blip.fm Open in urlscan Pro
54.163.233.121 Public Scan

Software

sffe /

Resource Hash

ec7d69015be507ee6045d259f50b6cf8ccb52ec7b41ec1bf50fee681683bea60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://blip.fm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 08:47:51 GMT
x-content-type-options: nosniff
age: 381976
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20040
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:20:44 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 15 Sep 2022 08:47:51 GMT

GET
H/1.1 200
OK trackpopbg.png
blip.fm/images/ 400 B
732 B 1455ms
109ms Image
image/png 54.163.233.121
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blip.fm/images/trackpopbg.png
Requested by: Host: blip.fm
URL: https://blip.fm/_/css/base.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.163.233.121 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-163-233-121.compute-1.amazonaws.com
Software: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19 /
Resource Hash: 51849fb8f2b161981d2a508c4e58503a0a752c6bbac592a742d92efdb1c378c6

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: blip.fm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://blip.fm/_/css/base.css
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/_/css/base.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 19 Sep 2021 18:52:43 GMT
Last-Modified: Tue, 04 Aug 2020 05:09:35 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19
ETag: "190-5ac0642db41c0"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=83
Content-Length: 400

GET
H2 204 config Show response
c.amazon-adsystem.com/cdn/prod/ 0
298 B 103ms
102ms XHR
text/plain 18.66.109.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fblip.fm%2Fmimosafire6&pubid=434bb5e4-3704-4b75-b36c-785a444462bd
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.109.174 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Server /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:54:07 GMT
via: 1.1 ee6745944298a5956e13c939ebdcf8f2.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P5
x-cache: Miss from cloudfront
access-control-allow-origin: https://blip.fm
cache-control: max-age=43150, s-maxage=43200
access-control-allow-credentials: true
x-amz-cf-id: z_VzFAdi7-mQJVgZASmllUyHAeZTnO-VkylUokmqy1AXcNkm3NyADg==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 23ms
8ms XHR
application/javascript 18.66.109.174
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.109.174 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: S8kNCKkikutwvs4V44q0sFuZ4JNc9Ate
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 45998
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Tue, 07 Sep 2021 22:15:56 GMT
server: AmazonS3
date: Sun, 19 Sep 2021 06:07:30 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 edffe6978db53d114a80cda421e0b6b9.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: FRA56-P5
x-amz-cf-id: 9SqSycLGow-dWKg9KKCQXGn0rJEm7ivRvgtSK9egee-uZmQmpjOP-Q==

GET
H2

200

collect
stats.g.doubleclick.net/r/
Redirect Chain

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=338473630&utmhn=blip.fm&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Free%20Music%...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-1449388-5&cid=1059862425.1632077648&jid=1952949964&_v=5.7.2&z=338473630

35 B
451 B

81ms
27ms

Image
image/gif

108.177.15.155
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-1449388-5&cid=1059862425.1632077648&jid=1952949964&_v=5.7.2&z=338473630

Requested by

Host: blip.fm
URL: https://blip.fm/mimosafire6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.177.15.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wr-in-f155.1e100.net

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sun, 19 Sep 2021 18:54:07 GMT
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:07 GMT
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
location: https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-1449388-5&cid=1059862425.1632077648&jid=1952949964&_v=5.7.2&z=338473630
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 369
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 iframe_api Show response
www.youtube.com/ 980 B
2 KB 66ms
30ms Script
text/javascript 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: blip.fm
URL: https://blip.fm/_/js/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

15f82c1390578d6d20727a3bb7191dc62d07b221005c34f191eddae4cfe0e21b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:54:08 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
server: ESF
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=31536000
report-to: {"group":"AZM8irYOyGiHPUipdmT4ndw90h_PnG3TnL0unA","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8irYOyGiHPUipdmT4ndw90h_PnG3TnL0unA"}]}
content-type: text/javascript; charset=utf-8
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: private, max-age=0
permissions-policy: ch-ua-full-version=*, ch-ua-platform=*, ch-ua-platform-version=*, ch-ua-arch=*, ch-ua-model=*
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8irYOyGiHPUipdmT4ndw90h_PnG3TnL0unA"
expires: Sun, 19 Sep 2021 18:54:08 GMT

GET
H/1.1 200
OK loadPage Show response
blip.fm/ajax/ 18 B
414 B 338ms
286ms XHR
application/json 54.163.233.121
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://blip.fm/ajax/loadPage?page=1&bliperId=3050106
Requested by: Host: blip.fm
URL: https://blip.fm/_/js/base.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.163.233.121 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-163-233-121.compute-1.amazonaws.com
Software: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19 / PHP/7.0.19
Resource Hash: 67f2b0a60f37796c436ea0d9f947a22cb196312a87705d10069b65acc2993f01

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: blip.fm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors
Accept: */*
Cache-Control: no-cache
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
Cookie: __utma=171230451.1059862425.1632077648.1632077648.1632077648.1; __utmc=171230451; __utmz=171230451.1632077648.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=171230451.1.10.1632077648
Connection: keep-alive
X-Fuzz-Ajax: true
Referer: https://blip.fm/mimosafire6
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/mimosafire6
X-Requested-With: XMLHttpRequest
X-Fuzz-Ajax: true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 19 Sep 2021 18:52:42 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19
X-Powered-By: PHP/7.0.19
Content-Type: application/json
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0
Connection: Keep-Alive
Keep-Alive: timeout=5, max=90
Content-Length: 18
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 rules-p-b0cBKofGeCYKg.js Show response
rules.quantcount.com/ 3 B
437 B 45ms
9ms Script
application/javascript 18.66.97.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-b0cBKofGeCYKg.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 01:33:36 GMT
via: 1.1 f4137273db9ae377298b8f8daf5b93f1.cloudfront.net (CloudFront)
age: 62433
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 3
last-modified: Sat, 04 Mar 2017 20:48:31 GMT
server: AmazonS3
etag: "8a80554c91d9fca8acb82f023de02f11"
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
x-amz-cf-id: dZu5fRDd3-2CunL7_iBnxG9Rl8UrJgkiN309qXR1N_wvIOor1as95w==

GET
H2 200 rules-p-c4o3JsfzdTxY6.js Show response
rules.quantcount.com/ 3 B
439 B 45ms
10ms Script
application/javascript 18.66.97.52
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-c4o3JsfzdTxY6.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.52 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 00:43:39 GMT
via: 1.1 f4137273db9ae377298b8f8daf5b93f1.cloudfront.net (CloudFront)
age: 65430
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 3
last-modified: Sat, 04 Mar 2017 20:53:31 GMT
server: AmazonS3
etag: "8a80554c91d9fca8acb82f023de02f11"
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
x-amz-cf-id: pYRFP4oeabNAmMflxpdYPANp1AxsFgLfZLQoVGwEvzx9jMXZ3ydXQw==

GET
H/1.1 200
OK noticebg-black.png
blip.fm/images/ 2 KB
3 KB 1163ms
96ms Image
image/png 54.163.233.121
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blip.fm/images/noticebg-black.png
Requested by: Host: blip.fm
URL: https://blip.fm/_/css/base.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.163.233.121 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-163-233-121.compute-1.amazonaws.com
Software: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19 /
Resource Hash: 3983c27985f9ae67aed69d7ca6a82a682a7095df30b8d8253014de0f4ee97427

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: blip.fm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://blip.fm/_/css/base.css
Cookie: __utma=171230451.1059862425.1632077648.1632077648.1632077648.1; __utmc=171230451; __utmz=171230451.1632077648.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=171230451.1.10.1632077648; _dlt=1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/_/css/base.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 19 Sep 2021 18:52:43 GMT
Last-Modified: Tue, 04 Aug 2020 05:09:53 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19
ETag: "9d5-5ac0643edea40"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 2517

GET
H/1.1 200
OK dockbg.png
blip.fm/images/ 607 B
939 B 520ms
102ms Image
image/png 54.163.233.121
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blip.fm/images/dockbg.png
Requested by: Host: blip.fm
URL: https://blip.fm/_/css/base.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.163.233.121 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-163-233-121.compute-1.amazonaws.com
Software: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19 /
Resource Hash: c04e372715cffbc60a3f59d89c6ba50bb9f8adbc36c2e75cbd155f4ae1a911e8

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: blip.fm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://blip.fm/_/css/base.css
Cookie: __utma=171230451.1059862425.1632077648.1632077648.1632077648.1; __utmc=171230451; __utmz=171230451.1632077648.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=171230451.1.10.1632077648; _dlt=1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/_/css/base.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 19 Sep 2021 18:52:43 GMT
Last-Modified: Tue, 04 Aug 2020 05:09:37 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19
ETag: "25f-5ac0642f9c640"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=88
Content-Length: 607

GET
H/1.1 200
OK alert.png
blip.fm/images/icons/ 3 KB
4 KB 713ms
96ms Image
image/png 54.163.233.121
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blip.fm/images/icons/alert.png
Requested by: Host: blip.fm
URL: https://blip.fm/_/css/base.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.163.233.121 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-163-233-121.compute-1.amazonaws.com
Software: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19 /
Resource Hash: 4db8af548255ad1270380918e096b18fddd5b984f95fd4862f18575f8267162f

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: blip.fm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://blip.fm/_/css/base.css
Cookie: __utma=171230451.1059862425.1632077648.1632077648.1632077648.1; __utmc=171230451; __utmz=171230451.1632077648.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=171230451.1.10.1632077648; _dlt=1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/_/css/base.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 19 Sep 2021 18:52:43 GMT
Last-Modified: Tue, 04 Aug 2020 05:09:49 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19
ETag: "d77-5ac0643b0e140"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=86
Content-Length: 3447

GET
H/1.1 200
OK sprite-uber.png
blip.fm/images/blip/ 64 KB
65 KB 616ms
95ms Image
image/png 54.163.233.121
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blip.fm/images/blip/sprite-uber.png
Requested by: Host: blip.fm
URL: https://blip.fm/_/css/base.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.163.233.121 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-163-233-121.compute-1.amazonaws.com
Software: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19 /
Resource Hash: 9585f9660d61236506d8fe0d442168949a866c238ee7fe8c5f32b0aec2b29d71

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: blip.fm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://blip.fm/_/css/base.css
Cookie: __utma=171230451.1059862425.1632077648.1632077648.1632077648.1; __utmc=171230451; __utmz=171230451.1632077648.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=171230451.1.10.1632077648; _dlt=1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/_/css/base.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 19 Sep 2021 18:52:43 GMT
Last-Modified: Tue, 04 Aug 2020 05:09:43 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19
ETag: "1015e-5ac06435553c0"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=87
Content-Length: 65886

GET
H/1.1 200
OK dialogbg.png
blip.fm/images/ 6 KB
6 KB 417ms
100ms Image
image/png 54.163.233.121
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://blip.fm/images/dialogbg.png
Requested by: Host: blip.fm
URL: https://blip.fm/_/css/base.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.163.233.121 , United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-163-233-121.compute-1.amazonaws.com
Software: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19 /
Resource Hash: 8389ab2ff25b494852f8aa7c6972c69140ffb4f74ad5fb5f030d6ed3a1160359

Request headers

Pragma: no-cache
Sec-Fetch-Site: same-origin
Accept-Encoding: gzip, deflate, br
Host: blip.fm
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: no-cors
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Cache-Control: no-cache
Sec-Fetch-Dest: image
Referer: https://blip.fm/_/css/base.css
Cookie: __utma=171230451.1059862425.1632077648.1632077648.1632077648.1; __utmc=171230451; __utmz=171230451.1632077648.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=171230451.1.10.1632077648; _dlt=1
Connection: keep-alive
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/_/css/base.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 19 Sep 2021 18:52:42 GMT
Last-Modified: Tue, 04 Aug 2020 05:09:44 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips PHP/7.0.19
ETag: "17ce-5ac0643649600"
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=89
Content-Length: 6094

GET
H2 200 pixel;r=1946441768;rf=0;a=p-b0cBKofGeCYKg;url=https%3A%2F%2Fblip.fm%2Fmimosafire6;uht=2;fpan=1;fpa=P0-1279919192-1632077648192;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=eccc2c00-20210811224039;cm=;gdpr=0;ref=...
pixel.quantserve.com/ 35 B
372 B 29ms
13ms Image
image/gif 91.228.74.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1946441768;rf=0;a=p-b0cBKofGeCYKg;url=https%3A%2F%2Fblip.fm%2Fmimosafire6;uht=2;fpan=1;fpa=P0-1279919192-1632077648192;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=eccc2c00-20210811224039;cm=;gdpr=0;ref=;d=blip.fm;je=0;sr=1600x1200x24;dst=0;et=1632077648192;tzo=0;ogl=title.Blip%252Efm%20-%20Listen%20to%20free%20music%2Ctype.website%2Cimage.https%3A%2F%2Fd1uswytv6491xe%252Ecloudfront%252Enet%2Fimages%2Fblip%2FblipIcon%252Epng%2Curl.http%3A%2F%2Fblip%252Efm%2Csite_name.Blip%252Efm

Requested by

Host: blip.fm
URL: https://blip.fm/mimosafire6

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.228.74.198 , United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:08 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 pixel;r=217125737;rf=0;a=p-c4o3JsfzdTxY6;url=https%3A%2F%2Fblip.fm%2Fmimosafire6;uht=2;fpan=0;fpa=P0-1279919192-1632077648192;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=eccc2c00-20210811224039;cm=;gdpr=0;ref=;...
pixel.quantserve.com/ 35 B
371 B 28ms
12ms Image
image/gif 91.228.74.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=217125737;rf=0;a=p-c4o3JsfzdTxY6;url=https%3A%2F%2Fblip.fm%2Fmimosafire6;uht=2;fpan=0;fpa=P0-1279919192-1632077648192;pbcn=u;pbc=;ns=0;ce=1;qjs=1;qv=eccc2c00-20210811224039;cm=;gdpr=0;ref=;d=blip.fm;je=0;sr=1600x1200x24;dst=0;et=1632077648195;tzo=0;ogl=title.Blip%252Efm%20-%20Listen%20to%20free%20music%2Ctype.website%2Cimage.https%3A%2F%2Fd1uswytv6491xe%252Ecloudfront%252Enet%2Fimages%2Fblip%2FblipIcon%252Epng%2Curl.http%3A%2F%2Fblip%252Efm%2Csite_name.Blip%252Efm

Requested by

Host: blip.fm
URL: https://blip.fm/mimosafire6

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.228.74.198 , United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:08 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3 200 www-widgetapi.js Show response
www.youtube.com/s/player/d7a19ed1/www-widgetapi.vflset/ 135 KB
44 KB 51ms
17ms Script
text/javascript 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/d7a19ed1/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

16de1d7645521d4b2909a9590e266c6a19dd4992b357f984d05b8e0683245bae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:22:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 1898
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 44760
x-xss-protection: 0
last-modified: Thu, 16 Sep 2021 21:16:41 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 19 Sep 2022 18:22:30 GMT

GET
H3 200 / Show response
www.youtube.com/embed/ Frame DA7A 32 KB
10 KB 50ms
50ms Document
text/html 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d7a19ed1/www-widgetapi.vflset/www-widgetapi.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3763253d17a9a127b00f2158e2fbd21da1b31dcac352945b00af79acef3af4e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blip.fm/
accept-encoding: gzip, deflate, br
cookie: YSC=2XOGwRBEBu8; VISITOR_INFO1_LIVE=1pecmVWIBMM
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/

Response headers

content-type: text/html; charset=utf-8
x-content-type-options: nosniff
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Sun, 19 Sep 2021 18:54:08 GMT
strict-transport-security: max-age=31536000
report-to: {"group":"AZM8irYOyGiHPUipdmT4ndw90h_PnG3TnL0unA","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8irYOyGiHPUipdmT4ndw90h_PnG3TnL0unA"}]}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
permissions-policy: ch-ua-full-version=*, ch-ua-platform=*, ch-ua-platform-version=*, ch-ua-arch=*, ch-ua-model=*
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8irYOyGiHPUipdmT4ndw90h_PnG3TnL0unA"
content-encoding: br
server: ESF
x-xss-protection: 0
set-cookie: CONSENT=PENDING+512; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.youtube.com; Secure
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 www-player-webp.css
www.youtube.com/s/player/d7a19ed1/ Frame DA7A 329 KB
45 KB 20ms
20ms Stylesheet
text/css 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/d7a19ed1/www-player-webp.css

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f0e6e2a301ea8e5884386e6780410150c1963082e8f39072361cda670e72558c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:16:06 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2282
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46352
x-xss-protection: 0
last-modified: Thu, 16 Sep 2021 21:16:41 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 19 Sep 2022 18:16:06 GMT

GET
H3 200 www-embed-player.js Show response
www.youtube.com/s/player/d7a19ed1/www-embed-player.vflset/ Frame DA7A 201 KB
66 KB 18ms
17ms Script
text/javascript 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/d7a19ed1/www-embed-player.vflset/www-embed-player.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

405618050d05b34ee30b7434fe54da5aba80e997c722fce87cbe8bf37dc767ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 23:11:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 243735
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67291
x-xss-protection: 0
last-modified: Thu, 16 Sep 2021 21:16:41 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Fri, 16 Sep 2022 23:11:53 GMT

GET
H3 200 base.js Show response
www.youtube.com/s/player/d7a19ed1/player_ias.vflset/de_DE/ Frame DA7A 2 MB
505 KB 29ms
28ms Script
text/javascript 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/d7a19ed1/player_ias.vflset/de_DE/base.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

356457fa6fd6703c1102e7d720768399835813e210e8910f83ba2f2e76ce3085

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 23:11:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 243748
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 516948
x-xss-protection: 0
last-modified: Thu, 16 Sep 2021 21:16:41 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Fri, 16 Sep 2022 23:11:40 GMT

GET
H3 200 fetch-polyfill.js Show response
www.youtube.com/s/player/d7a19ed1/fetch-polyfill.vflset/ Frame DA7A 8 KB
3 KB 25ms
25ms Script
text/javascript 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/d7a19ed1/fetch-polyfill.vflset/fetch-polyfill.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 17:55:12 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3536
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2830
x-xss-protection: 0
last-modified: Thu, 16 Sep 2021 21:16:41 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Mon, 19 Sep 2022 17:55:12 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame DA7A 15 KB
15 KB 59ms
26ms Font
font/woff2 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
Origin: https://www.youtube.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 13 Sep 2021 19:58:13 GMT
x-content-type-options: nosniff
age: 514555
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 13 Sep 2022 19:58:13 GMT

GET
H3

200

id Show response
googleads.g.doubleclick.net/pagead/ Frame DA7A
Redirect Chain

https://googleads.g.doubleclick.net/pagead/id
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

113 B
161 B

47ms
23ms

XHR
application/json

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9d0dc19f8d71213331d051940905e21148bc0eec54a244652298c71e178fc097

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:54:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 133
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 19 Sep 2021 18:54:08 GMT
x-content-type-options: nosniff
access-control-allow-origin: https://www.youtube.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad_status.js Show response
static.doubleclick.net/instream/ Frame DA7A 29 B
609 B 70ms
20ms Script
text/javascript 142.250.185.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.doubleclick.net/instream/ad_status.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d7a19ed1/www-embed-player.vflset/www-embed-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f6.1e100.net

Software

sffe /

Resource Hash

eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:39:16 GMT
x-content-type-options: nosniff
age: 892
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29
x-xss-protection: 0
last-modified: Thu, 12 Dec 2013 23:40:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 19 Sep 2021 18:54:16 GMT

GET
H3 200 remote.js Show response
www.youtube.com/s/player/d7a19ed1/player_ias.vflset/de_DE/ Frame DA7A 95 KB
29 KB 18ms
17ms Script
text/javascript 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/d7a19ed1/player_ias.vflset/de_DE/remote.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d7a19ed1/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

00e293a8e025b96124111cfe5aec205d29e63d148cd8715fd0dfc9ea4cdcdda8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 23:11:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 243748
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29920
x-xss-protection: 0
last-modified: Thu, 16 Sep 2021 21:16:41 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Fri, 16 Sep 2022 23:11:40 GMT

GET
H3 200 embed.js Show response
www.youtube.com/s/player/d7a19ed1/player_ias.vflset/de_DE/ Frame DA7A 24 KB
7 KB 17ms
17ms Script
text/javascript 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/d7a19ed1/player_ias.vflset/de_DE/embed.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d7a19ed1/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5b43ebebb44674128bee8be97e893868e07ca3d5512310a0c22fe975b7c2739

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 23:11:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 243735
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7340
x-xss-protection: 0
last-modified: Thu, 16 Sep 2021 21:16:41 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Fri, 16 Sep 2022 23:11:53 GMT

GET
H2 200 cast_sender.js Show response
www.gstatic.com/cv/js/sender/v1/ Frame DA7A 4 KB
3 KB 96ms
40ms Script
text/javascript 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d7a19ed1/player_ias.vflset/de_DE/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:54:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2007
x-xss-protection: 0
last-modified: Tue, 16 Feb 2021 23:57:06 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"cloudview","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="cloudview"
expires: Sun, 19 Sep 2021 18:54:08 GMT

GET
H3 200 cast_sender.js Show response
www.gstatic.com/eureka/clank/89/ Frame DA7A 48 KB
14 KB 55ms
24ms Script
text/javascript 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/eureka/clank/89/cast_sender.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eabf87315be46a093741ed7d6a367b58627e45fbcf22505e3fa092f4dc7a4d80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 07:35:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40699
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview-release
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14262
x-xss-protection: 0
last-modified: Tue, 16 Feb 2021 23:19:33 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"cloudview-release","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview-release"}]}
content-type: text/javascript
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="cloudview-release"
expires: Mon, 20 Sep 2021 07:35:49 GMT

GET
H/1.1 200
OK index.html Show response
sdk.scdn.co/embedded/ Frame 50DE 569 B
777 B 24ms
24ms Document
text/html 199.232.82.248
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.scdn.co/embedded/index.html
Requested by: Host: sdk.scdn.co
URL: https://sdk.scdn.co/spotify-player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.82.248 Marseille, France, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 1fee0b34c67a3e22047b627896862289225552817e79f658ade465b28c7103e0

Request headers

Host: sdk.scdn.co
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://blip.fm/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/

Response headers

Connection: keep-alive
Content-Length: 343
Last-Modified: Fri, 10 Sep 2021 09:54:02 GMT
ETag: "36e50209027281529c6df55c65a290e9"
Content-Type: text/html
Content-Encoding: gzip
Accept-Ranges: bytes
Date: Sun, 19 Sep 2021 18:54:09 GMT
Age: 809859
X-Served-By: cache-ord1743-ORD, cache-mrs10550-MRS
X-Cache: HIT, HIT
X-Cache-Hits: 3, 12
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600

GET
H2 200 gpt.js Show response
www.googletagservices.com/tag/js/ 73 KB
25 KB 59ms
23ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/tag/js/gpt.js

Requested by

Host: empowerlocal-plugin-js.s3.us-east-2.amazonaws.com
URL: https://empowerlocal-plugin-js.s3.us-east-2.amazonaws.com/header.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f161.1e100.net

Software

sffe /

Resource Hash

f8dc85513278b61c321c69c6a8774a48597d11003a1f520c7d00284c9d41cf0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:54:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "992 / 538 of 1000 / last-modified: 1631916691"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25035
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 19 Sep 2021 18:54:09 GMT

GET
H2 200 amp-ad-0.1.js Show response
cdn.ampproject.org/v0/ 71 KB
21 KB 88ms
21ms Script
text/javascript 216.58.212.161
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/v0/amp-ad-0.1.js

Requested by

Host: empowerlocal-plugin-js.s3.us-east-2.amazonaws.com
URL: https://empowerlocal-plugin-js.s3.us-east-2.amazonaws.com/header.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.161 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d3314696afdd9156dd6a16c9f5c538ef526316c81451080ecdc1ba3cddab2e5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding: br
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20784
x-xss-protection: 0
server: sffe
date: Sun, 19 Sep 2021 18:54:09 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: private, max-age=604800, stale-while-revalidate=604800
etag: "6d2dec9f8c8f3593"
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="amphtml-china-available"
expires: Sun, 19 Sep 2021 18:54:09 GMT

GET
H2 200 vue.js Show response
cdn.jsdelivr.net/npm/vue@2.x/dist/ 336 KB
89 KB 48ms
7ms Script
application/javascript 151.101.1.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/vue@2.x/dist/vue.js

Requested by

Host: empowerlocal-plugin-js.s3.us-east-2.amazonaws.com
URL: https://empowerlocal-plugin-js.s3.us-east-2.amazonaws.com/header.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.229 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

69b75483b270421e1a89426dd59387ba090772313561c3e9fa415396a78e8936

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 37277
x-jsd-version: 2.6.14
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
content-length: 90557
etag: W/"53fc9-Jp9Vk24Ybv0rJ6ZZ5HLpQ6vP7ig"
x-served-by: cache-fra19131-FRA, cache-hhn4083-HHN
x-jsd-version-type: version
date: Sun, 19 Sep 2021 18:54:09 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 vuetify.js Show response
cdn.jsdelivr.net/npm/vuetify@2.x/dist/ 2 MB
256 KB 61ms
20ms Script
application/javascript 151.101.1.229
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/vuetify@2.x/dist/vuetify.js

Requested by

Host: empowerlocal-plugin-js.s3.us-east-2.amazonaws.com
URL: https://empowerlocal-plugin-js.s3.us-east-2.amazonaws.com/header.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.1.229 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6dd4fff51fbb3100897e6ac0835da4e6af87ba686a9552b994a5abdfc1e95503

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
age: 40048
x-jsd-version: 2.5.8
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
content-length: 261690
etag: W/"189d04-zdvdxVDgpheWBcDq9CHpFREWgUc"
x-served-by: cache-fra19176-FRA, cache-hhn4083-HHN
x-jsd-version-type: version
date: Sun, 19 Sep 2021 18:54:09 GMT
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/250/ 353 KB
114 KB 77ms
10ms Script
application/javascript 2.21.140.111
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/250/addthis_widget.js?pub=Blip.fm

Requested by

Host: blip.fm
URL: https://blip.fm/_/js/base.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.21.140.111 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-21-140-111.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

acd2f7ad78edeebad4b6b0fdd17ff57d81c3726c60fd5435ee8c5a0115d29403

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Mon, 26 Oct 2020 18:11:48 GMT
server: nginx/1.15.8
etag: "5f971164-5834c"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
cache-control: public, max-age=600
date: Sun, 19 Sep 2021 18:54:09 GMT
x-host: s7.addthis.com
content-length: 116325

GET
H/1.1 200
OK QuickSignup.26.js.jgz Show response
d1uswytv6491xe.cloudfront.net/js/ 1 KB
1 KB 12ms
11ms Script
application/x-javascript 18.66.107.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1uswytv6491xe.cloudfront.net/js/QuickSignup.26.js.jgz
Requested by: Host: blip.fm
URL: https://blip.fm/_/js/base.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.107.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3c00d50d6046dfc2e2a7de2a5a177d35e11b708fe9fc93f966c0d28a304ab485

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 12 Feb 2021 03:39:52 GMT
Content-Encoding: gzip
Age: 18976458
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 742
Last-Modified: Thu, 04 Apr 2019 15:06:32 GMT
Server: AmazonS3
ETag: "7bc3abb8437d89e80c9407562df229a6"
Content-Type: application/x-javascript
Via: 1.1 da9380f22ff2303fc2fd4652bf7ec7ba.cloudfront.net (CloudFront)
Cache-Control: max-age=315360000
X-Amz-Cf-Pop: FRA56-P5
Accept-Ranges: bytes
X-Amz-Cf-Id: xcMIN-XTl4gXEuowHW6KeaZFPz2sPJ-QamTo7Yz_9hn09Vo0TBzjbA==
Expires: Thu, 04 Apr 2024 15:06:30 GMT

GET
H/1.1 200
OK profile.26.js.jgz Show response
d1uswytv6491xe.cloudfront.net/js/ 4 KB
2 KB 7ms
7ms Script
application/x-javascript 18.66.107.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1uswytv6491xe.cloudfront.net/js/profile.26.js.jgz
Requested by: Host: blip.fm
URL: https://blip.fm/_/js/base.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.107.59 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 4b6c4dd2186139cfe5da8627cbd85b7f54e8b4d84164a4f98af88427c6ebb5e0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Fri, 11 Jun 2021 10:51:59 GMT
Content-Encoding: gzip
Age: 8668931
X-Cache: Hit from cloudfront
Connection: keep-alive
Content-Length: 1287
Last-Modified: Thu, 04 Apr 2019 15:06:42 GMT
Server: AmazonS3
ETag: "b3067d3023e15c0cfc5362eb35a1a08a"
Content-Type: application/x-javascript
Via: 1.1 0afa2d721972ae312ad1dd54e47c43cb.cloudfront.net (CloudFront)
Cache-Control: max-age=315360000
X-Amz-Cf-Pop: FRA56-P5
Accept-Ranges: bytes
X-Amz-Cf-Id: ZHfJiWdKvcxlDz-WY8m-1_c7btG-pszOMf2pD_yXOUyNGCMSFT82BQ==
Expires: Thu, 04 Apr 2024 15:06:41 GMT

GET
BLOB 200
OK 92c5f14d-21e2-475b-ac8b-6630300089be
https://blip.fm/ 31 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://blip.fm/92c5f14d-21e2-475b-ac8b-6630300089be
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7725538fe2f71147bffeba7452b434c826aef9009666cb4360c605d0b2a91d1d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length: 31
Content-Type: application/javascript

GET
H2 200 analytics.js Show response
www.google-analytics.com/ Frame 50DE 48 KB
20 KB 87ms
25ms Script
text/javascript 142.250.185.110
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.110 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sdk.scdn.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 432
date: Sun, 19 Sep 2021 18:46:57 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19747
expires: Sun, 19 Sep 2021 20:46:57 GMT

GET
H/1.1 200
OK index.js Show response
sdk.scdn.co/embedded/ Frame 50DE 628 KB
156 KB 24ms
24ms Script
application/javascript 199.232.82.248
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://sdk.scdn.co/embedded/index.js
Requested by: Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 199.232.82.248 Marseille, France, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3b1a4a1c025813e7082240212112f092530497aac960b1d08c27db61d5a6066c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sdk.scdn.co/embedded/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 19 Sep 2021 18:54:09 GMT
Content-Encoding: gzip
Last-Modified: Fri, 10 Sep 2021 09:54:02 GMT
Age: 809858
ETag: "bbb4393d7bfdf22b52deea2d42f5a8e2"
X-Served-By: cache-ord1728-ORD, cache-mrs10550-MRS
X-Cache: HIT, HIT
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 159161
X-Cache-Hits: 2, 1

GET
H2 200 pubads_impl_2021091001.js Show response
securepubads.g.doubleclick.net/gpt/ 333 KB
117 KB 98ms
39ms Script
text/javascript 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091001.js?31062644

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

sffe /

Resource Hash

7345db8b8745d32b70fbbb0867ab8488760e99ce94aa40a78e73ad7fcba15866

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:54:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 119453
x-xss-protection: 0
last-modified: Fri, 10 Sep 2021 19:52:34 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Sun, 19 Sep 2021 18:54:09 GMT

GET
H2 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 120 B
752 B 85ms
34ms XHR
application/json 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=blip.fm

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

14b6bd569fe23027b2cfe5844ecb303486a2d6a129679656d3fd208cec8ad8a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 19 Sep 2021 18:54:09 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95
x-xss-protection: 0
expires: Sun, 19 Sep 2021 18:54:09 GMT

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 36ms
7ms Script
application/x-javascript 2.21.143.57
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js?pub=Blip.fm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.21.143.57 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-143-57.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:54:09 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: B402EDC6F7271ED7
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=10508
accept-ranges: bytes
content-length: 948
x-amz-id-2: 3ZiQcYtRTuh4WJ4BUq+mWoVqgQk4EdHwIkUrSZre2GxPFo/4IUZsv5aBqLknQUvSl0wjR3iM+HQ=

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/Blip.fm/ 166 B
325 B 201ms
200ms Script
application/javascript 2.21.140.111
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/Blip.fm/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js?pub=Blip.fm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.21.140.111 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-140-111.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4cf8b4da854cac70fb514c2d255e93904353bda1fcc7229de2f59d5971d83028

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:54:09 GMT
content-encoding: gzip
etag: 659743217
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public, max-age=59, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 154

GET
H2 200 300lo.json Show response
m.addthis.com/live/red_lojson/ 89 B
249 B 222ms
176ms Script
application/javascript 2.21.140.111
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://m.addthis.com/live/red_lojson/300lo.json?si=6147875119daacdc&bkl=0&bl=1&pdt=7317&sid=6147875119daacdc&pub=Blip.fm&rev=v8.28.8-wp&ln=en&pc=men&cb=0&ab=-&dp=blip.fm&fp=mimosafire6&fr=&of=0&pd=0&irt=0&vcl=0&md=0&ct=1&tct=0&abt=0&cdn=0&pi=1&rb=0&gen=100&chr=UTF-8&mk=mimosafire6%2Cprofile%2Cblip%2Clistener%2Cmusic%20fan%2Cdj%2Cfree%20music%2Cplaylist%2Ctracks%2Cmicroblog%2Cblips%2Clisten%2Cmp3&colc=1632077649795&jsl=4133&uvs=61478751ae3263da000&skipb=1&callback=addthis.cbs.jsonp__09422653695732430
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js?pub=Blip.fm
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.21.140.111 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-140-111.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9fc23f6bfaafcf59e94093730bc3d898d9cb79f26ea9bf8183d251b0e64b2195

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:10 GMT
cache-control: max-age=0, no-cache, no-store, no-transform
content-disposition: attachment; filename=1.txt
content-length: 89
content-type: application/javascript;charset=utf-8

GET sh.f48a1a04fe8dbf021b4cda1d.html
s7.addthis.com/static/ Frame 0C1A 0
0

GET
H2 200 sh.f48a1a04fe8dbf021b4cda1d.html Show response
s7.addthis.com/static/ Frame 8692 71 KB
26 KB 12ms
11ms Document
text/html 2.21.140.111
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/sh.f48a1a04fe8dbf021b4cda1d.html

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/250/addthis_widget.js?pub=Blip.fm

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.21.140.111 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-21-140-111.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

55d783462e6671fa985a6b0829db15474f4e57f0555c93e15cc2db6a1d1e6cab

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

:method: GET
:authority: s7.addthis.com
:scheme: https
:path: /static/sh.f48a1a04fe8dbf021b4cda1d.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blip.fm/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/

Response headers

server: nginx/1.15.8
content-type: text/html
last-modified: Thu, 04 Jun 2020 15:49:19 GMT
etag: W/"5ed917ff-11adc"
timing-allow-origin: *
cache-control: public, max-age=86313600
p3p: CP="NON ADM OUR DEV IND COM STA"
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
content-length: 26421
date: Sun, 19 Sep 2021 18:54:09 GMT
vary: Accept-Encoding
x-host: s7.addthis.com

GET bid
c.amazon-adsystem.com/e/dtb/ 0
0

GET
H2 200 / Show response
apresolve.spotify.com/ Frame 50DE 208 B
230 B 78ms
25ms Fetch
application/json 34.98.74.57
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://apresolve.spotify.com/?type=dealer&type=spclient
Requested by: Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.74.57 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 57.74.98.34.bc.googleusercontent.com
Software: /
Resource Hash: 7fcb7ddae6668cda975f56b3eebec45add7ed17d31a20e5cc56412c6307d0396

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sdk.scdn.co/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:54:10 GMT
content-encoding: gzip
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=0
alt-svc: clear
content-length: 102
via: 1.1 google

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
853 B 118ms
32ms Script
application/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=blip.fm

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091001.js?31062644

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 19 Sep 2021 18:54:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 88ms
33ms Script
application/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=blip.fm

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091001.js?31062644

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 19 Sep 2021 18:54:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 304 KB
88 KB 647ms
618ms XHR
text/plain 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=320028662497518&correlator=4425546330557939&output=ldjh&impl=fifs&eid=31060838%2C31062644%2C31062524%2C44750910&vrg=2021091001&ptt=17&sc=1&sfv=1-0-38&ecs=20210919&iu_parts=12230023%2Cel_blip_leaderboard%2Cel_blip_halfpage%2Cel_blip_mediumrectangle%2Cel_blip_largerectangle%2Cel_blip_largeleaderboard%2Cel_blip_skyscraper%2Cel_blip_anchor%2Cel_blip_superleaderboard%2Cel_blip_leaderboardtop&enc_prev_ius=%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F3%2C%2F0%2F3%2C%2F0%2F3%2C%2F0%2F4%2C%2F0%2F4%2C%2F0%2F4%2C%2F0%2F4%2C%2F0%2F5%2C%2F0%2F6%2C%2F0%2F7%2C%2F0%2F8%2C%2F0%2F9&prev_iu_szs=728x90%2C728x90%2C728x90%2C728x90%2C728x90%2C300x600%2C300x250%2C300x250%2C300x250%2C300x250%2C336x280%2C336x280%2C336x280%2C336x280%2C970x90%2C160x600%2C728x90%2C970x250%2C728x90&prev_scp=amznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1%7Camznbid%3D1%26amznp%3D1&eri=1&cust_params=amznbid%3D0%26amznp%3D0&cookie_enabled=1&bc=31&arp=1&abxe=1&lmt=1632077650&dt=1632077650060&dlt=1632077646860&idt=3111&frm=20&biw=1600&bih=1200&oid=3&adxs=-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C280%2C-9%2C436%2C-9%2C-9&adys=-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C689%2C-9%2C1110%2C-9%2C-9&adks=617433239%2C617433238%2C617433233%2C617433232%2C617433235%2C4165216314%2C3598324391%2C3598324388%2C3598324389%2C3598324394%2C1974185959%2C1974185958%2C1974185957%2C1974185956%2C3076314635%2C2382161721%2C3224969948%2C553478435%2C982267445&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca%7Cb%7Cc%7Cd%7Ce%7Cf%7Cg%7Ch%7Ci%7Cj&ifi=1&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fblip.fm%2Fmimosafire6&vis=1&dmc=8&scr_x=0&scr_y=0&psz=0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C1040x0%7C0x-1%7C1600x-1%7C0x-1%7C0x-1&msz=0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C1040x0%7C0x-1%7C1600x-1%7C0x-1%7C0x-1&ga_vid=1059862425.1632077648&ga_sid=1632077648&ga_hid=795778973&ga_fc=true&fws=2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C4%2C2%2C516%2C2%2C2&ohw=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C1040%2C0%2C1040%2C0%2C0&btvi=-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C-1%7C0%7C-1%7C0%7C-1%7C-1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0.

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091001.js?31062644

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

cafe /

Resource Hash

7e28884a46328b7e73dde9c5ba26912f8a9e75d24b30e99cb03d02ced992851e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:54:10 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 90350
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-2,-1,-1,-1
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-1,-2,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://blip.fm
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 40DB 6 KB
4 KB 129ms
34ms Document
text/html 142.250.186.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091001.js?31062644

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f1.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blip.fm/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Sun, 19 Sep 2021 18:54:10 GMT
expires: Mon, 19 Sep 2022 18:54:10 GMT
cache-control: public, immutable, max-age=31536000
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 401 check_scope Show response
api.spotify.com/v1/melody/v1/ Frame 50DE 77 B
247 B 31ms
31ms Fetch
application/json 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Requested by

Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

863e7d2c37417b268dcfbeb4430cccad660050490c6d66f2d657370df21c5b06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

authorization: Bearer undefined
Referer: https://sdk.scdn.co/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
www-authenticate: Bearer realm="spotify", error="invalid_token", error_description="Invalid access token"
server: envoy
access-control-allow-origin: *
date: Sun, 19 Sep 2021 18:54:10 GMT
access-control-max-age: 604800
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-credentials: true
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
alt-svc: clear
content-length: 92
x-content-type-options: nosniff

OPTIONS
H2 200 check_scope
api.spotify.com/v1/melody/v1/ Frame 0
0 82ms
27ms Preflight 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Protocol

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Origin: https://sdk.scdn.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: *
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
access-control-allow-credentials: true
access-control-max-age: 604800
content-length: 0
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
date: Sun, 19 Sep 2021 18:54:09 GMT
server: envoy
via: HTTP/2 edgeproxy, 1.1 google
alt-svc: clear

GET
H2 401 check_scope Show response
api.spotify.com/v1/melody/v1/ Frame 50DE 77 B
162 B 27ms
26ms Fetch
application/json 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Requested by

Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

863e7d2c37417b268dcfbeb4430cccad660050490c6d66f2d657370df21c5b06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

authorization: Bearer undefined
Referer: https://sdk.scdn.co/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
www-authenticate: Bearer realm="spotify", error="invalid_token", error_description="Invalid access token"
server: envoy
access-control-allow-origin: *
date: Sun, 19 Sep 2021 18:54:10 GMT
access-control-max-age: 604800
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-credentials: true
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
alt-svc: clear
content-length: 92
x-content-type-options: nosniff

OPTIONS
H2 200 check_scope
api.spotify.com/v1/melody/v1/ Frame 0
0 28ms
27ms Preflight 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Protocol

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Origin: https://sdk.scdn.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: *
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
access-control-allow-credentials: true
access-control-max-age: 604800
content-length: 0
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
date: Sun, 19 Sep 2021 18:54:10 GMT
server: envoy
via: HTTP/2 edgeproxy, 1.1 google
alt-svc: clear

GET
H3 200 container.html Show response
8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 5806 6 KB
3 KB 50ms
21ms Document
text/html 142.250.186.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091001.js?31062644

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f1.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blip.fm/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Sun, 19 Sep 2021 18:54:10 GMT
expires: Mon, 19 Sep 2022 18:54:10 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 container.html Show response
8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame F8CA 6 KB
3 KB 47ms
23ms Document
text/html 142.250.186.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091001.js?31062644

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f1.1e100.net

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-38/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blip.fm/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
timing-allow-origin: *
content-length: 3108
date: Sun, 19 Sep 2021 18:54:10 GMT
expires: Mon, 19 Sep 2022 18:54:10 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 72 KB
27 KB 48ms
27ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091001.js?31062644

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

24d026371427b41d6d168c5d4c18de465b026afc3907c86c8f3b3bc31bd87467

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:54:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27652
x-xss-protection: 0
server: sffe
etag: "1631879122047051"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Sun, 19 Sep 2021 18:54:10 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
9 KB 100ms
45ms XHR
application/json 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021091001&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091001.js?31062644

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

feefc2e349628d10fe991ec367a137062320c83c29cb8b950c09237e1f86f1da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Sun, 19 Sep 2021 18:54:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8580
x-xss-protection: 0

POST
H3 200 log_event Show response
www.youtube.com/youtubei/v1/ Frame DA7A 28 B
54 B 31ms
31ms XHR
application/json 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/d7a19ed1/www-embed-player.vflset/www-embed-player.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: application/json
X-YouTube-Utc-Offset: 0
X-YouTube-Client-Name: 56
Referer: https://www.youtube.com/embed/?enablejsapi=1&origin=https%3A%2F%2Fblip.fm&widgetid=1
X-YouTube-Client-Version: 1.20210915.1.2
X-YouTube-Time-Zone: Etc/Unknown
X-Goog-Visitor-Id: CgsxcGVjbVZXSUJNTSjQjp6KBg%3D%3D
X-YouTube-Ad-Signals: dt=1632077648409&flash=0&frm=2&u_tz&u_his=2&u_java&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_nplug=3&u_nmime=4&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C320%2C270&vis=1&wgl=true&ca_type=image&bid=ANyPxKpKnT3BDROSyQ7XZpPvRG5GToARtxRzDwtc7jseVTlU6UqSURBm7zf9Ny-2LO04Rm6Bcsw0wr3QKHb-6TIb6jJV58_T_A

Response headers

date: Sun, 19 Sep 2021 18:54:10 GMT
content-encoding: br
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: Origin, X-Origin, Referer
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31
x-xss-protection: 0
expires: Sun, 19 Sep 2021 18:54:10 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame C874 624 B
297 B 27ms
27ms Document
text/html 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYncXFlQEwAQ&v=APEucNVPSLQyBKeUxmopsrNo9Z92Bm0kdSGYq3Ohgyi8Eh-jyI05vyBtkIh8dGuAtZqKC8SwzibJ_V2pINe_Bn9UUEqlNxGTW1US4ZM3We1TG0TkxtvwVFQQ1Lv2zQRQ0tyHKmRCsentaQzKu-EyQX7cPN-X4_S5O8betVemMF0jbdaF-ptrEbs

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsYncXFlQEwAQ&v=APEucNVPSLQyBKeUxmopsrNo9Z92Bm0kdSGYq3Ohgyi8Eh-jyI05vyBtkIh8dGuAtZqKC8SwzibJ_V2pINe_Bn9UUEqlNxGTW1US4ZM3We1TG0TkxtvwVFQQ1Lv2zQRQ0tyHKmRCsentaQzKu-EyQX7cPN-X4_S5O8betVemMF0jbdaF-ptrEbs
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUn0uzxqFmbvlFBkL9-MZmvgTJqGXF6MwdkQ5CZPF2bhpjEA8haeIXGGWCSO
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 19 Sep 2021 18:54:10 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 5806 24 KB
13 KB 49ms
49ms Script
text/javascript 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AsprL03uLzZuxv21dj1yvPgbiumKYlqSjTxtAmMebjj09dgdYn-sJCjLjuNLFRw8wcidJAo0cqDnN55eGiQGomREq0sHwLw4sLGfLA063El3_slUmJ5CWiyODao2CzIZrG69Qelw6AphjLVl86zXoi-x1Lcw&cry=1&dbm_d=AKAmf-BsWX0t4LLJmSf1M3PHl7ylZrcYhFuTABFnJKEFVUWour-i0dNFAkUPphvZa42X5xsog_J0O_KnMyiUYx3xzr2jsEj3dMhsjtWe5qImMOYf64FVGmWqMUFB0HGLEs3FWxwbS-68B5P3TMDe9Wr73EdcIsuvnI0QpAYlTeB3Bpi5maKp4NJ3WViCXi4BX9PsKOnNhyp0_3vtUJ7Jgjo6PQbKqAnFgU9F0edlXKoa5BS6-GLLS3PAB_0SEyp6QbfqeqlrI1e5TJ9ZCoNFF1aAm6LOTq14pliOVkmwo_0QL0Cmh44UzQMTm7PY7AB4P4tVCTsIxpmomD9IaUlbhcpkijDrEes4iMwZ837I5ZAUM1bBAnfrByYhj20f8Y0AHLp0VA7L6ypQSie0WiIzcutgm89thHIs4y86KWUouFH6jmBdCksZprW-1MtBuIjuqWYtIdJ9QTCGJFLv0mKCK9WRhLis0ctMVoKAqBpkW26YdgXLtdhCysgfUMt-ebjhqmJWyjuUifrmnNW-UEct1m9fczndXbYU0Joq5wJ6K4Wu03OgI_3qXjHxaOt15UB-NTIQOHqowT_cyoIcg2MALT0z4kPsdshv0SUyZnaOzL7PmgvMvRMp6uMMsHjRQ2HkCM5STK5SACEfMYqG8JlkliRmQ65bZaae2mS796dBPBLI-OHwYbxcRMrv6cOY-ULcs_r6GYUgKpH3XDv4Z_NZO1rMubMzXOMeON70X4_nH266sCFGO24XZpXEKbY3PRUCbklwLuaa2kGskAH3h8p4sqWed9qnoZE77qbGRyr0SZU6Gp91EfmHVH-8SyTrdLbZ2UH3SRuzFC34EmuMYwLG0cmFZG10V2Ees8TeEZp3Cbc3666EfMxAiFFn_ZkO7VMoE1vT0r65bg42eASXZcF06LK32it5pHYt6lyvfiOQ_UQQNw0pfuPhMml7C8WQBcthslHUVim7FFDaMtVCUu9MHYPS-2QsIl4NVTf0bCukixWyrIK0VLjtX9dvBjd1iM3Qj6rcIT6GuCPwkowmX3MjCB7qPrl0vvL3VI82RnPyldutkWdad_ZuvRs_VRdmyq20_hZ3y7Zbx_KpAjC7AYisURyH7CfmZch0IlqHOVWzfYI_ldIaee_xbLtZvUh2HwrIAlCdNXl4fQcOIlKJLLXtO0IoaULCZrhk4CxBUr0UVMMNgdil4REfRizIaatDtbKrLVM2IuKUH5aEZeZdXQSikdinbWSuAAxqvZMZLgORAzodM7NoutiBiF2lp_px-MMOhchXrMRlND4-odFRZA6QBGrqKGDx8-4vNxN4bvEN2SFWB0f5PFg47ShVg6OVTOgVSAvn-_G7CcJ3ppeslMkscaOdB4n7rPFiaptzqL0JH4IHHk7BKZ2BnGXE30vqK7h-8g8zTA_v_2-Q4yfUDmNujCrJk3_tBEe3D3dAPviTJxQktt8heX-hBS-d9Kf-fu-sZvQCEXtjZUiXSK7npBkrguXvOnsNX4epuKtUpiyqHyUQlNqA8hX12dYr-eyckY-9pPKgP2tVubUO-T67miFfU1USaYVhCQtUY0273BLKQTIDi944ak_CqFXF-W_5XnGB-Bu5DE4P4yaX0eAqVGyWigEDARqbmpexdoLRgM_xYE82XTcwSGOpTSnuaVBitIPVNMnrFktIyteRMuPoWW6yl10L_F7oD-F4xAuwHLutY6d57lKtsIcDHG_-9kXhvcA4OD7vFHps1Jmsnl--qoir2JUHq8qkX9-FdN17Bxm9IVgFHigsG5F8enED_0Mk432zyamPFU5l4afIjjSgSaUEAesnXQWdi8BF3ERCRo4gnWUR-196scPsC91o5BvVOo_pkh0XTf63yusB3yqxIHwSZZZYZfAZq9gE0S_2X-F9jK2hvZVgYbz9rUWBdPOpZPRaAJRrqzBglANHE1meugMawSnt-c8O6DLepvK37NUVXcT6TKy7vqaUMIEoBerQPZvIX-gTBy64T5SxKTL8AP5obtmIUQCXj4pu9OGbUgJ1zRgDmnVy3D9ThJv9ulUydRUuCbB9iFAu1wytHDIyp3uT4qP7JIWDzQlCGyaJRbLHGv713eFeOqCdJFJ0KjfYo6ZokKKtEZ_FajevRwt5LOCXFFihZVo_1-T_qBpBYkuExokNrJZMat3cX-zLrGOj0mw943eZnhRwWAPPTa7yRvGCV9mL1KpumjAaB-Mn5BF4gEnU7Id4tV6-eoqekqUhCSFfuPGrfl99z-AsXgPYonc8w69tp2MDCcknDIu0jM9nmr76ygud3oihCDyCWzoVbhlFr-RLRRQL9NTz94whcNKNEdVLisX4TgYDucNNMKxzWcHER1HBVEEIrFODHm2K6rEm85ew45poRjLfuAMaO1f_JAQZSpCYtfE5IDXcgNOmSend42u-y1p9VHUkUSKDBBUF2EQ5pqL-A8Af1Gj2B8ks8cEu1wcYRGHAbZIv1DfTrBXaSy-eZS9hsC0EaToUb0PjfNfNsIClMXJSMh59_-oJFJ3RrdrySxcxsLcy1kDJmopKn905JJ2QyblgjviwnWBjyOLHoi6djDVSSbeit5OC51Kk-6gHfI0MJoXKoxuNln3FfT3RuvAz83HF5lkt2d-t3Xiag9O6gUyd8945b6wzCGy1zIki79dpiRzyvGHh3jsB1-g7dAQGhKbB5UgVtSk-pN8X239J5vBYP952nE7SHN-qvlwchg-Z_Ri8AYuVDsS5w4v3p84YA7PjOqg9HVIO-fd-g-wBnu564ocbspmTYXuXIuZ3f7psFs0sxBGKfC4OBCPTkNb1scoWK2GX4SLDd71AFkFAmD21KATN-po5irRrRzUBPrQ3UXtbrdJirY71sQf8WUh3ZnzNJzFKwE_DLk-RAqEJXqNWsjFDJx-ls6cV79XGhrOFe2ERoakmFtNQEMt1oH-2DUigAMIPyGALPuLjoNVdcm-5M4lJWQCcYXcoF1crVTk5voRg2SQJ-JCr2ufnwKneSBQDBNevLOVIRXiwfkYlS1lYoejdOx0gvrv_wtgEwqafdQI9V7q5N5wvYZWO6v4P3y4&cid=CAASEuRom1GASeG__3n6nDB7J8MlYQ&rfl=1%2Chttps%253A%252F%252Fblip.fm%252F%240

Requested by

Host: blip.fm
URL: https://blip.fm/mimosafire6

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d9cc892815537a5866e98cb7d3b6947a51b16e8a0eaf984468ac1d2982ac1d64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:10 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13034
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 5806 42 B
515 B 84ms
31ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BpI-8Y3MOvgIQQf_M8GXPHOs0SqVmQr3__yAfA-kBPdBhBEn6OsJE-zL23kuXXRu0Awc-b_Fz1fmUtWprbUyBil51i4dX8WgsB2nuYxJeoUTe_JsI

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/ Frame 5806 2 KB
1 KB 92ms
40ms Script
text/javascript 142.250.181.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/window_focus_fy2019.js

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:48:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 317
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 03 Oct 2021 18:48:53 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5806 128 KB
39 KB 46ms
45ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

daaaa4101e8414d3c9c0baab3c015599b7e1fa70035268b8ba23ea6790f00bf3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:54:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39526
x-xss-protection: 0
server: sffe
etag: "1631879102694099"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Sun, 19 Sep 2021 18:54:10 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/ Frame 5806 14 KB
7 KB 73ms
22ms Script
text/javascript 142.250.181.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

127fef9bff9c4a7bd820146a3785bf8c7d3c5dbf48dd087f2e0f1d91a25e32c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:52:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 99
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6211
x-xss-protection: 0
server: cafe
etag: 18326705275735229343
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 03 Oct 2021 18:52:31 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A640 624 B
297 B 26ms
25ms Document
text/html 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNX-bYichzXvHzkOuFBuajuRzAoDz6Ao0fxB4tMhjgZDufuxlsh28LkLTqsqTFFGj8V35nTdi4JczzUE-datkCZBDLegpDVuSHTsZGFY-hYxw2iIbNV2bn9aBzE8jEfy67sM5ZdFeU3fZ-zftYutj_yxqeB6apI34N_tYlVgZGgGR8z401U

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNX-bYichzXvHzkOuFBuajuRzAoDz6Ao0fxB4tMhjgZDufuxlsh28LkLTqsqTFFGj8V35nTdi4JczzUE-datkCZBDLegpDVuSHTsZGFY-hYxw2iIbNV2bn9aBzE8jEfy67sM5ZdFeU3fZ-zftYutj_yxqeB6apI34N_tYlVgZGgGR8z401U
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUn0uzxqFmbvlFBkL9-MZmvgTJqGXF6MwdkQ5CZPF2bhpjEA8haeIXGGWCSO
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sun, 19 Sep 2021 18:54:10 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame F8CA 24 KB
13 KB 44ms
44ms Script
text/javascript 172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CIq91fp7289YsX1HcKMsW1RZxTutEUumdsflocmx1JnZQvJN_s4q2pTUFdsRBhQ4beDktlZSgc2BEJTn_s4Clp7oA2X9FxzkUBqY3C0E5_Te5-I6hJ-_8QoeY6IcUkiapt2wcI8RKUTO74sksK4QGDe11R6Q&cry=1&dbm_d=AKAmf-Av6vmt5q8tRuOuAE2jsNoqTcBjtxMbYJDWJ7DDp46ymV05HoB4fV6JQIdrOOXlPwiYyOVQlU-EVOPgQ34FncfUfs5ZFwdldkMwTsM6rFSmpXslAtr09z3HELrS9gxrskD9C9FcPIQleAg7IwOTQzFBz519WeYD3muY6SE0JE_Yg5dVj1MRfya1TYjUQC4ZY87fnMu-ptgUa9GGeOkrjXEHXbxfxYdprylQr0tm4HQXi3_R_0HRqVWgpQ8cGn56E_FkssxmDaCSfHp7SPEwlTlAahBG2Ov1Y0Gi0U4Wb9yEtAJ_e7IQh3X882lgZPczZQtWM6eHxcj5wPy6YVKSCDL8pTP9a594bb0_wOJ6YZK8113fpZNiPKpAd8qgMWevgpjtg-oDYV3swa2mBxuUa_5KY8n7MeveVkdl-Z6HWokXUqjA1Nu3th41O-aAyj3W1LqFYQcS6fzvtOFulRIkRezLqCr9fnqp4-1p3EzjEOKVYQjGA9DXP_IVTP_Pusl0tAWioPJyPRyJpGki384OIW2D6OvAJ_leZqrGSzN3Y7P9bRliju2T7r9A477sIZ2lXT_xcUaZdGJlOrXaHBCjdAVg_pM-vj2Ge0QICAQPNccpEszGARyYq31r2jO7aSqB8K0UOuJWYfJIOQbaIFSacgUUFCFD-hFI4zhjaolM-r9fbleVSzO6UETz1O18RohHzHyRKUqWd3hMbYEkWbgl9uKlZo_-r0s4dNNLjTavDYlZ1mVjTiKaga7g-pGuRlW2xj6jedgeOoUpCqiU-QN2y8GrQ8bBTHtEOAm-himx6jDkekJTii0N5m7hcunUrEbs7pC7Kd4FbVWP2gMKRtcvFXRHJPRmj3gtMhLwUSKdog63fNrVsYKI651H8Mz1gVIf6_Ec21sbmZ3iJhMCAFZymtbvuFYAhWFLxXEP4mD-iGPEIoJduQhaOUdjqfMbTyaO_onnCGj2Qp2iwkrHPtI35KHJgdNivHv93YJB-38sWMpn3t0u1aM5go7d__IMA7aiE0bHPFPFaRcanI2c2VqKyvyrY4dhjDxl1v14OvfACIaUxb5OsmH8pjuLj-mhC-fVP_PItqiG-n8zwQKm4askajemTgk3YWxgQen_RflzECoCkqC7vaWhv_t3ne_fXYY_eVCS8Ek1KNeRiJ-oE7ThfV769zAPxZ3iAf-Y8CByCUMvxrdLg1QB2Lj6yjW7QBuACeX-dMCnNWPTMBNPwo1VV91pOknVAdwXs74vX8e0GDUcWpqzhEfhSyGEAA8DARlubWm9Wd11RKIZvChD8SRdgvnOtS3-_bBZ4lnRJLxTOXw8w6KJvqVFZxhPmszUTMk6PI5k_5qQAxhAbMaUMiOCamC6yr92bChsp7Xvu8sqdYO5Aw3WI-mcNFXpG6cjnTujbmmkNgZn0YPO0qav3uIWxFenDxcxbBFJzBVwGUq339k6jIEs4nIz0HO__Kzanj36WZ-CXFwS-8VZFfdU5oE3hGczVmmejdObV4FbqL0wZSldUQ9Ta9jiFjN1p7RzCcKvV0So6xpRHBsZrQI_O6v-LFnvFFbl4CMjnYb_4VKQOF9uO7Qps7Zfs7YsKVU85Dsyrl_1z7HMZ-PDCT27oLN2SDNBImfg5rZpcOaRWs-FU91AJk5SYcwlUl0YFVaO8Sl6nWGM6dfO7CT6CQmD9kaA9UD4KR8YwerudogMqAngPbsoFfBO5AG-W7zwIP3oFerDT69TH-5sq7Nhh4CY-eQszG1fMNBdYsU9tw5wVN_4_ckFTnUobeNuYjC99B9qtxg3cWrhlrFRWdgW7PGX6XaykeUPWtfrxyVKjSVq_jFzx4pnTPu-5OIPnmnbh3D5V_9vsGmxqkEmrcwS39j7h1L__WrTiUAJConqQIRBSgsdmJFHRUahY4ZOZXlvJyrP9g20i9iJj9-6RqpUFZFoRJuILPA6nGtZLBR3HJRFavFqBOW_HKgXnWD82N7hP3Fx2YFHUrtxAYezUI2bHfNXmRl6WFQuUTp7q4TZ1iIYo21jWCs63uDO50AI8COAFAA7064xXeQgr4uWKIRF3UX6iPKRNgX90Rl8oeq7IpGUfnWcf3vT573F3Ig2W9uOv5x8KALY0ogR8GOveRhurd917p1VU3QaniSDqmEbiLkC8Ny8EoK3RRP4Wi5uw4Wyr0fyTkdiyFhicPqpjirJYuDCIg-qHp2w_OFW_5-XGxBbf6Jenf5eWJhDtvVuVXpqfh2PioEyaoiQIZE0OTZkGCo6eO9Eg4Xv8Wa2jbivqXXsZMguzxsDorU3upLeEvIMl9nD0z7_GY_MkAXOzGLVwk2R0glbs-y1U5CTk4y-KShb4G1MgboDA_BAE2LeL-EuisIId8ALcMlcunB3n7HPSaSd0dl6EIMSxNTCd_9lN7MonoJOJM3qAUOfgv2UBPDAKf0Ce4AWQXf_UXSyfg6bTnUhoG_JdGabVqvrYEDa-YVDhjUag4n2RECa9iaYHCidZdxCsPXxyycLwthb5B5P58WpwE7XIO8ud0-LwHptJ13WnGNWFCSsl9sx3WHXsVS5maW-bkSvu10sbcq5P8AdykcAThuT4rWGmKkXcUwZa1JoQW-FWdsWYNtT0zCqdufFPa0_oo5OttesccDHtRTTGcMOdWj_U1UWgFso28kFzyu_xgMKJcp-1x3LDuw_PfxMg9NELiQjYAt9vEIrsfg0t9fDSy1wJvDvK0sLtqg1DSXIe3-QG4cqMdvXga-kCPuSfrbbMh13WfJ6EynFvy9itOfmfxjjz4Z2FvAilStUd73VQshWQYxz4wZU1ttCaIu02pMHk8mkimLjhQSYR8zJvkPp1WIzoGOqQeHUYuYGf4c-x9bGkFO3IEY-b2MbB-07gDFCD2l6CZM53-6SlZJHshO0uvxiIHY159u9MbVjz9QwQqLtXZ78_mLnDW7GkXkOYinw4bDaBX0JeQ8WSFVRDpknhMZSa29Z9W7xWl0l4QWgfGkADmKCQwT2sdWK0GO1S1S2vqgx9lvhDf2uOXtyCumeTvdGL6y8I9RNJKyiNybpqk91u5yU-ow1A3k&cid=CAASEuRoBzK6m8juOGhFDpJe8KKtKQ&rfl=1%2Chttps%253A%252F%252Fblip.fm%252F%240

Requested by

Host: blip.fm
URL: https://blip.fm/mimosafire6

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2cdfafcf3d37b129fd14c2d57e7b8250bf1bb97bf76241e10d11d7028700551e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:10 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13008
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame F8CA 42 B
107 B 81ms
32ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Bl6qxRnEJBkRR_EXODBycnZyCD9jFzpppj9RBvasO95up6eehvJfObEsn6WCtG-M_7D3Yg8wziPUVCLn0pL7wvtrE_LpZW3Se6gjJPzRCAG0yknUg

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:10 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/ Frame F8CA 2 KB
1 KB 74ms
27ms Script
text/javascript 142.250.181.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/window_focus_fy2019.js

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b6f6d0902ff385f68ec17c4c059d4fe89a0a08f1c022ab70580ea8552dfc0a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:48:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 317
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1339
x-xss-protection: 0
server: cafe
etag: 2275704724217174249
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 03 Oct 2021 18:48:53 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F8CA 128 KB
39 KB 66ms
66ms Script
text/javascript 172.217.23.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

daaaa4101e8414d3c9c0baab3c015599b7e1fa70035268b8ba23ea6790f00bf3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:54:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39526
x-xss-protection: 0
server: sffe
etag: "1631879102694099"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Sun, 19 Sep 2021 18:54:10 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/ Frame F8CA 14 KB
6 KB 70ms
23ms Script
text/javascript 142.250.181.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210915/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

127fef9bff9c4a7bd820146a3785bf8c7d3c5dbf48dd087f2e0f1d91a25e32c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:52:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 99
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6211
x-xss-protection: 0
server: cafe
etag: 18326705275735229343
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 03 Oct 2021 18:52:31 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame F8CA 0
0 92ms
29ms Image
text/html 142.250.186.36
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTarf3M3yn5PTdCef3XftHqHvA_xTEDsLaRhHcAcqQJDPpj7lfi4gL_zI2YpY4FakyZEdG5pqT9AEklPFPH-zV-EeVYfA
Requested by: Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.186.36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s04-in-f4.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 53ms
53ms Script
text/javascript 142.250.181.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021091001.js?31062644

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:54:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sun, 19 Sep 2021 18:54:10 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210915/r20110914/ Frame F8CA 23 KB
9 KB 60ms
27ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210915/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CIq91fp7289YsX1HcKMsW1RZxTutEUumdsflocmx1JnZQvJN_s4q2pTUFdsRBhQ4beDktlZSgc2BEJTn_s4Clp7oA2X9FxzkUBqY3C0E5_Te5-I6hJ-_8QoeY6IcUkiapt2wcI8RKUTO74sksK4QGDe11R6Q&cry=1&dbm_d=AKAmf-Av6vmt5q8tRuOuAE2jsNoqTcBjtxMbYJDWJ7DDp46ymV05HoB4fV6JQIdrOOXlPwiYyOVQlU-EVOPgQ34FncfUfs5ZFwdldkMwTsM6rFSmpXslAtr09z3HELrS9gxrskD9C9FcPIQleAg7IwOTQzFBz519WeYD3muY6SE0JE_Yg5dVj1MRfya1TYjUQC4ZY87fnMu-ptgUa9GGeOkrjXEHXbxfxYdprylQr0tm4HQXi3_R_0HRqVWgpQ8cGn56E_FkssxmDaCSfHp7SPEwlTlAahBG2Ov1Y0Gi0U4Wb9yEtAJ_e7IQh3X882lgZPczZQtWM6eHxcj5wPy6YVKSCDL8pTP9a594bb0_wOJ6YZK8113fpZNiPKpAd8qgMWevgpjtg-oDYV3swa2mBxuUa_5KY8n7MeveVkdl-Z6HWokXUqjA1Nu3th41O-aAyj3W1LqFYQcS6fzvtOFulRIkRezLqCr9fnqp4-1p3EzjEOKVYQjGA9DXP_IVTP_Pusl0tAWioPJyPRyJpGki384OIW2D6OvAJ_leZqrGSzN3Y7P9bRliju2T7r9A477sIZ2lXT_xcUaZdGJlOrXaHBCjdAVg_pM-vj2Ge0QICAQPNccpEszGARyYq31r2jO7aSqB8K0UOuJWYfJIOQbaIFSacgUUFCFD-hFI4zhjaolM-r9fbleVSzO6UETz1O18RohHzHyRKUqWd3hMbYEkWbgl9uKlZo_-r0s4dNNLjTavDYlZ1mVjTiKaga7g-pGuRlW2xj6jedgeOoUpCqiU-QN2y8GrQ8bBTHtEOAm-himx6jDkekJTii0N5m7hcunUrEbs7pC7Kd4FbVWP2gMKRtcvFXRHJPRmj3gtMhLwUSKdog63fNrVsYKI651H8Mz1gVIf6_Ec21sbmZ3iJhMCAFZymtbvuFYAhWFLxXEP4mD-iGPEIoJduQhaOUdjqfMbTyaO_onnCGj2Qp2iwkrHPtI35KHJgdNivHv93YJB-38sWMpn3t0u1aM5go7d__IMA7aiE0bHPFPFaRcanI2c2VqKyvyrY4dhjDxl1v14OvfACIaUxb5OsmH8pjuLj-mhC-fVP_PItqiG-n8zwQKm4askajemTgk3YWxgQen_RflzECoCkqC7vaWhv_t3ne_fXYY_eVCS8Ek1KNeRiJ-oE7ThfV769zAPxZ3iAf-Y8CByCUMvxrdLg1QB2Lj6yjW7QBuACeX-dMCnNWPTMBNPwo1VV91pOknVAdwXs74vX8e0GDUcWpqzhEfhSyGEAA8DARlubWm9Wd11RKIZvChD8SRdgvnOtS3-_bBZ4lnRJLxTOXw8w6KJvqVFZxhPmszUTMk6PI5k_5qQAxhAbMaUMiOCamC6yr92bChsp7Xvu8sqdYO5Aw3WI-mcNFXpG6cjnTujbmmkNgZn0YPO0qav3uIWxFenDxcxbBFJzBVwGUq339k6jIEs4nIz0HO__Kzanj36WZ-CXFwS-8VZFfdU5oE3hGczVmmejdObV4FbqL0wZSldUQ9Ta9jiFjN1p7RzCcKvV0So6xpRHBsZrQI_O6v-LFnvFFbl4CMjnYb_4VKQOF9uO7Qps7Zfs7YsKVU85Dsyrl_1z7HMZ-PDCT27oLN2SDNBImfg5rZpcOaRWs-FU91AJk5SYcwlUl0YFVaO8Sl6nWGM6dfO7CT6CQmD9kaA9UD4KR8YwerudogMqAngPbsoFfBO5AG-W7zwIP3oFerDT69TH-5sq7Nhh4CY-eQszG1fMNBdYsU9tw5wVN_4_ckFTnUobeNuYjC99B9qtxg3cWrhlrFRWdgW7PGX6XaykeUPWtfrxyVKjSVq_jFzx4pnTPu-5OIPnmnbh3D5V_9vsGmxqkEmrcwS39j7h1L__WrTiUAJConqQIRBSgsdmJFHRUahY4ZOZXlvJyrP9g20i9iJj9-6RqpUFZFoRJuILPA6nGtZLBR3HJRFavFqBOW_HKgXnWD82N7hP3Fx2YFHUrtxAYezUI2bHfNXmRl6WFQuUTp7q4TZ1iIYo21jWCs63uDO50AI8COAFAA7064xXeQgr4uWKIRF3UX6iPKRNgX90Rl8oeq7IpGUfnWcf3vT573F3Ig2W9uOv5x8KALY0ogR8GOveRhurd917p1VU3QaniSDqmEbiLkC8Ny8EoK3RRP4Wi5uw4Wyr0fyTkdiyFhicPqpjirJYuDCIg-qHp2w_OFW_5-XGxBbf6Jenf5eWJhDtvVuVXpqfh2PioEyaoiQIZE0OTZkGCo6eO9Eg4Xv8Wa2jbivqXXsZMguzxsDorU3upLeEvIMl9nD0z7_GY_MkAXOzGLVwk2R0glbs-y1U5CTk4y-KShb4G1MgboDA_BAE2LeL-EuisIId8ALcMlcunB3n7HPSaSd0dl6EIMSxNTCd_9lN7MonoJOJM3qAUOfgv2UBPDAKf0Ce4AWQXf_UXSyfg6bTnUhoG_JdGabVqvrYEDa-YVDhjUag4n2RECa9iaYHCidZdxCsPXxyycLwthb5B5P58WpwE7XIO8ud0-LwHptJ13WnGNWFCSsl9sx3WHXsVS5maW-bkSvu10sbcq5P8AdykcAThuT4rWGmKkXcUwZa1JoQW-FWdsWYNtT0zCqdufFPa0_oo5OttesccDHtRTTGcMOdWj_U1UWgFso28kFzyu_xgMKJcp-1x3LDuw_PfxMg9NELiQjYAt9vEIrsfg0t9fDSy1wJvDvK0sLtqg1DSXIe3-QG4cqMdvXga-kCPuSfrbbMh13WfJ6EynFvy9itOfmfxjjz4Z2FvAilStUd73VQshWQYxz4wZU1ttCaIu02pMHk8mkimLjhQSYR8zJvkPp1WIzoGOqQeHUYuYGf4c-x9bGkFO3IEY-b2MbB-07gDFCD2l6CZM53-6SlZJHshO0uvxiIHY159u9MbVjz9QwQqLtXZ78_mLnDW7GkXkOYinw4bDaBX0JeQ8WSFVRDpknhMZSa29Z9W7xWl0l4QWgfGkADmKCQwT2sdWK0GO1S1S2vqgx9lvhDf2uOXtyCumeTvdGL6y8I9RNJKyiNybpqk91u5yU-ow1A3k&cid=CAASEuRoBzK6m8juOGhFDpJe8KKtKQ&rfl=1%2Chttps%253A%252F%252Fblip.fm%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

574d0f8eeef6741771d3cef0cc4869634263181bbf42de1e93ca22dcae36d8e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:49:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 282
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9215
x-xss-protection: 0
server: cafe
etag: 10665788317172091938
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 03 Oct 2021 18:49:28 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame F8CA 41 KB
15 KB 31ms
30ms Script
text/javascript 142.250.181.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 17 Sep 2021 08:58:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 208564
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sat, 17 Sep 2022 08:58:06 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210915/r20110914/ Frame 5806 23 KB
9 KB 60ms
28ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210915/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AsprL03uLzZuxv21dj1yvPgbiumKYlqSjTxtAmMebjj09dgdYn-sJCjLjuNLFRw8wcidJAo0cqDnN55eGiQGomREq0sHwLw4sLGfLA063El3_slUmJ5CWiyODao2CzIZrG69Qelw6AphjLVl86zXoi-x1Lcw&cry=1&dbm_d=AKAmf-BsWX0t4LLJmSf1M3PHl7ylZrcYhFuTABFnJKEFVUWour-i0dNFAkUPphvZa42X5xsog_J0O_KnMyiUYx3xzr2jsEj3dMhsjtWe5qImMOYf64FVGmWqMUFB0HGLEs3FWxwbS-68B5P3TMDe9Wr73EdcIsuvnI0QpAYlTeB3Bpi5maKp4NJ3WViCXi4BX9PsKOnNhyp0_3vtUJ7Jgjo6PQbKqAnFgU9F0edlXKoa5BS6-GLLS3PAB_0SEyp6QbfqeqlrI1e5TJ9ZCoNFF1aAm6LOTq14pliOVkmwo_0QL0Cmh44UzQMTm7PY7AB4P4tVCTsIxpmomD9IaUlbhcpkijDrEes4iMwZ837I5ZAUM1bBAnfrByYhj20f8Y0AHLp0VA7L6ypQSie0WiIzcutgm89thHIs4y86KWUouFH6jmBdCksZprW-1MtBuIjuqWYtIdJ9QTCGJFLv0mKCK9WRhLis0ctMVoKAqBpkW26YdgXLtdhCysgfUMt-ebjhqmJWyjuUifrmnNW-UEct1m9fczndXbYU0Joq5wJ6K4Wu03OgI_3qXjHxaOt15UB-NTIQOHqowT_cyoIcg2MALT0z4kPsdshv0SUyZnaOzL7PmgvMvRMp6uMMsHjRQ2HkCM5STK5SACEfMYqG8JlkliRmQ65bZaae2mS796dBPBLI-OHwYbxcRMrv6cOY-ULcs_r6GYUgKpH3XDv4Z_NZO1rMubMzXOMeON70X4_nH266sCFGO24XZpXEKbY3PRUCbklwLuaa2kGskAH3h8p4sqWed9qnoZE77qbGRyr0SZU6Gp91EfmHVH-8SyTrdLbZ2UH3SRuzFC34EmuMYwLG0cmFZG10V2Ees8TeEZp3Cbc3666EfMxAiFFn_ZkO7VMoE1vT0r65bg42eASXZcF06LK32it5pHYt6lyvfiOQ_UQQNw0pfuPhMml7C8WQBcthslHUVim7FFDaMtVCUu9MHYPS-2QsIl4NVTf0bCukixWyrIK0VLjtX9dvBjd1iM3Qj6rcIT6GuCPwkowmX3MjCB7qPrl0vvL3VI82RnPyldutkWdad_ZuvRs_VRdmyq20_hZ3y7Zbx_KpAjC7AYisURyH7CfmZch0IlqHOVWzfYI_ldIaee_xbLtZvUh2HwrIAlCdNXl4fQcOIlKJLLXtO0IoaULCZrhk4CxBUr0UVMMNgdil4REfRizIaatDtbKrLVM2IuKUH5aEZeZdXQSikdinbWSuAAxqvZMZLgORAzodM7NoutiBiF2lp_px-MMOhchXrMRlND4-odFRZA6QBGrqKGDx8-4vNxN4bvEN2SFWB0f5PFg47ShVg6OVTOgVSAvn-_G7CcJ3ppeslMkscaOdB4n7rPFiaptzqL0JH4IHHk7BKZ2BnGXE30vqK7h-8g8zTA_v_2-Q4yfUDmNujCrJk3_tBEe3D3dAPviTJxQktt8heX-hBS-d9Kf-fu-sZvQCEXtjZUiXSK7npBkrguXvOnsNX4epuKtUpiyqHyUQlNqA8hX12dYr-eyckY-9pPKgP2tVubUO-T67miFfU1USaYVhCQtUY0273BLKQTIDi944ak_CqFXF-W_5XnGB-Bu5DE4P4yaX0eAqVGyWigEDARqbmpexdoLRgM_xYE82XTcwSGOpTSnuaVBitIPVNMnrFktIyteRMuPoWW6yl10L_F7oD-F4xAuwHLutY6d57lKtsIcDHG_-9kXhvcA4OD7vFHps1Jmsnl--qoir2JUHq8qkX9-FdN17Bxm9IVgFHigsG5F8enED_0Mk432zyamPFU5l4afIjjSgSaUEAesnXQWdi8BF3ERCRo4gnWUR-196scPsC91o5BvVOo_pkh0XTf63yusB3yqxIHwSZZZYZfAZq9gE0S_2X-F9jK2hvZVgYbz9rUWBdPOpZPRaAJRrqzBglANHE1meugMawSnt-c8O6DLepvK37NUVXcT6TKy7vqaUMIEoBerQPZvIX-gTBy64T5SxKTL8AP5obtmIUQCXj4pu9OGbUgJ1zRgDmnVy3D9ThJv9ulUydRUuCbB9iFAu1wytHDIyp3uT4qP7JIWDzQlCGyaJRbLHGv713eFeOqCdJFJ0KjfYo6ZokKKtEZ_FajevRwt5LOCXFFihZVo_1-T_qBpBYkuExokNrJZMat3cX-zLrGOj0mw943eZnhRwWAPPTa7yRvGCV9mL1KpumjAaB-Mn5BF4gEnU7Id4tV6-eoqekqUhCSFfuPGrfl99z-AsXgPYonc8w69tp2MDCcknDIu0jM9nmr76ygud3oihCDyCWzoVbhlFr-RLRRQL9NTz94whcNKNEdVLisX4TgYDucNNMKxzWcHER1HBVEEIrFODHm2K6rEm85ew45poRjLfuAMaO1f_JAQZSpCYtfE5IDXcgNOmSend42u-y1p9VHUkUSKDBBUF2EQ5pqL-A8Af1Gj2B8ks8cEu1wcYRGHAbZIv1DfTrBXaSy-eZS9hsC0EaToUb0PjfNfNsIClMXJSMh59_-oJFJ3RrdrySxcxsLcy1kDJmopKn905JJ2QyblgjviwnWBjyOLHoi6djDVSSbeit5OC51Kk-6gHfI0MJoXKoxuNln3FfT3RuvAz83HF5lkt2d-t3Xiag9O6gUyd8945b6wzCGy1zIki79dpiRzyvGHh3jsB1-g7dAQGhKbB5UgVtSk-pN8X239J5vBYP952nE7SHN-qvlwchg-Z_Ri8AYuVDsS5w4v3p84YA7PjOqg9HVIO-fd-g-wBnu564ocbspmTYXuXIuZ3f7psFs0sxBGKfC4OBCPTkNb1scoWK2GX4SLDd71AFkFAmD21KATN-po5irRrRzUBPrQ3UXtbrdJirY71sQf8WUh3ZnzNJzFKwE_DLk-RAqEJXqNWsjFDJx-ls6cV79XGhrOFe2ERoakmFtNQEMt1oH-2DUigAMIPyGALPuLjoNVdcm-5M4lJWQCcYXcoF1crVTk5voRg2SQJ-JCr2ufnwKneSBQDBNevLOVIRXiwfkYlS1lYoejdOx0gvrv_wtgEwqafdQI9V7q5N5wvYZWO6v4P3y4&cid=CAASEuRom1GASeG__3n6nDB7J8MlYQ&rfl=1%2Chttps%253A%252F%252Fblip.fm%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

574d0f8eeef6741771d3cef0cc4869634263181bbf42de1e93ca22dcae36d8e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:49:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 282
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9215
x-xss-protection: 0
server: cafe
etag: 10665788317172091938
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sun, 03 Oct 2021 18:49:28 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 5806 41 KB
15 KB 36ms
36ms Script
text/javascript 142.250.181.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 17 Sep 2021 08:58:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 208564
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sat, 17 Sep 2022 08:58:06 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C874
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIO-WVtP2qlFmyf05SLCNMU&google_cver=1

43 B
894 B

16ms
16ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIO-WVtP2qlFmyf05SLCNMU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYncXFlQEwAQ&v=APEucNVPSLQyBKeUxmopsrNo9Z92Bm0kdSGYq3Ohgyi8Eh-jyI05vyBtkIh8dGuAtZqKC8SwzibJ_V2pINe_Bn9UUEqlNxGTW1US4ZM3We1TG0TkxtvwVFQQ1Lv2zQRQ0tyHKmRCsentaQzKu-EyQX7cPN-X4_S5O8betVemMF0jbdaF-ptrEbs
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 19 Sep 2021 18:54:11 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 19 Sep 2021 18:54:11 GMT

Redirect headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIO-WVtP2qlFmyf05SLCNMU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame C874
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YUeHU3aFwtUgX9rIT69gLQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIO-WVtP2qlFmyf05SLCNMU&google_cver=1

43 B
894 B

28ms
28ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIO-WVtP2qlFmyf05SLCNMU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYncXFlQEwAQ&v=APEucNVPSLQyBKeUxmopsrNo9Z92Bm0kdSGYq3Ohgyi8Eh-jyI05vyBtkIh8dGuAtZqKC8SwzibJ_V2pINe_Bn9UUEqlNxGTW1US4ZM3We1TG0TkxtvwVFQQ1Lv2zQRQ0tyHKmRCsentaQzKu-EyQX7cPN-X4_S5O8betVemMF0jbdaF-ptrEbs
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 19 Sep 2021 18:54:11 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 19 Sep 2021 18:54:11 GMT

Redirect headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIO-WVtP2qlFmyf05SLCNMU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame C874
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEAfBalT4Mlq7XGRaAUTxnYA&google_cver=1

0
578 B

14ms
14ms

Image
text/html

185.33.220.240
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEAfBalT4Mlq7XGRaAUTxnYA&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYncXFlQEwAQ&v=APEucNVPSLQyBKeUxmopsrNo9Z92Bm0kdSGYq3Ohgyi8Eh-jyI05vyBtkIh8dGuAtZqKC8SwzibJ_V2pINe_Bn9UUEqlNxGTW1US4ZM3We1TG0TkxtvwVFQQ1Lv2zQRQ0tyHKmRCsentaQzKu-EyQX7cPN-X4_S5O8betVemMF0jbdaF-ptrEbs

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.240 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 19 Sep 2021 18:54:11 GMT
X-Proxy-Origin: 216.131.111.34; 216.131.111.34; 717.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: abde513a-1bb1-4d8d-a3f9-bfd102fe3e42
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEAfBalT4Mlq7XGRaAUTxnYA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame C874
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTc4ODU5MzcwMjMyMTU2MTc4Mw%3D%3D

170 B
243 B

123ms
123ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTc4ODU5MzcwMjMyMTU2MTc4Mw%3D%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 19 Sep 2021 18:54:11 GMT
X-Proxy-Origin: 216.131.111.34; 216.131.111.34; 717.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 392fcad6-229b-4f12-a757-55af9498fa30
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NTc4ODU5MzcwMjMyMTU2MTc4Mw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A640
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIO-WVtP2qlFmyf05SLCNMU&google_cver=1

43 B
894 B

14ms
14ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIO-WVtP2qlFmyf05SLCNMU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNX-bYichzXvHzkOuFBuajuRzAoDz6Ao0fxB4tMhjgZDufuxlsh28LkLTqsqTFFGj8V35nTdi4JczzUE-datkCZBDLegpDVuSHTsZGFY-hYxw2iIbNV2bn9aBzE8jEfy67sM5ZdFeU3fZ-zftYutj_yxqeB6apI34N_tYlVgZGgGR8z401U
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 19 Sep 2021 18:54:11 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 19 Sep 2021 18:54:11 GMT

Redirect headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIO-WVtP2qlFmyf05SLCNMU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame A640
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YUeHU3aFwtUgX9rIT69gLgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIO-WVtP2qlFmyf05SLCNMU&google_cver=1

43 B
894 B

18ms
17ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIO-WVtP2qlFmyf05SLCNMU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNX-bYichzXvHzkOuFBuajuRzAoDz6Ao0fxB4tMhjgZDufuxlsh28LkLTqsqTFFGj8V35nTdi4JczzUE-datkCZBDLegpDVuSHTsZGFY-hYxw2iIbNV2bn9aBzE8jEfy67sM5ZdFeU3fZ-zftYutj_yxqeB6apI34N_tYlVgZGgGR8z401U
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 19 Sep 2021 18:54:11 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 19 Sep 2021 18:54:11 GMT

Redirect headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIO-WVtP2qlFmyf05SLCNMU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame A640
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEAfBalT4Mlq7XGRaAUTxnYA&google_cver=1

0
578 B

13ms
13ms

Image
text/html

185.33.220.240
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEAfBalT4Mlq7XGRaAUTxnYA&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhCn9EsYvNLFlQEwAQ&v=APEucNX-bYichzXvHzkOuFBuajuRzAoDz6Ao0fxB4tMhjgZDufuxlsh28LkLTqsqTFFGj8V35nTdi4JczzUE-datkCZBDLegpDVuSHTsZGFY-hYxw2iIbNV2bn9aBzE8jEfy67sM5ZdFeU3fZ-zftYutj_yxqeB6apI34N_tYlVgZGgGR8z401U

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.240 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 19 Sep 2021 18:54:11 GMT
X-Proxy-Origin: 216.131.111.34; 216.131.111.34; 717.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: b0dd4026-4c61-4f4e-a69c-00ad72432f38
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEAfBalT4Mlq7XGRaAUTxnYA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame A640
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDcxMjExMzAxNjkwOTg4NTMxMw%3D%3D

170 B
232 B

119ms
119ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDcxMjExMzAxNjkwOTg4NTMxMw%3D%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 19 Sep 2021 18:54:11 GMT
X-Proxy-Origin: 216.131.111.34; 216.131.111.34; 717.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: e454278b-f0b1-480d-934a-8a1e335c5dfe
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NDcxMjExMzAxNjkwOTg4NTMxMw%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame C7E2 22 KB
8 KB 50ms
20ms Document
text/html 142.250.181.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 17 Sep 2021 08:58:07 GMT
expires: Sat, 17 Sep 2022 08:58:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 208564
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame B2F5 22 KB
8 KB 47ms
22ms Document
text/html 142.250.181.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
date: Fri, 17 Sep 2021 08:58:07 GMT
expires: Sat, 17 Sep 2022 08:58:07 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 208564
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame 82D0 12 KB
5 KB 45ms
26ms Document
text/html 142.250.181.225
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.225 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blip.fm/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Sun, 19 Sep 2021 17:49:19 GMT
expires: Mon, 19 Sep 2022 17:49:19 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 3892
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame BE05 783 B
537 B 76ms
31ms Document
text/html 142.250.186.36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.36 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f4.1e100.net

Software

GSE /

Resource Hash

ed5476724d927f039dfc688302a4e099a07a47607b7380e0107b2ae2e8fe5d0c

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-6WKlzS17HfE2oAD7EN42NQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://blip.fm/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Sun, 19 Sep 2021 18:54:11 GMT
date: Sun, 19 Sep 2021 18:54:11 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-6WKlzS17HfE2oAD7EN42NQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 515
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 401 check_scope Show response
api.spotify.com/v1/melody/v1/ Frame 50DE 77 B
162 B 28ms
28ms Fetch
application/json 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Requested by

Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

863e7d2c37417b268dcfbeb4430cccad660050490c6d66f2d657370df21c5b06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

authorization: Bearer undefined
Referer: https://sdk.scdn.co/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
www-authenticate: Bearer realm="spotify", error="invalid_token", error_description="Invalid access token"
server: envoy
access-control-allow-origin: *
date: Sun, 19 Sep 2021 18:54:10 GMT
access-control-max-age: 604800
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-credentials: true
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
alt-svc: clear
content-length: 92
x-content-type-options: nosniff

OPTIONS
H2 200 check_scope
api.spotify.com/v1/melody/v1/ Frame 0
0 38ms
38ms Preflight 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Protocol

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Origin: https://sdk.scdn.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: *
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
access-control-allow-credentials: true
access-control-max-age: 604800
content-length: 0
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
date: Sun, 19 Sep 2021 18:54:10 GMT
server: envoy
via: HTTP/2 edgeproxy, 1.1 google
alt-svc: clear

GET
H/1.1 200
OK zy291edt4ui9 Show response
hal9000.redintelligence.net/zone/ Frame 5806 11 KB
4 KB 55ms
19ms Script
text/html 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/zy291edt4ui9?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCY5A0UodHYcW4ENDl-gatyKKYCrXN-YNXnNC5q-UM8C4QASC1y4pGYJXikIKgB8gBCakCGEMp1birsz6oAwGqBKoBT9Co17quitGe1erfdsxPSQK6DgP7_r94gEQ0waAidwcwV_x_9ilsc7xkXLwtv3FcObFHfcg6pB4H_qwIScoH9xZXOhMRCCDI0YqG6Ks2mZfu1hFSb6WtR2sht9Vmm20clBdmCnuZWRRh5m9p5yM8Mg4zjjncfL8VNXJ6FQvrBVnyj5DCKpauGbR5uvS9jQMjL0qZSm3XeIP4dcyiQc5vQv447DJSTCpUgnPABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi04MTA1MTk1ODAzOTE0MDY5gAoDmAsByAsBgAwBsBPCmtoK0BMA2BMD2BQB0BUBgBcB%26ae%3D1%26num%3D1%26cid%3DCAASEuRom1GASeG__3n6nDB7J8MlYQ%26sig%3DAOD64_2AmAExLriWcHtfwWNfh6Hi2oYZ5A%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-BEcNu_P63b5TzL0-lpoF0t9jcK37nsSuJCgEvtOrf4aXcpJUsWd48zOZqwPCS8SNeZ2oMCwPtMJYjj2y96owFvlYNDmNh4XSbQWeWQcz6cRjo5_s2QmiAf9OuP3iCOmcvX3UlgbW0_idpshtSo16bCh2_rvQ%26cry%3D1%26dbm_d%3DAKAmf-DEhxLEG3Ahxz1s-6FY4EdePlHhemhgw7HkfvvxqMdCDuBRKaUWBK4vxMMmLlfNLtsbWdRKZKpDSPIzwaRe86DXsVueDgErKWSLbz0lxPllMDLkmM90iTeXrnQ0CtSmuGfuDwgHLmkbYzZ_zDMfH4sfSQX778J_jzEpbVHGoLxraVPz31anoDGnFlgYfc7iPi2Lqqd6Vf_wQrRirHepWNXrRkpoRdwXsi4St_uCoYFs9Da3nO3leyOu4u6Ta02m5UrXpdiVvdllRUEzKElwusYTX4CXEKnpVDKQLbqCzo30gnHXQA3gjvoUuO-sKbZBwzjAaCvf1BJvgPp4WrNUNjIrXoyRjfTDFIkE1Yx6-5hygYY418MYSKJy9w_l0irhvdHALZxoLSJ80PKpBvqhFsBJwf371aUNaBRvtiJq9odXP7nyvMMZIPsUvJyycTqLawNp3zhl%26adurl%3D
Requested by: Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 783bf5baea552aa0371e4f75cf4111d3932f63169f992c46e3bacefbc4de728b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 19 Sep 2021 18:54:11 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3857
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK 4727t6qteyti Show response
hal9000.redintelligence.net/zone/ Frame F8CA 11 KB
4 KB 53ms
19ms Script
text/html 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/4727t6qteyti?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCr-ZmUodHYca4ENDl-gatyKKYCrXN-YNX_Ni5q-UM8C4QASC1y4pGYJXikIKgB8gBCakCGEMp1birsz6oAwGqBKoBT9BjfcUiTDGqaTyWYJLGoUQALCBtCao3-pc4UJuGx5Rc1515sZo1hz0ShuvxupSegwevjrVgJ-dIIfREMw1zQ-NF7oAQOiD72HqAN5MuuRYQLVeyn-tehCfqmV9BBQOWmWXhxZnzMaAgpD1k2KNmlG2ZaUv7VCBFZFpuNeJ8wX6J2QYoIm-3fGywoNOoN_5wauqNfe_Ximrddbsa7o6ys9yYWBTLOUPTfJ7ABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi04MTA1MTk1ODAzOTE0MDY5gAoDmAsByAsBgAwBsBPCmtoK0BMA2BMD2BQB0BUBgBcB%26ae%3D1%26num%3D1%26cid%3DCAASEuRoBzK6m8juOGhFDpJe8KKtKQ%26sig%3DAOD64_1_cy0hux-OL3afhp-z0iGjfpu3HQ%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-BJwJNZGSd1sNfLgmTKTtZxjH5IG3cshvxQGU2k85VRFW6V32EWovNkEeob96BasKjbPooZwU98HRU68wPpRuvnvRWIcgI4rmJKwP8FteKOKy_sE1VV_aSSGXUO8p4MgilwABDf65_8sO-0pbO-jV2tE2Fn3A%26cry%3D1%26dbm_d%3DAKAmf-D5xScVtpV5OARUxgoLZ0ixVbqsANdcg8reV_2otGH23Dhe3ghQsYWL9ChEDSy8dxUYk0ES8-qWsm7AZR53vk726DeLF3pSva97rvmDvI5NmZRkrMnqazNF8yfHEVJkek7KtJR8JZi-qusUFvviin7NBHUZxhUaGubI0duPC_l3rsEk4SBiEjYYxJ2JgdAbsEOCyhOs4hqrQp0jt5wFoP0RZ1aNnY7LR26BL50yKGm5rplYnU5dogi4k_zG-5bVKztnVYzyHGr5ut5lZ1dzpYICjHyWQm4Ykd3BONWyVkRxpbDjMj6OLGAYkbYnTRzVNptm2aLt5GssffascEsgHd67Hw1GMGcDS9qArs3Vymbf91GsHsoKPt9UV0EWPnBMC7OoOAB4xg4HLzeo8s26UJhm_wnG7X0n_S35nXot7mcJBnl7ZUn_hWZilAR4eBiB_KGjz-eG%26adurl%3D
Requested by: Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 0a73cb42697d7af1daf64e3b6846ded29de8a09326c5ef5aaef669f19b905fab

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 19 Sep 2021 18:54:11 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 3860
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 0laMBStFIjGDX-Lbokpit1PiwVNzXcztY6qwAF7AamA.js Show response
pagead2.googlesyndication.com/bg/ Frame C7E2 35 KB
13 KB 26ms
26ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/0laMBStFIjGDX-Lbokpit1PiwVNzXcztY6qwAF7AamA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d2568c052b452231835fe2dba24a62b753e2c153735dcced63aab0005ec06a60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 11:36:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 26274
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13319
x-xss-protection: 0
last-modified: Mon, 13 Sep 2021 14:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Mon, 19 Sep 2022 11:36:17 GMT

GET
H3 200 0laMBStFIjGDX-Lbokpit1PiwVNzXcztY6qwAF7AamA.js Show response
pagead2.googlesyndication.com/bg/ Frame B2F5 35 KB
13 KB 26ms
26ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/0laMBStFIjGDX-Lbokpit1PiwVNzXcztY6qwAF7AamA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d2568c052b452231835fe2dba24a62b753e2c153735dcced63aab0005ec06a60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 11:36:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 26274
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13319
x-xss-protection: 0
last-modified: Mon, 13 Sep 2021 14:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Mon, 19 Sep 2022 11:36:17 GMT

GET
H/1.1

200
OK

request.php Show response
hal900015.redintelligence.net/ Frame 5806
Redirect Chain

https://hal900015.redintelligence.net/request.php?zone=zy291edt4ui9&nw=20&renderingType=javascript&namespace=a39e53a4ce&subid=&uid=6eb0eaa04bf20535&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900015.redintelligence.net/request.php?zone=zy291edt4ui9&nw=20&renderingType=javascript&namespace=a39e53a4ce&subid=&uid=6eb0eaa04bf20535&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

101ms
74ms

Script
application/x-javascript

138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900015.redintelligence.net/request.php?zone=zy291edt4ui9&nw=20&renderingType=javascript&namespace=a39e53a4ce&subid=&uid=6eb0eaa04bf20535&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCY5A0UodHYcW4ENDl-gatyKKYCrXN-YNXnNC5q-UM8C4QASC1y4pGYJXikIKgB8gBCakCGEMp1birsz6oAwGqBKoBT9Co17quitGe1erfdsxPSQK6DgP7_r94gEQ0waAidwcwV_x_9ilsc7xkXLwtv3FcObFHfcg6pB4H_qwIScoH9xZXOhMRCCDI0YqG6Ks2mZfu1hFSb6WtR2sht9Vmm20clBdmCnuZWRRh5m9p5yM8Mg4zjjncfL8VNXJ6FQvrBVnyj5DCKpauGbR5uvS9jQMjL0qZSm3XeIP4dcyiQc5vQv447DJSTCpUgnPABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi04MTA1MTk1ODAzOTE0MDY5gAoDmAsByAsBgAwBsBPCmtoK0BMA2BMD2BQB0BUBgBcB%26ae%3D1%26num%3D1%26cid%3DCAASEuRom1GASeG__3n6nDB7J8MlYQ%26sig%3DAOD64_2AmAExLriWcHtfwWNfh6Hi2oYZ5A%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-BEcNu_P63b5TzL0-lpoF0t9jcK37nsSuJCgEvtOrf4aXcpJUsWd48zOZqwPCS8SNeZ2oMCwPtMJYjj2y96owFvlYNDmNh4XSbQWeWQcz6cRjo5_s2QmiAf9OuP3iCOmcvX3UlgbW0_idpshtSo16bCh2_rvQ%26cry%3D1%26dbm_d%3DAKAmf-DEhxLEG3Ahxz1s-6FY4EdePlHhemhgw7HkfvvxqMdCDuBRKaUWBK4vxMMmLlfNLtsbWdRKZKpDSPIzwaRe86DXsVueDgErKWSLbz0lxPllMDLkmM90iTeXrnQ0CtSmuGfuDwgHLmkbYzZ_zDMfH4sfSQX778J_jzEpbVHGoLxraVPz31anoDGnFlgYfc7iPi2Lqqd6Vf_wQrRirHepWNXrRkpoRdwXsi4St_uCoYFs9Da3nO3leyOu4u6Ta02m5UrXpdiVvdllRUEzKElwusYTX4CXEKnpVDKQLbqCzo30gnHXQA3gjvoUuO-sKbZBwzjAaCvf1BJvgPp4WrNUNjIrXoyRjfTDFIkE1Yx6-5hygYY418MYSKJy9w_l0irhvdHALZxoLSJ80PKpBvqhFsBJwf371aUNaBRvtiJq9odXP7nyvMMZIPsUvJyycTqLawNp3zhl%26adurl%3D&documentReferer=https%3A%2F%2Fblip.fm%2F&ancestorOrigins=https%3A%2F%2Fblip.fm&random=9380722759017&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: a4df73a04eba989b132b6930f492d6dd5aa2044f733021c18e0ff35c349f37f2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 19 Sep 2021 18:54:11 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 80689800129809900710632011722015
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1307
Expires: Sun, 19 Sep 2021 19:54:11 +0200

Redirect headers

Pragma: no-cache
Date: Sun, 19 Sep 2021 18:54:11 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=zy291edt4ui9&nw=20&renderingType=javascript&namespace=a39e53a4ce&subid=&uid=6eb0eaa04bf20535&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCY5A0UodHYcW4ENDl-gatyKKYCrXN-YNXnNC5q-UM8C4QASC1y4pGYJXikIKgB8gBCakCGEMp1birsz6oAwGqBKoBT9Co17quitGe1erfdsxPSQK6DgP7_r94gEQ0waAidwcwV_x_9ilsc7xkXLwtv3FcObFHfcg6pB4H_qwIScoH9xZXOhMRCCDI0YqG6Ks2mZfu1hFSb6WtR2sht9Vmm20clBdmCnuZWRRh5m9p5yM8Mg4zjjncfL8VNXJ6FQvrBVnyj5DCKpauGbR5uvS9jQMjL0qZSm3XeIP4dcyiQc5vQv447DJSTCpUgnPABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi04MTA1MTk1ODAzOTE0MDY5gAoDmAsByAsBgAwBsBPCmtoK0BMA2BMD2BQB0BUBgBcB%26ae%3D1%26num%3D1%26cid%3DCAASEuRom1GASeG__3n6nDB7J8MlYQ%26sig%3DAOD64_2AmAExLriWcHtfwWNfh6Hi2oYZ5A%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-BEcNu_P63b5TzL0-lpoF0t9jcK37nsSuJCgEvtOrf4aXcpJUsWd48zOZqwPCS8SNeZ2oMCwPtMJYjj2y96owFvlYNDmNh4XSbQWeWQcz6cRjo5_s2QmiAf9OuP3iCOmcvX3UlgbW0_idpshtSo16bCh2_rvQ%26cry%3D1%26dbm_d%3DAKAmf-DEhxLEG3Ahxz1s-6FY4EdePlHhemhgw7HkfvvxqMdCDuBRKaUWBK4vxMMmLlfNLtsbWdRKZKpDSPIzwaRe86DXsVueDgErKWSLbz0lxPllMDLkmM90iTeXrnQ0CtSmuGfuDwgHLmkbYzZ_zDMfH4sfSQX778J_jzEpbVHGoLxraVPz31anoDGnFlgYfc7iPi2Lqqd6Vf_wQrRirHepWNXrRkpoRdwXsi4St_uCoYFs9Da3nO3leyOu4u6Ta02m5UrXpdiVvdllRUEzKElwusYTX4CXEKnpVDKQLbqCzo30gnHXQA3gjvoUuO-sKbZBwzjAaCvf1BJvgPp4WrNUNjIrXoyRjfTDFIkE1Yx6-5hygYY418MYSKJy9w_l0irhvdHALZxoLSJ80PKpBvqhFsBJwf371aUNaBRvtiJq9odXP7nyvMMZIPsUvJyycTqLawNp3zhl%26adurl%3D&documentReferer=https%3A%2F%2Fblip.fm%2F&ancestorOrigins=https%3A%2F%2Fblip.fm&random=9380722759017&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Sun, 19 Sep 2021 19:54:11 +0200

GET
H/1.1

200
OK

request.php Show response
hal900020.redintelligence.net/ Frame F8CA
Redirect Chain

https://hal900020.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=66c8fde413&subid=&uid=f9a615e2248e3506&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900020.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=66c8fde413&subid=&uid=f9a615e2248e3506&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

111ms
85ms

Script
application/x-javascript

178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900020.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=66c8fde413&subid=&uid=f9a615e2248e3506&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCr-ZmUodHYca4ENDl-gatyKKYCrXN-YNX_Ni5q-UM8C4QASC1y4pGYJXikIKgB8gBCakCGEMp1birsz6oAwGqBKoBT9BjfcUiTDGqaTyWYJLGoUQALCBtCao3-pc4UJuGx5Rc1515sZo1hz0ShuvxupSegwevjrVgJ-dIIfREMw1zQ-NF7oAQOiD72HqAN5MuuRYQLVeyn-tehCfqmV9BBQOWmWXhxZnzMaAgpD1k2KNmlG2ZaUv7VCBFZFpuNeJ8wX6J2QYoIm-3fGywoNOoN_5wauqNfe_Ximrddbsa7o6ys9yYWBTLOUPTfJ7ABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi04MTA1MTk1ODAzOTE0MDY5gAoDmAsByAsBgAwBsBPCmtoK0BMA2BMD2BQB0BUBgBcB%26ae%3D1%26num%3D1%26cid%3DCAASEuRoBzK6m8juOGhFDpJe8KKtKQ%26sig%3DAOD64_1_cy0hux-OL3afhp-z0iGjfpu3HQ%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-BJwJNZGSd1sNfLgmTKTtZxjH5IG3cshvxQGU2k85VRFW6V32EWovNkEeob96BasKjbPooZwU98HRU68wPpRuvnvRWIcgI4rmJKwP8FteKOKy_sE1VV_aSSGXUO8p4MgilwABDf65_8sO-0pbO-jV2tE2Fn3A%26cry%3D1%26dbm_d%3DAKAmf-D5xScVtpV5OARUxgoLZ0ixVbqsANdcg8reV_2otGH23Dhe3ghQsYWL9ChEDSy8dxUYk0ES8-qWsm7AZR53vk726DeLF3pSva97rvmDvI5NmZRkrMnqazNF8yfHEVJkek7KtJR8JZi-qusUFvviin7NBHUZxhUaGubI0duPC_l3rsEk4SBiEjYYxJ2JgdAbsEOCyhOs4hqrQp0jt5wFoP0RZ1aNnY7LR26BL50yKGm5rplYnU5dogi4k_zG-5bVKztnVYzyHGr5ut5lZ1dzpYICjHyWQm4Ykd3BONWyVkRxpbDjMj6OLGAYkbYnTRzVNptm2aLt5GssffascEsgHd67Hw1GMGcDS9qArs3Vymbf91GsHsoKPt9UV0EWPnBMC7OoOAB4xg4HLzeo8s26UJhm_wnG7X0n_S35nXot7mcJBnl7ZUn_hWZilAR4eBiB_KGjz-eG%26adurl%3D&documentReferer=https%3A%2F%2Fblip.fm%2F&ancestorOrigins=https%3A%2F%2Fblip.fm&random=4433660603849&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: f07c9aa92e2155dc094b4a1505a17ff72bd3ce57b11b05cab5e0f373dcd4539b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 19 Sep 2021 18:54:11 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 43958200153297800710612011722020
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1311
Expires: Sun, 19 Sep 2021 19:54:11 +0200

Redirect headers

Pragma: no-cache
Date: Sun, 19 Sep 2021 18:54:11 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=66c8fde413&subid=&uid=f9a615e2248e3506&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCr-ZmUodHYca4ENDl-gatyKKYCrXN-YNX_Ni5q-UM8C4QASC1y4pGYJXikIKgB8gBCakCGEMp1birsz6oAwGqBKoBT9BjfcUiTDGqaTyWYJLGoUQALCBtCao3-pc4UJuGx5Rc1515sZo1hz0ShuvxupSegwevjrVgJ-dIIfREMw1zQ-NF7oAQOiD72HqAN5MuuRYQLVeyn-tehCfqmV9BBQOWmWXhxZnzMaAgpD1k2KNmlG2ZaUv7VCBFZFpuNeJ8wX6J2QYoIm-3fGywoNOoN_5wauqNfe_Ximrddbsa7o6ys9yYWBTLOUPTfJ7ABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi04MTA1MTk1ODAzOTE0MDY5gAoDmAsByAsBgAwBsBPCmtoK0BMA2BMD2BQB0BUBgBcB%26ae%3D1%26num%3D1%26cid%3DCAASEuRoBzK6m8juOGhFDpJe8KKtKQ%26sig%3DAOD64_1_cy0hux-OL3afhp-z0iGjfpu3HQ%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-BJwJNZGSd1sNfLgmTKTtZxjH5IG3cshvxQGU2k85VRFW6V32EWovNkEeob96BasKjbPooZwU98HRU68wPpRuvnvRWIcgI4rmJKwP8FteKOKy_sE1VV_aSSGXUO8p4MgilwABDf65_8sO-0pbO-jV2tE2Fn3A%26cry%3D1%26dbm_d%3DAKAmf-D5xScVtpV5OARUxgoLZ0ixVbqsANdcg8reV_2otGH23Dhe3ghQsYWL9ChEDSy8dxUYk0ES8-qWsm7AZR53vk726DeLF3pSva97rvmDvI5NmZRkrMnqazNF8yfHEVJkek7KtJR8JZi-qusUFvviin7NBHUZxhUaGubI0duPC_l3rsEk4SBiEjYYxJ2JgdAbsEOCyhOs4hqrQp0jt5wFoP0RZ1aNnY7LR26BL50yKGm5rplYnU5dogi4k_zG-5bVKztnVYzyHGr5ut5lZ1dzpYICjHyWQm4Ykd3BONWyVkRxpbDjMj6OLGAYkbYnTRzVNptm2aLt5GssffascEsgHd67Hw1GMGcDS9qArs3Vymbf91GsHsoKPt9UV0EWPnBMC7OoOAB4xg4HLzeo8s26UJhm_wnG7X0n_S35nXot7mcJBnl7ZUn_hWZilAR4eBiB_KGjz-eG%26adurl%3D&documentReferer=https%3A%2F%2Fblip.fm%2F&ancestorOrigins=https%3A%2F%2Fblip.fm&random=4433660603849&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Sun, 19 Sep 2021 19:54:11 +0200

GET
H3 200 0laMBStFIjGDX-Lbokpit1PiwVNzXcztY6qwAF7AamA.js Show response
pagead2.googlesyndication.com/bg/ Frame 82D0 35 KB
13 KB 26ms
26ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/0laMBStFIjGDX-Lbokpit1PiwVNzXcztY6qwAF7AamA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

sffe /

Resource Hash

d2568c052b452231835fe2dba24a62b753e2c153735dcced63aab0005ec06a60

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 11:36:17 GMT
content-encoding: br
x-content-type-options: nosniff
age: 26274
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13319
x-xss-protection: 0
last-modified: Mon, 13 Sep 2021 14:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Mon, 19 Sep 2022 11:36:17 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame BE05 0
0 42ms
42ms Image
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gpt_2021091001&jk=320028662497518&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s56-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 0FE8
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873830a7df8deda4aa6?subid=80689800129809900710632011722015&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=80689800129809900710632011722015&actionid=731824&produktid=businessgiro&dt_url=

0
629 B

113ms
70ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=80689800129809900710632011722015&actionid=731824&produktid=businessgiro&dt_url=

Requested by

Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request.php?zone=zy291edt4ui9&nw=20&renderingType=javascript&namespace=a39e53a4ce&subid=&uid=6eb0eaa04bf20535&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCY5A0UodHYcW4ENDl-gatyKKYCrXN-YNXnNC5q-UM8C4QASC1y4pGYJXikIKgB8gBCakCGEMp1birsz6oAwGqBKoBT9Co17quitGe1erfdsxPSQK6DgP7_r94gEQ0waAidwcwV_x_9ilsc7xkXLwtv3FcObFHfcg6pB4H_qwIScoH9xZXOhMRCCDI0YqG6Ks2mZfu1hFSb6WtR2sht9Vmm20clBdmCnuZWRRh5m9p5yM8Mg4zjjncfL8VNXJ6FQvrBVnyj5DCKpauGbR5uvS9jQMjL0qZSm3XeIP4dcyiQc5vQv447DJSTCpUgnPABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi04MTA1MTk1ODAzOTE0MDY5gAoDmAsByAsBgAwBsBPCmtoK0BMA2BMD2BQB0BUBgBcB%26ae%3D1%26num%3D1%26cid%3DCAASEuRom1GASeG__3n6nDB7J8MlYQ%26sig%3DAOD64_2AmAExLriWcHtfwWNfh6Hi2oYZ5A%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-BEcNu_P63b5TzL0-lpoF0t9jcK37nsSuJCgEvtOrf4aXcpJUsWd48zOZqwPCS8SNeZ2oMCwPtMJYjj2y96owFvlYNDmNh4XSbQWeWQcz6cRjo5_s2QmiAf9OuP3iCOmcvX3UlgbW0_idpshtSo16bCh2_rvQ%26cry%3D1%26dbm_d%3DAKAmf-DEhxLEG3Ahxz1s-6FY4EdePlHhemhgw7HkfvvxqMdCDuBRKaUWBK4vxMMmLlfNLtsbWdRKZKpDSPIzwaRe86DXsVueDgErKWSLbz0lxPllMDLkmM90iTeXrnQ0CtSmuGfuDwgHLmkbYzZ_zDMfH4sfSQX778J_jzEpbVHGoLxraVPz31anoDGnFlgYfc7iPi2Lqqd6Vf_wQrRirHepWNXrRkpoRdwXsi4St_uCoYFs9Da3nO3leyOu4u6Ta02m5UrXpdiVvdllRUEzKElwusYTX4CXEKnpVDKQLbqCzo30gnHXQA3gjvoUuO-sKbZBwzjAaCvf1BJvgPp4WrNUNjIrXoyRjfTDFIkE1Yx6-5hygYY418MYSKJy9w_l0irhvdHALZxoLSJ80PKpBvqhFsBJwf371aUNaBRvtiJq9odXP7nyvMMZIPsUvJyycTqLawNp3zhl%26adurl%3D&documentReferer=https%3A%2F%2Fblip.fm%2F&ancestorOrigins=https%3A%2F%2Fblip.fm&random=9380722759017&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: pb.media01.eu
:scheme: https
:path: /view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=80689800129809900710632011722015&actionid=731824&produktid=businessgiro&dt_url=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Sun, 19 Sep 2021 08:54:14 GMT
server: Microsoft-IIS/10.0
set-cookie: ASP.NET_SessionId=qexcxjadrfn0vu2nfoyfztqd; path=/; secure; HttpOnly; SameSite=None DTU=66B1C18C5896A761FFCF6A4A91F060DE; expires=Tue, 19-Sep-2023 18:54:14 GMT; path=/; SameSite=None; secure; HttpOnly; SameSite=None
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
access-control-allow-origin: *
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
access-control-allow-methods: GET,POST
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
date: Sun, 19 Sep 2021 18:54:13 GMT
content-length: 0

Redirect headers

Server: nginx/1.19.7
Date: Sun, 19 Sep 2021 18:54:11 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Keep-Alive: timeout=20
X-Powered-By: PHP/7.2.34
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Range, Content-Disposition, Content-Type, Authorization
Access-Control-Allow-Credentials: true
Set-Cookie: trscj=MTYzMjA3NzY1MXxMM1J5WTJzdlpYQjJMMlU1T1dGaFkyVTVOR1UyWlRVNE56TTRNekJoTjJSbU9HUmxaR0UwWVdFMlAzTjFZbWxrUFRnd05qZzVPREF3TVRJNU9EQTVPVEF3TnpFd05qTXlNREV4TnpJeU1ERTFKblE5YUhSc2NBPT18YUhSMGNITTZMeTg0T0RJMU5EWTRZV05tTldSa01EazRZV1UzWVRZeFpHTmhNekEwWVRjeU5pNXpZV1psWm5KaGJXVXVaMjl2WjJ4bGMzbHVaR2xqWVhScGIyNHVZMjl0THc9PQ%3D%3D; expires=Mon, 19-Sep-2022 18:54:11 GMT; Max-Age=31536000; path=/; samesite=none; domain=.medialead.de; secure SERVERID177589=2|YUeHV|YUeHV; path=/; HttpOnly
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=80689800129809900710632011722015&actionid=731824&produktid=businessgiro&dt_url=
Strict-Transport-Security: max-age=63072000;includeSubdomains;preload max-age=15768000
X-IPLB-Request-ID: D8836F22:EB30_91EFC182:01BB_61478753_8B1420C:26680
X-IPLB-Instance: 40028
Cache-control: private

GET
H2 200 / Show response
adv.office-partner.de/ Frame 5BCB 930 B
1 KB 43ms
8ms Document
text/html 185.172.148.128
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request.php?zone=zy291edt4ui9&nw=20&renderingType=javascript&namespace=a39e53a4ce&subid=&uid=6eb0eaa04bf20535&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCY5A0UodHYcW4ENDl-gatyKKYCrXN-YNXnNC5q-UM8C4QASC1y4pGYJXikIKgB8gBCakCGEMp1birsz6oAwGqBKoBT9Co17quitGe1erfdsxPSQK6DgP7_r94gEQ0waAidwcwV_x_9ilsc7xkXLwtv3FcObFHfcg6pB4H_qwIScoH9xZXOhMRCCDI0YqG6Ks2mZfu1hFSb6WtR2sht9Vmm20clBdmCnuZWRRh5m9p5yM8Mg4zjjncfL8VNXJ6FQvrBVnyj5DCKpauGbR5uvS9jQMjL0qZSm3XeIP4dcyiQc5vQv447DJSTCpUgnPABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi04MTA1MTk1ODAzOTE0MDY5gAoDmAsByAsBgAwBsBPCmtoK0BMA2BMD2BQB0BUBgBcB%26ae%3D1%26num%3D1%26cid%3DCAASEuRom1GASeG__3n6nDB7J8MlYQ%26sig%3DAOD64_2AmAExLriWcHtfwWNfh6Hi2oYZ5A%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-BEcNu_P63b5TzL0-lpoF0t9jcK37nsSuJCgEvtOrf4aXcpJUsWd48zOZqwPCS8SNeZ2oMCwPtMJYjj2y96owFvlYNDmNh4XSbQWeWQcz6cRjo5_s2QmiAf9OuP3iCOmcvX3UlgbW0_idpshtSo16bCh2_rvQ%26cry%3D1%26dbm_d%3DAKAmf-DEhxLEG3Ahxz1s-6FY4EdePlHhemhgw7HkfvvxqMdCDuBRKaUWBK4vxMMmLlfNLtsbWdRKZKpDSPIzwaRe86DXsVueDgErKWSLbz0lxPllMDLkmM90iTeXrnQ0CtSmuGfuDwgHLmkbYzZ_zDMfH4sfSQX778J_jzEpbVHGoLxraVPz31anoDGnFlgYfc7iPi2Lqqd6Vf_wQrRirHepWNXrRkpoRdwXsi4St_uCoYFs9Da3nO3leyOu4u6Ta02m5UrXpdiVvdllRUEzKElwusYTX4CXEKnpVDKQLbqCzo30gnHXQA3gjvoUuO-sKbZBwzjAaCvf1BJvgPp4WrNUNjIrXoyRjfTDFIkE1Yx6-5hygYY418MYSKJy9w_l0irhvdHALZxoLSJ80PKpBvqhFsBJwf371aUNaBRvtiJq9odXP7nyvMMZIPsUvJyycTqLawNp3zhl%26adurl%3D&documentReferer=https%3A%2F%2Fblip.fm%2F&ancestorOrigins=https%3A%2F%2Fblip.fm&random=9380722759017&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.172.148.128 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

:method: GET
:authority: adv.office-partner.de
:scheme: https
:path: /?utm_source=webgains&utm_campaign=webgains
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/

Response headers

server: keycdn-engine
date: Sun, 19 Sep 2021 18:54:11 GMT
content-type: text/html
content-length: 930
last-modified: Thu, 06 May 2021 15:37:28 GMT
etag: "3a2-5c1ab16ba8ac4"
expires: Sun, 26 Sep 2021 18:54:11 GMT
cache-control: max-age=604800
link: <http://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
x-cache: HIT
x-edge-location: defr
access-control-allow-origin: *
accept-ranges: bytes

GET
H/1.1 200
OK link.html Show response
track.webgains.com/ Frame 5806 1 KB
2 KB 209ms
100ms Script
text/html 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=80689800129809900710632011722015&nw=1
Requested by: Host: blip.fm
URL: https://blip.fm/mimosafire6
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 54cb95d83370e3a2473be7f6e3691b4c05b1f391be022830af5d960606b065f3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 19 Sep 2021 18:54:11 GMT
Last-Modified: Sun, 19 Sep 2021 18:54:11 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html;charset=utf-8
Content-Length: 1231
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3

200

activityi;dc_pre=CLqSnIXbi_MCFR6uUQodYnoENQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7103192022236.72 Show response
5994599.fls.doubleclick.net/ Frame 1E49
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7103192022236.72?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CLqSnIXbi_MCFR6uUQodYnoENQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7103192022236.72?

390 B
345 B

78ms
46ms

Document
text/html

142.250.185.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CLqSnIXbi_MCFR6uUQodYnoENQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7103192022236.72?

Requested by

Host: blip.fm
URL: https://blip.fm/mimosafire6

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f6.1e100.net

Software

cafe /

Resource Hash

c7c06699ad3b058e5377c79ede998d2ed3af6e62cd0056c5708de005c2af3280

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 5994599.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CLqSnIXbi_MCFR6uUQodYnoENQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7103192022236.72?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUn0uzxqFmbvlFBkL9-MZmvgTJqGXF6MwdkQ5CZPF2bhpjEA8haeIXGGWCSO
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 19 Sep 2021 18:54:11 GMT
expires: Sun, 19 Sep 2021 18:54:11 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 322
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 19 Sep 2021 18:54:11 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CLqSnIXbi_MCFR6uUQodYnoENQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7103192022236.72?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK request_content.php Show response
hal900015.redintelligence.net/ Frame 3E8C 7 KB
2 KB 36ms
12ms Document
text/html 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900015.redintelligence.net/request_content.php?s=80689800129809900710632011722015&a=504dcde4
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request.php?zone=zy291edt4ui9&nw=20&renderingType=javascript&namespace=a39e53a4ce&subid=&uid=6eb0eaa04bf20535&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=970x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCY5A0UodHYcW4ENDl-gatyKKYCrXN-YNXnNC5q-UM8C4QASC1y4pGYJXikIKgB8gBCakCGEMp1birsz6oAwGqBKoBT9Co17quitGe1erfdsxPSQK6DgP7_r94gEQ0waAidwcwV_x_9ilsc7xkXLwtv3FcObFHfcg6pB4H_qwIScoH9xZXOhMRCCDI0YqG6Ks2mZfu1hFSb6WtR2sht9Vmm20clBdmCnuZWRRh5m9p5yM8Mg4zjjncfL8VNXJ6FQvrBVnyj5DCKpauGbR5uvS9jQMjL0qZSm3XeIP4dcyiQc5vQv447DJSTCpUgnPABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi04MTA1MTk1ODAzOTE0MDY5gAoDmAsByAsBgAwBsBPCmtoK0BMA2BMD2BQB0BUBgBcB%26ae%3D1%26num%3D1%26cid%3DCAASEuRom1GASeG__3n6nDB7J8MlYQ%26sig%3DAOD64_2AmAExLriWcHtfwWNfh6Hi2oYZ5A%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-BEcNu_P63b5TzL0-lpoF0t9jcK37nsSuJCgEvtOrf4aXcpJUsWd48zOZqwPCS8SNeZ2oMCwPtMJYjj2y96owFvlYNDmNh4XSbQWeWQcz6cRjo5_s2QmiAf9OuP3iCOmcvX3UlgbW0_idpshtSo16bCh2_rvQ%26cry%3D1%26dbm_d%3DAKAmf-DEhxLEG3Ahxz1s-6FY4EdePlHhemhgw7HkfvvxqMdCDuBRKaUWBK4vxMMmLlfNLtsbWdRKZKpDSPIzwaRe86DXsVueDgErKWSLbz0lxPllMDLkmM90iTeXrnQ0CtSmuGfuDwgHLmkbYzZ_zDMfH4sfSQX778J_jzEpbVHGoLxraVPz31anoDGnFlgYfc7iPi2Lqqd6Vf_wQrRirHepWNXrRkpoRdwXsi4St_uCoYFs9Da3nO3leyOu4u6Ta02m5UrXpdiVvdllRUEzKElwusYTX4CXEKnpVDKQLbqCzo30gnHXQA3gjvoUuO-sKbZBwzjAaCvf1BJvgPp4WrNUNjIrXoyRjfTDFIkE1Yx6-5hygYY418MYSKJy9w_l0irhvdHALZxoLSJ80PKpBvqhFsBJwf371aUNaBRvtiJq9odXP7nyvMMZIPsUvJyycTqLawNp3zhl%26adurl%3D&documentReferer=https%3A%2F%2Fblip.fm%2F&ancestorOrigins=https%3A%2F%2Fblip.fm&random=9380722759017&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 564603b5ddad05d0ead8fa98125e7f9e40d71cbadb835700047bab2f1bcc6108

Request headers

Host: hal900015.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Cookie: 8lcfmzhxc8d6_uid=3145a9af74766ab3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/

Response headers

Date: Sun, 19 Sep 2021 18:54:11 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Sun, 19 Sep 2021 19:54:11 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2054
Connection: close
Content-Type: text/html; charset=utf-8

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame 5806
Redirect Chain

https://pv.medialead.de/trck/eview/e99aace94e6e5873830a7df8deda4aa6?subid=80689800129809900710632011722015
https://ad-server.eu/wm/pb/native.png

68 B
312 B

156ms
31ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 19 Sep 2021 18:57:34 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Sun, 19 Sep 2021 18:54:11 GMT
Server: nginx/1.17.5
X-IPLB-Request-ID: D8836F22:EB32_91EFC182:01BB_61478753_8B1420D:26680
X-Powered-By: PHP/7.2.21
X-IPLB-Instance: 40028
Strict-Transport-Security: max-age=63072000;includeSubdomains;preload, max-age=15768000
Content-Type: text/html; charset=UTF-8
Location: https://ad-server.eu/wm/pb/native.png
Cache-control: private
Transfer-Encoding: chunked
Keep-Alive: timeout=20

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame 5806 43 B
703 B 63ms
33ms Image
image/gif 104.92.94.3
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2601050&v=18332&q=376776&r=296283&pref1=80689800129809900710632011722015&pv=1

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.92.94.3 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-92-94-3.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 19 Sep 2021 18:54:11 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 9AA6 1 KB
749 B 26ms
26ms Document
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 18 Sep 2021 21:06:15 GMT
expires: Sun, 19 Sep 2021 21:06:15 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 78476
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 5806 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9b484ca51e38e9000a41f95ffb28b17da3d7832c10382f40be3c4f2e22cd9383

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 059E
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=43958200153297800710612011722020&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=43958200153297800710612011722020&actionid=879111&produktid=ratenkredit&dt_url=

0
201 B

63ms
63ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=43958200153297800710612011722020&actionid=879111&produktid=ratenkredit&dt_url=

Requested by

Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=66c8fde413&subid=&uid=f9a615e2248e3506&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCr-ZmUodHYca4ENDl-gatyKKYCrXN-YNX_Ni5q-UM8C4QASC1y4pGYJXikIKgB8gBCakCGEMp1birsz6oAwGqBKoBT9BjfcUiTDGqaTyWYJLGoUQALCBtCao3-pc4UJuGx5Rc1515sZo1hz0ShuvxupSegwevjrVgJ-dIIfREMw1zQ-NF7oAQOiD72HqAN5MuuRYQLVeyn-tehCfqmV9BBQOWmWXhxZnzMaAgpD1k2KNmlG2ZaUv7VCBFZFpuNeJ8wX6J2QYoIm-3fGywoNOoN_5wauqNfe_Ximrddbsa7o6ys9yYWBTLOUPTfJ7ABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi04MTA1MTk1ODAzOTE0MDY5gAoDmAsByAsBgAwBsBPCmtoK0BMA2BMD2BQB0BUBgBcB%26ae%3D1%26num%3D1%26cid%3DCAASEuRoBzK6m8juOGhFDpJe8KKtKQ%26sig%3DAOD64_1_cy0hux-OL3afhp-z0iGjfpu3HQ%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-BJwJNZGSd1sNfLgmTKTtZxjH5IG3cshvxQGU2k85VRFW6V32EWovNkEeob96BasKjbPooZwU98HRU68wPpRuvnvRWIcgI4rmJKwP8FteKOKy_sE1VV_aSSGXUO8p4MgilwABDf65_8sO-0pbO-jV2tE2Fn3A%26cry%3D1%26dbm_d%3DAKAmf-D5xScVtpV5OARUxgoLZ0ixVbqsANdcg8reV_2otGH23Dhe3ghQsYWL9ChEDSy8dxUYk0ES8-qWsm7AZR53vk726DeLF3pSva97rvmDvI5NmZRkrMnqazNF8yfHEVJkek7KtJR8JZi-qusUFvviin7NBHUZxhUaGubI0duPC_l3rsEk4SBiEjYYxJ2JgdAbsEOCyhOs4hqrQp0jt5wFoP0RZ1aNnY7LR26BL50yKGm5rplYnU5dogi4k_zG-5bVKztnVYzyHGr5ut5lZ1dzpYICjHyWQm4Ykd3BONWyVkRxpbDjMj6OLGAYkbYnTRzVNptm2aLt5GssffascEsgHd67Hw1GMGcDS9qArs3Vymbf91GsHsoKPt9UV0EWPnBMC7OoOAB4xg4HLzeo8s26UJhm_wnG7X0n_S35nXot7mcJBnl7ZUn_hWZilAR4eBiB_KGjz-eG%26adurl%3D&documentReferer=https%3A%2F%2Fblip.fm%2F&ancestorOrigins=https%3A%2F%2Fblip.fm&random=4433660603849&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 Schwaig, Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: pb.media01.eu
:scheme: https
:path: /view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=43958200153297800710612011722020&actionid=879111&produktid=ratenkredit&dt_url=
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/

Response headers

cache-control: no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Sun, 19 Sep 2021 08:54:14 GMT
server: Microsoft-IIS/10.0
set-cookie: ASP.NET_SessionId=bludigafdokfvhdanpesu2bz; path=/; secure; HttpOnly; SameSite=None DTU=CD7A95608AA40FDF868CC5E28FFFEDC1; expires=Tue, 19-Sep-2023 18:54:14 GMT; path=/; SameSite=None; secure; HttpOnly; SameSite=None
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
access-control-allow-origin: *
access-control-allow-credentials: true
x-xss-protection: 1; mode=block
access-control-allow-methods: GET,POST
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
date: Sun, 19 Sep 2021 18:54:13 GMT
content-length: 0

Redirect headers

Server: nginx/1.19.7
Date: Sun, 19 Sep 2021 18:54:11 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Keep-Alive: timeout=20
X-Powered-By: PHP/7.2.34
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,OPTIONS
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Range, Content-Disposition, Content-Type, Authorization
Access-Control-Allow-Credentials: true
Set-Cookie: trscj=MTYzMjA3NzY1MXxMM1J5WTJzdlpYQjJMMlU1T1dGaFkyVTVOR1UyWlRVNE56TTRPREZrTXpRd01EazVNMlV4WlRkbFAzTjFZbWxrUFRRek9UVTRNakF3TVRVek1qazNPREF3TnpFd05qRXlNREV4TnpJeU1ESXdKblE5YUhSc2NBPT18YUhSMGNITTZMeTg0T0RJMU5EWTRZV05tTldSa01EazRZV1UzWVRZeFpHTmhNekEwWVRjeU5pNXpZV1psWm5KaGJXVXVaMjl2WjJ4bGMzbHVaR2xqWVhScGIyNHVZMjl0THc9PQ%3D%3D; expires=Mon, 19-Sep-2022 18:54:11 GMT; Max-Age=31536000; path=/; samesite=none; domain=.medialead.de; secure SERVERID177589=2|YUeHV|YUeHV; path=/; HttpOnly
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=43958200153297800710612011722020&actionid=879111&produktid=ratenkredit&dt_url=
Strict-Transport-Security: max-age=63072000;includeSubdomains;preload max-age=15768000
X-IPLB-Request-ID: D8836F22:EB30_91EFC182:01BB_61478753_8B14212:26680
X-IPLB-Instance: 40028
Cache-control: private

GET
H2 200 / Show response
adv.office-partner.de/ Frame 91A8 930 B
1 KB 7ms
6ms Document
text/html 185.172.148.128
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=66c8fde413&subid=&uid=f9a615e2248e3506&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCr-ZmUodHYca4ENDl-gatyKKYCrXN-YNX_Ni5q-UM8C4QASC1y4pGYJXikIKgB8gBCakCGEMp1birsz6oAwGqBKoBT9BjfcUiTDGqaTyWYJLGoUQALCBtCao3-pc4UJuGx5Rc1515sZo1hz0ShuvxupSegwevjrVgJ-dIIfREMw1zQ-NF7oAQOiD72HqAN5MuuRYQLVeyn-tehCfqmV9BBQOWmWXhxZnzMaAgpD1k2KNmlG2ZaUv7VCBFZFpuNeJ8wX6J2QYoIm-3fGywoNOoN_5wauqNfe_Ximrddbsa7o6ys9yYWBTLOUPTfJ7ABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi04MTA1MTk1ODAzOTE0MDY5gAoDmAsByAsBgAwBsBPCmtoK0BMA2BMD2BQB0BUBgBcB%26ae%3D1%26num%3D1%26cid%3DCAASEuRoBzK6m8juOGhFDpJe8KKtKQ%26sig%3DAOD64_1_cy0hux-OL3afhp-z0iGjfpu3HQ%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-BJwJNZGSd1sNfLgmTKTtZxjH5IG3cshvxQGU2k85VRFW6V32EWovNkEeob96BasKjbPooZwU98HRU68wPpRuvnvRWIcgI4rmJKwP8FteKOKy_sE1VV_aSSGXUO8p4MgilwABDf65_8sO-0pbO-jV2tE2Fn3A%26cry%3D1%26dbm_d%3DAKAmf-D5xScVtpV5OARUxgoLZ0ixVbqsANdcg8reV_2otGH23Dhe3ghQsYWL9ChEDSy8dxUYk0ES8-qWsm7AZR53vk726DeLF3pSva97rvmDvI5NmZRkrMnqazNF8yfHEVJkek7KtJR8JZi-qusUFvviin7NBHUZxhUaGubI0duPC_l3rsEk4SBiEjYYxJ2JgdAbsEOCyhOs4hqrQp0jt5wFoP0RZ1aNnY7LR26BL50yKGm5rplYnU5dogi4k_zG-5bVKztnVYzyHGr5ut5lZ1dzpYICjHyWQm4Ykd3BONWyVkRxpbDjMj6OLGAYkbYnTRzVNptm2aLt5GssffascEsgHd67Hw1GMGcDS9qArs3Vymbf91GsHsoKPt9UV0EWPnBMC7OoOAB4xg4HLzeo8s26UJhm_wnG7X0n_S35nXot7mcJBnl7ZUn_hWZilAR4eBiB_KGjz-eG%26adurl%3D&documentReferer=https%3A%2F%2Fblip.fm%2F&ancestorOrigins=https%3A%2F%2Fblip.fm&random=4433660603849&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.172.148.128 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

:method: GET
:authority: adv.office-partner.de
:scheme: https
:path: /?utm_source=webgains&utm_campaign=webgains
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/

Response headers

server: keycdn-engine
date: Sun, 19 Sep 2021 18:54:11 GMT
content-type: text/html
content-length: 930
last-modified: Thu, 06 May 2021 15:37:28 GMT
etag: "3a2-5c1ab16ba8ac4"
expires: Sun, 26 Sep 2021 18:54:11 GMT
cache-control: max-age=604800
link: <http://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
x-cache: HIT
x-edge-location: defr
access-control-allow-origin: *
accept-ranges: bytes

GET
H/1.1 200
OK link.html Show response
track.webgains.com/ Frame F8CA 1 KB
2 KB 145ms
108ms Script
text/html 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=43958200153297800710612011722020&nw=1
Requested by: Host: blip.fm
URL: https://blip.fm/mimosafire6
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 3b41886aaaf5dc073b526f5785474e000c697f56315a329a03872f8f6b6bed75

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 19 Sep 2021 18:54:11 GMT
Last-Modified: Sun, 19 Sep 2021 18:54:11 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html;charset=utf-8
Content-Length: 1233
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3

200

activityi;dc_pre=COj0ooXbi_MCFcSlUQodVM4LyA;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5412555136543.802 Show response
5994599.fls.doubleclick.net/ Frame 01FC
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5412555136543.802?
https://5994599.fls.doubleclick.net/activityi;dc_pre=COj0ooXbi_MCFcSlUQodVM4LyA;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5412555136543.802?

391 B
345 B

44ms
44ms

Document
text/html

142.250.185.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=COj0ooXbi_MCFcSlUQodVM4LyA;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5412555136543.802?

Requested by

Host: blip.fm
URL: https://blip.fm/mimosafire6

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f6.1e100.net

Software

cafe /

Resource Hash

b7463806943a9ba13e5a3175d8bd3f80102ae09737ff4557f705b1a37ee85f28

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 5994599.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=COj0ooXbi_MCFcSlUQodVM4LyA;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5412555136543.802?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUn0uzxqFmbvlFBkL9-MZmvgTJqGXF6MwdkQ5CZPF2bhpjEA8haeIXGGWCSO
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 19 Sep 2021 18:54:11 GMT
expires: Sun, 19 Sep 2021 18:54:11 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 322
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Sun, 19 Sep 2021 18:54:11 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=COj0ooXbi_MCFcSlUQodVM4LyA;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5412555136543.802?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK request_content.php Show response
hal900020.redintelligence.net/ Frame C0C1 7 KB
2 KB 33ms
11ms Document
text/html 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900020.redintelligence.net/request_content.php?s=43958200153297800710612011722020&a=41a12013
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request.php?zone=4727t6qteyti&nw=20&renderingType=javascript&namespace=66c8fde413&subid=&uid=f9a615e2248e3506&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCr-ZmUodHYca4ENDl-gatyKKYCrXN-YNX_Ni5q-UM8C4QASC1y4pGYJXikIKgB8gBCakCGEMp1birsz6oAwGqBKoBT9BjfcUiTDGqaTyWYJLGoUQALCBtCao3-pc4UJuGx5Rc1515sZo1hz0ShuvxupSegwevjrVgJ-dIIfREMw1zQ-NF7oAQOiD72HqAN5MuuRYQLVeyn-tehCfqmV9BBQOWmWXhxZnzMaAgpD1k2KNmlG2ZaUv7VCBFZFpuNeJ8wX6J2QYoIm-3fGywoNOoN_5wauqNfe_Ximrddbsa7o6ys9yYWBTLOUPTfJ7ABKqd_L7PAeAEA5AGAaAGTYAH6-foXqgH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgd8ggbYWR4LXN1YnN5bi04MTA1MTk1ODAzOTE0MDY5gAoDmAsByAsBgAwBsBPCmtoK0BMA2BMD2BQB0BUBgBcB%26ae%3D1%26num%3D1%26cid%3DCAASEuRoBzK6m8juOGhFDpJe8KKtKQ%26sig%3DAOD64_1_cy0hux-OL3afhp-z0iGjfpu3HQ%26client%3Dca-pub-6949480713202456%26dbm_c%3DAKAmf-BJwJNZGSd1sNfLgmTKTtZxjH5IG3cshvxQGU2k85VRFW6V32EWovNkEeob96BasKjbPooZwU98HRU68wPpRuvnvRWIcgI4rmJKwP8FteKOKy_sE1VV_aSSGXUO8p4MgilwABDf65_8sO-0pbO-jV2tE2Fn3A%26cry%3D1%26dbm_d%3DAKAmf-D5xScVtpV5OARUxgoLZ0ixVbqsANdcg8reV_2otGH23Dhe3ghQsYWL9ChEDSy8dxUYk0ES8-qWsm7AZR53vk726DeLF3pSva97rvmDvI5NmZRkrMnqazNF8yfHEVJkek7KtJR8JZi-qusUFvviin7NBHUZxhUaGubI0duPC_l3rsEk4SBiEjYYxJ2JgdAbsEOCyhOs4hqrQp0jt5wFoP0RZ1aNnY7LR26BL50yKGm5rplYnU5dogi4k_zG-5bVKztnVYzyHGr5ut5lZ1dzpYICjHyWQm4Ykd3BONWyVkRxpbDjMj6OLGAYkbYnTRzVNptm2aLt5GssffascEsgHd67Hw1GMGcDS9qArs3Vymbf91GsHsoKPt9UV0EWPnBMC7OoOAB4xg4HLzeo8s26UJhm_wnG7X0n_S35nXot7mcJBnl7ZUn_hWZilAR4eBiB_KGjz-eG%26adurl%3D&documentReferer=https%3A%2F%2Fblip.fm%2F&ancestorOrigins=https%3A%2F%2Fblip.fm&random=4433660603849&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: 3ed994fab019069a1da1f042c61673f9dbd9d29c391485cec2c80698597a077e

Request headers

Host: hal900020.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
Accept-Encoding: gzip, deflate, br
Cookie: 8lcfmzhxc8d6_uid=3145a9af74766ab3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/

Response headers

Date: Sun, 19 Sep 2021 18:54:11 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Sun, 19 Sep 2021 19:54:11 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 2036
Connection: close
Content-Type: text/html; charset=utf-8

GET
H/1.1

200
OK

native.png
ad-server.eu/wm/pb/ Frame F8CA
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=43958200153297800710612011722020
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=43958200153297800710612011722020
https://ad-server.eu/wm/pb/native.png

68 B
312 B

110ms
30ms

Image
image/png

54.76.176.197
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad-server.eu/wm/pb/native.png
Requested by: Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.76.176.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-76-176-197.eu-west-1.compute.amazonaws.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 19 Sep 2021 18:57:34 GMT
Last-Modified: Sat, 21 Dec 2019 23:06:59 GMT
Server: nginx/1.4.6 (Ubuntu)
ETag: "5dfea593-44"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 68

Redirect headers

Date: Sun, 19 Sep 2021 18:54:11 GMT
Server: nginx/1.19.7
X-IPLB-Request-ID: D8836F22:EB32_91EFC182:01BB_61478753_8B1421A:26680
X-Powered-By: PHP/7.2.34
X-IPLB-Instance: 40028
Strict-Transport-Security: max-age=63072000;includeSubdomains;preload, max-age=15768000
Content-Type: text/html; charset=UTF-8
Location: https://ad-server.eu/wm/pb/native.png
Cache-control: private
Transfer-Encoding: chunked
Keep-Alive: timeout=20

GET
H/1.1 200
OK cshow.php
www.awin1.com/ Frame F8CA 43 B
703 B 36ms
35ms Image
image/gif 104.92.94.3
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.awin1.com/cshow.php?s=2601050&v=18332&q=376776&r=296283&pref1=43958200153297800710612011722020&pv=1

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.92.94.3 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-92-94-3.deploy.static.akamaitechnologies.com

Software

Resource Hash

2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 19 Sep 2021 18:54:11 GMT
Strict-Transport-Security: max-age=86400
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Cache-Control: no-store, no-cache, max-age=0, must-revalidate
Awin-Akamai-Rule-Set: default
Node: Helix
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C306 1 KB
749 B 26ms
26ms Document
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f10.1e100.net

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 18 Sep 2021 21:06:15 GMT
expires: Sun, 19 Sep 2021 21:06:15 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 78476
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame F8CA 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 52600e58f763bfb12cd61a9a3b664a1e2f8f54d015d7bbc1dba6952fa58c29e1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 css
fonts.googleapis.com/ Frame 3E8C 4 KB
648 B 62ms
32ms Stylesheet
text/css 142.250.186.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request_content.php?s=80689800129809900710632011722015&a=504dcde4

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.170 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

932060b34fe451f1cb994f3da257f6d2d0f281e1e286e9f3f0e2da63e862fec6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900015.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 19 Sep 2021 18:54:02 GMT
server: ESF
date: Sun, 19 Sep 2021 18:54:11 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 19 Sep 2021 18:54:11 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 3E8C 15 KB
15 KB 37ms
14ms Image
image/png 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/laptop_1200x627.jpg
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request_content.php?s=80689800129809900710632011722015&a=504dcde4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: b74a6bc5fcebab0304820c6ea0c1d14c2c7aedf2e8a34e29b3d1241cbf24505e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900015.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 19 Sep 2021 18:54:11 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 15249
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 3E8C 15 KB
15 KB 36ms
13ms Image
image/png 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/52343/creativesup/1200x627_2.jpg
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request_content.php?s=80689800129809900710632011722015&a=504dcde4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: a5128ed353a2cb6142070aea3d011932c05d4f49305b03583e6fdc5c5ec8cf3e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900015.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 19 Sep 2021 18:54:11 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 15250
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 3E8C 16 KB
16 KB 38ms
13ms Image
image/png 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request_content.php?s=80689800129809900710632011722015&a=504dcde4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 55514b9ee284f220a9c3bde2e16ebab93634a925c260502240d8c33711a227b0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900015.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 19 Sep 2021 18:54:11 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16531
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame 5BCB 89 KB
35 KB 80ms
29ms Script
application/javascript 142.250.185.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

7678acf460f2585a33be7ac015daaea255f32f97ae376df619e0d4bf618fa1be

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:54:11 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35357
x-xss-protection: 0
last-modified: Sun, 19 Sep 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 19 Sep 2021 18:54:11 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ Frame 91A8 89 KB
35 KB 91ms
57ms Script
application/javascript 142.250.185.232
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.232 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

133b521b4b83acf155b46d969e4bcca926a86a9fa9b05a4937e79cc817c14a7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:54:11 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35360
x-xss-protection: 0
last-modified: Sun, 19 Sep 2021 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 19 Sep 2021 18:54:11 GMT

GET
H3 200 dc_pre=CLqSnIXbi_MCFR6uUQodYnoENQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7103192022236.72
adservice.google.com/ddm/fls/z/ Frame 1E49 42 B
63 B 86ms
36ms Image
image/gif 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CLqSnIXbi_MCFR6uUQodYnoENQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7103192022236.72

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=CLqSnIXbi_MCFR6uUQodYnoENQ;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=7103192022236.72?

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 5806 51 KB
51 KB 60ms
7ms Script
application/javascript 18.66.97.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=80689800129809900710632011722015&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c6ce2b47cde7cf913a3c34ddce355fa9c75012577dd34c35928add8676cb7fa0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: ESJ1m.JcTMC7xiA46tdzcog3eD2HGNO9
via: 1.1 e44e0b24e706487eaec6b9e01f2166dd.cloudfront.net (CloudFront)
last-modified: Mon, 13 Sep 2021 10:14:21 GMT
server: AmazonS3
age: 35029
etag: "ec0ced40cbb5211db06b8a36f209e442"
x-cache: Hit from cloudfront
content-type: application/javascript
date: Sun, 19 Sep 2021 09:10:22 GMT
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
content-length: 51794
x-amz-cf-id: 25CoaZ1nwAhP9mlrINYzlvD9F0s9T1tzDT_JITMyUpyP4blxlvv3fw==

GET
H/1.1 200
OK link.html
track.webgains.com/ Frame 5806 85 B
541 B 65ms
23ms Image
image/gif 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.webgains.com/link.html?wgcampaignid=99582&viewref=66656800163173800951425011722016&wglinkid=498343
Requested by: Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 19 Sep 2021 18:54:11 GMT
Last-Modified: Sun, 19 Sep 2021 18:54:11 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: image/gif
Content-Length: 85
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame C0C1 1 KB
418 B 34ms
32ms Stylesheet
text/css 142.250.186.170
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Titillium+Web:400,700

Requested by

Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=43958200153297800710612011722020&a=41a12013

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.170 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f10.1e100.net

Software

ESF /

Resource Hash

9c1521286e7dd2d6f8c2262b15bca8867bcae973a83879accdd00e1cb9831e5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sun, 19 Sep 2021 17:35:34 GMT
server: ESF
date: Sun, 19 Sep 2021 18:54:11 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Sun, 19 Sep 2021 18:54:11 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame C0C1 16 KB
16 KB 36ms
12ms Image
image/png 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/postbank_pool_privatkredit_1200x627.jpg
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=43958200153297800710612011722020&a=41a12013
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 7935c674a5a33c52567473938a701d06ef8119360b39f96ea57a820f20ae535a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 19 Sep 2021 18:54:11 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16249
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame C0C1 15 KB
15 KB 36ms
12ms Image
image/png 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/52343/creativesup/1200x627_2.jpg
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=43958200153297800710612011722020&a=41a12013
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: a5128ed353a2cb6142070aea3d011932c05d4f49305b03583e6fdc5c5ec8cf3e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 19 Sep 2021 18:54:11 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 15250
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame C0C1 16 KB
16 KB 36ms
12ms Image
image/png 138.201.84.244
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=43958200153297800710612011722020&a=41a12013
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.84.244 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.244.84.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 55514b9ee284f220a9c3bde2e16ebab93634a925c260502240d8c33711a227b0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 19 Sep 2021 18:54:11 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16531
Vary: Accept-Encoding
Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9AA6
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEITLH1Z3hbBgGg_F4tSvEO0&google_cver=1&google_push=AYg5qPICMrLtUv0SXKrQYmqwxMbKAXW8liNQ3B-TLDztPx01NibDsbRWKkR3mXxed_YGSX0UmRobvQxjQqlGWQlJE4--rqWgnl_lCA
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=4BABFED5C34E4AD6B5CE1B95EE3FABB0&google_push=AYg5qPICMrLtUv0SXKrQYmqwxMbKAXW8liNQ3B-TLDztPx01NibDsbRWKkR3mXxed_YGSX0UmRobvQxjQqlGWQl...

170 B
188 B

124ms
123ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=4BABFED5C34E4AD6B5CE1B95EE3FABB0&google_push=AYg5qPICMrLtUv0SXKrQYmqwxMbKAXW8liNQ3B-TLDztPx01NibDsbRWKkR3mXxed_YGSX0UmRobvQxjQqlGWQlJE4--rqWgnl_lCA

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 19 Sep 2021 18:54:11 GMT
x-content-type-options: nosniff
server: openresty
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=4BABFED5C34E4AD6B5CE1B95EE3FABB0&google_push=AYg5qPICMrLtUv0SXKrQYmqwxMbKAXW8liNQ3B-TLDztPx01NibDsbRWKkR3mXxed_YGSX0UmRobvQxjQqlGWQlJE4--rqWgnl_lCA
strict-transport-security: max-age=63072000; includeSubdomains; preload
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Sat, 18 Sep 2021 18:54:11 GMT

GET
H2

200

google_sync_status
x.bidswitch.net/ Frame 9AA6
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEFdGPuKrw6r0RjhpgoPAVXk&google_cver=1&google_push=AYg5qPIh3foJIOYRUPtgkhbd3YJLEsQdkQ5lZjp44JfZVoD51moefJ3Bwy53EkiQ_teSZ19hgypd06S-lSZR34Pu0UXv...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEFdGPuKrw6r0RjhpgoPAVXk&google_cver=1&google_push=AYg5qPIh3foJIOYRUPtgkhbd3YJLEsQdkQ5lZjp44JfZVoD51moefJ3Bwy53EkiQ_teSZ19hgypd06S-lSZR34...
https://a.sportradarserving.com/sync?ssp=bidswitch&bidswitch_ssp_id=google
https://a.sportradarserving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=google
https://x.bidswitch.net/sync?dsp_id=409&expires=14&user_group=1&user_id=6d3ff8c2-6f38-4963-aa50-393a3754c1fa&ssp=google
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_cm=1&google_hm=gqJOqdpzTOuwkgGkWzS1Kw==
https://x.bidswitch.net/google_sync_status?ssp_name=google&google_gid=CAESEFdGPuKrw6r0RjhpgoPAVXk&google_cver=1

43 B
145 B

9ms
8ms

Image
image/gif

18.196.76.242
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/google_sync_status?ssp_name=google&google_gid=CAESEFdGPuKrw6r0RjhpgoPAVXk&google_cver=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.196.76.242 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-76-242.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:54:12 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:12 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://x.bidswitch.net/google_sync_status?ssp_name=google&google_gid=CAESEFdGPuKrw6r0RjhpgoPAVXk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 316
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9AA6
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEKFhvmYMrNYSpFWYCzDMtvY&google_cver=1&google_push=AYg5qPI8bxdCWJPBmmiVw2ygsZFM8RddzqYc1CBbbFmzlvrQeUXcxbLHfGe9nLNIYVeGarYnwOo2RmGo...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEKFhvmYMrNYSpFWYCzDMtvY&google_cver=1&google_push=AYg5qPI8bxdCWJPBmmiVw2ygsZFM8RddzqYc1CBbbFmzlvrQeUXcxbLHfGe9nLNIYVeGarYnwOo...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTUwMDA4NDM0NTA0OTU0MjkxOQ&google_push=AYg5qPI8bxdCWJPBmmiVw2ygsZFM8RddzqYc1CBbbFmzlvrQeUXcxbLHfGe9nLNIYVeGarYnwOo2Rm...

170 B
188 B

123ms
123ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTUwMDA4NDM0NTA0OTU0MjkxOQ&google_push=AYg5qPI8bxdCWJPBmmiVw2ygsZFM8RddzqYc1CBbbFmzlvrQeUXcxbLHfGe9nLNIYVeGarYnwOo2RmGowK3UYoUaz9mVsZG1Sl7sxg

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTUwMDA4NDM0NTA0OTU0MjkxOQ&google_push=AYg5qPI8bxdCWJPBmmiVw2ygsZFM8RddzqYc1CBbbFmzlvrQeUXcxbLHfGe9nLNIYVeGarYnwOo2RmGowK3UYoUaz9mVsZG1Sl7sxg
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9AA6
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEEVNOD5n58w1xRsOB3uWWG0&google_cver=1&google_push=AYg5qPIIX8MWB9xe_eYotn8CizMTzDWYWwmv2fWB1gq_qnPtJoVXpbt5Gz5MCWjl9_JA32Xh42igaxezl98wKV-u6iKs9kA6b5n1DA
https://rtb.openx.net/sync/dds?google_gid=CAESEEVNOD5n58w1xRsOB3uWWG0&google_cver=1&google_push=AYg5qPIIX8MWB9xe_eYotn8CizMTzDWYWwmv2fWB1gq_qnPtJoVXpbt5Gz5MCWjl9_JA32Xh42igaxezl98wKV-u6iKs9kA6b5n1D...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIIX8MWB9xe_eYotn8CizMTzDWYWwmv2fWB1gq_qnPtJoVXpbt5Gz5MCWjl9_JA32Xh42igaxezl98wKV-u6iKs9kA6b5n1DA&google_hm=S5zNfBlywicbZRhapfviLA==

170 B
188 B

123ms
123ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIIX8MWB9xe_eYotn8CizMTzDWYWwmv2fWB1gq_qnPtJoVXpbt5Gz5MCWjl9_JA32Xh42igaxezl98wKV-u6iKs9kA6b5n1DA&google_hm=S5zNfBlywicbZRhapfviLA==

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIIX8MWB9xe_eYotn8CizMTzDWYWwmv2fWB1gq_qnPtJoVXpbt5Gz5MCWjl9_JA32Xh42igaxezl98wKV-u6iKs9kA6b5n1DA&google_hm=S5zNfBlywicbZRhapfviLA==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: fu10ge6lvjtdgqi5btr4scrkf2avf6uu

GET

pixel
cm.g.doubleclick.net/ Frame 9AA6
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEBA2HvoWazGvRI103MzJcW0&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUeHU3aFwtUgX9rIT69gLgAABGkAAAIB&google_cver=1&google_gid=CAESEBA2HvoWazGvRI103MzJcW0&google_push=AYg5qPLXP6eRLfOTkKaa4Rlr_XBw9Ms4iBOIJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUeHU3aFwtUgX9rIT69gLgAABGkAAAIB&google_cver=1&google_gid=CAESEBA2HvoWazGvRI103MzJcW0&google_push=AYg5qPLXP6eRLfOTkKaa4Rlr_XBw9Ms4iBOIJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUeHU3aFwtUgX9rIT69gLgAABGkAAAIB&google_cver=1&google_gid=CAESEBA2HvoWazGvRI103MzJcW0&google_push=AYg5qPLXP6eRLfOTkKaa4Rlr_XBw9Ms4iBOIJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUeHU3aFwtUgX9rIT69gLgAABGkAAAIB&google_cver=1&google_gid=CAESEBA2HvoWazGvRI103MzJcW0&google_push=AYg5qPLXP6eRLfOTkKaa4Rlr_XBw9Ms4iBOIJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUeHU3aFwtUgX9rIT69gLgAABGkAAAIB&google_cver=1&google_gid=CAESEBA2HvoWazGvRI103MzJcW0&google_push=AYg5qPLXP6eRLfOTkKaa4Rlr_XBw9Ms4iBOIJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUeHU3aFwtUgX9rIT69gLgAABGkAAAIB&google_cver=1&google_gid=CAESEBA2HvoWazGvRI103MzJcW0&google_push=AYg5qPLXP6eRLfOTkKaa4Rlr_XBw9Ms4iBOIJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUeHU3aFwtUgX9rIT69gLgAABGkAAAIB&google_cver=1&google_gid=CAESEBA2HvoWazGvRI103MzJcW0&google_push=AYg5qPLXP6eRLfOTkKaa4Rlr_XBw9Ms4iBOIJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUeHU3aFwtUgX9rIT69gLgAABGkAAAIB&google_cver=1&google_gid=CAESEBA2HvoWazGvRI103MzJcW0&google_push=AYg5qPLXP6eRLfOTkKaa4Rlr_XBw9Ms4iBOIJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUeHU3aFwtUgX9rIT69gLgAABGkAAAIB&google_cver=1&google_gid=CAESEBA2HvoWazGvRI103MzJcW0&google_push=AYg5qPLXP6eRLfOTkKaa4Rlr_XBw9Ms4iBOIJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUeHU3aFwtUgX9rIT69gLgAABGkAAAIB&google_cver=1&google_gid=CAESEBA2HvoWazGvRI103MzJcW0&google_push=AYg5qPLXP6eRLfOTkKaa4Rlr_XBw9Ms4iBOIJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUeHU3aFwtUgX9rIT69gLgAABGkAAAIB&google_cver=1&google_gid=CAESEBA2HvoWazGvRI103MzJcW0&google_push=AYg5qPLXP6eRLfOTkKaa4Rlr_XBw9Ms4iBOIJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUeHU3aFwtUgX9rIT69gLgAABGkAAAIB&google_cver=1&google_gid=CAESEBA2HvoWazGvRI103MzJcW0&google_push=AYg5qPLXP6eRLfOTkKaa4Rlr_XBw9Ms4iBOIJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUeHU3aFwtUgX9rIT69gLgAABGkAAAIB&google_cver=1&google_gid=CAESEBA2HvoWazGvRI103MzJcW0&google_push=AYg5qPLXP6eRLfOTkKaa4Rlr_XBw9Ms4iBOIJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUeHU3aFwtUgX9rIT69gLgAABGkAAAIB&google_cver=1&google_gid=CAESEBA2HvoWazGvRI103MzJcW0&google_push=AYg5qPLXP6eRLfOTkKaa4Rlr_XBw9Ms4iBOIJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUeHU3aFwtUgX9rIT69gLgAABGkAAAIB&google_cver=1&google_gid=CAESEBA2HvoWazGvRI103MzJcW0&google_push=AYg5qPLXP6eRLfOTkKaa4Rlr_XBw9Ms4iBOIJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUeHU3aFwtUgX9rIT69gLgAABGkAAAIB&google_cver=1&google_gid=CAESEBA2HvoWazGvRI103MzJcW0&google_push=AYg5qPLXP6eRLfOTkKaa4Rlr_XBw9Ms4iBOIJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUeHU3aFwtUgX9rIT69gLgAABGkAAAIB&google_cver=1&google_gid=CAESEBA2HvoWazGvRI103MzJcW0&google_push=AYg5qPLXP6eRLfOTkKaa4Rlr_XBw9Ms4iBOIJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YUeHU3aFwtUgX9rIT69gLgAABGkAAAIB&google_cver=1&google_gid=CAESEBA2HvoWazGvRI103MzJcW0&google_push=AYg5qPLXP6eRLfOTkKaa4Rlr_XBw9Ms4iBOIJ...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9AA6
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEIdcjMkpVtCxXozJ_dgjS1w&google_cver=1&google_push=AYg5qPKIt4qX9msyQr1d2q1XCtykjff2rTTdVM8ZBXImNFQsoGFw_xbOgRblYTa4O9KnnnhJjhatonx5e0fvKR0x...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPKIt4qX9msyQr1d2q1XCtykjff2rTTdVM8ZBXImNFQsoGFw_xbOgRblYTa4O9KnnnhJjhatonx5e0fvKR0xw_lUEq6ZJF2J_Q

170 B
188 B

127ms
126ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPKIt4qX9msyQr1d2q1XCtykjff2rTTdVM8ZBXImNFQsoGFw_xbOgRblYTa4O9KnnnhJjhatonx5e0fvKR0xw_lUEq6ZJF2J_Q

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Sun, 19 Sep 2021 18:54:11 GMT
via: 1.1 7fd88bab22735486702d23ba4e028d86.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA60-P3
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPKIt4qX9msyQr1d2q1XCtykjff2rTTdVM8ZBXImNFQsoGFw_xbOgRblYTa4O9KnnnhJjhatonx5e0fvKR0xw_lUEq6ZJF2J_Q
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: oj9c69cBUDpoEXEKeGgfsJP92n8Aah2uoRyMJ-8TDdWIbl6zPWQbOQ==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9AA6
Redirect Chain

https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESENMcYLajniFQsUL-mQnX7Fw&google_cver=1&google_push=AYg5qPKOfvnCSiE6NCj8bmamdIOKmxcw1MKX3QwnL6jDqLHDA_sK8Xpf...
https://pixel.advertising.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESENMcYLajniFQsUL-mQnX7Fw&google_cver=1&google_push=AYg5qPKOfvnCSiE6NCj8bmamdIOKmxcw1MKX3QwnL6jDqLHDA_sK8Xpf...
https://ups.analytics.yahoo.com/ups/58202/sync?gdpr=&gdpr_consent=&redir=true&google_gid=CAESENMcYLajniFQsUL-mQnX7Fw&google_cver=1&google_push=AYg5qPKOfvnCSiE6NCj8bmamdIOKmxcw1MKX3QwnL6jDqLHDA_sK8X...
https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBmYTNkYzdlYy0xOTdhLTExZWMtYWUzZS0wMjU2NjliYTM4OGE%3D&google_push=AYg5qPKOfvnCSiE6NCj8bmamdIOKmxcw1MKX3QwnL6jDqLHDA_sK8XpfYDXcDN71u4...

170 B
188 B

125ms
124ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBmYTNkYzdlYy0xOTdhLTExZWMtYWUzZS0wMjU2NjliYTM4OGE%3D&google_push=AYg5qPKOfvnCSiE6NCj8bmamdIOKmxcw1MKX3QwnL6jDqLHDA_sK8XpfYDXcDN71u4Eqo_7WL0IGRxHBQk79OWudWB-dWOjnGmrvFx0

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sun, 19 Sep 2021 18:54:11 GMT
Server: ATS/7.1.2.138
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://cm.g.doubleclick.net/pixel?google_nid=oath_eb&google_hm=VVBmYTNkYzdlYy0xOTdhLTExZWMtYWUzZS0wMjU2NjliYTM4OGE%3D&google_push=AYg5qPKOfvnCSiE6NCj8bmamdIOKmxcw1MKX3QwnL6jDqLHDA_sK8XpfYDXcDN71u4Eqo_7WL0IGRxHBQk79OWudWB-dWOjnGmrvFx0
Connection: keep-alive
Content-Length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 9AA6 0
12 B 70ms
36ms Image
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KedVIL2FZMzxxMOrRucCSgH_edGO9eaUM4O0n_uT9NpXzks5MQjDfcLikidxo7F8zighnaIQ

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:54:11 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 dc_pre=COj0ooXbi_MCFcSlUQodVM4LyA;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5412555136543.802
adservice.google.com/ddm/fls/z/ Frame 01FC 42 B
63 B 36ms
35ms Image
image/gif 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=COj0ooXbi_MCFcSlUQodVM4LyA;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5412555136543.802

Requested by

Host: 5994599.fls.doubleclick.net
URL: https://5994599.fls.doubleclick.net/activityi;dc_pre=COj0ooXbi_MCFcSlUQodVM4LyA;src=5994599;type=invmedia;cat=wieh99wc;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5412555136543.802?

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://5994599.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame F8CA 51 KB
51 KB 31ms
15ms Script
application/javascript 18.66.97.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513135&wgcampaignid=99582&js=1&viewref=43958200153297800710612011722020&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.97.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c6ce2b47cde7cf913a3c34ddce355fa9c75012577dd34c35928add8676cb7fa0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: ESJ1m.JcTMC7xiA46tdzcog3eD2HGNO9
via: 1.1 e44e0b24e706487eaec6b9e01f2166dd.cloudfront.net (CloudFront)
last-modified: Mon, 13 Sep 2021 10:14:21 GMT
server: AmazonS3
age: 35029
etag: "ec0ced40cbb5211db06b8a36f209e442"
x-cache: Hit from cloudfront
content-type: application/javascript
date: Sun, 19 Sep 2021 09:10:22 GMT
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
content-length: 51794
x-amz-cf-id: OFWhsFNsk-7RBFYxIMASAdH0vs2zKHLy9r3YwSgLq4ZuKTm7U8WZFg==

GET
H/1.1 200
OK link.html
track.webgains.com/ Frame F8CA 3 KB
3 KB 63ms
23ms Image
image/png 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.webgains.com/link.html?wgcampaignid=99582&viewref=33205300163979600710680011722019&wglinkid=2513135
Requested by: Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 19 Sep 2021 18:54:11 GMT
Last-Modified: Sun, 19 Sep 2021 18:54:11 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: image/png
Content-Length: 2808
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET cm
p.rfihub.com/ Frame C306 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C306
Redirect Chain

https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEGQl-tSpJE9B46hg3AGdzlg&google_cver=1&google_push=AYg5qPIltI8VPLUt2grvISbfl5LdD1kjKeu9bi4Zd1Ekai5m_ScN5Ewnyw21OOu-VLjSSGTv4sCeljy...
https://pixel-sync.sitescout.com/dmp/pixelSync?cookieQ=1&nid=8&google_gid=CAESEGQl-tSpJE9B46hg3AGdzlg&google_cver=1&google_push=AYg5qPIltI8VPLUt2grvISbfl5LdD1kjKeu9bi4Zd1Ekai5m_ScN5Ewnyw21OOu-VLjSS...
https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=aksSYVuLR0eNI-1jr2l7aGFHh1M

170 B
188 B

126ms
126ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=aksSYVuLR0eNI-1jr2l7aGFHh1M

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
location: https://cm.g.doubleclick.net/pixel?google_nid=ssc&google_hm=aksSYVuLR0eNI-1jr2l7aGFHh1M
cache-control: max-age=0,no-cache,no-store
content-length: 0
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET /
dsp.adfarm1.adition.com/cookie/ Frame C306 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C306
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEFdGPuKrw6r0RjhpgoPAVXk&google_cver=1&google_push=AYg5qPKrkE4bF6zRCXy10YNeL6SHP9amHmzJa8Ttaoy13fxYJ1jLeh1-mpek7HnogXARsPTnAdhIYPm76avBWKccYZ0_...
https://r.scoota.co/sync?ssp=bidswitch&bidswitch_ssp_id=google
https://r.scoota.co/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=google
https://x.bidswitch.net/sync?dsp_id=29&expires=30&user_id=24b8d44f-5fab-4e48-9387-4e10ca1c6fef&ssp=google
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPIh3foJIOYRUPtgkhbd3YJLEsQdkQ5lZjp44JfZVoD51moefJ3Bwy53EkiQ_teSZ19hgypd06S-lSZR34Pu0UXvtxzYnF_e&google_hm=gqJOqdpzTOuwkgGkWzS1Kw==

170 B
188 B

124ms
123ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPIh3foJIOYRUPtgkhbd3YJLEsQdkQ5lZjp44JfZVoD51moefJ3Bwy53EkiQ_teSZ19hgypd06S-lSZR34Pu0UXvtxzYnF_e&google_hm=gqJOqdpzTOuwkgGkWzS1Kw==

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:12 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPIh3foJIOYRUPtgkhbd3YJLEsQdkQ5lZjp44JfZVoD51moefJ3Bwy53EkiQ_teSZ19hgypd06S-lSZR34Pu0UXvtxzYnF_e&google_hm=gqJOqdpzTOuwkgGkWzS1Kw==
date: Sun, 19 Sep 2021 18:54:11 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C306
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEKFhvmYMrNYSpFWYCzDMtvY&google_cver=1&google_push=AYg5qPI9lWU6pRpm_EFCCYkr6_lJDekJkRz0zlL-0nzqBts3RHrOqVp9rKv32sV6VPqw58opMqVp9_JE...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEKFhvmYMrNYSpFWYCzDMtvY&google_cver=1&google_push=AYg5qPI9lWU6pRpm_EFCCYkr6_lJDekJkRz0zlL-0nzqBts3RHrOqVp9rKv32sV6VPqw58opMqV...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODAxMzA2NTI5ODM1NDA4OTIzNQ&google_push=AYg5qPI9lWU6pRpm_EFCCYkr6_lJDekJkRz0zlL-0nzqBts3RHrOqVp9rKv32sV6VPqw58opMqVp9_...

170 B
188 B

125ms
125ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODAxMzA2NTI5ODM1NDA4OTIzNQ&google_push=AYg5qPI9lWU6pRpm_EFCCYkr6_lJDekJkRz0zlL-0nzqBts3RHrOqVp9rKv32sV6VPqw58opMqVp9_JEV2SC1QCHdHX6577K5Io

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=ODAxMzA2NTI5ODM1NDA4OTIzNQ&google_push=AYg5qPI9lWU6pRpm_EFCCYkr6_lJDekJkRz0zlL-0nzqBts3RHrOqVp9rKv32sV6VPqw58opMqVp9_JEV2SC1QCHdHX6577K5Io
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C306
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEH...
https://sync.targeting.unrulymedia.com/csync/RX-d160ac7f-0299-4ccd-ae99-156ef5acff10-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DAYg5qPLx6WNwPUH9B2OBVWTap...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPLx6WNwPUH9B2OBVWTap8JuvizeC-l_TjXHcXBINWz_iF926x5IL9O7D6Z35_sPh5ofrr5AC5iJjegON0eYTs20EcjoUw&google_hm=A9FgrH8CmUzNrpkVbvWs_xA

170 B
188 B

124ms
124ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPLx6WNwPUH9B2OBVWTap8JuvizeC-l_TjXHcXBINWz_iF926x5IL9O7D6Z35_sPh5ofrr5AC5iJjegON0eYTs20EcjoUw&google_hm=A9FgrH8CmUzNrpkVbvWs_xA

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPLx6WNwPUH9B2OBVWTap8JuvizeC-l_TjXHcXBINWz_iF926x5IL9O7D6Z35_sPh5ofrr5AC5iJjegON0eYTs20EcjoUw&google_hm=A9FgrH8CmUzNrpkVbvWs_xA
date: Sun, 19 Sep 2021 18:54:11 GMT
server: Tengine
p3p: CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag: RXd160ac7f02994ccdae99156ef5acff10003
content-type: text/html

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C306
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEOTGWiXpDFNAfSH_JBgA8Qo&google_cver=1&google_push=AYg5qPKuvCShA4Rv08HtSQ-xZrPFSkoBpnE3g6TxQHV3qMmBfaqMQ8NlGI9r_AsfvcKLipyyHH...
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEOTGWiXpDFNAfSH_JBgA8Qo&google_cver=1&google_push=AYg5qPKuvCShA4Rv08HtSQ-xZrPFSkoBpnE3g6TxQHV3qMmBfaqMQ8NlGI9r_AsfvcKLipyyHH...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS0zMTlyektGRTJ1RS5jTXEuSVZ5STVxenkwWXV4SGlRTH5B&google_push=AYg5qPKuvCShA4Rv08HtSQ-xZrPFSkoBpnE3g6TxQHV3qMmBfaqMQ8NlG...

170 B
188 B

126ms
126ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS0zMTlyektGRTJ1RS5jTXEuSVZ5STVxenkwWXV4SGlRTH5B&google_push=AYg5qPKuvCShA4Rv08HtSQ-xZrPFSkoBpnE3g6TxQHV3qMmBfaqMQ8NlGI9r_AsfvcKLipyyHHEVP4EON-_jOGs1Cz_kBb_JUB-A

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Sun, 19 Sep 2021 18:54:11 GMT
Server: ATS/7.1.2.138
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS0zMTlyektGRTJ1RS5jTXEuSVZ5STVxenkwWXV4SGlRTH5B&google_push=AYg5qPKuvCShA4Rv08HtSQ-xZrPFSkoBpnE3g6TxQHV3qMmBfaqMQ8NlGI9r_AsfvcKLipyyHHEVP4EON-_jOGs1Cz_kBb_JUB-A
Connection: keep-alive
Content-Length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame C306 0
12 B 37ms
34ms Image
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LioQZI0Jf6D488wVF7Fuwaee9ukBgcm2aMQX8p-1eR6iV3TwfE5-YILQlglf0DJORwCXDCBg

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 19 Sep 2021 18:54:11 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1 200
OK viewability Show response
hal900015.redintelligence.net/ Frame 3E8C 0
150 B 36ms
14ms Script
text/html 138.201.135.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900015.redintelligence.net/viewability?s=80689800129809900710632011722015&a=f2c66c8d&vb=m
Requested by: Host: hal900015.redintelligence.net
URL: https://hal900015.redintelligence.net/request_content.php?s=80689800129809900710632011722015&a=504dcde4
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.135.164 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.135.201.138.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900015.redintelligence.net/request_content.php?s=80689800129809900710632011722015&a=504dcde4
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 19 Sep 2021 18:54:11 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H3 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame 3E8C 16 KB
16 KB 27ms
27ms Font
font/woff2 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

efb3cdc5e4582fd67dffab6fc6e5062074ce3f8c51747346af944e97749dc309

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900015.redintelligence.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 01:22:16 GMT
x-content-type-options: nosniff
age: 495115
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15948
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:32 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 14 Sep 2022 01:22:16 GMT

GET
H3 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v14/ Frame 3E8C 16 KB
16 KB 30ms
30ms Font
font/woff2 142.250.184.227
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.227 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9950fa5ca9cf47072770900d259bcf6778aa1119652d2e706d5eb92df254199

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900015.redintelligence.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 01:22:16 GMT
x-content-type-options: nosniff
age: 495115
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16112
x-xss-protection: 0
last-modified: Tue, 15 Sep 2020 18:10:09 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 14 Sep 2022 01:22:16 GMT

GET
H/1.1 200
OK viewability Show response
hal900020.redintelligence.net/ Frame C0C1 0
150 B 35ms
12ms Script
text/html 178.63.52.121
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900020.redintelligence.net/viewability?s=43958200153297800710612011722020&a=06ee5a64&vb=m
Requested by: Host: hal900020.redintelligence.net
URL: https://hal900020.redintelligence.net/request_content.php?s=43958200153297800710612011722020&a=41a12013
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 178.63.52.121 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.121.52.63.178.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://hal900020.redintelligence.net/request_content.php?s=43958200153297800710612011722020&a=41a12013
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date: Sun, 19 Sep 2021 18:54:11 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 401 check_scope Show response
api.spotify.com/v1/melody/v1/ Frame 50DE 77 B
162 B 40ms
39ms Fetch
application/json 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Requested by

Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

863e7d2c37417b268dcfbeb4430cccad660050490c6d66f2d657370df21c5b06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

authorization: Bearer undefined
Referer: https://sdk.scdn.co/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
www-authenticate: Bearer realm="spotify", error="invalid_token", error_description="Invalid access token"
server: envoy
access-control-allow-origin: *
date: Sun, 19 Sep 2021 18:54:11 GMT
access-control-max-age: 604800
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-credentials: true
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
alt-svc: clear
content-length: 92
x-content-type-options: nosniff

OPTIONS
H2 200 check_scope
api.spotify.com/v1/melody/v1/ Frame 0
0 24ms
24ms Preflight 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Protocol

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Origin: https://sdk.scdn.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: *
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
access-control-allow-credentials: true
access-control-max-age: 604800
content-length: 0
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
date: Sun, 19 Sep 2021 18:54:11 GMT
server: envoy
via: HTTP/2 edgeproxy, 1.1 google
alt-svc: clear

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C7E2 0
20 B 38ms
37ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BhO9qUodHYY7tNuCU7_UP27S3-AkAAAAAOAHgBAI&bg=!m5ilmNzNAAaUnz4elJ87ACkAdvg8Wofs8ldwJpIr0FJcE2qxP-E_LyEhURi5yCq3U-GjnrQGGoJRFQIAAAIoUgAAADNoAQcKABNJ_uO-Vne-dT9PhztBGrV87HHomQLOtg1pRCahPiSbJvon5_17eYx8gPGhI6zlMI2wNESfwcCPF3UsCZzdTACQigIDHXX25KRgVjJYLD9Pf517cmywkMkNR7oUH0_wuouiYLLjO6QCEjofC79_xmyT7JFONGr_hB6gmJn5jDEnKQZUzpkj8XgReZ-Y3FdMwE9g8K9pAgdunCIYAptRbNNWRyvlvUuOiTiM_xBeP_u_umc7lWLQrGOVhHpRyyRTH6Xq4UHU-quGL3YhhWfRWPlBV1mOKtdN-MoX2LV0PpGiAK84Zh6NVZi69pcjH9geO8hq2Dfjz59tKzAW9wTcnfCWmImqUfu-7sQB2qTbTTeGr5JGNRp3k_Xeall_mMdV5924jVNkqItSUjmDeukuYPk9ZAAIKdw89xu4eETV_Dtxt_Co7nThk1D0m87P_5clB3puAuo5SdUvD-orphZ4mE3JpNlvAbGq32GTdWvjyGm2PXjBBZTXvc6NiMR-1v9dEYWpNQWmqtQsRZP0b7N5lNy1hAj9FfHcFZN0zgBJlEXd_0CE0xXLY6EOIBLc47uBv-yYjQYxc0T1WWgf4F9E08fffJAjhFqDdXAPPLUiBWUyDuL8Y5DFncaDCxrbb14meaM3BJO8zDyCiHFXnoA0tVokfKovKpFNYl3FNAhIJiL5shb9H-qAeT2FWNnqmoE_NDFTThBgf93NvcD9T-Hg97UW0HHTtyZnba5Inw5V0yHzxC4zVv-w8B1x7IrNhce-yFBwE622KGQwAY5Rn00XUbejbQaJ2mI_wT7jhQTI5-T188y2SGP4dCZOMcwXwP_PkckchGAHynwofvjaU5HBxbM5YvHoWrztqBPPmWv3QS8u36r_qFIn9kiJAj8g0SQKYseGPQ3OjtOJq3yLcx9M6DlMWGGTrO8vBr9wLpyH0KypVHMeRq5mXL7dXX6agHxpmanJCCCMdD-TPdSpcy0gkv5WdMuMDQ

Requested by

Host: 8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com
URL: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 53ms
52ms Image
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&t=2&li=gpt_2021091001&jk=320028662497518&bg=!FhWlFVHNAAaUnz4elJ87ACkAdvg8Ws_CO4qLALIKZNxfc0o9B_LoLUHiu9rhhaLB6hoMb43hVShuKAIAAAIgUgAAACtoAQeZAnItjzN7J1tuJV8oW-xlUSgmXXrH7PNVj3FXVA24C42-ygu97hZqazv3aOY2MpvgdrOFuoWpgghzD60exmQ_JhWH17i-cv0zeoyzt-9V85VFEK0hyCyTKMsxxFU7ZR4OwR0Cdittt4z8bmJw8qfLeeaVN_xHNxZoW8iwoH8Mo6nZV2rW3ql4_6XEWpInxyqPTczlmwGxJeUxngA_p_hnQ5z76vRKgsfGShTX0AlkGeKwEBa8oYO6aZGdNEcv0ggxywD8B1nrlhZWdo43MPHux5K1MQPS628bCDswotB-cyyhXxxVm5XfFTgxfkRemdFQQk4vxVW-09bydPrzk7aZ8PoeZRQ_KijoMD3SPyfwMPAAYv_VOrrwZDX3n7QY2_ZOSiDgb0QOroNAMB2AqEf8juaO1Uh5UmASvTJQ3xOt8qDSsIS-W5-FCqWrUupqF74jFcqGEynUu8I3l_8iXfmmqo1xcELpyxprNA85nFFJS_Nx9FL8BCt9isSp-WgNcaUdmLTK-sieTUZVKUUFOG6bjRqmF-cO65Fk8_gPT_9yHk8qvdc15DQHDqf1WWNy8Zyqrb9kAp6J_E__ll2Uu0IXoh5Ixsf3pA-vzuG6iOcqdwG_nULa4rTzdL_f07gYFR4llGQPnn-1B0pMZug7NwYKbHNjNViCFOm8YptoSEQw_hM5xjQDCRcPlNuNnN8Q-llObqGps7zhnnEDeb1uXRUBISufsUTWKfdIjQfaD9qEafSuVHpLqUWTbLfJukDQg82DzSeRpXklM6eI2lnri4VX6FlIRsFDO9Tui9IMTAgyEDuj3USH8Eb6apJh7NfoAd0dHloGtg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.181.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s56-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://blip.fm/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B2F5 0
20 B 40ms
40ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B28MSUodHYa_TNp3j7_UPtcO6wAoAAAAAOAHgBAI&bg=!BgWlBUHNAAaUnz4elJ87ACkAdvg8Wnr9Rm7syGPQTLVteFSOdTA9LTpL0da75ZQBgA3KyEpH7k7bAwIAAAJSUgAAACZoAQeZAs-MM5EcEeEz9aALwNobXD6YE8AquZCU1rsNQqjekG54l8ekH8ZV4D9I0u96_VOBC6gUeCsBuq9tjCTVpOBWiOxE-T5AA_biOOlstz43zCWtkTUxo9MlKgePi07kBpb78PiZJB0tXUuVuV7lXwo-INcvSJhe_3w43pDKSqlPwpDSWDZendlvMzXqvyF_Vb0EbpxovRUoKK0dtt0a3Pku3sZloh4i2DKX_Jd-kpx53PkfhDggTv2gvYu1k0_i3tMEW1UhO44qM9M7Jnck_p0YA4N60yXvgZlolyDEPbHXRWt9sCfnTSWZuvlwdxJAu9QxccwyKzy-zEtx0IfUn0laCl3_bp4EjPMqEsoCXjbuJsEDmN4fIakuwr1CkC3nF_Ba_tGwnS9sm6E_ZW8Wv0QumFl3O-Egf2zEOkQBAIC5b86bLYR5NEUKITtobCqjU0GD_Jsw9hW0mMbK6X5sH5oivbRHpv5Tg91cC_QjqXrtOqi-Rl_hixyeCiXiZ-mrO1VHwZ3LJ7i07gVJNgceCgAUfUCWojdJ1bPH1e4M7ppe4NO-JnPxYJXKhBXYicN6Dvl0qyBJv0x1Uu2F3ZvSeUkB2vcIgt-a8tVvzPe9LjKUzALksIxe77kktopL4iDrffK99RkxL71Pr0_g87LX5uP8kyuQeqNmWTWTS0tgj5O_k9g0Cn37wfxEIsqpJdQ7qElXRMB0Qe4ilE6HAP-ToBj7ozTC9paWl96ohzqC7p9DHuoTiat64qFVCWBhAxNQFZy-NXv5K-iKyv3eJHPHe2U8_ttGl59kXr6oBJsF1TSYDSHSxIz37I9XVhCoAlWYiIVycIlG0e6blLN7cgwZbuQuL0XbiJi3EKcU15kiOspGS9fZa8tj3yw4O6kYLNoAOR6ABI8K9EAiwl42IWtMMuBvj25V_EbuMnmlo_fzwGj8r4EVhQCIbj_pttQ6aBs4fpUAdw

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:11 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 401 check_scope Show response
api.spotify.com/v1/melody/v1/ Frame 50DE 77 B
162 B 29ms
28ms Fetch
application/json 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Requested by

Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

863e7d2c37417b268dcfbeb4430cccad660050490c6d66f2d657370df21c5b06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

authorization: Bearer undefined
Referer: https://sdk.scdn.co/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
www-authenticate: Bearer realm="spotify", error="invalid_token", error_description="Invalid access token"
server: envoy
access-control-allow-origin: *
date: Sun, 19 Sep 2021 18:54:11 GMT
access-control-max-age: 604800
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-credentials: true
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
alt-svc: clear
content-length: 92
x-content-type-options: nosniff

OPTIONS
H2 200 check_scope
api.spotify.com/v1/melody/v1/ Frame 0
0 27ms
27ms Preflight 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Protocol

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: authorization
Origin: https://sdk.scdn.co
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

access-control-allow-origin: *
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
access-control-allow-credentials: true
access-control-max-age: 604800
content-length: 0
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
date: Sun, 19 Sep 2021 18:54:11 GMT
server: envoy
via: HTTP/2 edgeproxy, 1.1 google
alt-svc: clear

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 5806 42 B
64 B 65ms
34ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv4MVccijilW28ujrOg7DmpV9UudccL9HY7MfQcjlCl6BFa1iaRay761WCYMtGSxdtmcOxfsFfHtybvyS-GCPoRXASoGp-8f-ZuAQJJ&sai=AMfl-YRo6OcC090iCfy__NRDUI4lDtMMa9a2qOoGHGdG0fR_2U70KPHKjchAJa8ci6W3IP3u_f7ZnDXhD_Na4ZHUPyfvQzhXHjWEsr2T5gcHZTBPSlZIaVIp55ZM3ZQ&sig=Cg0ArKJSzEU0hOq-3KY1EAE&cid=CAASEuRom1GASeG__3n6nDB7J8MlYQ&id=lidar2&mcvt=1357&p=689,315,779,1285&asp=689,315,779,1285&mtos=1357,1357,1357,1357,1357&tos=1357,0,0,0,0&v=20210917&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=3076314635&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&eosm=0&rst=1632077650807&rpt=531&isd=0&lsd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame F8CA 42 B
64 B 34ms
33ms Fetch
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstpiHvRzJsPV1qb3xp--ISNEhNsinphVxNwa3d9q24njME6TUPO5kAqHnYduDzBOAZ9KQ8nXufzpaG-YbvE4ETZAMh072eOa1zgwCB5&sai=AMfl-YRVJeceYww463sgufv-p8V_3Psgu0_qhVcXkuRkxyteqiFZQv2_KRGGeZbRZHx0d1ef9bQnB_XsAftqaJ6q5BsjGGKsjND_Ia5UmE5QyXn3Lq2A7wrPbChuAdY&sig=Cg0ArKJSzKrHwhpoPIlFEAE&cid=CAASEuRoBzK6m8juOGhFDpJe8KKtKQ&id=lidar2&mcvt=1323&p=1110,436,1200,1164&asp=1110,436,1200,1164&mtos=1323,1323,1323,1323,1323&tos=1323,0,0,0,0&v=20210917&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=3224969948&rs=4&met=mue&la=0&cr=0&osd=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIl0%3D&vs=4&eosm=0&rst=1632077650811&rpt=626&isd=0&lsd=0&r=v

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://8825468acf5dd098ae7a61dca304a726.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 19 Sep 2021 18:54:12 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 401 check_scope Show response
api.spotify.com/v1/melody/v1/ Frame 50DE 77 B
162 B 30ms
30ms Fetch
application/json 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Requested by

Host: sdk.scdn.co
URL: https://sdk.scdn.co/embedded/index.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

envoy /

Resource Hash

863e7d2c37417b268dcfbeb4430cccad660050490c6d66f2d657370df21c5b06

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

authorization: Bearer undefined
Referer: https://sdk.scdn.co/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
www-authenticate: Bearer realm="spotify", error="invalid_token", error_description="Invalid access token"
server: envoy
access-control-allow-origin: *
date: Sun, 19 Sep 2021 18:54:12 GMT
access-control-max-age: 604800
access-control-allow-methods: GET, POST, OPTIONS, PUT, DELETE, PATCH
content-type: application/json
via: HTTP/2 edgeproxy, 1.1 google
access-control-allow-credentials: true
access-control-allow-headers: Accept, App-Platform, Authorization, Content-Type, Origin, Retry-After, Spotify-App-Version, X-Cloud-Trace-Context, client-token, content-access-token
alt-svc: clear
content-length: 92
x-content-type-options: nosniff

OPTIONS
H2 200 check_scope
api.spotify.com/v1/melody/v1/ Frame 0
0 27ms
26ms Preflight 35.186.224.25
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://api.spotify.com/v1/melody/v1/check_scope?scope=web-playback

Protocol

Server

35.186.224.25 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS