-empire.shivtr.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1709700824564&bpp=1&bdt=1811&idt=0&shv=r20240304&mjsv=m202402290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90%2C1200x280&nras=3&correlator=5743391807227&frm=20&pv=1&ga_vid=1350388314.1709700824&ga_sid=1709700824&ga_hid=847034209&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=300&ady=1637&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C95325257%2C44795921%2C95325752%2C95325974%2C95320376%2C95324160%2C95325784%2C95326935&oid=2&pvsid=2068325300587508&tmod=748581815&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=15

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

915d9e5035eb445e27bc5b633b1e76b54482d0f567f3ee20b864e966c96e0fe1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://demonic-empire.shivtr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 303
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Mar 2024 04:53:44 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 55ms
54ms Image
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ama_success&c=2&wpc=ca-pub-2367108048287515&warn=13&w=1600&h=1200&pp=0&ppp=0&eatf=false&eatfAbg=true&reatf=true&a=6%2C1%2C5%2C7&apv=20240304_093954&sat=1709634376092&afm=0&as_count=1&d_count=0&ng_count=0&am_count=2&atf_count=1&mdns=0.044&alldns=0.227&allp=16&fd=(0%2C16%2C6)%2C(1%2C0%2C0)%2C(2%2C0%2C0)&pgh=2027&abl=false&rr=n&su=demonic-empire.shivtr.com&pvc=2068325300587508&r=0.1&eid=44759875%2C44759926%2C44759837%2C95325257%2C44795921%2C95325752%2C95325974%2C95320376%2C95324160%2C95325784%2C95326935

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Mar 2024 04:53:44 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame ABB0 15 KB
16 KB 91ms
29ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 20:16:13 GMT
x-content-type-options: nosniff
age: 117451
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 04 Mar 2025 20:16:13 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame ABB0 15 KB
16 KB 81ms
22ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 05:37:46 GMT
x-content-type-options: nosniff
age: 83758
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Mar 2025 05:37:46 GMT

GET
H3 200 zrt_lookup_nohtml_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240304/r20110914/ Frame F9C5 9 KB
4 KB 22ms
21ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240304/r20110914/zrt_lookup_nohtml_fy2021.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df7a397b8ce58f6251a395e02608b4f620e934a958bdfe6702c6f2033593eed0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://demonic-empire.shivtr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 34783
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4155
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Mar 2024 19:14:01 GMT
etag: 5035419970550746386
expires: Tue, 19 Mar 2024 19:14:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_nohtml_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240304/r20110914/ Frame 6A17 9 KB
4 KB 22ms
21ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240304/r20110914/zrt_lookup_nohtml_fy2021.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df7a397b8ce58f6251a395e02608b4f620e934a958bdfe6702c6f2033593eed0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://demonic-empire.shivtr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 34783
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4155
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Mar 2024 19:14:01 GMT
etag: 5035419970550746386
expires: Tue, 19 Mar 2024 19:14:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_nohtml_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20240304/r20110914/ Frame 6546 9 KB
4 KB 24ms
23ms Document
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20240304/r20110914/zrt_lookup_nohtml_fy2021.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

df7a397b8ce58f6251a395e02608b4f620e934a958bdfe6702c6f2033593eed0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://demonic-empire.shivtr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 34783
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4155
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Mar 2024 19:14:01 GMT
etag: 5035419970550746386
expires: Tue, 19 Mar 2024 19:14:01 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame F9C5 5 KB
767 B 35ms
34ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240304/r20110914/zrt_lookup_nohtml_fy2021.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

47ce859f7f0f545825c8ab983547bbf88d0de3f52afebc7a1ccc0611661df70d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 06 Mar 2024 04:53:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 06 Mar 2024 04:08:34 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 06 Mar 2024 04:53:44 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame C95D 2 KB
564 B 31ms
31ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Poppins%3A400%2C600

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6700a61b5bd8006d07ddcdf84df499411e0ca045c8e124af25f72b8c4e82dab3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 06 Mar 2024 04:53:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 06 Mar 2024 04:12:29 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 06 Mar 2024 04:53:44 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/ Frame C95D 2 KB
822 B 23ms
22ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 01:23:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 12588
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Mar 2024 01:23:56 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/ Frame C95D 23 KB
9 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/abg_lite_fy2021.js

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8a33861cdc370b2db8442132658b06069640881bc90f369feca9b30c77e5f460

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 21:40:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25973
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8947
x-xss-protection: 0
server: cafe
etag: 12299188824252842506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Mar 2024 21:40:51 GMT

GET
H3 200 window_focus_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/ Frame C95D 3 KB
1 KB 27ms
24ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/window_focus_fy2021.js

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 21:40:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25973
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Mar 2024 21:40:51 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/ Frame C95D 20 KB
8 KB 27ms
23ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

535487d55c5cbf22bf933588a42e38efdc60bcbd42591420ed217db20cf423c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 00:58:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14140
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8212
x-xss-protection: 0
server: cafe
etag: 9277691884081322989
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Mar 2024 00:58:04 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame C95D 207 KB
63 KB 28ms
24ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2aa131b334742b75fe3de815997b21d4783cea50a210783c0e243fb7d9d6eac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:40:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 773
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64050
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 05:40:51 GMT

GET
H2 200 eea50308dcf9de2b0c0fe89d3b5a5e83.js Show response
www.gstatic.com/mysidia/ Frame C95D 36 KB
15 KB 27ms
23ms Script
text/javascript 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/eea50308dcf9de2b0c0fe89d3b5a5e83.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a86d26e0a9759e5d6b482f102d7cade65f3dbe4792972bd59caa9966b9ff568b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 04:05:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 175706
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15206
x-xss-protection: 0
last-modified: Wed, 28 Feb 2024 00:55:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 02 Jun 2024 04:05:18 GMT

GET
H3 200 fullscreen_api_adapter_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/elements/html/ Frame F9C5 15 KB
6 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240304/r20110914/zrt_lookup_nohtml_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5a1433553dad10b1617e945447ce8d2a7a4ce6542ad50fdb8b563f85560cbc3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 19:03:29 GMT
content-encoding: br
x-content-type-options: nosniff
age: 35415
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6454
x-xss-protection: 0
server: cafe
etag: 9518204868993021864
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Mar 2024 19:03:29 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame F9C5 205 B
295 B 27ms
26ms Image
image/png 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240304/r20110914/zrt_lookup_nohtml_fy2021.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 19:32:20 GMT
x-content-type-options: nosniff
age: 120084
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 04 Mar 2025 19:32:20 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame F9C5 604 B
919 B 26ms
25ms Image
image/png 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240304/r20110914/zrt_lookup_nohtml_fy2021.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 08:52:35 GMT
x-content-type-options: nosniff
age: 72069
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 05 Mar 2025 08:52:35 GMT

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/elements/html/ Frame F9C5 22 KB
9 KB 29ms
28ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240304/r20110914/zrt_lookup_nohtml_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5efd17aa9600929f5517878dd267b6fdfeca37478d6987b5d75caec4f1e4b1a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 07:34:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 76775
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9093
x-xss-protection: 0
server: cafe
etag: 981128176822753981
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Mar 2024 07:34:09 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame ABB0 0
0 56ms
56ms Fetch
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CxiMi1_bnZdLAOLah9u8PjcyF4Airmuufdsmt8LnCEmQQASDYoKYEYJWCgICYB6AB3fCqwCrIAQmoAwHIA8sEqgThAU_QQfVLuxORgpMYKsY4IWs7AGRHqIyyQ54GeNKi3js0-0SNO8BDQ7QIlhRcXvdDBGdow-O3eJxSjWYaSvFArXJ7f7v-nVrZZ8dLPCsF5-YOoOcy-TozN129zL8HJAz9V_-sjvIq-B4DbNlEnLQi_LBJSqhRquNexkSXxI_ErySmjaPS88EVPQTQCi1eAFU7bTT0xvPU5C6_mJYelGeEGJTiTD3Vli2G0LmcaAQTmaFfIRF_QucvvDvhwhSvEXVQ-sl-j01DvH4Bxh5SYTZWVmTD1-ecrQCycsvTHKmg2DxORMAE367-q78EiAWS0PG6TZIFBAgEGAGSBQQIBRgEoAYugAfdqPufBagH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6--sQKoB9XJG6gHpr4b2AcA8gcEEI-lDdIIKwiR4YBwEAEYHzIH64uA4L-ADToJgECAgICAgJQoSL39wTpY_O2g8uvehAOaCaUBaHR0cHM6Ly9wZGZpeGVycy5jb20vZG93bmxvYWRGaXhlci5odG1sP2NhbXBhaWduX2lkPTIwNzkzMDI2NTc4JmFkZ3JvdXBfaWQ9MTU0NDQyNjM1MTAzJnBsYWNlbWVudF9pZD1kZW1vbmljLWVtcGlyZS5zaGl2dHIuY29tJmNyZWF0aXZlX2lkPTY5MTM5ODU1MjYyNCZjb25zZW50PXtlZWF9gAoByAsBuBPkA9gTDIgUA9AVAZgWAYAXAbIXHAoaCAASFHB1Yi0yMzY3MTA4MDQ4Mjg3NTE1GAA&sigh=p-dtX0E5eW8&uach_m=%5BUACH%5D&ase=2&template_id=484&cbvp=2&vis=1&nis=5

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2367108048287515&output=html&h=90&slotname=2876344136&adk=4229348686&adf=4046715466&pi=t.ma~as.2876344136&w=728&lmt=1709700823&format=728x90&url=https%3A%2F%2Fdemonic-empire.shivtr.com%2F&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1709700823590&bpp=1&bdt=837&idt=308&shv=r20240304&mjsv=m202402290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5743391807227&frm=20&pv=1&ga_vid=1350388314.1709700824&ga_sid=1709700824&ga_hid=847034209&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=436&ady=293&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C95325257%2C44795921%2C95325752%2C95325974%2C95320376%2C95324160%2C95325784%2C95326935&oid=2&pvsid=2068325300587508&tmod=748581815&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=314
Attribution-Reporting-Eligible: event-source
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 06 Mar 2024 04:53:44 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame ED8F 55 KB
21 KB 160ms
75ms Document
text/html 2a02:2638:3::12
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Zef21wAN9ckH_ZuhAA3X0IKoON1BoPBG26WV2w&u=%7C%2Bw%2BsJbBej4oyb1zHQ7FbJ3Ai92A%2BeAHhprrw4ERZUS8%3D%7C&c1=jWCgqsKSUoWKRvDssmEQ3dRte9oWhU873PslWXxlgwqBkwvNjl8q6e-4vOkZyr-tuWKbg6CJmKWOyQl4xhWEpmV2nJHJuXlGgiWEq9cM7a-8O7zYkRCTdWgTqnXsTnnbkyC6HzUTlUAEU9xtfgSmaqC-MfrodTiJXfrIJuGJx8NLMXHt05u0Y4sTdAz2FQgs1X0SYdjGQPtKp1eMF1bFuUov2m2NpeYkKslFmISlZP1-NWBU4ThoWXCOyNDacBH0Oh0owpiznSoDR2n0NhAHw0VhEuvY46GRsYS_6BBY34NtwT9PfIKL95ParOM8QjGItfqivx3V-0ogip2Olexp44ejC7rk_f7SKDKXIdY3h9sZuTpOrgv7nLtZCVcw4_B-kNIGZWF0fVQRMQFSKnxMWIurhFXEmPivUNRWOQQdvvuTI8CM2hpZ0j5eW83u7HvFUOUfStWiMwinMBcXe_9P-2LlMGUmsbibGhLnEPyjGhwKLj6yYcYvz25QL5YRV2dpZiAQnRt2_4UpsXawSB_cdQmv7NO7n5O-UmbIpr998FS-ThYMqzmVaj3BWOo7MTd7Qls_ab_SKPsm12K7XsywrJC6iIqQ4h99lD5MI_4Ht-GodwsYb7XtDyMEl3s7BWlpzOUeZgrmYNn-fa9mUaGcyw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCkE-O1_bnZcnrN6G39u8P0K-3QMme0rFc1Z2R93DAjbcBEAEgAGCVgoCAmAeCARdjYS1wdWItMjM2NzEwODA0ODI4NzUxNcgBCakCH1NzF942sj6oAwHIAwKqBNYBT9DvhK5q2WArRR7KBiO0-FFM73OBHHhYGSfHDFvG6TnCI4y9-EEPrzq7Znazzct8Ez8pZ2euSUXa1CjC5dbKwHw_KcmaYJz9qYfhy5s826q3vUOo34SsdjbKUpR0BhVL8XkWgVJIddS6OMtOAEs7pBttaudQq2ONso7a8aIrGdS-aPwTN66-uMVqMGAdPG5mFOp9aoUQs8nTKKRwdCzkePAVyDuLp9NQK8IayC1UMe5PSkx8O8CjuZRq79FkY4qEJaHho9PQZUZWL503cNox-uh9ZpqnMoAG_4XPw_jnr_dHoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAqgHrb6xAtgHANIIKQiR4YBwEAEyB-uLgOC_gA06CYBAgICAgICUKEi9_cE6WICToPLr3oQD-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1EyHj-zVb-7AoTV5VRKwKbke1K0A%26client%3Dca-pub-2367108048287515%26adurl%3D

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::12 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

14d7c0f9c35c7e60ebea4f2a0c5fa12195868621683e588b2c5034f43cbe9d9d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Wed, 06 Mar 2024 04:53:44 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=IABeGaSPIGgscu5-mYGXF8lTsQdyG0ldqzFj6L79Lp5luDFODlt0pNLDQ91oLfyCBzFSd04NJS4jbdvcV_lvJ4Ay5xfo44FMxdyPCTrr7TJ4VTaIK2tueXYixhT4d2MlOXHG4MDO1DWXC1sOt0uw-RQ1eG7vZ08YdBZZdEXiIobaSiG5Mu1xc4ZL5uGzyxuIl9WUxTo0JfWvkZSc3P4f1HeaL9kh09ASboXBH-buONxDHsZvz5uuTXb-XAUiid1dU-eRJA"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 3386539
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 window_focus_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/ Frame CF3B 3 KB
1 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/window_focus_fy2021.js

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 21:40:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25973
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Mar 2024 21:40:51 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/ Frame CF3B 20 KB
8 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

535487d55c5cbf22bf933588a42e38efdc60bcbd42591420ed217db20cf423c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 00:58:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14140
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8212
x-xss-protection: 0
server: cafe
etag: 9277691884081322989
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Mar 2024 00:58:04 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame CF3B 207 KB
63 KB 28ms
26ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2aa131b334742b75fe3de815997b21d4783cea50a210783c0e243fb7d9d6eac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:40:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 773
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64050
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 05:40:51 GMT

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 400F 171 KB
52 KB 171ms
104ms Document
text/html 2a02:2638:3::12
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Zef21wAN9coH_ZuhAA3X0EWvFd_Qj8pufazauQ&u=%7C%2Bw%2BsJbBej4o5%2BlnN0POBkebnuRz17ltqXDuDpCbIda8%3D%7C&c1=jWCgqsKSUoWKRvDssmEQ3dRte9oWhU873PslWXxlgwqBkwvNjl8q6e-4vOkZyr-tuWKbg6CJmKWOyQl4xhWEpmV2nJHJuXlGVbQKOBzD9N3WsSoSaoPOG6J9AO7Y8FBsqWd7x8jd-78c849e_mfN3-HRxVnriK6hTIblzE-A9qxi36xcIYc1rWDVPD7Aq10yHd1IuwopainJGSZmkIviTom-IwrPitFD5f157Gpk6Cwrm1cvNzouQxYKGZQ0yoEhnWF-TeBqAS_A8LzKRT37AmkGXg11H5Q-uC4Xpg7MExkGxqHhONVk9yWLAYSJqJ2AH3_pLu2DLr1_26PF6_vG21Fikl98UqhadNqwOSHfje5hfRIkjwcgn6znhc5ZJnpMWTfRLDib5RGsOGzZtwH8K6ahaRoV76w0M4HEXPriv7vWSEwlD9apFLJ-WPd5wakfONIoRJWif4OZXqqkI0B7Tp0fy7RcqA4TGMVwwibvl6HculGONFOj3UhgvV9434gJRZbyeHoRLsFCYlVhiel2_vLKEqu-KadET1wr5_T9QDThY9uhpPVp3XB7ydziRHlpAtzdvLVo57Ssf92zbRCArnBT2ld0gQNUQE4DUdbP7br2W1GK5hWciTnKfMgCqngkpuEPa5wIMYE&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCOilO1_bnZcrrN6G39u8P0K-3QMme0rFcxYyL4JoBwI23ARABIABglYKAgJgHggEXY2EtcHViLTIzNjcxMDgwNDgyODc1MTXIAQmpAh9TcxfeNrI-qAMByAMCqgTWAU_QBorzKW4Z4nEqy5F922Ds8XKsknFyWhzan2ZKBqiFOk1ZaheIWANksSmp6w1JMoCJZsotspCKFB0aqOa7qIW8brHqn1Ga3JcoHU8O53WMtPfrQ4i9G_9JcD71hpCIQO489W762stGLe1UEXyrTsSOHqyYsUE9GP3MJN4PVka2nZsB03206-RFydNWfBuBjt-IIiKKefWq4EuoHiQGlyfpJXvAtlHj8j4P4lMPV-UuWVQBQBDAknFM2Q7r3pAv3-mpDYNpS5OlCBxOAl9N3XWzGK91T52ABsDmwvjNiYTb8gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7ECqAetvrEC2AcA0ggpCJHhgHAQATIH64uA4L-ADToJgECAgICAgJQoSL39wTpYgJOg8uvehAP6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1igwS17NIfLhOkwT2VeKikeC8hNw%26client%3Dca-pub-2367108048287515%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240304/r20110914/zrt_lookup_nohtml_fy2021.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::12 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

76ebe4f3c80b681258c1968d5acfe9d2c91872b06cbde742d1311ed64086e037

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Wed, 06 Mar 2024 04:53:44 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=9NebbKSPIGgscu5-yI42vfYWE63BILIsK_fl50QOuEZFo6m5TtCBCq-lOIqUwvqiJqPc-a4mmFLCeVK_x6e_EHzMNekysC4aZ1xSHfc96rhAaE3gIy6CCzjFzkYd4FaTlM_eE4xGcwnKWjXBRHIuyCpc_mV-Gj1QKLUGxmAcrqiq_Fa7hrFrWWExJ2nt-HyIquo7AA0o-sNfL3UQ0AI5aRlVivFgBS1u5B6YGeI0pH8bmosxmlBkItEXSYUDKX9PI9Fq_w"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 51534819
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 window_focus_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/ Frame 6546 3 KB
1 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240304/r20110914/zrt_lookup_nohtml_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 21:40:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25973
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Mar 2024 21:40:51 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/ Frame 6546 20 KB
8 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240304/r20110914/zrt_lookup_nohtml_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

535487d55c5cbf22bf933588a42e38efdc60bcbd42591420ed217db20cf423c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 00:58:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14140
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8212
x-xss-protection: 0
server: cafe
etag: 9277691884081322989
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Mar 2024 00:58:04 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame 6546 207 KB
63 KB 29ms
28ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20240304/r20110914/zrt_lookup_nohtml_fy2021.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2aa131b334742b75fe3de815997b21d4783cea50a210783c0e243fb7d9d6eac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:40:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 773
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64050
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 05:40:51 GMT

GET
H3 200 neFZPoS4RqR4jfdTFmgUuiCC8zWeQsTNscPgsnGRUhI.js Show response
pagead2.googlesyndication.com/bg/ Frame 7888 51 KB
20 KB 43ms
43ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/neFZPoS4RqR4jfdTFmgUuiCC8zWeQsTNscPgsnGRUhI.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9de1593e84b846a4788df753166814ba2082f3359e42c4cdb1c3e0b271915212

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 21:52:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 111651
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20184
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 11:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Mar 2025 21:52:53 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame A830 4 KB
679 B 33ms
29ms Stylesheet
text/css 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2367108048287515&output=html&h=280&adk=3809598800&adf=1604629528&pi=t.aa~a.1182920990~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1709700824&rafmt=1&to=qs&pwprc=9183188665&format=1200x280&url=https%3A%2F%2Fdemonic-empire.shivtr.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1709700824564&bpp=2&bdt=1811&idt=-M&shv=r20240304&mjsv=m202402290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=2&correlator=5743391807227&frm=20&pv=1&ga_vid=1350388314.1709700824&ga_sid=1709700824&ga_hid=847034209&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1737&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C95325257%2C44795921%2C95325752%2C95325974%2C95320376%2C95324160%2C95325784%2C95326935&oid=2&pvsid=2068325300587508&tmod=748581815&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=9

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8753541a3a44842cd815d81c4f8c589e0a0d763112d622f3088cd6f064e825fd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 06 Mar 2024 04:53:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 06 Mar 2024 03:13:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 06 Mar 2024 04:53:44 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/ Frame A830 2 KB
822 B 26ms
22ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 01:23:56 GMT
content-encoding: br
x-content-type-options: nosniff
age: 12588
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Mar 2024 01:23:56 GMT

GET
H3 200 abg_lite_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/ Frame A830 23 KB
9 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8a33861cdc370b2db8442132658b06069640881bc90f369feca9b30c77e5f460

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 21:40:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25973
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8947
x-xss-protection: 0
server: cafe
etag: 12299188824252842506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Mar 2024 21:40:51 GMT

GET
H3 200 window_focus_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/ Frame A830 3 KB
1 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 21:40:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 25973
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Mar 2024 21:40:51 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/ Frame A830 20 KB
8 KB 26ms
23ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20240304/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

535487d55c5cbf22bf933588a42e38efdc60bcbd42591420ed217db20cf423c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 00:58:04 GMT
content-encoding: br
x-content-type-options: nosniff
age: 14140
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8212
x-xss-protection: 0
server: cafe
etag: 9277691884081322989
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Mar 2024 00:58:04 GMT

GET
H3 200 ufs_web_display.js Show response
pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ Frame A830 207 KB
63 KB 26ms
24ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2aa131b334742b75fe3de815997b21d4783cea50a210783c0e243fb7d9d6eac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:40:51 GMT
content-encoding: br
x-content-type-options: nosniff
age: 773
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64050
x-xss-protection: 0
server: cafe
etag
vary: Accept-Encoding
content-type: text/javascript; charset=ISO-8859-1
cache-control: public, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 06 Mar 2024 05:40:51 GMT

GET
H3 200 eea50308dcf9de2b0c0fe89d3b5a5e83.js Show response
www.gstatic.com/mysidia/ Frame A830 36 KB
15 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/eea50308dcf9de2b0c0fe89d3b5a5e83.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a86d26e0a9759e5d6b482f102d7cade65f3dbe4792972bd59caa9966b9ff568b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 04:05:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 175706
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15206
x-xss-protection: 0
last-modified: Wed, 28 Feb 2024 00:55:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 02 Jun 2024 04:05:18 GMT

GET
H3 200 neFZPoS4RqR4jfdTFmgUuiCC8zWeQsTNscPgsnGRUhI.js Show response
pagead2.googlesyndication.com/bg/ Frame A405 51 KB
20 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/neFZPoS4RqR4jfdTFmgUuiCC8zWeQsTNscPgsnGRUhI.js

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9de1593e84b846a4788df753166814ba2082f3359e42c4cdb1c3e0b271915212

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 21:52:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 111651
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20184
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 11:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Mar 2025 21:52:53 GMT

GET
H2 200 14763004658117789537
tpc.googlesyndication.com/simgad/9119114932533656539/ Frame A830 11 KB
11 KB 24ms
22ms Image
image/jpeg 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/9119114932533656539/14763004658117789537?w=600&h=314&tw=1&q=75

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

81964aadd4e436a03b58c2f6597af6aa079f349d773bce3f7d1d229f4f6cd451

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Thu, 06 Mar 2025 01:53:21 GMT
date: Wed, 06 Mar 2024 01:53:21 GMT
x-content-type-options: nosniff
age: 10823
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11388
x-xss-protection: 0
last-modified: Sat, 18 Nov 2023 15:29:27 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 14763004658117789537
tpc.googlesyndication.com/simgad/2914349705548515401/ Frame A830 3 KB
3 KB 22ms
21ms Image
image/png 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/2914349705548515401/14763004658117789537?w=100&h=100&tw=1&q=75

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

37d5b07c436cfe35ab0ea2083b687e03cf6df5f288863c988f997e258b2a9751

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

expires: Tue, 04 Mar 2025 19:22:13 GMT
date: Mon, 04 Mar 2024 19:22:13 GMT
x-content-type-options: nosniff
age: 120691
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2705
x-xss-protection: 0
last-modified: Tue, 12 Dec 2023 15:45:05 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
allow-fenced-frame-automatic-beacons: true

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame ED8F 2 KB
1 KB 153ms
72ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Zef21wAN9ckH_ZuhAA3X0IKoON1BoPBG26WV2w&u=%7C%2Bw%2BsJbBej4oyb1zHQ7FbJ3Ai92A%2BeAHhprrw4ERZUS8%3D%7C&c1=jWCgqsKSUoWKRvDssmEQ3dRte9oWhU873PslWXxlgwqBkwvNjl8q6e-4vOkZyr-tuWKbg6CJmKWOyQl4xhWEpmV2nJHJuXlGgiWEq9cM7a-8O7zYkRCTdWgTqnXsTnnbkyC6HzUTlUAEU9xtfgSmaqC-MfrodTiJXfrIJuGJx8NLMXHt05u0Y4sTdAz2FQgs1X0SYdjGQPtKp1eMF1bFuUov2m2NpeYkKslFmISlZP1-NWBU4ThoWXCOyNDacBH0Oh0owpiznSoDR2n0NhAHw0VhEuvY46GRsYS_6BBY34NtwT9PfIKL95ParOM8QjGItfqivx3V-0ogip2Olexp44ejC7rk_f7SKDKXIdY3h9sZuTpOrgv7nLtZCVcw4_B-kNIGZWF0fVQRMQFSKnxMWIurhFXEmPivUNRWOQQdvvuTI8CM2hpZ0j5eW83u7HvFUOUfStWiMwinMBcXe_9P-2LlMGUmsbibGhLnEPyjGhwKLj6yYcYvz25QL5YRV2dpZiAQnRt2_4UpsXawSB_cdQmv7NO7n5O-UmbIpr998FS-ThYMqzmVaj3BWOo7MTd7Qls_ab_SKPsm12K7XsywrJC6iIqQ4h99lD5MI_4Ht-GodwsYb7XtDyMEl3s7BWlpzOUeZgrmYNn-fa9mUaGcyw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCkE-O1_bnZcnrN6G39u8P0K-3QMme0rFc1Z2R93DAjbcBEAEgAGCVgoCAmAeCARdjYS1wdWItMjM2NzEwODA0ODI4NzUxNcgBCakCH1NzF942sj6oAwHIAwKqBNYBT9DvhK5q2WArRR7KBiO0-FFM73OBHHhYGSfHDFvG6TnCI4y9-EEPrzq7Znazzct8Ez8pZ2euSUXa1CjC5dbKwHw_KcmaYJz9qYfhy5s826q3vUOo34SsdjbKUpR0BhVL8XkWgVJIddS6OMtOAEs7pBttaudQq2ONso7a8aIrGdS-aPwTN66-uMVqMGAdPG5mFOp9aoUQs8nTKKRwdCzkePAVyDuLp9NQK8IayC1UMe5PSkx8O8CjuZRq79FkY4qEJaHho9PQZUZWL503cNox-uh9ZpqnMoAG_4XPw_jnr_dHoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAqgHrb6xAtgHANIIKQiR4YBwEAEyB-uLgOC_gA06CYBAgICAgICUKEi9_cE6WICToPLr3oQD-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_1EyHj-zVb-7AoTV5VRKwKbke1K0A%26client%3Dca-pub-2367108048287515%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 01 Mar 2025 04:53:45 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame ED8F 2 KB
1 KB 154ms
74ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 01 Mar 2025 04:53:45 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame ED8F 308 B
636 B 159ms
123ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sat, 01 Mar 2025 04:53:45 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame ED8F 293 B
621 B 155ms
120ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sat, 01 Mar 2025 04:53:45 GMT

GET
H2 200 lg.php
cat.nl3.eu.criteo.com/delivery/ Frame ED8F 43 B
348 B 114ms
36ms Image
image/gif 178.250.1.6
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl3.eu.criteo.com/delivery/lg.php?cppv=3&cpp=sw2Dml-90d1-tkO-jlBS_zxbK8nBDBi6TpIjE9loX46W9MVxHLDZux7opnKCAx1J0g-_eCc2EUdgBbDK7p9PjSFLg4tXvf_13PWxnNYCS7vLxTQgww3W1B8AABguYD_n503EuR9h0XCulV6-vQlvuvSP71tq_F4ZH8J_FsAFgZg4_EQW3t7f1hKbiJrZp-8WIXGjdXpdazPtXl06cNJu_7XQtvIm6eNL944XuHGFDr71V7bFnndpdv7XyHQlnsn1OszwD8Im_--ZjeWXNdnWSNgsxAj64PShndTmpBv3eVi7DAg9EEnosUcbshTKYkrMK7GVJexxiXiXB377m42EiVNtBob4-13Y-Kdvf71MJAod5-xIbasN74DBD315hlsjNmQBn6YL7IRAvDZ99D8E-w2uPg09uHSaHTQt8aIk_ht9opOOFeJR6JF0tvbioLUTjf63jQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.6 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Mar 2024 04:53:45 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1524902
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 7dabf8ae0b8c40c2b9eaba02f157e933_image_ad_160x600.gif
static.criteo.net/design/dt/9292/5323939/ Frame ED8F 61 KB
62 KB 112ms
77ms Image
image/gif 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/design/dt/9292/5323939/7dabf8ae0b8c40c2b9eaba02f157e933_image_ad_160x600.gif

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0eb2f5b19c357a2b43e65bb70af5e52d4a87eda535042fa711b334dfaca4a2f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 29 Feb 2024 13:21:29 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "65e084d9-f51f"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 62751
expires: Sat, 01 Mar 2025 04:53:45 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 400F 2 KB
1 KB 164ms
124ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Zef21wAN9coH_ZuhAA3X0EWvFd_Qj8pufazauQ&u=%7C%2Bw%2BsJbBej4o5%2BlnN0POBkebnuRz17ltqXDuDpCbIda8%3D%7C&c1=jWCgqsKSUoWKRvDssmEQ3dRte9oWhU873PslWXxlgwqBkwvNjl8q6e-4vOkZyr-tuWKbg6CJmKWOyQl4xhWEpmV2nJHJuXlGVbQKOBzD9N3WsSoSaoPOG6J9AO7Y8FBsqWd7x8jd-78c849e_mfN3-HRxVnriK6hTIblzE-A9qxi36xcIYc1rWDVPD7Aq10yHd1IuwopainJGSZmkIviTom-IwrPitFD5f157Gpk6Cwrm1cvNzouQxYKGZQ0yoEhnWF-TeBqAS_A8LzKRT37AmkGXg11H5Q-uC4Xpg7MExkGxqHhONVk9yWLAYSJqJ2AH3_pLu2DLr1_26PF6_vG21Fikl98UqhadNqwOSHfje5hfRIkjwcgn6znhc5ZJnpMWTfRLDib5RGsOGzZtwH8K6ahaRoV76w0M4HEXPriv7vWSEwlD9apFLJ-WPd5wakfONIoRJWif4OZXqqkI0B7Tp0fy7RcqA4TGMVwwibvl6HculGONFOj3UhgvV9434gJRZbyeHoRLsFCYlVhiel2_vLKEqu-KadET1wr5_T9QDThY9uhpPVp3XB7ydziRHlpAtzdvLVo57Ssf92zbRCArnBT2ld0gQNUQE4DUdbP7br2W1GK5hWciTnKfMgCqngkpuEPa5wIMYE&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCOilO1_bnZcrrN6G39u8P0K-3QMme0rFcxYyL4JoBwI23ARABIABglYKAgJgHggEXY2EtcHViLTIzNjcxMDgwNDgyODc1MTXIAQmpAh9TcxfeNrI-qAMByAMCqgTWAU_QBorzKW4Z4nEqy5F922Ds8XKsknFyWhzan2ZKBqiFOk1ZaheIWANksSmp6w1JMoCJZsotspCKFB0aqOa7qIW8brHqn1Ga3JcoHU8O53WMtPfrQ4i9G_9JcD71hpCIQO489W762stGLe1UEXyrTsSOHqyYsUE9GP3MJN4PVka2nZsB03206-RFydNWfBuBjt-IIiKKefWq4EuoHiQGlyfpJXvAtlHj8j4P4lMPV-UuWVQBQBDAknFM2Q7r3pAv3-mpDYNpS5OlCBxOAl9N3XWzGK91T52ABsDmwvjNiYTb8gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7ECqAetvrEC2AcA0ggpCJHhgHAQATIH64uA4L-ADToJgECAgICAgJQoSL39wTpYgJOg8uvehAP6CwIIAYAMAdAVAYAXAQ%26num%3D1%26sig%3DAOD64_1igwS17NIfLhOkwT2VeKikeC8hNw%26client%3Dca-pub-2367108048287515%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 01 Mar 2025 04:53:45 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 400F 2 KB
1 KB 164ms
125ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 01 Mar 2025 04:53:45 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 400F 308 B
636 B 143ms
121ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sat, 01 Mar 2025 04:53:45 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 400F 293 B
621 B 142ms
120ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sat, 01 Mar 2025 04:53:45 GMT

GET
H2 200 lg.php
cat.nl3.eu.criteo.com/delivery/ Frame 400F 43 B
347 B 101ms
36ms Image
image/gif 178.250.1.6
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.nl3.eu.criteo.com/delivery/lg.php?cppv=3&cpp=TwFD8ES6QcixGzHSLci8L7keuyoh7etiRb8-N2q0M83VtSvYekjrznN4J5CGO9mfuFTdLLUvqe8BWo-MaBAIlRxzKh2pFnAJV_uRGdMwEwmPrROU3r9v-lvRxuEr9guBKc_XZ_1Fp9THKPwAp-4HkKmv_yOydWwGDu0yE3HQTjgjX6zscp71Qw-pTd640_24t5JLiWvV5T5Vx79NMNRQI3weCNw9QcPSjCCD9U2zB-hoxT41rhgY6lnAkgG7EuiFeemJOWrSY-FbOfkXJa1wcFJ8UPZJSoGn-uvtTCJWY2ocjQN6wsKUXhBAs68zVzNeUAiBHJSE9QBavQWQ0DKII77zAlxm9V0uhjYHNrvyjZHFPrUK1UYA-NIbObDeqTJ1VTVmfsy1WUoYAUD2Frjw7hufz25IBqv1ORUAHSghH60EByUctECzZmPbCsuh4B-2-IVYKg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.6 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Mar 2024 04:53:44 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 1554869
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame ED8F 0
128 B 144ms
48ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=IABeGaSPIGgscu5-mYGXF8lTsQdyG0ldqzFj6L79Lp5luDFODlt0pNLDQ91oLfyCBzFSd04NJS4jbdvcV_lvJ4Ay5xfo44FMxdyPCTrr7TJ4VTaIK2tueXYixhT4d2MlOXHG4MDO1DWXC1sOt0uw-RQ1eG7vZ08YdBZZdEXiIobaSiG5Mu1xc4ZL5uGzyxuIl9WUxTo0JfWvkZSc3P4f1HeaL9kh09ASboXBH-buONxDHsZvz5uuTXb-XAUiid1dU-eRJA&sds=2&rev=90888.4&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 06 Mar 2024 04:53:44 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame ED8F 2 KB
1 KB 97ms
96ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 01 Mar 2025 04:53:45 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame ED8F 2 KB
1 KB 95ms
95ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 01 Mar 2025 04:53:45 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 400F 12 KB
6 KB 51ms
49ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 01 Mar 2025 04:53:45 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 400F 0
127 B 48ms
37ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=9NebbKSPIGgscu5-yI42vfYWE63BILIsK_fl50QOuEZFo6m5TtCBCq-lOIqUwvqiJqPc-a4mmFLCeVK_x6e_EHzMNekysC4aZ1xSHfc96rhAaE3gIy6CCzjFzkYd4FaTlM_eE4xGcwnKWjXBRHIuyCpc_mV-Gj1QKLUGxmAcrqiq_Fa7hrFrWWExJ2nt-HyIquo7AA0o-sNfL3UQ0AI5aRlVivFgBS1u5B6YGeI0pH8bmosxmlBkItEXSYUDKX9PI9Fq_w&sds=2&rev=90888.4&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 06 Mar 2024 04:53:45 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 400F 2 KB
1 KB 43ms
40ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 01 Mar 2025 04:53:45 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 400F 2 KB
1 KB 42ms
39ms Image
image/svg+xml 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 01 Mar 2025 04:53:45 GMT

GET
DATA 200
OK truncated
/ Frame A830 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3fb0c151788a799cd3dc24ba559180cb918f809a6afabc3d59b051d19f67dbca

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame A830 16 KB
16 KB 24ms
23ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 18:30:08 GMT
x-content-type-options: nosniff
age: 123817
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 04 Mar 2025 18:30:08 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame A830 15 KB
15 KB 27ms
27ms Font
font/woff2 2a00:1450:4001:82f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 05:37:46 GMT
x-content-type-options: nosniff
age: 83759
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Mar 2025 05:37:46 GMT

GET
DATA 200
OK truncated
/ Frame CF3B 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 69a73b8f9d05ea5655f126bf80b2b6634c79beda7200f4e9259a326dc4f074f4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame CF3B 0
19 B 57ms
56ms Image
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CLTNV1_bnZcnrN6G39u8P0K-3QMme0rFc1Z2R93DAjbcBEAEgAGCVgoCAmAeCARdjYS1wdWItMjM2NzEwODA0ODI4NzUxNcgBCakCH1NzF942sj6oAwHIAwKqBNMBT9DvhK5q2WArRR7KBiO0-FFM73OBHHhYGSfHDFvG6TnCI4y9-EEPrzq7Znazzct8Ez8pZ2euSUXa1CjC5dbKwHw_KcmaYJz9qYfhy5s826q3vUOo34SsdjbKUpR0BhVL8XkWgVJIddS6OMtOAEs7pBttaudQq2ONso7a8aIrGdS-aPwTN66-uMVqMGAdPG5mFOp9aoUQs8nTKKRwdCzkePAVyDuLp9NQK8IayC0WM8_dyt-sBmZznk7mzzjAba2Ok6vPu1FkrXvw3SIpXMKpMHxdj4AG_4XPw_jnr_dHoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAqgHrb6xAtgHANIIKQiR4YBwEAEyB-uLgOC_gA06CYBAgICAgICUKEi9_cE6WICToPLr3oQDgAoB-gsCCAGADAHQFQGAFwGyFxoKGBIUcHViLTIzNjcxMDgwNDgyODc1MTUYAA&sigh=YQWJGISPMK4&uach_m=%5BUACH%5D&cbvp=2&vis=1

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20240304/r20110914/zrt_lookup_nohtml_fy2021.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 06 Mar 2024 04:53:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.fr3.eu.criteo.com/google/auction/ Frame CF3B 0
126 B 117ms
35ms Image
text/plain 2a02:2638:d::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.fr3.eu.criteo.com/google/auction/notify?profile=14&payload=mo3_GdyBMKAB2ASdg2ICAgAAAOq7SLHP8AVTvm0gjxDX9udlr1-mweEKcfh0JgAAEgAACgpBUVVERHdFUER3HwE2XGI6E6B5LCm0LEbOVg&wp=Zef21wAN9ckH_ZuhAA3X0IKoON1BoPBG26WV2w&cbvp=2

Requested by

Host: demonic-empire.shivtr.com
URL: https://demonic-empire.shivtr.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:d::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:44 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 175438
server: Kestrel
content-length: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame A830 0
0 55ms
55ms Fetch
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CmFAP2PbnZYTBJL2t9u8Pwv-EgAKrmuufdsmt8LnCEmQQASDYoKYEYJWCgICYB6AB3fCqwCrIAQmoAwHIA8sEqgTjAU_QyqNCiDCnHcb7yzOoKRRt1kZtYvtI8uWhIQ-RSokdrEy9urvIiaVI_Ieoaygc1v-Z3hawdiOxZmfmuxg4MNp4cpbt10Z5UNJyJHhkCrJbYMevbI39sADnkwCZC33ZADWcLrjUWObp-RnsxD7XBSFURUFZy4ABiPZE3ppZISTaTLoU-FQASL_V7SsIOuFWM2nFHjPVFUp9i7tA3cv9A7x0Gb-to5dEP0QBFZJvVDwDIeRmLPEoOR6gggBKNbXW8kzPaw915WPfxZ_oGX28_xgHVjVtgTN-zReY6eL2O-p_GuULwATfrv6rvwSIBZLQ8bpNkgUECAQYAZIFBAgFGASgBi6AB92o-58FqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHr76xAqgH1ckbqAemvhvYBwDyBwQQ-d4K0ggrCJHhgHAQARgfMgfri4Dgv4ANOgmAQICAgICAlChIvf3BOliw8sny696EA5oJpQFodHRwczovL3BkZml4ZXJzLmNvbS9kb3dubG9hZEZpeGVyLmh0bWw_Y2FtcGFpZ25faWQ9MjA3OTMwMjY1NzgmYWRncm91cF9pZD0xNTQ0NDI2MzUxMDMmcGxhY2VtZW50X2lkPWRlbW9uaWMtZW1waXJlLnNoaXZ0ci5jb20mY3JlYXRpdmVfaWQ9NjkxMzk4NTUyNjI0JmNvbnNlbnQ9e2VlYX2ACgHICwG4E-QD2BMMiBQD0BUBmBYBgBcBshccChoIABIUcHViLTIzNjcxMDgwNDgyODc1MTUYAA&sigh=CBQkSghGw9A&uach_m=%5BUACH%5D&ase=2&template_id=484&cbvp=2&vis=1&nis=5

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2367108048287515&output=html&h=280&adk=3809598800&adf=1604629528&pi=t.aa~a.1182920990~rp.3&w=1200&fwrn=4&fwrnh=100&lmt=1709700824&rafmt=1&to=qs&pwprc=9183188665&format=1200x280&url=https%3A%2F%2Fdemonic-empire.shivtr.com%2F&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1709700824564&bpp=2&bdt=1811&idt=-M&shv=r20240304&mjsv=m202402290101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C728x90&nras=2&correlator=5743391807227&frm=20&pv=1&ga_vid=1350388314.1709700824&ga_sid=1709700824&ga_hid=847034209&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=200&ady=1737&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759837%2C95325257%2C44795921%2C95325752%2C95325974%2C95320376%2C95324160%2C95325784%2C95326935&oid=2&pvsid=2068325300587508&tmod=748581815&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&bz=1&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=9
Attribution-Reporting-Eligible: event-source
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 06 Mar 2024 04:53:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 6546 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8c58b9e30d932e26d02f3f8940d76bbc91738b6e7d2cfb0a3b80cc17d2ec492a

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 113ms
67ms XHR
application/json 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20240304&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b903ba45e091e40211c78f7548ad28cf9a117493a96a330e307aa430c6aef2e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12595
x-xss-protection: 0

GET
H3 200 neFZPoS4RqR4jfdTFmgUuiCC8zWeQsTNscPgsnGRUhI.js Show response
pagead2.googlesyndication.com/bg/ Frame FA3F 51 KB
20 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/neFZPoS4RqR4jfdTFmgUuiCC8zWeQsTNscPgsnGRUhI.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9de1593e84b846a4788df753166814ba2082f3359e42c4cdb1c3e0b271915212

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Mon, 04 Mar 2024 21:52:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 111652
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20184
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 11:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 04 Mar 2025 21:52:53 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 6546 0
19 B 57ms
56ms Image
text/html 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CuqwS1_bnZcrrN6G39u8P0K-3QMme0rFcxYyL4JoBwI23ARABIABglYKAgJgHggEXY2EtcHViLTIzNjcxMDgwNDgyODc1MTXIAQmpAh9TcxfeNrI-qAMByAMCqgTTAU_QBorzKW4Z4nEqy5F922Ds8XKsknFyWhzan2ZKBqiFOk1ZaheIWANksSmp6w1JMoCJZsotspCKFB0aqOa7qIW8brHqn1Ga3JcoHU8O53WMtPfrQ4i9G_9JcD71hpCIQO489W762stGLe1UEXyrTsSOHqyYsUE9GP3MJN4PVka2nZsB03206-RFydNWfBuBjt-IIiKKefWq4EuoHiQGlyfpJXvAtlHj8j4P4lMPFecPy9SSkC1mQlaWVS4Cep4I1V-jI5vr_1uYru7xHHNVRb8nOEaABsDmwvjNiYTb8gGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7ECqAetvrEC2AcA0ggpCJHhgHAQATIH64uA4L-ADToJgECAgICAgJQoSL39wTpYgJOg8uvehAOACgH6CwIIAYAMAdAVAYAXAbIXGgoYEhRwdWItMjM2NzEwODA0ODI4NzUxNRgA&sigh=5A4qUoKQeiY&uach_m=%5BUACH%5D&cbvp=2&vis=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20240304/r20110914/zrt_lookup_nohtml_fy2021.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 06 Mar 2024 04:53:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.nl3.eu.criteo.com/google/auction/ Frame 6546 0
126 B 110ms
35ms Image
text/plain 2a02:2638:3::9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://rtb.nl3.eu.criteo.com/google/auction/notify?profile=14&payload=mqzOGcz6RMgB2ASdg2ICAgAAAOq7SLHP8AVTvm0gjxDX9udlYno6ZeUvnyqyUwAAEgAACgpBUVVCQVFFQkFRHwE2XGI6E6B5LCm0LEbOVg&wp=Zef21wAN9coH_ZuhAA3X0EWvFd_Qj8pufazauQ&cbvp=2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:44 GMT
strict-transport-security: max-age=31536000; preload;
server-processing-duration-in-ticks: 164670
server: Kestrel
content-length: 0

GET
H2 200 000ElhcUCzl9SLIhT1xzBGcIqFzWUCdi9tfbR2ZHuwmdncZGOxENe35AeEWunNcVDYpxd1B8hBztXMvTmCWyUMnUubWfCbGyYPsaTodnGaD0VW2HbPEb6eJ3VLRe2NgeD9nvjGpIcqdALxYvTnWhRHQkVQNEAijlu1gwuNnFIsWph2moiKa07alKWYXwmmkHdEyet...
imageproxy.eu.criteo.net/v1/ Frame 400F 4 KB
5 KB 162ms
85ms Image
image/png 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/v1/000ElhcUCzl9SLIhT1xzBGcIqFzWUCdi9tfbR2ZHuwmdncZGOxENe35AeEWunNcVDYpxd1B8hBztXMvTmCWyUMnUubWfCbGyYPsaTodnGaD0VW2HbPEb6eJ3VLRe2NgeD9nvjGpIcqdALxYvTnWhRHQkVQNEAijlu1gwuNnFIsWph2moiKa07alKWYXwmmkHdEyetT9w1wuXiq2PhisFDfSme86TiN0j7XoT9x2JbluJfz9Dl14Qjq9V

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

22965e772d52a2044625993d4b8139c96a5aa2962c02f155ae7785702e1519fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 4568
expires: Sun, 16 Feb 2025 02:11:11 GMT

GET
H2 200 001V2hWWepCVDv9snlRnAzhsko9Z5a297pplf4JuzTDSiJa1XtdaLE4xIw9ACObBrkV6B7P2js2a8FnqjHxUNUVTXad8bAmodHC3Cprz2GJ0JnnKM6NqPvQUgUZLi1jIOvGIUFZYUpvOs2VETd0gn8tDh7xNGR3LQdBfjxOAT5gL6n9
imageproxy.eu.criteo.net/v1/ Frame 400F 7 KB
7 KB 156ms
79ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/v1/001V2hWWepCVDv9snlRnAzhsko9Z5a297pplf4JuzTDSiJa1XtdaLE4xIw9ACObBrkV6B7P2js2a8FnqjHxUNUVTXad8bAmodHC3Cprz2GJ0JnnKM6NqPvQUgUZLi1jIOvGIUFZYUpvOs2VETd0gn8tDh7xNGR3LQdBfjxOAT5gL6n9?b=400

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

265bc4d9800383d47c3d8c6fe27ea12383acbdbafc1f5f63732bc26450992c57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:44 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=10368000
timing-allow-origin: *
content-length: 7294
expires: Wed, 26 Jun 2024 14:06:14 GMT

GET
H2 200 00072CXAgK1UdiKqFPMhf34FHMj6UvsxhaCItejgyN1dSLkURdPeQ3yRcGXVdLuSolqcazcklUYTpoLER2hnromzOAOTZmTJOkRaWKDdyeb5N9pJeUW0lo9AcugRZha1g9cwinhEst7yLkVUTX6X5m6UGgRVHSC5dhVYuJK53yDGBK1uzun1b
imageproxy.eu.criteo.net/v1/ Frame 400F 6 KB
6 KB 155ms
78ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/v1/00072CXAgK1UdiKqFPMhf34FHMj6UvsxhaCItejgyN1dSLkURdPeQ3yRcGXVdLuSolqcazcklUYTpoLER2hnromzOAOTZmTJOkRaWKDdyeb5N9pJeUW0lo9AcugRZha1g9cwinhEst7yLkVUTX6X5m6UGgRVHSC5dhVYuJK53yDGBK1uzun1b?b=400

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

08b9636b6775125253e8c852c70e1e86af7d3f18472e95ebcbd5213cf5da7a13

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:44 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=10368000
timing-allow-origin: *
content-length: 6114
expires: Tue, 04 Jun 2024 12:30:59 GMT

GET
H2 200 002CBn5u50oPYEUrnjzcAwZcBXQlttnXBU0z6xHP0l1vR5aVzkxSdE5Eeit8k4jxCqgiN4cZTS1ceWzLjOjOIjU038iwIv9GTZPCW5CnzO7E6hFV33UK7tSDPKMbxi5MLrEwofpkEKo6bcwY8uahBhNgBIiwuqARfKiLSUeVj71hDHRAhau9S6MqSPH
imageproxy.eu.criteo.net/v1/ Frame 400F 11 KB
11 KB 173ms
96ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/v1/002CBn5u50oPYEUrnjzcAwZcBXQlttnXBU0z6xHP0l1vR5aVzkxSdE5Eeit8k4jxCqgiN4cZTS1ceWzLjOjOIjU038iwIv9GTZPCW5CnzO7E6hFV33UK7tSDPKMbxi5MLrEwofpkEKo6bcwY8uahBhNgBIiwuqARfKiLSUeVj71hDHRAhau9S6MqSPH?b=400

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

5ec86fe055f703d79cee010fe657a9f65ae83d666880a1ba459116b3e033174e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=10368000
timing-allow-origin: *
content-length: 11536
expires: Wed, 12 Jun 2024 05:43:10 GMT

GET
H2 200 000DYeXvndF7ANyEZkk6r3jIPVzfYLoty27JJAeQstYCQmVRPHaCvTBSuhuAZMfVAGLhogOih7Wy4SkmeI3taQ2fEycMZol92bp3iiVZcht7YaEH9rrEpZDlzMnZJYuNfYxWxdtSk5AO6WIaV4Ps2wppzRTFOF
imageproxy.eu.criteo.net/v1/ Frame 400F 8 KB
8 KB 118ms
41ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/v1/000DYeXvndF7ANyEZkk6r3jIPVzfYLoty27JJAeQstYCQmVRPHaCvTBSuhuAZMfVAGLhogOih7Wy4SkmeI3taQ2fEycMZol92bp3iiVZcht7YaEH9rrEpZDlzMnZJYuNfYxWxdtSk5AO6WIaV4Ps2wppzRTFOF?b=400

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

921fa3d1ef42adcaa71736c399c07c0178592734bf522a13eeabd3b042164c55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=10368000
timing-allow-origin: *
content-length: 7808
expires: Sat, 22 Jun 2024 14:13:48 GMT

GET
H2 200 002tJVet4OMAZC5TEDDBRG3Diwvu9kycb2HLmfqqcGF0kX2svRsIAGyN5P1BA8lE8Z2iimDuoELk3SGHWxEr29XMKDrrVtfIUbSwr5IsB6XfPljxmPDdSdvHv0MJ5s9tJctrM5JTgjYlMTXhRmp0gFuf
imageproxy.eu.criteo.net/v1/ Frame 400F 5 KB
5 KB 154ms
77ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/v1/002tJVet4OMAZC5TEDDBRG3Diwvu9kycb2HLmfqqcGF0kX2svRsIAGyN5P1BA8lE8Z2iimDuoELk3SGHWxEr29XMKDrrVtfIUbSwr5IsB6XfPljxmPDdSdvHv0MJ5s9tJctrM5JTgjYlMTXhRmp0gFuf?b=400

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

c2cad61fe2e4155f3d2f862e29bb1c0a305c4ed49ca98a78bc082debc08a5a52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=10368000
timing-allow-origin: *
content-length: 5066
expires: Tue, 04 Jun 2024 11:46:39 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 31ms
30ms Script
text/javascript 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 06 Mar 2024 04:53:45 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame E799 13 KB
5 KB 22ms
21ms Document
text/html 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://demonic-empire.shivtr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 24874
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Mar 2024 21:59:11 GMT
expires: Wed, 05 Mar 2025 21:59:11 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame CAA0 829 B
1 KB 89ms
33ms Document
text/html 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

e0d3b312d1e54f91754aad904fa199f46114e2a8b274b51dab00396658e4a1d2

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-PAqEtkheHmdt9L58GrTE2A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://demonic-empire.shivtr.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-PAqEtkheHmdt9L58GrTE2A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 06 Mar 2024 04:53:45 GMT
expires: Wed, 06 Mar 2024 04:53:45 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 000DYeXvndF7ANyEZkk6r3jIPVzfYLoty27JJAeQstYCQmVRPHaCvTBSuhuAZMfVAGLhogOih7Wy4SkmeI3taQ2fEycMZol92bp3iiVZcht7YaEH9rrEpZDlzMnZJYuNfYxWxdtSk5AO6WIaV4Ps2wppzRTFOF
imageproxy.eu.criteo.net/v1/ Frame 400F 8 KB
8 KB 57ms
55ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

921fa3d1ef42adcaa71736c399c07c0178592734bf522a13eeabd3b042164c55

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=10368000
timing-allow-origin: *
content-length: 7808
expires: Sat, 22 Jun 2024 14:13:48 GMT

GET
H2 200 002tJVet4OMAZC5TEDDBRG3Diwvu9kycb2HLmfqqcGF0kX2svRsIAGyN5P1BA8lE8Z2iimDuoELk3SGHWxEr29XMKDrrVtfIUbSwr5IsB6XfPljxmPDdSdvHv0MJ5s9tJctrM5JTgjYlMTXhRmp0gFuf
imageproxy.eu.criteo.net/v1/ Frame 400F 5 KB
5 KB 39ms
39ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://imageproxy.eu.criteo.net/v1/002tJVet4OMAZC5TEDDBRG3Diwvu9kycb2HLmfqqcGF0kX2svRsIAGyN5P1BA8lE8Z2iimDuoELk3SGHWxEr29XMKDrrVtfIUbSwr5IsB6XfPljxmPDdSdvHv0MJ5s9tJctrM5JTgjYlMTXhRmp0gFuf?b=400

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

c2cad61fe2e4155f3d2f862e29bb1c0a305c4ed49ca98a78bc082debc08a5a52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=10368000
timing-allow-origin: *
content-length: 5066
expires: Tue, 04 Jun 2024 11:46:39 GMT

GET
H2 200 00072CXAgK1UdiKqFPMhf34FHMj6UvsxhaCItejgyN1dSLkURdPeQ3yRcGXVdLuSolqcazcklUYTpoLER2hnromzOAOTZmTJOkRaWKDdyeb5N9pJeUW0lo9AcugRZha1g9cwinhEst7yLkVUTX6X5m6UGgRVHSC5dhVYuJK53yDGBK1uzun1b
imageproxy.eu.criteo.net/v1/ Frame 400F 6 KB
6 KB 42ms
42ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

08b9636b6775125253e8c852c70e1e86af7d3f18472e95ebcbd5213cf5da7a13

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:44 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=10368000
timing-allow-origin: *
content-length: 6114
expires: Tue, 04 Jun 2024 12:30:59 GMT

GET
H2 200 001V2hWWepCVDv9snlRnAzhsko9Z5a297pplf4JuzTDSiJa1XtdaLE4xIw9ACObBrkV6B7P2js2a8FnqjHxUNUVTXad8bAmodHC3Cprz2GJ0JnnKM6NqPvQUgUZLi1jIOvGIUFZYUpvOs2VETd0gn8tDh7xNGR3LQdBfjxOAT5gL6n9
imageproxy.eu.criteo.net/v1/ Frame 400F 7 KB
7 KB 46ms
46ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

265bc4d9800383d47c3d8c6fe27ea12383acbdbafc1f5f63732bc26450992c57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=10368000
timing-allow-origin: *
content-length: 7294
expires: Wed, 26 Jun 2024 14:06:14 GMT

GET
H2 200 000ElhcUCzl9SLIhT1xzBGcIqFzWUCdi9tfbR2ZHuwmdncZGOxENe35AeEWunNcVDYpxd1B8hBztXMvTmCWyUMnUubWfCbGyYPsaTodnGaD0VW2HbPEb6eJ3VLRe2NgeD9nvjGpIcqdALxYvTnWhRHQkVQNEAijlu1gwuNnFIsWph2moiKa07alKWYXwmmkHdEyet...
imageproxy.eu.criteo.net/v1/ Frame 400F 4 KB
5 KB 45ms
45ms Image
image/png 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

22965e772d52a2044625993d4b8139c96a5aa2962c02f155ae7785702e1519fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/png
cache-control: public, max-age=31104000
timing-allow-origin: *
content-length: 4568
expires: Sun, 16 Feb 2025 02:11:11 GMT

GET
H3 200 hhT7r2j7IM84IjrHPq4DliozylkjplqSUN38T7c3Pqk.js Show response
pagead2.googlesyndication.com/bg/ Frame E799 40 KB
15 KB 24ms
22ms Script
text/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/hhT7r2j7IM84IjrHPq4DliozylkjplqSUN38T7c3Pqk.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8614fbaf68fb20cf38223ac73eae03962a33ca5923a65a9250ddfc4fb7373ea9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Tue, 05 Mar 2024 19:16:46 GMT
content-encoding: br
x-content-type-options: nosniff
age: 34619
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15753
x-xss-protection: 0
last-modified: Mon, 26 Feb 2024 11:38:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 05 Mar 2025 19:16:46 GMT

GET
H2 200 002CBn5u50oPYEUrnjzcAwZcBXQlttnXBU0z6xHP0l1vR5aVzkxSdE5Eeit8k4jxCqgiN4cZTS1ceWzLjOjOIjU038iwIv9GTZPCW5CnzO7E6hFV33UK7tSDPKMbxi5MLrEwofpkEKo6bcwY8uahBhNgBIiwuqARfKiLSUeVj71hDHRAhau9S6MqSPH
imageproxy.eu.criteo.net/v1/ Frame 400F 11 KB
11 KB 42ms
41ms Image
image/webp 2a02:2638:3::10
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::10 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

5ec86fe055f703d79cee010fe657a9f65ae83d666880a1ba459116b3e033174e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
strict-transport-security: max-age=31536000; preload;
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Kestrel
content-type: image/webp
cache-control: public, max-age=10368000
timing-allow-origin: *
content-length: 11536
expires: Wed, 12 Jun 2024 05:43:10 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame CAA0 0
0 53ms
53ms Image
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20240304&jk=2068325300587508&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame E799 0
10 B 22ms
21ms Image
text/plain 2a00:1450:4001:830::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?6sQN_g
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

date: Wed, 06 Mar 2024 04:53:45 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame ABB0 42 B
64 B 57ms
56ms Fetch
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss7ST2rExTuJsBI9KXRVBtBXYBA-oDI0zbacqu_EcCrW1sW_71BqOcgtfmaN2haZkLKpDlRWKgagl3IV1MbO-UTb3I6a0rGb4YQpiORHk6fWsSsRJPCQpxkhB55WEH4hB6UGe_T-gEUcytJ8NgP_t6g4eNAZvY3NBqj5mYhJUgM&sig=Cg0ArKJSzJWFbe1LhEv-EAE&id=lidar2&mcvt=1001&p=0,0,90,728&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20240229&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=4229348686&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=563362400&rst=1709700823905&rpt=866&met=mue&wmsd=0&pbe=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Mar 2024 04:53:45 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 55ms
55ms Image
text/html 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20240304&jk=2068325300587508&bg=!DwylDEPNAAauXHXJjlw7ADQBe5WfOO_zJQvgn31T6h0dSxRsqaifBT_wZfP7VaZPZX3gVD6DVEHVe9K2hUQ5hzs1X5wGAgAAAIdSAAAABGgBB5kC3qpmZJGRkdU6jvDvoOvNeFGqoE8alxNa_QF0NaybsMfyeoNkztcZnDE8aW_QsQhGY-0xbM2KB6AiihjHJvB3RlquKo0u_wJW_85G4u-9n-aW_fzvwCoV7l2KeIoa1Sl5Bkb5Za7NuJveyrzddCJYsJe6e_1hwOUf_nLPUGHaFpDqYXdrolC182w0GOOiSI6SwtgahW9ehlruTGGuZTwcvCyQjgTHvz6hIB6P32jUH_OBTQL1Md3pQxh_hNNyTTfdaNFqLE6h0J4E4xR8RZ9qRpTjrWg2_U8W9zR4qt4Hm5jQi9P69DSVzgbJ-kv-YlhbhtnbzzFFp3HnHaY3ybyRY9sThRsVbh0eQc-lQ_8QEDax49z9rbJTiV1IBJ-nrLn-nloh2_BJZcrrblEk1U33_68Sv0-3LScJMX8MydHgU14uZ-lc4gLzx0vftAoKpJHI9-4IeJg2-j4y4NVZXsDWtIHHyVBCWPGGPRPcECUu2czRYLjAe_0F5TowZgB_IjBg_EiodzZhPIUtA0EERe21ZmLgnlaqJ8PHwirusvAOpnhn5J9cbL42QMQpmdwq77iMCPiJ3oHcCqDC4voJw7QlR1z0SH6ji-gp48oKwNpvLmFN_bePSBcZKOwILlEsG1SNM-li_y7_2lsdLx44rk8euec8Yv1tEIaVH91u4_lVru0YwWHhxEs9AgYCn6YR565ioqCFlEgOTQ1v2Ew96C_JiaXD7IQY4DOFazdzFYjiTJeBz8W_WfHtpKrtCeQUKhcqSOCVGtE7C8KX2Bsxbxa8EDeMwrZhW6NSHzqwU7k4QqxlCU9rw2JOGeJzCkPNUADozyn6x-cBJ8x13dF3xsPND78r0P94DHoNNdPWTMtUwqwHSHONAqwFKHrR_xz-CxsHcsnGeFTl_tdUdzJvRykpXqIXb_FgmZUXS83je2Eq4cFrvPePgk0SqshQrXR0Vgh_LvL9gM9mBu7MyFKmR0qU
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://demonic-empire.shivtr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

POST
H2 200 all
csm.eu.criteo.net/ Frame ED8F 0
127 B 38ms
38ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 06 Mar 2024 04:53:45 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame CF3B 42 B
64 B 55ms
55ms Fetch
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstaJBisOtHkYo6i1mEVg4d25gYpymYQNfgWtZ9Ef7M5uOg_HhJLmc_3dlrBiRnyjz4qlzSKerlBQZnB-elCXdBKYEDx0jIjQq3XAevvo6h2JFlkxTBJ6xVrOPxVNGBZb6zMuFFAZy7fe34N&sig=Cg0ArKJSzGQKqjMcKUdMEAE&id=lidar2&mcvt=1000&p=0,0,600,160&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20240229&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271803&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=563362400&rst=1709700824787&rpt=129&met=ie&wmsd=0&pbe=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Mar 2024 04:53:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 6546 42 B
64 B 57ms
57ms Fetch
image/gif 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsttC9fPXxZNi9M_q23AjMKYfoTFFvjpRgJOM53h_Pq_CQ27oEe6EHVBmVhrvolc2QsTeT3upUnUc55KGUDiCJ1edZmCxzYCeb2xClKr-hsUFgpf0adeSF5iabuDpzgm1lVzXkvZx-4sGhx3ug&sig=Cg0ArKJSzIGMA8XV3saSEAE&id=lidar2&mcvt=1000&p=0,0,600,200&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20240229&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271804&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&co=563362400&rst=1709700824661&rpt=324&met=ie&wmsd=0&pbe=0&vae=0&spb=0&sfl=0&ffslot=0&reach=8&io2=0

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/activeview/current/ufs_web_display.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Mar 2024 04:53:46 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 400F 0
127 B 38ms
38ms Ping
text/plain 2a02:2638:3::1a
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::1a , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 06 Mar 2024 04:53:45 GMT
strict-transport-security: max-age=31536000; preload;
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0

Verdicts & Comments Add Verdict or Comment

82 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
demonic-empire.shivtr.com/	1969-12-31 23:59:59	Name: site_game_id Value: 184678
demonic-empire.shivtr.com/	1969-12-31 23:59:59	Name: _shivtr_bakery Value: LNQ8%2FSJcmSngD5xqDHV49dSewovyxIaPUyuGISsJ6CYMfiHlBLdQvBFbuckfLMcEe%2Bag45A%2BTfzQ3nmYbt6UVylmG9M9JZ2koJKp2tNh8IlfZZ0N%2BrMEVcXgut1X7TaA0kS%2BrwL7Eef1gVsI%2FPnUZehZaMQAL%2FRH2Ju4rB81TSINN6r3rqoJAGKEMIQ%2FbkojrZvojLdM%2Bx8VwVCtvOqqYh2WFOdTA8TfmUa7o%2Ft%2BIhDzQwH%2FsuO3vTpniYpd14Ypys2Djf%2BAAclJ6xR3rdbiuTQszDwsqTDUau23kVz6y%2BXZUZx4cvE%3D--liaECgjWRusEPbI7--2Ty3MeMXm%2Bl6IIxHLYZWrA%3D%3D
.shivtr.com/	1970-01-20 23:14:12	Name: __eoi Value: ID=a28a6d6ee2220a5c:T=1709700823:RT=1709700823:S=AA-Afjb_rrt-kMb67R_TJmqy5lf7
.criteo.com/	1970-01-21 04:16:36	Name: receive-cookie-deprecation Value: 1

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	Message: Origin trial controlled feature not enabled: 'attribution-reporting'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.eu.criteo.com
cat.nl3.eu.criteo.com
csm.eu.criteo.net
demonic-empire.shivtr.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
i0.wp.com
imageproxy.eu.criteo.net
pagead2.googlesyndication.com
res.cloudinary.com
rtb.fr3.eu.criteo.com
rtb.nl3.eu.criteo.com
s3.amazonaws.com
static.criteo.net
static.shivtr.com
tpc.googlesyndication.com
wow.zamimg.com
www.google.com
www.gstatic.com
www.wowfan.cz
13.33.187.68
178.250.1.6
192.0.77.2
2a00:1450:4001:808::2002
2a00:1450:4001:80f::200a
2a00:1450:4001:811::2003
2a00:1450:4001:828::2002
2a00:1450:4001:82f::2003
2a00:1450:4001:82f::2004
2a00:1450:4001:830::2001
2a02:2638:3::10
2a02:2638:3::12
2a02:2638:3::1a
2a02:2638:3::3
2a02:2638:3::9
2a02:2638:d::c
2a02:26f0:480:587::523
45.33.21.148
46.105.124.43
52.216.78.214
0101f1a2e65d66a8af54470ef2853f727dbaed3caf9aabaa522c9c46880f7e58
0635d732c479b8b327cc7ef699d1983cf37dd191c0cb911134d7be5d595a2bb9
08b9636b6775125253e8c852c70e1e86af7d3f18472e95ebcbd5213cf5da7a13
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
14d7c0f9c35c7e60ebea4f2a0c5fa12195868621683e588b2c5034f43cbe9d9d
160f9c28c35e4390cd35e90cf1ccb3d80a58de14da97300d738b4e65cf54c7aa
22965e772d52a2044625993d4b8139c96a5aa2962c02f155ae7785702e1519fb
240ac5cfe833b81f6607a9f702f7b30bc7383485fe86af4cd21b7c6d9cd2e3e8
265bc4d9800383d47c3d8c6fe27ea12383acbdbafc1f5f63732bc26450992c57
2fd319c7809baaf44380af89d4d6cc83eead0773f5942ac01b8b5931c7abc336
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
37d5b07c436cfe35ab0ea2083b687e03cf6df5f288863c988f997e258b2a9751
38444148a2237a29af423edbe716ea9587872041585593d569fa13206db7a80e
396bd1ab182a204c8c227c5d6aef6cbe3a3481500e816635b408da715695dfa1
3fb0c151788a799cd3dc24ba559180cb918f809a6afabc3d59b051d19f67dbca
41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd
444c4c7901307178ed2d1362b09d15f689d48c3a4bed4e7513431ce155dc5778
47ce859f7f0f545825c8ab983547bbf88d0de3f52afebc7a1ccc0611661df70d
4817af49d2bea29e98e801b84209ed1623aeb8d5e90d1ca362b7966166fb5824
4886f61c850f335aa921f14e1d6203403c69dd7a8dcfbbb5974f92f698a192bd
4d03b6e90b232fb83c1da9981b5cb4012063ad310ccf71e33b5e8fd1fe2d8fb9
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
53487ad0a5a88b197291a6e37f5b5236b6b70684eb1b37e8aa9050bdfc4d058e
535487d55c5cbf22bf933588a42e38efdc60bcbd42591420ed217db20cf423c6
54cc0e7807cf8bdf5d48a2930fbcd3b5a30b0dae8cc3bbab2efcee6fad1a092d
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5a1433553dad10b1617e945447ce8d2a7a4ce6542ad50fdb8b563f85560cbc3e
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
5e97fba31c1c44783c4852e361c7be30f2282ddcd4eb99dceb3ee9ca0aa94331
5ec86fe055f703d79cee010fe657a9f65ae83d666880a1ba459116b3e033174e
5efd17aa9600929f5517878dd267b6fdfeca37478d6987b5d75caec4f1e4b1a8
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
61e9b17329f13fbae525515109fc97760f3d0b74684b075f09234fe6a3860a63
6700a61b5bd8006d07ddcdf84df499411e0ca045c8e124af25f72b8c4e82dab3
69a73b8f9d05ea5655f126bf80b2b6634c79beda7200f4e9259a326dc4f074f4
7088d6c86fda7a1dbd11ce4ec06ab4cf62f816203c1a68092d8b87bb847d2ec7
7109bd81801a56e6a2aa9671eade8495fea7107e38553c1800caf303dde5bb34
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
748d77ecc9866e292c4ae69636ea30b6fb1e6af8d88a8059e0af2176429648c4
74c3eeecd923e56f2d4796ea18d4acd478cc329cdbdca2e51b55573a69f301c2
76ebe4f3c80b681258c1968d5acfe9d2c91872b06cbde742d1311ed64086e037
7c328c382892475e77d0d96832bfa0b35612da6a9705f013d588ef0393c04b88
7e40e9568b9cda5fa38f6cb2623a68d2ba5410cf50ccc7206fa2daa8182f8b36
7e41ca21e421f129d3881e345f990027b66c0ab3c5580e549575f9393d117cbd
8026b77a36d1a7e20e512f163552d9b6634d5437c0fb7b18d6aeb0650cb92ca7
81964aadd4e436a03b58c2f6597af6aa079f349d773bce3f7d1d229f4f6cd451
830870bb74c6a4a16f3c0c49a7934378a8c26fe68fa8bf280e7d1b2a5ddc0f12
85e41af2f1124000f87c8a5caab08cd7568e2eeda71879c623fea4fbce4c469d
8614fbaf68fb20cf38223ac73eae03962a33ca5923a65a9250ddfc4fb7373ea9
86c06c5c4747bb6da8d7594ed31b1494459d202ba31ede706bf8f741acedc9b3
8753541a3a44842cd815d81c4f8c589e0a0d763112d622f3088cd6f064e825fd
8a33861cdc370b2db8442132658b06069640881bc90f369feca9b30c77e5f460
8a4acdbc5956c3196a8c4327078b5364d58362446a3620aa375085c0b4a4411d
8c58b9e30d932e26d02f3f8940d76bbc91738b6e7d2cfb0a3b80cc17d2ec492a
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
915d9e5035eb445e27bc5b633b1e76b54482d0f567f3ee20b864e966c96e0fe1
920a3defda6e075bd5ce32ebb4def4352b165fade37338fb91758aaedc1fc098
921fa3d1ef42adcaa71736c399c07c0178592734bf522a13eeabd3b042164c55
9301f07ce28c09e87781be0f793b1eec60e04eb986e7b58bb99aeecfc1b7669a
95177cb9a19bb527f7ba16b9f0d2ff334091efc9c01ecd2bef69435fd3be7126
9de1593e84b846a4788df753166814ba2082f3359e42c4cdb1c3e0b271915212
9e2e766b44b4bd31a6887776e57d5a5f502237e48cf90ded21436cfb6addf0be
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a0eb2f5b19c357a2b43e65bb70af5e52d4a87eda535042fa711b334dfaca4a2f
a24b219c5dd7b0c9efdb2ffb85e250809341705b37781e9b00435f9b8c5e2e3f
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a36f65ba8424df56787d94cb8096a1e3943dd479df81d2f8892bbede37a96c85
a45b9f8f42c2dba06a065e38d99ff5521de332c3197f9fb4ab8801ab4970e041
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
a8696976a432d2a4a4e0e19717ec37aba6ff16ee796270d134dca7ae7feecda6
a86d26e0a9759e5d6b482f102d7cade65f3dbe4792972bd59caa9966b9ff568b
a87130e14586c4efd63f5bb61764ee8c26b2353892c185446ef25ca23827a8bb
af7a8d497304bd6b298030b06e50a4dc2e1e41fa7c2c6859affa77c92f068abf
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b033555869a4e4bbf069af142ba979c054fcff8d0f4d83b14d99a71b9ab07ca2
b2aa131b334742b75fe3de815997b21d4783cea50a210783c0e243fb7d9d6eac
b903ba45e091e40211c78f7548ad28cf9a117493a96a330e307aa430c6aef2e6
bd777b49e978d13efd23e3c33717d52238ff7f3d31d5085f7a2069f6de94c48f
c2cad61fe2e4155f3d2f862e29bb1c0a305c4ed49ca98a78bc082debc08a5a52
d07e63487d8893ea65f1cb4da7973d1a538857717ad8dba6c8fed1cb588a4298
d6eade1ffe31d8226156f5c00fb48810841b02e60dd16f190205b162e8f73dc2
d75a105ae665367fed5c8b4f861ef14368df2ddc603b7777140164b0d57c333a
dc86183c64a971df266cf43382fe00a3b1c600ec6107714e06597192164b82b5
df7a397b8ce58f6251a395e02608b4f620e934a958bdfe6702c6f2033593eed0
e0d3b312d1e54f91754aad904fa199f46114e2a8b274b51dab00396658e4a1d2
e207f1d35c0fab195c596ef48599a9f52b4297050a4ee95c82eb98d4035f0350
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ee3affa7a75a5dab262c3796ec8926c8852a2040a013cf9421e284e88ce0930e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
ff4094a2d0a0df94d358f9363bafe98fb4ed45601b46456651bb7ae23a48f625

demonic-empire.shivtr.com Open in urlscan Pro 45.33.21.148 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

150 Requests

100 %HTTPS

70 %IPv6

13 Domains

21 Subdomains

21 IPs

3 Countries

2258 kBTransfer

5780 kBSize

4 Cookies

7 Outgoing links

Redirected requests

150 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

demonic-empire.shivtr.com Open in urlscan Pro
45.33.21.148 Public Scan

Screenshot
Live screenshot

Full Image

150
Requests

100 %
HTTPS

70 %
IPv6

13
Domains

21
Subdomains

21
IPs

3
Countries

2258 kB
Transfer

5780 kB
Size

4
Cookies

150 HTTP transactions
5 data transactions