simcast.com Open in urlscan Pro
45.79.244.12 Public Scan

Software

sffe /

Resource Hash

eda80ba132b4cfc1d3d58a29de5e971ad4e184bfd159739ef17d32eeb818cdd3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28305
x-xss-protection: 0
server: sffe
etag: "1185 / 791 of 1000 / last-modified: 1649714841"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 12 Apr 2022 05:15:51 GMT

GET
H2 200 pubads_impl_2022040701.js Show response
securepubads.g.doubleclick.net/gpt/ 368 KB
125 KB 22ms
20ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022040701.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4eba10304f45a9ca7d6b3b882e564a5dd00d3900dc515fbe6137765ed0fb45a3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:04:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 660
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 127673
x-xss-protection: 0
last-modified: Thu, 07 Apr 2022 08:34:53 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 12 Apr 2023 05:04:51 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 113 B
121 B 64ms
32ms XHR
application/json 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=simcast.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aee958f37bc556666a5c5f0f40b380bb2b692678f91cf4ba3c87a85617dbb636

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 12 Apr 2022 05:15:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 96
x-xss-protection: 0
expires: Tue, 12 Apr 2022 05:15:52 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203300101/ 301 KB
108 KB 78ms
47ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203300101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-9565037823771164&plah=simcast.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b38b16469af42a9ac6c8f858f28f1d6c386a1b78da8a3c61f62e87a3b6e9f37a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 110328
x-xss-protection: 0
server: cafe
etag: 14641304765675448842
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Tue, 12 Apr 2022 05:15:52 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220406/r20190131/ Frame D78D 10 KB
5 KB 81ms
27ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220406/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

340b20f9ff6d073c2fea911631d8a6e13af185d983cbe842ddca27df91d0f295

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 42429
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4398
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 11 Apr 2022 17:28:43 GMT
etag: 14837630671339829333
expires: Mon, 25 Apr 2022 17:28:43 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK fa-solid-900.woff2
simcast.com/lib/fontawesome-5.9.0/webfonts/ 74 KB
74 KB 503ms
251ms Font
font/woff2 45.79.244.12
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL: https://simcast.com/lib/fontawesome-5.9.0/webfonts/fa-solid-900.woff2
Requested by: Host: simcast.com
URL: https://simcast.com/lib/fontawesome-5.9.0/css/all.min.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 45.79.244.12 Atlanta, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS: nb-45-79-244-12.atlanta.nodebalancer.linode.com
Software: Apache/2.4.38 (Debian) /
Resource Hash: cd398be1a91817126cef10224738e624358edf6f08043abad7e60c1aaeccc8d0

Request headers

Referer: https://simcast.com/lib/fontawesome-5.9.0/css/all.min.css
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
last-modified: Wed, 08 Dec 2021 21:32:06 GMT
server: Apache/2.4.38 (Debian)
etag: "126b0-5d2a938b14180"
upgrade: h2
connection: Upgrade
accept-ranges: bytes
content-type: font/woff2
content-length: 75440

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 215 B
415 B 26ms
25ms Script
text/javascript 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=simcast.com&callback=_gfp_s_&client=ca-pub-9565037823771164

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202203300101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-9565037823771164&plah=simcast.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

872.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

cafe /

Resource Hash

387e5fd88605e6cab5eb37b0f0320b69fff97eb9f928787872c02d6e48352e0a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 200
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 87ms
31ms Script
application/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=simcast.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 12 Apr 2022 05:15:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 84ms
29ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=simcast.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 12 Apr 2022 05:15:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 52ms
52ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dthewaterwomanplus.com%26pcid%3D802%26rid%3D152%26a%3D0&tn=DIV&cls=menutop%20clearfix&ign=false&pw=1600&ph=1200&x=0&y=0

Requested by

Host: simcast.com
URL: https://simcast.com/?d=thewaterwomanplus.com&pcid=802&rid=152&a=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 90BF 603 B
68 B 75ms
48ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-9565037823771164&output=html&adk=1272721408&adf=3838797007&lmt=1649740552&plat=2%3A16777216%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dthewaterwomanplus.com%26pcid%3D802%26rid%3D152%26a%3D0&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1649740552024&bpp=3&bdt=602&idt=153&shv=r20220406&mjsv=m202203300101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=6163707405432&frm=20&pv=2&ga_vid=248144035.1649740552&ga_sid=1649740552&ga_hid=1945186641&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759842%2C44760475%2C31065371%2C31065787&oid=2&pvsid=1300786470299441&pem=252&tmod=1858283370&uas=0&nvt=1&ref=http%3A%2F%2Fthewaterwomanplus.com%2F&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=172

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 46
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Apr 2022 05:15:52 GMT
expires: Tue, 12 Apr 2022 05:15:52 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK stn-player.js Show response
embed.sendtonews.com/stn-player/20220404/ 608 KB
177 KB 507ms
208ms Script
application/javascript 54.225.130.195
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js
Requested by: Host: thewaterwomanplus.com
URL: http://thewaterwomanplus.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.225.130.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-130-195.compute-1.amazonaws.com
Software: Apache /
Resource Hash: a84858483923c0281d69fb5c305370d29c27d16d3fdd2b277277efe9fd9122f8

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Tue, 12 Apr 2022 05:15:52 GMT
Content-Encoding: gzip
Last-Modified: Tue, 05 Apr 2022 00:53:54 GMT
Server: Apache
ETag: "97fb7-5dbddadd18c80-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: max-age=3600, no-cache="set-cookie"
transfer-encoding: chunked
Connection: keep-alive
Accept-Ranges: bytes
X-Robots-Tag: noindex, nofollow
Expires: Tue, 12 Apr 2022 06:15:52 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 67ms
20ms Script
text/javascript 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-205158314-1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 3521
date: Tue, 12 Apr 2022 04:17:11 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Tue, 12 Apr 2022 06:17:11 GMT

GET
H/1.1 200
OK ajaxjs.php Show response
simcast.com/widgets/ms/ 4 B
363 B 371ms
133ms XHR
text/html 45.79.244.12
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL: https://simcast.com/widgets/ms/ajaxjs.php?fra=0&p=0
Requested by: Host: code.jquery.com
URL: https://code.jquery.com/jquery-3.4.1.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 45.79.244.12 Atlanta, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS: nb-45-79-244-12.atlanta.nodebalancer.linode.com
Software: Apache/2.4.38 (Debian) /
Resource Hash: 118afd859a9e500d848a3406ac0ea212dc2a0b8d16d2bee0738b83b388118737

Request headers

Accept: text/plain, */*; q=0.01
Referer: https://simcast.com/?d=thewaterwomanplus.com&pcid=802&rid=152&a=0
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:52 GMT
content-encoding: gzip
server: Apache/2.4.38 (Debian)
vary: Accept-Encoding
upgrade: h2
cache-control: no-store, no-cache, must-revalidate
connection: Upgrade
content-type: text/html; charset=UTF-8
content-length: 24
expires: Thu, 19 Nov 1981 08:52:00 GMT

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 92ms
15ms Preflight 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://simcast.com
access-control-max-age: 600
age: 0
content-length: 0
date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 92ms
16ms Preflight 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://simcast.com
access-control-max-age: 600
age: 0
content-length: 0
date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 92ms
16ms Preflight 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://simcast.com
access-control-max-age: 600
age: 0
content-length: 0
date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 92ms
16ms Preflight 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://simcast.com
access-control-max-age: 600
age: 0
content-length: 0
date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 92ms
16ms Preflight 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://simcast.com
access-control-max-age: 600
age: 0
content-length: 0
date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 92ms
17ms Preflight 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://simcast.com
access-control-max-age: 600
age: 0
content-length: 0
date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 101ms
26ms Preflight 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://simcast.com
access-control-max-age: 600
age: 0
content-length: 0
date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 90ms
16ms Preflight 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://simcast.com
access-control-max-age: 600
age: 0
content-length: 0
date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 92ms
17ms Preflight 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://simcast.com
access-control-max-age: 600
age: 0
content-length: 0
date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 101ms
26ms Preflight 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://simcast.com
access-control-max-age: 600
age: 0
content-length: 0
date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 100ms
25ms Preflight 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://simcast.com
access-control-max-age: 600
age: 0
content-length: 0
date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33

OPTIONS
H2 200 bidRequest
c2shb.pubgw.yahoo.com/ Frame 0
0 99ms
25ms Preflight 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-openrtb-version
Access-Control-Request-Method: POST
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With,Content-Type,X-Openrtb-Version
access-control-allow-methods: GET,POST,OPTIONS
access-control-allow-origin: https://simcast.com
access-control-max-age: 600
age: 0
content-length: 0
date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33

POST
H/1.1 200
OK auction Show response
prebid.adnxs.com/pbs/v1/openrtb2/ 795 B
780 B 537ms
473ms XHR
application/json 37.252.161.190
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.adnxs.com/pbs/v1/openrtb2/auction
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.252.161.190 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS: prebid.ams1.adnexus.net
Software: nginx/1.21.3 /
Resource Hash: 36e11ca68843fac95fae601ef69e7da4499c6a5a52bb3299d2612ea2acc17be6

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 12 Apr 2022 05:15:52 GMT
Content-Encoding: gzip
Server: nginx/1.21.3
X-Prebid: pbs-go/0.205.0
Vary: Accept-Encoding, Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://simcast.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Transfer-Encoding: chunked
Expires: 0

GET
H2 200 hb Show response
ice.360yield.com/ 250 B
463 B 134ms
42ms XHR
application/json 63.33.104.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ice.360yield.com/hb?jsonp=%7B%22bid_request%22%3A%7B%22secure%22%3A1%2C%22id%22%3A%22127af84f76e9ea43%22%2C%22version%22%3A%227.7.0-JS-6.4.0%22%2C%22referrer%22%3A%22https%3A%2F%2Fsimcast.com%2F%3Fd%3Dthewaterwomanplus.com%26pcid%3D802%26rid%3D152%26a%3D0%22%2C%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22adapex.io%22%2C%22sid%22%3A%22s1404%22%2C%22hp%22%3A1%7D%5D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2207b64c8d-fed2-45bb-923b-9129d21be6c6%22%2C%22atype%22%3A1%7D%5D%7D%5D%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2246ab80b5f35c662%22%2C%22bidfloor%22%3A0.0125%2C%22bidfloorcur%22%3A%22USD%22%2C%22pid%22%3A22597743%2C%22tid%22%3A%2243d0d5b3-1fc0-4203-92ce-cf7afc3a3778%22%2C%22banner%22%3A%7B%22format%22%3A%5B%7B%22w%22%3A970%2C%22h%22%3A90%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%7D%2C%7B%22w%22%3A728%2C%22h%22%3A250%7D%2C%7B%22w%22%3A970%2C%22h%22%3A250%7D%5D%7D%7D%2C%7B%22id%22%3A%2247d09b068632c94%22%2C%22bidfloor%22%3A0.0125%2C%22bidfloorcur%22%3A%22USD%22%2C%22pid%22%3A22597746%2C%22tid%22%3A%223bddcb14-29b6-4516-93e3-09f063a2b5e2%22%2C%22banner%22%3A%7B%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%7D%2C%7B%22w%22%3A300%2C%22h%22%3A100%7D%2C%7B%22w%22%3A320%2C%22h%22%3A100%7D%2C%7B%22w%22%3A336%2C%22h%22%3A280%7D%5D%7D%7D%2C%7B%22id%22%3A%22483e008a8a36088%22%2C%22bidfloor%22%3A0.0125%2C%22bidfloorcur%22%3A%22USD%22%2C%22pid%22%3A22597745%2C%22tid%22%3A%225a23fdef-5fdc-4b0c-b10c-b06b922a5441%22%2C%22banner%22%3A%7B%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%7D%2C%7B%22w%22%3A300%2C%22h%22%3A100%7D%5D%7D%7D%2C%7B%22id%22%3A%22495e5b196181c45%22%2C%22bidfloor%22%3A0.0125%2C%22bidfloorcur%22%3A%22USD%22%2C%22pid%22%3A22597747%2C%22tid%22%3A%2267743701-5881-4a70-96f3-af9285e1111d%22%2C%22banner%22%3A%7B%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%7D%5D%7D%7D%5D%7D%7D
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 63.33.104.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-63-33-104-96.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: fc655013aef992208ceaa6937c6ed7f7159019af55dc309f65334b1aea9a75b5

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 12 Apr 2022 05:15:52 GMT
access-control-allow-credentials: true
content-type: application/json; charset=UTF-8
content-length: 250
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
344 B 740ms
184ms XHR
text/plain 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 12 Apr 2022 05:15:52 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
server: envoy
x-envoy-upstream-service-time: 76
vary: origin, Accept-Encoding

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
96 B 122ms
85ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 332f251bb62f357a7d71d1cc15db9efcaa59dd27535a87b492727a0379e82942

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 6 KB
6 KB 136ms
101ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 2ed8bfd5796a084b5ad147a5c25ab6aa8448a00b3725b79573db33260de9ac64

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 6498

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
96 B 125ms
90ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: a35db3789cd5585c7269892a1972238741c2afffc9ebdb9908d2da6c131ea331

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 6 KB
6 KB 152ms
117ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 456dcb0a5fe94f314309a469d7a4632f4b5b451d48c9afb1a5a0b8af98e11a39

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 6587

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
121 B 1072ms
1037ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: e585abf30bea4d3457ae7a7f9159393ffbd8b0faa1da6245d0d7ca2db372787d

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Apr 2022 05:15:53 GMT
server: ATS/9.1.0.33
age: 1
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
96 B 121ms
86ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: abf384cefa40b3a2a1530a6487e19632cc8ea18b84669fecd0b199b40b90e72c

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
292 B 110ms
84ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 41720bc767ec312de629cfc0c9ba0f741a745aa4022f5abeaaf08209d4432910

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
96 B 122ms
86ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 3391332467d71f13aec0222130f9d35c05ef13c6b6deb6d15843918bece41002

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
96 B 119ms
85ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 27734a72f2c299c6cc6ef7d59127438fcc57a34a5c0adff45778e665406d4feb

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 6 KB
6 KB 126ms
100ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 41ef4c6a38bf64dc68deb4c7fd34ea04e71e4ea9c3858fef60eb333ea676fe50

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 6440

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 66 B
96 B 111ms
85ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: 911d1d2cac1129b123ed1b44394037c8c50bd628dfa5634cfe9a5708250354b0

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 66

POST
H2 200 bidRequest Show response
c2shb.pubgw.yahoo.com/ 7 KB
7 KB 155ms
129ms XHR
application/json 18.156.195.47
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c2shb.pubgw.yahoo.com/bidRequest
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.156.195.47 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-156-195-47.eu-central-1.compute.amazonaws.com
Software: ATS/9.1.0.33 /
Resource Hash: b970cdd84a6e12bcc475d20c88b97c80a6f774b568007b8b339ba101e348ac07

Request headers

Referer: https://simcast.com/
x-openrtb-version: 2.5
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
server: ATS/9.1.0.33
age: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers
access-control-allow-methods: POST,GET,HEAD,OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
content-length: 6962

GET
H2 200 cygnus Show response
htlb.casalemedia.com/ 36 B
327 B 160ms
87ms XHR
application/json 23.32.59.34
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/cygnus?s=754850&v=7.2&ac=j&sd=1&r=%7B%22id%22%3A%22680171f7607995%22%2C%22site%22%3A%7B%22ref%22%3A%22https%3A%2F%2Fsimcast.com%2F%3Fd%3Dthewaterwomanplus.com%26pcid%3D802%26rid%3D152%26a%3D0%22%2C%22page%22%3A%22https%3A%2F%2Fsimcast.com%2F%3Fd%3Dthewaterwomanplus.com%26pcid%3D802%26rid%3D152%26a%3D0%22%2C%22keywords%22%3A%22search%2Cnews%2Cautomotive%2Cbeauty%2Ceducation%2Cevents%2Cfashion%2Cfinance%2Cgames%2Chealth%2Chome%2Cinsurance%2Clegal%2Cpets%2Cproperty%2Cshopping%2Csports%2Ctechnology%2Ctransport%2Ctravel%2Cutilties%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%2C%22ixdiag%22%3A%7B%22msd%22%3A0%2C%22msi%22%3A0%2C%22mfu%22%3A0%2C%22bu%22%3A4%2C%22iu%22%3A0%2C%22nu%22%3A0%2C%22ou%22%3A0%2C%22allu%22%3A4%2C%22ren%22%3Afalse%2C%22version%22%3A%226.16.0%22%2C%22userIds%22%3A%5B%5D%2C%22fpd%22%3Atrue%7D%7D%2C%22imp%22%3A%5B%7B%22id%22%3A%2269b12f3b22abdd7%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A970%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22754850%22%2C%22sid%22%3A%22970x90%22%2C%22fl%22%3A%22p%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22754850%22%2C%22sid%22%3A%22728x90%22%2C%22fl%22%3A%22p%22%7D%7D%2C%7B%22w%22%3A728%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22754850%22%2C%22sid%22%3A%22728x250%22%2C%22fl%22%3A%22p%22%7D%7D%2C%7B%22w%22%3A970%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22754850%22%2C%22sid%22%3A%22970x250%22%2C%22fl%22%3A%22p%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22dfp_ad_unit_code%22%3A%22%2F22181265%2Fsmc_970v_1%22%7D%2C%22bidfloor%22%3A0.01%2C%22bidfloorcur%22%3A%22USD%22%7D%2C%7B%22id%22%3A%227322e7317fcce04%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22755348%22%2C%22sid%22%3A%22300x250%22%2C%22fl%22%3A%22p%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A100%2C%22ext%22%3A%7B%22siteID%22%3A%22755348%22%2C%22sid%22%3A%22300x100%22%2C%22fl%22%3A%22p%22%7D%7D%2C%7B%22w%22%3A320%2C%22h%22%3A100%2C%22ext%22%3A%7B%22siteID%22%3A%22755348%22%2C%22sid%22%3A%22320x100%22%2C%22fl%22%3A%22p%22%7D%7D%2C%7B%22w%22%3A336%2C%22h%22%3A280%2C%22ext%22%3A%7B%22siteID%22%3A%22755348%22%2C%22sid%22%3A%22336x280%22%2C%22fl%22%3A%22p%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22dfp_ad_unit_code%22%3A%22%2F22181265%2Fsmc_300v_2%22%7D%2C%22bidfloor%22%3A0.01%2C%22bidfloorcur%22%3A%22USD%22%7D%2C%7B%22id%22%3A%22771f913d1dbf675%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A300%2C%22h%22%3A250%2C%22ext%22%3A%7B%22siteID%22%3A%22755347%22%2C%22sid%22%3A%22300x250%22%2C%22fl%22%3A%22p%22%7D%7D%2C%7B%22w%22%3A300%2C%22h%22%3A100%2C%22ext%22%3A%7B%22siteID%22%3A%22755347%22%2C%22sid%22%3A%22300x100%22%2C%22fl%22%3A%22p%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22dfp_ad_unit_code%22%3A%22%2F22181265%2Fsmc_300v_1%22%7D%2C%22bidfloor%22%3A0.01%2C%22bidfloorcur%22%3A%22USD%22%7D%2C%7B%22id%22%3A%22797975aa232e0fb%22%2C%22banner%22%3A%7B%22topframe%22%3A1%2C%22format%22%3A%5B%7B%22w%22%3A728%2C%22h%22%3A90%2C%22ext%22%3A%7B%22siteID%22%3A%22755349%22%2C%22sid%22%3A%22728x90%22%2C%22fl%22%3A%22p%22%7D%7D%5D%7D%2C%22ext%22%3A%7B%22dfp_ad_unit_code%22%3A%22%2F22181265%2Fsmc_sticky_footer%22%7D%2C%22bidfloor%22%3A0.01%2C%22bidfloorcur%22%3A%22USD%22%7D%5D%2C%22at%22%3A1%2C%22source%22%3A%7B%22ext%22%3A%7B%22schain%22%3A%7B%22ver%22%3A%221.0%22%2C%22complete%22%3A1%2C%22nodes%22%3A%5B%7B%22asi%22%3A%22adapex.io%22%2C%22sid%22%3A%22s1404%22%2C%22hp%22%3A1%2C%22rid%22%3A%22e42ccca5-5f29-46de-8f13-e6bdfe5d2fd7%22%7D%5D%7D%7D%7D%2C%22user%22%3A%7B%22eids%22%3A%5B%7B%22source%22%3A%22pubcid.org%22%2C%22uids%22%3A%5B%7B%22id%22%3A%2207b64c8d-fed2-45bb-923b-9129d21be6c6%22%7D%5D%7D%5D%7D%7D
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.32.59.34 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-32-59-34.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 7434e3a02d64682e8648f14cebc246ee592745b3e56b1e09e746aadc033e0c28

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:52 GMT
x-ak-initial-geo: CC:[DE], RC:[HE], CN:[EU], CIP:[217.114.215.133], XFF:[]
server: Apache
content-type: application/json
access-control-allow-origin: https://simcast.com
x-cs-client-geo: 12
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 36
x-ak-client-geo: 12
expires: Tue, 12 Apr 2022 05:15:52 GMT

POST
H2 204 25 Show response
web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/ 0
145 B 132ms
33ms XHR
text/plain 2a02:fa8:8806:12::1460
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to

Full URL: https://web.hb.ad.cpe.dotomi.com/cvx/client/hb/ortb/25
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a02:fa8:8806:12::1460 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
pragma: no-cache
date: Tue, 12 Apr 2022 05:15:52 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
expires: 0

POST
H2 200 prebid-request Show response
onetag-sys.com/ 15 B
358 B 65ms
19ms XHR
application/json 51.89.9.251
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://onetag-sys.com/prebid-request

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

51.89.9.251 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip251.ip-51-89-9.eu

Software

Resource Hash

663dab1310a7e64c3bdd7dfdc81b7fc9a28884d4ee290b96077c7b32bbe84707

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

strict-transport-security: max-age=15552000
content-encoding: gzip
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
access-control-allow-origin: https://simcast.com
cache-control: no-transform, no-cache
access-control-allow-credentials: true
content-type: application/json
access-control-allow-headers: content-type, origin, referer, user-agent
content-length: 41

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 19 B
697 B 89ms
25ms XHR
application/json 185.33.220.216
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.216 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

0c09c070833c786cb25be38bc30992b30bad578f817dbc9e34beacd8b8ea44c5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 12 Apr 2022 05:15:52 GMT
X-Proxy-Origin: 217.114.215.133; 217.114.215.133; 872.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 12e22b71-f36a-4c09-8f58-1bb5a19ecb14
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://simcast.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 19
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 prebid Show response
prebid.media.net/rtb/ 1 KB
905 B 207ms
165ms XHR
application/json 34.107.148.139
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.media.net/rtb/prebid?cid=8CUQWX43D
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.107.148.139 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 139.148.107.34.bc.googleusercontent.com
Software: nginx /
Resource Hash: c199d9f2eb19c8bf2e48044c50af450f2595f7363e7520fb7fb3decc5556d5cc

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:52 GMT
content-encoding: gzip
server: nginx
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
via: 1.1 google

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
109 B 146ms
85ms XHR
text/plain 18.184.75.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.75.207 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-75-207.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 12 Apr 2022 05:15:52 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
110 B 135ms
74ms XHR
text/plain 18.184.75.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.75.207 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-75-207.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 12 Apr 2022 05:15:52 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
109 B 153ms
92ms XHR
text/plain 18.184.75.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.75.207 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-75-207.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 12 Apr 2022 05:15:52 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
109 B 138ms
78ms XHR
text/plain 18.184.75.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.75.207 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-75-207.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 12 Apr 2022 05:15:52 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
109 B 141ms
81ms XHR
text/plain 18.184.75.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.75.207 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-75-207.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 12 Apr 2022 05:15:52 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
109 B 142ms
81ms XHR
text/plain 18.184.75.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.75.207 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-75-207.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 12 Apr 2022 05:15:52 GMT
access-control-allow-credentials: true
vary: Origin

POST
H2 204 v1 Show response
btlr.sharethrough.com/universal/ 0
109 B 150ms
91ms XHR
text/plain 18.184.75.207
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://btlr.sharethrough.com/universal/v1?supply_id=WYu2BXv1
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.184.75.207 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-184-75-207.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 12 Apr 2022 05:15:52 GMT
access-control-allow-credentials: true
vary: Origin

POST v1
btlr.sharethrough.com/universal/ 0
0

POST
H2 200 / Show response
prebid.smilewanted.com/ 0
77 B 95ms
39ms XHR
application/json 104.22.68.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.smilewanted.com/
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
cf-ray: 6fa97c951a7c906a-FRA
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

POST
H2 200 / Show response
prebid.smilewanted.com/ 0
77 B 99ms
44ms XHR
application/json 104.22.68.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.smilewanted.com/
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
cf-ray: 6fa97c951a7d906a-FRA
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

POST
H2 200 / Show response
prebid.smilewanted.com/ 0
76 B 93ms
38ms XHR
application/json 104.22.68.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.smilewanted.com/
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
cf-ray: 6fa97c951a7e906a-FRA
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

POST
H2 200 / Show response
prebid.smilewanted.com/ 0
433 B 92ms
37ms XHR
application/json 104.22.68.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.smilewanted.com/
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.68.131 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
cf-ray: 6fa97c951a7f906a-FRA
access-control-allow-headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

POST
H/1.1 200
OK / Show response
ghb.adtelligent.com/v2/auction/ 9 KB
2 KB 866ms
337ms XHR
application/json 2a0c:5c81:5142::2
24SHELLS

General

Check archive.org

Show headers Download Go to

Full URL: https://ghb.adtelligent.com/v2/auction/
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2a0c:5c81:5142::2 London, United Kingdom, ASN55081 (24SHELLS, US),
Reverse DNS
Software: Adtelligent /
Resource Hash: 396580bb43113a38111ac739408af5ed81539ea20bb8292fd778147e63ae0602

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 12 Apr 2022 05:15:53 GMT
Content-Encoding: gzip
Server: Adtelligent
Content-Type: application/json; charset=UTF-8
Access-Control-Allow-Origin: https://simcast.com
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Length: 1510

POST
H2 200 bid-request Show response
rtb.adpone.com/ 740 B
969 B 110ms
52ms XHR
application/json 2606:4700:20::681a:a19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adpone.com/bid-request?pid=12221811452584
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:a19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 96d94f9625545e85da9a68842200963d862f4fb4eb65976203785084ca9e118b

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DQTyZ%2F3ascNvbG0K9fRGWjuRdom8god2Hxw%2F5uPVem1qZVbmrZZuhxR5HfvuHfpo9g9pIYMxG4cdFoRrF75CCBJ9ZgIk8vC5dq5KKLSlLBJ1ubNJwmAX4SJd%2BPWIW6DQMuV3AIc1NZMwxCAv"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
cf-ray: 6fa97c952ad5928f-FRA

POST
H2 200 bid-request Show response
rtb.adpone.com/ 774 B
721 B 110ms
53ms XHR
application/json 2606:4700:20::681a:a19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adpone.com/bid-request?pid=12221811452584
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:a19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da6cb50a50a476dc4e473d15353c415efe04830cc05f8aa88abc111c640e6259

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ht7n2jP1dwRym7%2BhFVArvDXouqlUCZc%2BCee%2FPOZTYjcrqYKMwcm7lLGhcNxYx1erMgtsi1kbSIl3DPrf3S%2FoD%2FAWUJyGNj0zN7EVW2gQhYweYncnTCQzok41TJ21zORg8JmgYemfqxhD%2F7W%2F"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
cf-ray: 6fa97c952ad6928f-FRA

POST
H2 200 bid-request Show response
rtb.adpone.com/ 774 B
722 B 109ms
53ms XHR
application/json 2606:4700:20::681a:a19
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://rtb.adpone.com/bid-request?pid=12221811452584
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:a19 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9eb53c1ab38491672d0cf6b309bff73d86a299452e43abfa4314790b8759c5b9

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 12 Apr 2022 05:15:52 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dcB4GuvY75dPzr10LkMvDW1nHRFOvJk3Da5nwkPrxAeD05GC5if1Z7Y0fyf%2Fwzgy42G99kE3frwf%2BKQ%2BQvo6io%2FP5PTGg1vL0r62MtoD3PZ0Fz5iIt2mmZ%2F8ik1HyTTLZMKETtQQgPq5I%2Bjv"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://simcast.com
access-control-allow-credentials: true
cf-ray: 6fa97c952ad7928f-FRA

POST
H3 200 collect Show response
www.google-analytics.com/j/ 1 B
21 B 56ms
26ms XHR
text/plain 2a00:1450:4001:831::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1945186641&t=pageview&_s=1&dl=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dthewaterwomanplus.com%26pcid%3D802%26rid%3D152%26a%3D0&dr=http%3A%2F%2Fthewaterwomanplus.com%2F&ul=en-us&de=UTF-8&dt=Simcast%20News%20portal.&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAUABAAAAAC~&jid=1658271886&gjid=1044232643&cid=248144035.1649740552&tid=UA-205158314-1&_gid=1064723579.1649740552&_r=1&gtm=2ou460&z=1583963231

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:52 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 css
fonts.googleapis.com/ 3 KB
1 KB 82ms
28ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Open+Sans:600

Requested by

Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

4d9f4f598117d5f4f4755691e9a6b4e4094f6563cafab7bd0122f63c5862d25e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 12 Apr 2022 04:21:38 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 12 Apr 2022 05:15:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 12 Apr 2022 05:15:53 GMT

GET
H2 200 icon
fonts.googleapis.com/ 569 B
439 B 82ms
29ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/icon?family=Material+Icons

Requested by

Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e0c254788ad36f95d44c1786c590263e89ea3976fcbc9ae7c82c52493b254391

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 12 Apr 2022 05:15:53 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 12 Apr 2022 05:15:53 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 12 Apr 2022 05:15:53 GMT

GET
H3 200 OverlayScrollbars.min.css
cdnjs.cloudflare.com/ajax/libs/overlayscrollbars/1.13.1/css/ 20 KB
5 KB 72ms
42ms Stylesheet
text/css 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/overlayscrollbars/1.13.1/css/OverlayScrollbars.min.css

Requested by

Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

58a8a37fc288ebcb1babc66777ac8c7a922e145d307567c8b7a824dc959c41f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:53 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 6629253
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4023
timing-allow-origin: *
last-modified: Wed, 16 Dec 2020 13:04:39 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5fda05e7-4e34"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S3MuMxA%2F1b6TSA8APnJA8MHzTULALux5muG15wZTw1xUpvAYs4OmHKtGUbo9ZnxcMKtsMcLlo%2B%2B1%2BbgYhWTRg5W2LL4aOhPNrZs%2FMa6fJx9y7UcauUaikuFbbak7pme5FSx4KTGOWZeVLk5QirXzBtKb"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6fa97c992ebb9b9a-FRA
expires: Sun, 02 Apr 2023 05:15:53 GMT

GET
H2 200 os-theme-thick-dark.css
kingsora.github.io/OverlayScrollbars/etc/ 2 KB
898 B 137ms
34ms Stylesheet
text/css 2606:50c0:8003::153
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://kingsora.github.io/OverlayScrollbars/etc/os-theme-thick-dark.css
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:50c0:8003::153 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: GitHub.com /
Resource Hash: 66da5459be23890fc12f7f9df218846bd64192d854ad67be5d809349191e73de

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-fastly-request-id: c92399149db4529fb66b779ab46cfa04a1127e54
date: Tue, 12 Apr 2022 05:15:53 GMT
content-encoding: gzip
age: 79
x-cache: HIT
content-length: 495
x-served-by: cache-ams21062-AMS
access-control-allow-origin: *
last-modified: Wed, 16 Dec 2020 12:11:35 GMT
server: GitHub.com
x-github-request-id: AD66:DAAD:265FFB:276261:6254B8B0
x-timer: S1649740553.231813,VS0,VE0
etag: W/"5fd9f977-9ea"
vary: Accept-Encoding
content-type: text/css; charset=utf-8
via: 1.1 varnish
expires: Mon, 11 Apr 2022 23:34:03 GMT
cache-control: max-age=600
permissions-policy: interest-cohort=()
accept-ranges: bytes
x-proxy-cache: HIT
x-cache-hits: 1

GET
H3 200 OverlayScrollbars.min.js Show response
cdnjs.cloudflare.com/ajax/libs/overlayscrollbars/1.13.1/js/ Frame 87B8 53 KB
21 KB 47ms
24ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/overlayscrollbars/1.13.1/js/OverlayScrollbars.min.js

Requested by

Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ee61ec65bd3bc8cc949991393cfd5aca248620bc53e8ac94f9afe44c30961c0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:53 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 5907915
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 20502
timing-allow-origin: *
last-modified: Wed, 16 Dec 2020 13:04:39 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5fda05e7-d208"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nf54GbYvTaaiT0WIXflpj2p2NmLNXVgwWhUnSZ08rUiOww4QCvlXIujQOOUDjpsZKvcN4c22rNPJVFqR8T1M3Rh%2BmFvglfMZNsCF8KMp2cxSK0wRfBYfAp657MqT5KVGubXD9vtZutXyPCyRIWdkT0HI"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6fa97c992ebd9b9a-FRA
expires: Sun, 02 Apr 2023 05:15:53 GMT

GET
H2 200 prebid.js Show response
d29xw9s9x32j3w.cloudfront.net/players/library/prebid/6.12.0/ Frame 87B8 334 KB
101 KB 502ms
406ms Script
application/javascript 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/players/library/prebid/6.12.0/prebid.js
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c9fcabd6766d79a49d07a82461fed0b6e2a9bde6bd066d5107c4aabc9a7cbf36

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:54 GMT
content-encoding: gzip
last-modified: Wed, 16 Feb 2022 23:36:58 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-C1
etag: W/"1c7777ec3f15f66750ea282b9545a85d"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: application/javascript
via: 1.1 f58d1aa3b3b084adbea41c7523e2047e.cloudfront.net (CloudFront)
cache-control: no-cache
x-amz-cf-id: l2nTfqdqwfJ785j3DLO0xkTOkaCIJZ13csWy9NXcnIQ56GaI9zdQLg==

GET
H2 200 comScore.gt.min.js Show response
d29xw9s9x32j3w.cloudfront.net/players/library/streamsense/6.3.4.190424/ Frame 87B8 335 KB
335 KB 117ms
21ms Script
application/javascript 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/players/library/streamsense/6.3.4.190424/comScore.gt.min.js
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 37da4f4e9645bcde259d1669db9d2548d9ff4f80e72bbe405232924129ae4db7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 21:42:12 GMT
via: 1.1 f58d1aa3b3b084adbea41c7523e2047e.cloudfront.net (CloudFront)
last-modified: Thu, 16 Jan 2020 23:25:25 GMT
server: AmazonS3
age: 27225
etag: "4a51b8991a6b67323936c2eb62e3518e"
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: max-age=86400
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 342796
x-amz-cf-id: qRLATaMrgXrtS5KzV_8SAKthrPou6yMaIfSdjwc7emYPmFqMJziYXg==

GET
H2 200 ima3.js Show response
imasdk.googleapis.com/js/sdkloader/ Frame 87B8 374 KB
125 KB 127ms
32ms Script
text/javascript 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/sdkloader/ima3.js

Requested by

Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

22e56b7e66a75203914f5f0cb9cf1c4e95c065f101ace2189cc31de2da60f61e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 127633
x-xss-protection: 0
expires: Tue, 12 Apr 2022 05:15:53 GMT

GET
H2 200 reddit.png
d29xw9s9x32j3w.cloudfront.net/images/social/ 1 KB
1 KB 177ms
83ms Image
image/png 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/images/social/reddit.png
Requested by: Host: simcast.com
URL: https://simcast.com/?d=thewaterwomanplus.com&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9861f51d1896f195c45f603bdc6b7f1455817966f5da945371c922a6f8797711

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 08:21:40 GMT
via: 1.1 f58d1aa3b3b084adbea41c7523e2047e.cloudfront.net (CloudFront)
last-modified: Fri, 24 Apr 2020 20:07:21 GMT
server: AmazonS3
age: 75260
etag: "cb93bb50e5d021cc38de445a672c18a2"
x-cache: Hit from cloudfront
content-type: image/png
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 1094
x-amz-cf-id: mPa6r4LQey05nKJ54HNJHGmO4eZqLJfC2IF5AsbkjuC-l6vqnsye1g==

GET
H2 200 facebook.png
d29xw9s9x32j3w.cloudfront.net/images/social/ 322 B
638 B 177ms
83ms Image
image/png 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/images/social/facebook.png
Requested by: Host: simcast.com
URL: https://simcast.com/?d=thewaterwomanplus.com&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0597ab745938c4a2cc0818fc2447beb211629e484fed0b4143bdd6fa5724be61

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 20:39:42 GMT
via: 1.1 f58d1aa3b3b084adbea41c7523e2047e.cloudfront.net (CloudFront)
last-modified: Fri, 24 Apr 2020 20:07:21 GMT
server: AmazonS3
age: 30982
etag: "311cf2edc46e82f2a6911332b7db54e1"
x-cache: Hit from cloudfront
content-type: image/png
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 322
x-amz-cf-id: V1gJChPi5kYwQ9_BTDcZ56Xn17CdIeJ-CkFkydBRt6QSaDEo-4lmXQ==

GET
H2 200 twitter.png
d29xw9s9x32j3w.cloudfront.net/images/social/ 832 B
1 KB 178ms
84ms Image
image/png 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/images/social/twitter.png
Requested by: Host: simcast.com
URL: https://simcast.com/?d=thewaterwomanplus.com&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 94a557b756089fc7dde1c857bb1a2f776dff6aeec3ceead5c2fa2304433b88ee

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:06:16 GMT
via: 1.1 f58d1aa3b3b084adbea41c7523e2047e.cloudfront.net (CloudFront)
last-modified: Fri, 24 Apr 2020 20:07:21 GMT
server: AmazonS3
age: 36579
etag: "8be584e844dabfe22970a0cb943c047e"
x-cache: Hit from cloudfront
content-type: image/png
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 832
x-amz-cf-id: Yi4YYKJiUXYy_ewJTWO1M2_CslJLuVa3INVMrgjA4nazx3-U6msYqw==

GET
H2 200 email.png
d29xw9s9x32j3w.cloudfront.net/images/social/ 773 B
1 KB 179ms
85ms Image
image/png 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/images/social/email.png
Requested by: Host: simcast.com
URL: https://simcast.com/?d=thewaterwomanplus.com&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3b7f1a6aeceeb60c709478e55147a48f4031ac6617b3ab089210f1f1f59b7204

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 20:39:42 GMT
via: 1.1 f58d1aa3b3b084adbea41c7523e2047e.cloudfront.net (CloudFront)
last-modified: Fri, 24 Apr 2020 20:07:21 GMT
server: AmazonS3
age: 30982
etag: "4bd445ddc3f9d6101690e15cfc1a04f0"
x-cache: Hit from cloudfront
content-type: image/png
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 773
x-amz-cf-id: MJftPWv2Oj1gDS3HXEPxnZPF8q5HrKfG0nt115mCvvOUuE4WYnQWLA==

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
187 B 320ms
101ms Ping
image/gif 52.205.234.143
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=qhmTd_5Oq8se6qFt&instance=611112&version=7.2.0&age=220412&cmd=PRE_INIT&key=eKVKXbhX&seq=1&order=1&canonical=https://simcast.com/?d=thewaterwomanplus.com%26pcid=802%26rid=152%26a=0&EXTREF=https://simcast.com/?d=thewaterwomanplus.com%26pcid=802%26rid=152%26a=0&REF=https://simcast.com/?d=thewaterwomanplus.com%26pcid=802%26rid=152%26a=0&serverHost=embed.sendtonews.com
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.234.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-234-143.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:53 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

GET
H/1.1 200
OK data_read.php Show response
embed.sendtonews.com/player4/ 42 KB
9 KB 128ms
127ms Fetch
text/html 54.225.130.195
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://embed.sendtonews.com/player4/data_read.php?cmd=loadInitial&session=qhmTd_5Oq8se6qFt&instance=611112&version=7.2.0&age=220412&ESG_key=eKVKXbhX&type=FULL&EXTREF=https://simcast.com/?d=thewaterwomanplus.com%26pcid=802%26rid=152%26a=0&REF=https://simcast.com/?d=thewaterwomanplus.com%26pcid=802%26rid=152%26a=0&ogSet=1
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.225.130.195 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-130-195.compute-1.amazonaws.com
Software: Apache /
Resource Hash: d88e2ec5a5cbf493f574ea6bb0289037fe5103c71100487bc5d63790b724f903

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Tue, 12 Apr 2022 05:15:53 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=1, no-cache="set-cookie"
Connection: keep-alive
Content-Length: 8802
Expires: Tue, 12 Apr 2022 05:15:54 GMT

GET
H2 204 analytics.min.js Show response
cdn.resonate.com/analytics.js/v1/200302733/ Frame 87B8 0
169 B 111ms
26ms Script
text/plain 104.18.12.242
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.resonate.com/analytics.js/v1/200302733/analytics.min.js

Requested by

Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.12.242 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
server: cloudflare
cf-ray: 6fa97c999a909183-FRA
date: Tue, 12 Apr 2022 05:15:53 GMT
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 141ms
102ms Ping
image/gif 52.205.234.143
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=qhmTd_5Oq8se6qFt&instance=214611112&version=7.2.0&age=220412&cmd=GET&key=eKVKXbhX&c_id=12018&seq=1&order=2&canonical=https://simcast.com/?d=thewaterwomanplus.com%26pcid=802%26rid=152%26a=0&EXTREF=https://simcast.com/?d=thewaterwomanplus.com%26pcid=802%26rid=152%26a=0&REF=https://simcast.com/?d=thewaterwomanplus.com%26pcid=802%26rid=152%26a=0&playerCfg=FL
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.234.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-234-143.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:53 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

POST
H/1.1 200
OK data_stn_l.php
timber.sendtonews.com/timber/ 0
253 B 474ms
138ms Ping
text/html 54.225.215.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://timber.sendtonews.com/timber/data_stn_l.php?CMD=GET&ESG_key=eKVKXbhX&ES_key=eKVKXbhX&ES_ID=30800&S_RKEY=aIIH2i36tZ&USR_ID=214611112&ST_usrKey=qhmTd_5Oq8se6qFt&SM_ID=1916518&C_ID=12018&C_companyName=Adapex&version=70020000&sC_ID=8783&AC_ID=2008&TYPE=FLOAT&EXTREF=https://simcast.com/?d=thewaterwomanplus.com%26pcid=802%26rid=152%26a=0&REF=https://simcast.com/?d=thewaterwomanplus.com%26pcid=802%26rid=152%26a=0&PLAYERCODE=LVFNLN&OGSET=1&REFONLY=1&STRIPQUERY=1&serverHost=embed.sendtonews.com
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.225.215.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-215-105.compute-1.amazonaws.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Tue, 12 Apr 2022 05:15:53 GMT
Server: Apache
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=1
Connection: keep-alive
Content-Length: 0
Expires: Tue, 12 Apr 2022 05:15:54 GMT

GET
H2 200 0.js Show response
player.sendtonews.com/bidderFiles/ 4 KB
2 KB 73ms
17ms Script
application/javascript 99.86.4.125
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://player.sendtonews.com/bidderFiles/0.js
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.125 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-125.fra6.r.cloudfront.net
Software: Apache /
Resource Hash: 7f1d279703b902aee3682bf47afc04d7d9a4417e08a137638cd8dcce1141c450

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 04:20:22 GMT
content-encoding: gzip
age: 3348
x-cache: Hit from cloudfront
content-length: 1394
access-control-allow-origin: *
last-modified: Thu, 03 Mar 2022 21:08:40 GMT
server: Apache
etag: "e75-5d956cd664600-gzip"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 f2ee8ec5deee40e44013272a9c7aa35c.cloudfront.net (CloudFront)
cache-control: max-age=3600, no-cache="set-cookie"
x-amz-cf-pop: FRA6-C1
accept-ranges: bytes
x-robots-tag: noindex, nofollow
x-amz-cf-id: kCj36CepFq1GSTpHCkW16ZHYMosB8fLUxX56O-HV2Va6ToBO1khLpQ==
expires: Tue, 12 Apr 2022 05:20:05 GMT

GET
H2 200 memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4gaVI.woff2
fonts.gstatic.com/s/opensans/v28/ 16 KB
17 KB 70ms
19ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v28/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4gaVI.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

578ea33c3a1daec87277cd626647c55f3e0abd72c0673cde0fe40d4fb8fd5579

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 22:46:24 GMT
x-content-type-options: nosniff
age: 541769
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16712
x-xss-protection: 0
last-modified: Tue, 01 Mar 2022 22:06:51 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Apr 2023 22:46:24 GMT

GET
H2 200 flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2
fonts.gstatic.com/s/materialicons/v126/ 121 KB
122 KB 75ms
25ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/materialicons/v126/flUhRq6tzZclQEJ-Vdg-IuiaDsNc.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/icon?family=Material+Icons

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

964709088e8bcf45e9ff2aebe7f320065836761408638f677d01590478a36551

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 18:57:23 GMT
x-content-type-options: nosniff
age: 37110
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 124372
x-xss-protection: 0
last-modified: Wed, 09 Mar 2022 18:26:40 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 11 Apr 2023 18:57:23 GMT

GET
H2 200 nr86nt12uwuuv1h5cjs026dhwgs8dn32.jpg
d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/ 43 KB
43 KB 57ms
18ms Image
image/jpeg 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/nr86nt12uwuuv1h5cjs026dhwgs8dn32.jpg
Requested by: Host: simcast.com
URL: https://simcast.com/?d=thewaterwomanplus.com&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 2db0530ec39243900b91880f6e8a50a0e0054a58dd6f74f1d935ae04a82f3869

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 22:10:26 GMT
via: 1.1 6def1f0ddc805dce17407cce01d5b32c.cloudfront.net (CloudFront)
age: 25527
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 43631
last-modified: Mon, 11 Apr 2022 22:07:35 GMT
server: AmazonS3
etag: "38b84f3b1e2fbbb5cc777cb2e9765c1b"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
x-amz-cf-id: uCbFGgjGZ6sRaloIfgXzj-w4iJA4iPBkgpp4mdjzlwUJNxYwcPjpZA==

GET
H2 200 iamqr3uyqxlmq8l0dsnugmbjqbkvi46u.jpg
d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/ 55 KB
55 KB 119ms
80ms Image
image/jpeg 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/iamqr3uyqxlmq8l0dsnugmbjqbkvi46u.jpg
Requested by: Host: simcast.com
URL: https://simcast.com/?d=thewaterwomanplus.com&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6a920e580647cd284b44dc12ed7ed4fee4622037d4d4de195af9fb6d5efbd6b5

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 22:10:26 GMT
via: 1.1 6def1f0ddc805dce17407cce01d5b32c.cloudfront.net (CloudFront)
age: 25527
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 55943
last-modified: Mon, 11 Apr 2022 22:06:47 GMT
server: AmazonS3
etag: "bd3fe5388c5a2d5b43e71ebc65490aba"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
x-amz-cf-id: k5OUiWv8cIkiBje7sXX6EgYM3WzJ-4v0phIpij6F1TpqQY0d-7rySA==

GET
H2 200 q4gb7d3zbny7np9q7ooswyimlmxzqk34.jpg
d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/ 25 KB
26 KB 118ms
80ms Image
image/jpeg 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/q4gb7d3zbny7np9q7ooswyimlmxzqk34.jpg
Requested by: Host: simcast.com
URL: https://simcast.com/?d=thewaterwomanplus.com&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b2b97edb4b41d905de7d2cbea0f1a7052395a926c4640ef00b5794dbf2131c3a

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 21:48:39 GMT
via: 1.1 6def1f0ddc805dce17407cce01d5b32c.cloudfront.net (CloudFront)
age: 26835
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 25945
last-modified: Mon, 11 Apr 2022 21:48:12 GMT
server: AmazonS3
etag: "ffb79e4e747c1e9233a60ba84eb630f6"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
x-amz-cf-id: qpH_fN6X3i9iiwokRuASvEgRsNdsbe5K19FP5gYEQOjan6-Xkzm6XA==

GET
H2 200 durxoojmb9a9vpxtumoxz6hl5us1fyys.jpg
d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/ 23 KB
24 KB 66ms
27ms Image
image/jpeg 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/durxoojmb9a9vpxtumoxz6hl5us1fyys.jpg
Requested by: Host: simcast.com
URL: https://simcast.com/?d=thewaterwomanplus.com&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9fff4cc0c2d1a27a7342777e5fd53c0b31db093d8e6e0b0f2cd9c7ae2159c676

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 19:15:19 GMT
via: 1.1 6def1f0ddc805dce17407cce01d5b32c.cloudfront.net (CloudFront)
age: 36035
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 23787
last-modified: Mon, 11 Apr 2022 19:10:10 GMT
server: AmazonS3
etag: "11d6f8090ea08725f68dd1db8fe327e2"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
x-amz-cf-id: j2RopNiDccj4psueAUxtm13YTFE2q14eXZt_F2vE6X1iJJnpgfl5dA==

GET
H2 200 ecsbhznsf2v85j991d1oyowk7b55xz9c.jpg
d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/ 46 KB
46 KB 64ms
26ms Image
image/jpeg 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/ecsbhznsf2v85j991d1oyowk7b55xz9c.jpg
Requested by: Host: simcast.com
URL: https://simcast.com/?d=thewaterwomanplus.com&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: dc0a6fe35d4a908ca0a25e4a8a21d6b522e440848f237ef027ef3a0969dbf012

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 14:32:52 GMT
via: 1.1 6def1f0ddc805dce17407cce01d5b32c.cloudfront.net (CloudFront)
age: 52982
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 46837
last-modified: Mon, 11 Apr 2022 14:28:54 GMT
server: AmazonS3
etag: "3b1ded69b9c7e0373707e8620334c188"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
x-amz-cf-id: 3eaJr7_Vk3yS5Mx1CQcWecekOCFAicdcB1LfejBhd56sHSJvbPKGug==

GET
H2 200 5goiw3t7zdicbwddugwc2fyvsz86j1dd.jpg
d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/ 49 KB
50 KB 65ms
27ms Image
image/jpeg 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/5goiw3t7zdicbwddugwc2fyvsz86j1dd.jpg
Requested by: Host: simcast.com
URL: https://simcast.com/?d=thewaterwomanplus.com&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9e96297106776a95d49df6f6f910df779e175d83a9cf29932cb92acb547472c3

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 00:58:24 GMT
via: 1.1 6def1f0ddc805dce17407cce01d5b32c.cloudfront.net (CloudFront)
age: 26565
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 50208
last-modified: Fri, 08 Apr 2022 21:46:31 GMT
server: AmazonS3
etag: "3fe4c142093b63b45207bdb463ca7bc8"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
x-amz-cf-id: kzBAQ-E6le8kgVkAZIRKiL6xWc3Fy6wSilC0XDoLRksh9RoGX3A9jw==

GET
H2 200 4ib5skc82oafxwtwdvvpkljgmky3pktw.jpg
d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/ 49 KB
49 KB 64ms
26ms Image
image/jpeg 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/4ib5skc82oafxwtwdvvpkljgmky3pktw.jpg
Requested by: Host: simcast.com
URL: https://simcast.com/?d=thewaterwomanplus.com&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 88d30235f1e15daa4619b92741a93611894c56bac303ce93bee71a8955c96acb

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 00:27:38 GMT
via: 1.1 6def1f0ddc805dce17407cce01d5b32c.cloudfront.net (CloudFront)
age: 17344
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 49959
last-modified: Fri, 08 Apr 2022 21:48:22 GMT
server: AmazonS3
etag: "66a386c1a4608c59a9d3cd02129cc8ea"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
x-amz-cf-id: aw6cSpO0qNxL7o3rjC1vrOZMg-BylikmCzn8MSrAnzAb_iMTyyNVxA==

GET
H2 200 qd6kbi8wfytlj8sedrjfidzkudevsfa6.jpg
d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/ 33 KB
33 KB 62ms
24ms Image
image/jpeg 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/qd6kbi8wfytlj8sedrjfidzkudevsfa6.jpg
Requested by: Host: simcast.com
URL: https://simcast.com/?d=thewaterwomanplus.com&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e5fcb39072d51e1baa4809572b5b8bd60deaa6a4958b287fca00ff54787309ad

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 21:28:16 GMT
via: 1.1 6def1f0ddc805dce17407cce01d5b32c.cloudfront.net (CloudFront)
age: 28068
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 33574
last-modified: Fri, 08 Apr 2022 21:27:17 GMT
server: AmazonS3
etag: "68edb493d87b2e9890b5ff3fd0a31b13"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
x-amz-cf-id: unPMfTWygxX2V7k6ZoN7MUBea3gO1KFs-2-fuqlEJNDGRLesazfMAg==

GET
H2 200 9fuzsofgqzuaymlanl3ayrvt1yhsfn0f.jpg
d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/ 54 KB
55 KB 64ms
27ms Image
image/jpeg 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/9fuzsofgqzuaymlanl3ayrvt1yhsfn0f.jpg
Requested by: Host: simcast.com
URL: https://simcast.com/?d=thewaterwomanplus.com&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4a35a2e0d2f77924fe095a2fff5bd5086943886d384f9dab809327bcd23ef74e

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 21:08:22 GMT
via: 1.1 6def1f0ddc805dce17407cce01d5b32c.cloudfront.net (CloudFront)
age: 29287
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 55397
last-modified: Fri, 08 Apr 2022 21:06:43 GMT
server: AmazonS3
etag: "b55602685169ed81ae5cad00326057cf"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
x-amz-cf-id: w4LRcjRsFq68OuLz7ZATGPwdI2pGR-x6Mn401HoHy1TOj1y8S5ML-w==

GET
H2 200 2d01ysb6v7zvxwvdg4xtbvvhnvd5vf57.jpg
d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/ 22 KB
23 KB 62ms
25ms Image
image/jpeg 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/video_thumb/XL/2d01ysb6v7zvxwvdg4xtbvvhnvd5vf57.jpg
Requested by: Host: simcast.com
URL: https://simcast.com/?d=thewaterwomanplus.com&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 04fb97b5c94f0ce68ec225d722f28471947805e6f3f2633cd4560fd7b059a250

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 18:01:12 GMT
via: 1.1 6def1f0ddc805dce17407cce01d5b32c.cloudfront.net (CloudFront)
age: 40949
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 22836
last-modified: Fri, 08 Apr 2022 17:48:15 GMT
server: AmazonS3
etag: "c077f71bfb5e79f9d177eff295095cff"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
x-amz-cf-id: 5bhO2klDeiBbdYtL4WWpGaeY6SZ5jat-ODMoUQkhkcShBInwV5eZKQ==

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 102ms
101ms Ping
image/gif 52.205.234.143
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=qhmTd_5Oq8se6qFt&instance=214611112&version=7.2.0&age=220412&cmd=RTP&key=eKVKXbhX&c_id=12018&seq=1&order=3&sC_ID=8783&sm_id=1916518&load=1&status=LVFNLNIY&ac_id=2008&EXTREF=https://simcast.com/?d=thewaterwomanplus.com%26pcid=802%26rid=152%26a=0&REF=https://simcast.com/?d=thewaterwomanplus.com%26pcid=802%26rid=152%26a=0&playerCfg=FL
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.234.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-234-143.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:53 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

POST
H/1.1 200
OK data_stn_l.php
timber.sendtonews.com/timber/ 0
253 B 444ms
141ms Ping
text/html 54.225.215.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://timber.sendtonews.com/timber/data_stn_l.php?CMD=RTP&ESG_key=eKVKXbhX&ES_key=eKVKXbhX&ES_ID=30800&S_RKEY=aIIH2i36tZ&USR_ID=214611112&ST_usrKey=qhmTd_5Oq8se6qFt&SM_ID=1916518&C_ID=12018&C_companyName=Adapex&version=70020000&sC_ID=8783&AC_ID=2008&TYPE=FLOAT&EXTREF=https://simcast.com/?d=thewaterwomanplus.com%26pcid=802%26rid=152%26a=0&REF=https://simcast.com/?d=thewaterwomanplus.com%26pcid=802%26rid=152%26a=0&PLAYERCODE=LVFNLN&OGSET=1&REFONLY=1&STRIPQUERY=1
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.225.215.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-215-105.compute-1.amazonaws.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Tue, 12 Apr 2022 05:15:53 GMT
Server: Apache
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=1
Connection: keep-alive
Content-Length: 0
Expires: Tue, 12 Apr 2022 05:15:54 GMT

GET
H3 200 bridge3.509.0_en.html Show response
imasdk.googleapis.com/js/core/ Frame 2156 632 KB
205 KB 50ms
20ms Document
text/html 2a00:1450:4001:808::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/js/core/bridge3.509.0_en.html

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d78fa11d49d6f5896519ee387440209a4ad363f68a816146c03b732b3fd45809

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 97373
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 209648
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
cross-origin-resource-policy: cross-origin
date: Mon, 11 Apr 2022 02:13:00 GMT
expires: Tue, 11 Apr 2023 02:13:00 GMT
last-modified: Mon, 04 Apr 2022 21:52:50 GMT
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 client.js Show response
s0.2mdn.net/instream/video/ Frame 87B8 44 KB
17 KB 138ms
32ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/instream/video/client.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d0bffc7261df1454c5e05475cda7d9e6647318dc6c3936767e1252bfe8849c54

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16746
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 12 Apr 2022 05:15:53 GMT

GET
H2 200 4qqqn0pn7r518p5s64s2n0qroo878q23playlist.m3u8 Show response
d29xw9s9x32j3w.cloudfront.net/videos/m3u8/ 291 B
840 B 25ms
25ms XHR
application/x-mpegurl 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/m3u8/4qqqn0pn7r518p5s64s2n0qroo878q23playlist.m3u8
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 83b93678f87e518423ed142a3fd3df6c00eac55770521a08d49e3f772511effb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 22:10:27 GMT
via: 1.1 6def1f0ddc805dce17407cce01d5b32c.cloudfront.net (CloudFront)
age: 25527
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 291
last-modified: Mon, 11 Apr 2022 22:03:26 GMT
server: AmazonS3
etag: "75c91c3303accc0fca2cc402313681fe"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: application/x-mpegURL
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
x-amz-cf-id: oB6vgS-mq5AEKxz3gz_uiiLaC0FZEHBUyYaoQqVs9ZqPzTLEovtplQ==

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 112ms
111ms Ping
image/gif 52.205.234.143
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=qhmTd_5Oq8se6qFt&instance=214611112&version=7.2.0&age=220412&cmd=IMA&key=eKVKXbhX&c_id=12018&seq=1&order=4&EXTREF=https://simcast.com/?d=thewaterwomanplus.com%26pcid=802%26rid=152%26a=0&REF=https://simcast.com/?d=thewaterwomanplus.com%26pcid=802%26rid=152%26a=0&playerCfg=FL&recoveryMethod=ssai&imaVersion=3.509.0&blocked=false&recovered=false&hasAdParams=true
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.234.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-234-143.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:53 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ Frame 87B8 107 B
122 B 55ms
27ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=simcast.com

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 12 Apr 2022 05:15:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 omweb-v1.js Show response
pagead2.googlesyndication.com/omsdk/releases/live/ Frame BBA0 37 KB
13 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/omsdk/releases/live/omweb-v1.js

Requested by

Host: srcdoc
URL: about:srcdoc

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2511b147f3cf95f742758d3e2062eac98f5265a859dc07959eb8a32f0a2f528

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 04:58:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1044
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/omsdk-team-release-policy
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12861
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 20:08:54 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="omsdk-team-release-policy"
vary: Accept-Encoding
report-to: {"group":"omsdk-team-release-policy","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/omsdk-team-release-policy"}]}
content-type: text/javascript
cache-control: public, max-age=3600
accept-ranges: bytes
expires: Tue, 12 Apr 2022 05:58:29 GMT

GET
H2 200 o43s3r84no0300p0n0393opqon42o60nbase.en.vtt
d29xw9s9x32j3w.cloudfront.net/videos/cc_text/ 8 KB
9 KB 20ms
19ms TextTrack
text/vtt 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/cc_text/o43s3r84no0300p0n0393opqon42o60nbase.en.vtt
Requested by: Host: simcast.com
URL: https://simcast.com/?d=thewaterwomanplus.com&pcid=802&rid=152&a=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 608643ee36b600371d10713a71f20d8fe12f5a743959a96d9b86208e11a0d4d1

Request headers

Referer: https://simcast.com/
Origin: https://simcast.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 22:10:27 GMT
via: 1.1 6def1f0ddc805dce17407cce01d5b32c.cloudfront.net (CloudFront)
age: 25527
x-cache: Hit from cloudfront
content-length: 8639
last-modified: Mon, 11 Apr 2022 22:05:05 GMT
server: AmazonS3
etag: "6b947598479649d7ee9188475d38b012"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: text/vtt
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
x-amz-cf-id: GLLBtl93f63pjQ7m8tTnY9pGTRsWW5gtu20anKnVUzSm-UjPAVDQBw==

GET
H2 200 4qqqn0pn7r518p5s64s2n0qroo878q23.m3u8 Show response
d29xw9s9x32j3w.cloudfront.net/videos/m3u8/300k/ 2 KB
852 B 19ms
18ms XHR
application/x-mpegurl 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/m3u8/300k/4qqqn0pn7r518p5s64s2n0qroo878q23.m3u8
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 1a8fad1a20636dd062b306edc76a80e67ecbc9eef8e181913673460ff62d8bbd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 22:13:04 GMT
content-encoding: gzip
age: 25370
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
access-control-allow-origin: *
last-modified: Mon, 11 Apr 2022 22:04:41 GMT
server: AmazonS3
etag: W/"5382795cff1f5ba32592fa0462350dc8"
vary: Accept-Encoding,Origin
access-control-allow-methods: GET, HEAD, POST
content-type: application/x-mpegURL
via: 1.1 6def1f0ddc805dce17407cce01d5b32c.cloudfront.net (CloudFront)
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: ExL1dMOWKfCrTVgZXolUxWB3oHbwAfO6n3ZmgyM1D9cuLqbGS5EiHg==

GET
H2 200 4qqqn0pn7r518p5s64s2n0qroo878q23-00001.ts Show response
d29xw9s9x32j3w.cloudfront.net/videos/m3u8/300k/ 285 KB
287 KB 22ms
20ms XHR
video/mp2t 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/m3u8/300k/4qqqn0pn7r518p5s64s2n0qroo878q23-00001.ts
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 22a2de34c5c7d763136a7906d49ee0b257e4d8e67e92ebaa21017a6d6d68e323

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 22:13:05 GMT
via: 1.1 6def1f0ddc805dce17407cce01d5b32c.cloudfront.net (CloudFront)
age: 25369
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
content-length: 292340
last-modified: Mon, 11 Apr 2022 22:04:35 GMT
server: AmazonS3
etag: "42cbc7e38c652906ec23b8d59fe394cc"
vary: Origin
access-control-allow-methods: GET, HEAD, POST
content-type: video/mp2t
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
x-amz-cf-id: nd26k_QSfurqL_nQav7LTsxC59j_4Zh5RvgWh1pkyWliYCXpLCq5YA==

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
10 KB 57ms
30ms XHR
application/json 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220406&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bfdf87cc9ae11233e6137028a93ede4f49fbecf1e3635420211f45acc6b2bb7e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 12 Apr 2022 05:15:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10593
x-xss-protection: 0

GET
BLOB 200
OK 4b376a04-c764-42a9-9d57-09df2a7c7613
https://simcast.com/ 87 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://simcast.com/4b376a04-c764-42a9-9d57-09df2a7c7613
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 95e79f8f609054fab2a6270b53cc6abf54e57561ae9f64903536a668af16747f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Length: 89323
Content-Type: text/javascript

GET
H2 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 2156 28 KB
2 KB 116ms
69ms XHR
text/xml 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?iu=%2F92056281%2Fsimcast.com-premium&env=vp&gdfp_req=1&unviewed_position_start=1&ad_rule=1&output=xml_vmap1&sz=480x270&ciu_szs=300x60&description_url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dthewaterwomanplus.com%26pcid%3D802%26rid%3D152%26a%3D0&hl=en&vpa=auto&vpmute=1&vconp=2&cmsid=2460952&vid=1916518&us_privacy=false&cust_params=sessionKey%3D214611112-qhmTd_5Oq8se6qFt%26schain%3Dsendtonews.com%2CVRAfdwVZOg7jMyH8bxgoOA%26content%3D8783%26placementType%3DPremium%26embed%3DeKVKXbhX%26domain%3Dsimcast.com%26player_size%3Dlarge%26player_width%3D761%26player_height%3D428%26player_type%3Dfloat%26version%3D7.2.0%26player_status%3DLVFNLNIY%26play_code%3D2008%26view100%3D1%26excl_cat%3Dstl_id00157%26rand%3D4%26iris_id%3Diris_e73ffab7214f9487%26iris_context%3Dic_7095941%2Cic_2815204%2Cic_0291942%2Cic_7753435%2Cic_8328276%2Cic_3890383%2Cic_4984102%2Cic_2662116%2Cic_2036727%2Cic_2001389%2Cic_5366174%2Cic_8717611%2Cic_5063263%2Cic_7558382%2Cic_3551019%2Cic_5922261%2Cic_1237971%2Cic_9954675%2Cic_3393155%2Cic_6990772%2Cic_0234645%2Cic_6156363%2Cic_9649250%2Cic_8660380%2Cic_0827591%26us_privacy%3Dfalse&sdkv=h.3.509.0&osd=2&frm=0&vis=1&sdr=1&is_amp=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&u_so=l&ctv=0&mpt=stnvideo%2Fplayer&sdki=44d&ptt=20&adk=2458199627&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.509.0&sid=38125EBF-DC56-4327-A731-901495C30455&nel=0&eid=44750823%2C44756710%2C44758348%2C44761692&url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dthewaterwomanplus.com%26pcid%3D802%26rid%3D152%26a%3D0&dt=1649740553766&cookie=ID%3D3dc216fb1ad8fe38-229601bd73cd008d%3AT%3D1649740552%3ART%3D1649740552%3AS%3DALNI_MZOqwobE1UZovH_Hz23VrgaoA6Pcw&correlator=1679405894630450&scor=3010499462648501&ged=ve4_td1_tt0_pd1_la1000_er0.0.0.0_vi0.0.1200.1600_vp0_eb16491

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.509.0_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a9515025749d76758fe12c746a9e9a43af794d16483886c9ca1d0d1d412e1ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:53 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1582
x-xss-protection: 0
google-lineitem-id: 0
pragma: no-cache
server: cafe
google-creative-id: 0
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 103ms
35ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 12 Apr 2022 05:15:53 GMT

GET
H2 200 4qqqn0pn7r518p5s64s2n0qroo878q23.m3u8 Show response
d29xw9s9x32j3w.cloudfront.net/videos/m3u8/1000k/ 2 KB
847 B 18ms
18ms XHR
application/x-mpegurl 65.9.7.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d29xw9s9x32j3w.cloudfront.net/videos/m3u8/1000k/4qqqn0pn7r518p5s64s2n0qroo878q23.m3u8
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.7.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-7-94.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e77cffcd82a746eafc068f35d9f552c54713bcb4c7e1b7000a515f992c3759e2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 22:10:28 GMT
content-encoding: gzip
age: 25526
x-cache: Hit from cloudfront
x-amz-storage-class: REDUCED_REDUNDANCY
content-disposition: attachment
access-control-allow-origin: *
last-modified: Mon, 11 Apr 2022 22:05:07 GMT
server: AmazonS3
etag: W/"66828e01299cc4b7ffea406908991b04"
vary: Accept-Encoding,Origin
access-control-allow-methods: GET, HEAD, POST
content-type: application/x-mpegURL
via: 1.1 6def1f0ddc805dce17407cce01d5b32c.cloudfront.net (CloudFront)
access-control-expose-headers: Access-Control-Allow-Origin, Access-Control-Allow-Credentials
cache-control: max-age=86400
x-amz-cf-pop: FRA56-C1
x-amz-cf-id: V2k-8hBfGg-ZMbwDmAiOlcDSnmlSdVRopmRn4Ph4CKQjjDMzKbohwg==

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 101ms
101ms Ping
image/gif 52.205.234.143
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=qhmTd_5Oq8se6qFt&instance=214611112&version=7.2.0&age=220412&cmd=INV&key=eKVKXbhX&c_id=12018&seq=1&order=5&alt=0&sC_ID=8783&sm_id=1916518&load=1&status=LVFNLNIY&ac_id=2008&EXTREF=https://simcast.com/?d=thewaterwomanplus.com%26pcid=802%26rid=152%26a=0&REF=https://simcast.com/?d=thewaterwomanplus.com%26pcid=802%26rid=152%26a=0&playerCfg=FL
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.234.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-234-143.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:53 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

POST
H/1.1 200
OK data_stn_l.php
timber.sendtonews.com/timber/ 0
253 B 141ms
141ms Ping
text/html 54.225.215.105
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://timber.sendtonews.com/timber/data_stn_l.php?CMD=INV&ESG_key=eKVKXbhX&ES_key=eKVKXbhX&ES_ID=30800&S_RKEY=aIIH2i36tZ&USR_ID=214611112&ST_usrKey=qhmTd_5Oq8se6qFt&SM_ID=1916518&C_ID=12018&C_companyName=Adapex&version=70020000&sC_ID=8783&AC_ID=2008&TYPE=FLOAT&EXTREF=https://simcast.com/?d=thewaterwomanplus.com%26pcid=802%26rid=152%26a=0&REF=https://simcast.com/?d=thewaterwomanplus.com%26pcid=802%26rid=152%26a=0&PLAYERWIDTH=761.125&PLAYERCODE=LVFNLN&OGSET=1&REFONLY=1&STRIPQUERY=1
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.225.215.105 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-225-215-105.compute-1.amazonaws.com
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Tue, 12 Apr 2022 05:15:53 GMT
Server: Apache
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: *
Cache-Control: max-age=1
Connection: keep-alive
Content-Length: 0
Expires: Tue, 12 Apr 2022 05:15:54 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 8F2B 13 KB
5 KB 48ms
19ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 604
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 12 Apr 2022 05:05:49 GMT
expires: Wed, 12 Apr 2023 05:05:49 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 980F 783 B
1 KB 79ms
29ms Document
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

a2ba14976031df0ab3fa27f8d183ba71c2811b7eeb196fd986ab6ea20da16f35

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-H3hb7bpvKVRe2ucP/xzAvw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 513
content-security-policy: script-src 'report-sample' 'nonce-H3hb7bpvKVRe2ucP/xzAvw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 12 Apr 2022 05:15:53 GMT
expires: Tue, 12 Apr 2022 05:15:53 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 ads Show response
pubads.g.doubleclick.net/gampad/ Frame 2156 28 KB
7 KB 295ms
268ms XHR
text/xml 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pubads.g.doubleclick.net/gampad/ads?slotname=%2F92056281%2Fsimcast.com-premium&sz=480x270&ciu_szs=300x60&cust_params=sessionKey%3D214611112-qhmTd_5Oq8se6qFt%26schain%3Dsendtonews.com%2CVRAfdwVZOg7jMyH8bxgoOA%26content%3D8783%26placementType%3DPremium%26embed%3DeKVKXbhX%26domain%3Dsimcast.com%26player_size%3Dlarge%26player_width%3D761%26player_height%3D428%26player_type%3Dfloat%26version%3D7.2.0%26player_status%3DLVFNLNIY%26play_code%3D2008%26view100%3D1%26excl_cat%3Dstl_id00157%26rand%3D4%26iris_id%3Diris_e73ffab7214f9487%26iris_context%3Dic_7095941%2Cic_2815204%2Cic_0291942%2Cic_7753435%2Cic_8328276%2Cic_3890383%2Cic_4984102%2Cic_2662116%2Cic_2036727%2Cic_2001389%2Cic_5366174%2Cic_8717611%2Cic_5063263%2Cic_7558382%2Cic_3551019%2Cic_5922261%2Cic_1237971%2Cic_9954675%2Cic_3393155%2Cic_6990772%2Cic_0234645%2Cic_6156363%2Cic_9649250%2Cic_8660380%2Cic_0827591%26us_privacy%3Dfalse&url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dthewaterwomanplus.com%26pcid%3D802%26rid%3D152%26a%3D0&unviewed_position_start=1&output=xml_vast4&env=vp&gdfp_req=1&ad_rule=0&video_url_to_fetch=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dthewaterwomanplus.com%26pcid%3D802%26rid%3D152%26a%3D0&useragent=Mozilla%2F5.0%20(Windows%20NT%2010.0%3B%20Win64%3B%20x64)%20AppleWebKit%2F537.36%20(KHTML%2C%20like%20Gecko)%20Chrome%2F100.0.4896.75%20Safari%2F537.36%2Cgzip(gfe)&vad_type=linear&vpos=preroll&pod=1&ppos=1&lip=true&min_ad_duration=0&max_ad_duration=30000&vrid=1263268&sid=38125EBF-DC56-4327-A731-901495C30455&adk=2458199627&correlator=1679405894630450&dt=1649740553916&ged=ve4_td1_tt0_pd1_la1000_er200.20.628.781_vi0.0.1200.1600_vp100_ts0_eb24171&is_amp=0&omid_p=Google1%2Fh.3.509.0&osd=2&ptt=20&scor=3010499462648501&sdk_apis=2%2C7%2C8&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&us_privacy=false&vis=1&u_so=l&eid=44750823%2C44756710%2C44758348%2C44761692&hl=en&frm=0&cmsid=2460952&mpt=stnvideo%2Fplayer&sdki=44d&sdkv=h.3.509.0&sdr=1&vconp=2&video_doc_id=1916518&vpa=auto&vpmute=1&nel=0&kfa=0&tfcd=0&ctv=0&cookie=ID%3D3dc216fb1ad8fe38-229601bd73cd008d%3AT%3D1649740552%3ART%3D1649740552%3AS%3DALNI_MZOqwobE1UZovH_Hz23VrgaoA6Pcw

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.509.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ns3213307.ip-141-95-99.eu

Software

cafe /

Resource Hash

4a82cb1d422bc24ce4478ef3c9f66ba209c731cc2c38714d4fd76a2ef9113bdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:54 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6924
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 VZx5lKL-R1DYt4uczQuO7ewneocOxZLDwOE_DB7Gp_E.js Show response
pagead2.googlesyndication.com/bg/ Frame 8F2B 35 KB
13 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/VZx5lKL-R1DYt4uczQuO7ewneocOxZLDwOE_DB7Gp_E.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

559c7994a2fe4750d8b78b9ccd0b8eedec277a870ec592c3c0e13f0c1ec6a7f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 18:37:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38324
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13564
x-xss-protection: 0
last-modified: Mon, 04 Apr 2022 12:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 11 Apr 2023 18:37:09 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 980F 0
0 72ms
71ms Image
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220406&jk=1300786470299441&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 8F2B 0
9 B 19ms
18ms Image
text/plain 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?YTifOA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:54 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 2156 29 KB
16 KB 115ms
50ms XHR
text/xml 74.125.140.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-B1TVqZoiZTn86SXZNp-gNXOwCiO_BTsMdSF_tKw8-_EbkG60kZPZ32k1rO5Q4_TmZ4L84cCJmYRiq4dcBLJJtg5yQeMw&cry=1&dbm_d=AKAmf-Cvvk4bDueEfwnsLXYJt8ZJlBx8iSzwbdLH5lX6l2QwLA-TePJ7v_D-3-3i-eYpD7zYMH_yFwf0SD-1LGyjEJNBBvr0vFbl3PwqCK9Tmqqj02Pi5FjnjFQqH4CUkdoRW9dqeOFXoehAdzg7arh8NaDreqYAKj6fTobspZfA6AL-k_uZAdBFQM7HD8UUHX9tn9kZiaTTOVmVo649PS5CDWoZ6krIuM8wyG_o6jOy-8Th8Jxtw1uxq1g79djsgLbOSrDKSIIAyiXps5slfvWYAqMo1oBje27Biv6tNs0ZMTJeUy7xp_JhNeKzHDz81cpwHsEaoJQjhB8VQiP_F5UhCkZP-hgmkij9f_j5QPQO18Iz7W1gwXGk728Vw5xTHwEtd8nh_if4V4dNzm42m9uepqCUwJmj5xSZlejqqHCoq3YVOJHB95H-F-Uec-WGcAVYp0ZM6fK8NJnfab5CYo4hO0QVIgvmayAJ-8wjKMR8uG7jrBxQ0JQj83Z0Mi81w_cibn5-WjFps_s_7GERbR0v9LSP8eOK3iCZ0T2wGXhixcDMXRMyt2vMYGpL4eIBXee2Bi6cbAW_e9ffBWNvBspL0xHR6xjFhGVWvLcO-etZUVNoPzO8NfYfVPajnPeKYIy5X7xEr-dxXWRTcSHuSWPF9Bc1ySPPNdijkPCqx5U9OlVXfhdLE71zCFKRBbIGaMBT6fYlD3ax7R0l3OD7VH8xGAhSKX-FMPQNlKeLzI8cvV4MmyQ2jgOBLOhOw3d0odBrHJQjiqrGlsiwtbY6x5f06ZVgfngdIEizwfKB3HuJiE-o8RnL2C25hPEDa4WCyiEg_PXDJa5Eq3PN-PypG8-oxUK6enuOxS4nHBp_oaad9qyhWL5sEAWyv97ISIJ_vqqCh1zT9Cf6CBRSTL7ln-Z-k91d757e0yeWBPnwe2phWB0nYjVFm_bIpv_SfuuD5bKTEJqGXMoKfmxagRvPakuxHrlGhw88FsfHL2JGp9W9HOWYuT7K2GpU7bqwgLPHXz7AdC5h2lempIv98cWvIX59ZUkulkYfuSVfntZUla8xYiFZr4k1ue2HLeMCjZXsPfPibhwqqi04woJiqfHmvt6mEjHDws7QmKrUBdqlBewpJxMbojNYGoTdDwpP5ZbjVUqobdShKYrSx4fJ9WnA_OcIFMfZTqd2kcMkJejbCYs3-hBycg6px8D_4ar_QEKrd_Lv8mxAnqJab5XaTUNHcjDSeQMCqbj7_KsZ5kJv8d3cfwkufpeLfrC7765no9my-oZENivZ7GFRg4UVu6oYt0vCpm0Q5UyTWAdjhOu0s8yshG8EAkgwrO061uzbQEihL9dP5z5mZj_J1zoyXrZslHj7PXvPQsfp9tRBKZDeY-S672OR3D17hHEyHzo9xzLrsupY6xuMRPOsYuw2q7FtBeNEm2kDadPbvt0FQAOz0R7lS_Geza8BTDQGFHKU5Z5LoDt_BxPld5HcJdXBx1vugMh1iPWsWfRiY5UQkCmhMSUof4FogVmIMJjvAVaen1liz_qJwvtexQq4fykataqnBZ89vcxrJxeU7nEhfIE65SnlJ79uZu5aPPX9am6g1c8O_a7rcS6VvNbRv-kdo7uTPC4gdVEWUwOqEgadJ-3E57obwuT6r5k1dnsHDvqb5R7FZlkvmuE8GkS35nEDPqDYVMl3D28IVOeuqtB9aQODrI256PBAd-uLA5oocNcDb8DjLtz_vja466Ss2BkhhEgDfbZyC88aeR8i_qx3ya4rBe7eMyOmukJbRGZ9Xq3Vd0vLqSrCZW_NoIqwcslndkQe-xXHoUbOq7Mvk6EHLDrAnSxr6vMUp-M7ZJFddcDGr8OIv8eNxWMnM0VTImLkpOFN31QdiVRvYlnXdz3XnbX6HQ0T6pVnBfLPla6-gCcSW77vt6dR8RD7510K0RF2V84WV9SiMqhXgqURp7EJu9l7NQmKaJlbCwlwt6aDQ3q24WYJK_hIXymHeFyTicXnXrUUgwfi11Mlw5CGZ3UbGMKkbQahI68Kob68nrVXuVawweMN0bIxBwe9h0t1IvYz4es3jHikzNFRKAku659eThwXv2wMdv4h1khkmCAAiX8PrnaFSKjrMaVon_rPVYHBrjdLi9c6aPVsmwFOqShHBMPKdl8TfJGL322tRKct9RatEZigrAkvy8oxLcn6KdzJWkhzraf48F9gaDjgwJ1Xl-o-l-GZ941yBeH36nARU8WpJCSw71vcjE9-jz3ezNG3j8WhQKiqORml10G7VNW_486Vk_dzDlRh6C-rvS8Q2sKGW7NzKulI8Iyi7tYTCJoe3kwNetMeTY-Xid44Gp9dpbrEgHhrOQLFh8FZj7oKfzRIhv_EbsVS3Byc5goW511aYXdyheZrY6pMnJqkAjL9wBo9ngLFug-UICtGRw0LZt-tiuk4w96TMsvVylX-zX0cVlLtma3zem3E3pxEmevN7wtAdY3PRpt9OfWdtO26vJkE1fF3f_UDUp_zFn_btFn1PAgAbNUugp5iMDsCUr3SEdutlRXoU1OGX3vOuDHNd6UDQid3dgA9t9Wo9QSpxsw6mJynRCXc_1xYVMhtYbl5NE34wByGiEy56NKHbcNjFPt1UDUkuS1S2-umGqwYxE9TAFrbCE6Tiwhx-rjFOLu2fERlQJGuM9Eopl-PUwwQtDQYoTWt4I2Os5taFLh3BFTXmo_hTs18Lk7ZetuLx92qosSAqu7pmzrzKLHAKf_NfKDmAk5Bld8TrxD3w0Cek-MYEfYc1vR6fwbKuBQV8m-nEOw6Oo9NVVm_S3ZEEE8A3ZMSQCLjEJhwOr6W8_955sAosF3nGMJVlQpFDsO1GG0bVH6Bm1qMjX79I6adyVwDWIJHXjSGofzf-ZMzAeRMcJ3S4rGr-W11cL4Tp8ynpNcZDbBaSdP_S7Qe9yO809cXip7HYsnodShoA7GMC78rPus1thYUt6f09tKOIAKPz0iWgkvw5UcmYYOl_qsQBnI5aWzgFlH30L0zaW7gt6LFKMppsN7_ilUAP-HSBDFHXz7xOe4h4U1gtgemhv5zHhQuWIaIQHUmMztb1qg-n3-Hh_X6yHhPCxhzQ7laAEfmU9gUaNREeeRu1Ajz2sXd6VcrN61Ba0UekQAyqWWDQVbYDpUReY1gfZ0fR-ppiRPtAzRW1mkCPClyhDOgwvpEAGP00yhsHBcSwExP0dRwrMG6d5R4BocbFjPBei7ru7obXvAN6ZnYA2urimpjfipJAbk60Dz-nbjywVHsXLn1VCtQIo6fRZXVa3lFbc7G02PIXQ&cid=CAASJORobd-JBtIozbZ92BSmPtc5WCdBY2bi79syT5NDgwADQTKiuA&vpa=auto&vpmute=1&vconp=2&sdkv=h.3.509.0&osd=2&frm=0&vis=1&sdr=1&is_amp=0&hl=en&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&u_so=l&ctv=0&mpt=stnvideo%2Fplayer&us_privacy=false&sdki=44d&ptt=20&adk=2458199627&sdk_apis=2%2C7%2C8&omid_p=Google1%2Fh.3.509.0&sid=38125EBF-DC56-4327-A731-901495C30455&nel=0&eid=44750823%2C44756710%2C44758348%2C44761692&url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dthewaterwomanplus.com%26pcid%3D802%26rid%3D152%26a%3D0&dt=1649740554225&ged=ve4_td1_tt0_pd1_la1000_er200.20.628.781_vi0.0.1200.1600_vp100_ts0_eb24171

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.509.0_en.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.140.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wq-in-f157.1e100.net

Software

cafe /

Resource Hash

56dde794552da26f47ffb8593f0bffc10015ab4ef1f40a32e14dc53a533f433f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:54 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://imasdk.googleapis.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 2156 0
54 B 548ms
191ms Ping
image/gif 2607:f8b0:4007:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~l1voxi2j&c=6163707405432&slotId=3081853702716&qqid=CJPsxL3ijfcCFUrXEQgdaIMN9w&gqid=CQtVYsnOOpGgx_APsayyyAc&fb=ima_html5-lima&sdkv=h.3.509.0&ppt=stnvideo%2Fplayer&mrd=4&aab=1&itv=1&eee=missing-element&bi=missing-id&wta=1&ghmsh_eids=44750823%2C44756710%2C44758348%2C44761692&vmfc=11&vhc=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.509.0_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4007:817::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:54 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 2156 42 B
64 B 30ms
29ms Image
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
pubads.g.doubleclick.net/pagead/ Frame 2156 0
0 42ms
42ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pubads.g.doubleclick.net/pagead/adview?ai=CE3DdCQtVYtPDPMqux_AP6Ia2uA-d94y1aefY2qnbD7_oor3AARABIPHr-0ZglYKAgJQHoAHxmpeaKMgBBakCZ3BdLDg-sj6oAwGYBACqBIgCT9Bu31xKIsvNX1ksP_pS-_ZPVxv32-pz_G2qAj4Ozk-t-0k3s3G9yiz1BB5OiICBLczVcDvtfdn4nrEBg8JW9QOEECShaSyztHA91h3iELSQ644wh_jFPErsJjlZi4ITs5aVtdbbPqhCxDVRIc336_LVrZeIcg1gAJeNHaGg7pQOQJQayq8Y_h6USSboIRSUJtk6N_HkqMpBezLO3CWR_8KrI-tndnbM6PZXH_eEqBdqC321eCSoZVTbWnH30YYEAFSaNaRu1SkAJMM6XQAVRgTuRACXpS3FBhXyXnZ5SVTKRzwFqOx8zmZXMFiLmKxDC9ovQYgEB-S8VX3pfSkt7bcRjfhX--wpwAThxYu57wPgBAOIBfjJkbE-kgUGCBsQAhgBkgUGCB0QBBgBkgUGCB0QARgBkgUGCB4QARgBkAYBoAZ2gAfx0uf5AqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcA8gcKEOrXChiJnZvHAdIICQiA4YAQEAEYHYAKA8gLAbAT9pXhDsgT_4ri3wPQEwDYEwqIFALYFAHQFQGAFwGyFx4KHAgAEhRwdWItOTUwNTgyMzc0Mzk3ODMzNxi54ig&sigh=tGAvzqd9gAk&cmd=Ch1jYS12aWRlby1wdWItOTUwNTgyMzc0Mzk3ODMzNxAAGAI&uach_m=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&cid=CAQSOwCNIrLMM-33dGJwwiIVzBr_x2XwqyIh8WZRK8RHGy7n3zNMDMywcSVY8MFcrtMgNb-5yNYhmLXvwA07&vt=10&sdkv=h.3.509.0&vci=CjwIAhIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1OTA3MDQxOTAyOTlAqgIKbQgBEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MjUyMzkwMjkyCTE2OTQzMDQzMEB7UjMI_QYQDyUAAPBBKAE6CzQxNzc3OTMzNy0xQgRHREJNUABaEFlYdWJZRWZLTGJaRUJXdUkYAQ..
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s11-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

POST
H2 204 csi
csi.gstatic.com/ Frame 87B8 0
327 B 521ms
191ms Ping
image/gif 2607:f8b0:4007:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=1~l1voxhwn&c=6163707405432&slotId=3081853702716&eee=missing-element&bi=missing-id
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/sdkloader/ima3.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4007:817::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:54 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

206
Partial Content

29
r4---sn-4g5ednds.c.2mdn.net/videoplayback/id/820af5fca6f1a1cd/itag/344/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1681276554/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip...
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/820af5fca6f1a1cd/itag/344/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1681276554/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signa...
https://r4---sn-4g5ednds.c.2mdn.net/videoplayback/id/820af5fca6f1a1cd/itag/344/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1681276554/sparams/acao,ctier,expire,id,ip,ipbits,ita...

2 MB
0

86ms
20ms

Media
video/mp4

2a00:1450:4001:19::9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r4---sn-4g5ednds.c.2mdn.net/videoplayback/id/820af5fca6f1a1cd/itag/344/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1681276554/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/379A575F378C47448C0964D4B36CDB866DEB765E.1D96EC3B72E7693032CA0F3B5A663D64DB3E3E34/key/cms1/cms_redirect/yes/mh/Bn/mip/2001:1b60:1010:3:1012:51a9:e477:889d/mm/42/mn/sn-4g5ednds/ms/onc/mt/1649740210/mv/u/mvi/4/pl/29?cpn=YXubYEfKLbZEBWuI&file=file.mp4

Protocol

HTTP/1.1

Server

2a00:1450:4001:19::9 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Tue, 12 Apr 2022 05:15:54 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 01 Apr 2022 12:44:11 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Content-Range: bytes 0-4094046/4094047
Cache-Control: private, max-age=86400
Connection: close
Accept-Ranges: bytes
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 4094047
Expires: Tue, 12 Apr 2022 05:15:54 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:54 GMT
x-content-type-options: nosniff
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://r4---sn-4g5ednds.c.2mdn.net/videoplayback/id/820af5fca6f1a1cd/itag/344/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1681276554/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/379A575F378C47448C0964D4B36CDB866DEB765E.1D96EC3B72E7693032CA0F3B5A663D64DB3E3E34/key/cms1/cms_redirect/yes/mh/Bn/mip/2001:1b60:1010:3:1012:51a9:e477:889d/mm/42/mn/sn-4g5ednds/ms/onc/mt/1649740210/mv/u/mvi/4/pl/29?cpn=YXubYEfKLbZEBWuI&file=file.mp4
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 691
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 151ms
46ms Preflight
application/json 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsimcast.com%2F&domain=simcast.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://simcast.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 12 Apr 2022 05:15:54 GMT
expires: 0
pragma: no-cache
server-processing-duration-in-ticks: 1580
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fsimcast.com%2F&domain=simcast.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=lhghaXxwTzF0VVBVamVaVTN0c1NlcGcrcDFhMjJxS0RrYWtFN3UzWXZJT3RmY29lQmZkNjlibjU2RWt0SUpOSVVWa1lVQW5nZUpqQ1lnV2hXYy92MlRqS3plRGh0TUZyOGt2dE0yZGFmdTR4aU94THNZUmtiZGV6b0QxVT...

347 B
615 B

84ms
29ms

XHR
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=lhghaXxwTzF0VVBVamVaVTN0c1NlcGcrcDFhMjJxS0RrYWtFN3UzWXZJT3RmY29lQmZkNjlibjU2RWt0SUpOSVVWa1lVQW5nZUpqQ1lnV2hXYy92MlRqS3plRGh0TUZyOGt2dE0yZGFmdTR4aU94THNZUmtiZGV6b0QxVTU5ZWFJdUxGRHQ0S2RoaGdBZXo2TzJEME9UN2ZzTjQySUtIbVM0YXk5a2NSMW02ek9zSG0xZk5DQlc5L2lUVUxkdUlucHgzcmJxbVFCYVczNCtBV1FRam5uZmRwY29LYW9ac1hBNUJMdDE2VUlVVjY3UHNRPXw&cppv=2

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

cd84094b9ed5ce5e5f005c2d41110c583f8c71d8a8b2941e7a1ed96ca9e3f034

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:53 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2863
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:53 GMT
location: https://mug.criteo.com/sid?cpp=lhghaXxwTzF0VVBVamVaVTN0c1NlcGcrcDFhMjJxS0RrYWtFN3UzWXZJT3RmY29lQmZkNjlibjU2RWt0SUpOSVVWa1lVQW5nZUpqQ1lnV2hXYy92MlRqS3plRGh0TUZyOGt2dE0yZGFmdTR4aU94THNZUmtiZGV6b0QxVTU5ZWFJdUxGRHQ0S2RoaGdBZXo2TzJEME9UN2ZzTjQySUtIbVM0YXk5a2NSMW02ek9zSG0xZk5DQlc5L2lUVUxkdUlucHgzcmJxbVFCYVczNCtBV1FRam5uZmRwY29LYW9ac1hBNUJMdDE2VUlVVjY3UHNRPXw&cppv=2
strict-transport-security: max-age=31536000; preload;
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: https://simcast.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1853
content-length: 482
expires: 0

POST
H/1.1 200 579.json Show response
id5-sync.com/g/v2/ 213 B
529 B 55ms
18ms XHR
application/json 141.95.99.210
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/579.json

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.99.210 , France, ASN16276 (OVH, FR),

Reverse DNS

Software

Resource Hash

474f1aa9e1522f9cf1f9cb99542a00138a3eaa844b214a99514a25d7934c3596

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://simcast.com
date: Tue, 12 Apr 2022 05:15:54 GMT
access-control-allow-credentials: true
vary: Origin
transfer-encoding: chunked
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/json;charset=UTF-8

GET envelope
api.rlcdn.com/api/identity/ 0
0

GET
H/1.1 204
No Content any Show response
idx.liadm.com/idex/prebid/ 0
485 B 752ms
104ms XHR
text/plain 34.198.184.125
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://idx.liadm.com/idex/prebid/any

Requested by

Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.198.184.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-198-184-125.compute-1.amazonaws.com

Software

nginx/1.18.0 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

Date: Tue, 12 Apr 2022 05:15:55 GMT
Request-Time: 1
Server: nginx/1.18.0
Vary: Origin
Access-Control-Allow-Origin: https://simcast.com
Connection: keep-alive
Access-Control-Allow-Credentials: true
Strict-Transport-Security: max-age=31536000; includeSubDomains
trace-id: e126a200faf8ff10

GET
H2 200 id Show response
id.crwdcntrl.net/ 63 B
333 B 145ms
54ms XHR
application/json 52.50.215.59
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://id.crwdcntrl.net/id
Requested by: Host: cdn.adapex.io
URL: https://cdn.adapex.io/hb/aaw.smc.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.50.215.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-50-215-59.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 0538456d2300958b25c960258e30a8ef4e38e3d77b013f134cc41c9959d91793

Request headers

Referer: https://simcast.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:54 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://simcast.com
cache-control: no-cache
x-server: 10.45.18.19
access-control-allow-credentials: true
content-type: application/json;charset=utf-8
content-length: 63
expires: 0

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 51ms
25ms Script
application/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=simcast.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022040701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 12 Apr 2022 05:15:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 28ms
28ms Script
application/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=simcast.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022040701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 12 Apr 2022 05:15:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 75 KB
26 KB 527ms
526ms XHR
text/plain 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=1300786470299441&correlator=737216317516678&eid=31065787&output=ldjh&gdfp_req=1&vrg=2022040701&ptt=17&impl=fifs&iu_parts=22181265%3A22632072816%2Csmc_970v_1%2Csmc_300v_2%2Csmc_300v_1%2Csmc_sticky_footer&enc_prev_ius=%2F0%2F1%2C%2F0%2F2%2C%2F0%2F3%2C%2F0%2F4&prev_iu_szs=970x90%7C728x90%7C728x250%7C970x250%2C300x250%7C300x100%7C320x100%7C336x280%2C300x250%7C300x100%2C728x90&ifi=2&adks=3965337665%2C1446839202%2C489656950%2C1861010398&sfv=1-0-38&ecs=20220412&fsapi=false&prev_scp=refresh_count%3D0%26hb_cs%3Dcurrent%26hb_bd%3D3%26hb_adomain%3Dduelbits.com%26hb_format%3Dbanner%26hb_source%3Dclient%26hb_size%3D728x90%26hb_pb%3D0.22%26hb_adid%3D574f4e161bb37bf%26hb_bidder%3Dyahoossp%26anh%3Dtrue%7Crefresh_count%3D0%26hb_cs%3Dcurrent%26hb_bd%3D2%26hb_adomain%3Dbusinessinfoline.com%26hb_format%3Dbanner%26hb_source%3Dclient%26hb_size%3D320x100%26hb_pb%3D0.02%26hb_adid%3D1387796b5026d057%26hb_bidder%3Dadtelligent%26anh%3Dtrue%7Crefresh_count%3D0%26hb_cs%3Dcurrent%26hb_bd%3D3%26hb_adomain%3Dduelbits.com%26hb_format%3Dbanner%26hb_source%3Dclient%26hb_size%3D300x250%26hb_pb%3D0.16%26hb_adid%3D65d3a6f86ad8a69%26hb_bidder%3Dyahoossp%26anh%3Dtrue%7Crefresh_count%3D0%26hb_cs%3Dcurrent%26hb_bd%3D2%26hb_adomain%3Dduelbits.com%26hb_format%3Dbanner%26hb_source%3Dclient%26hb_size%3D728x90%26hb_pb%3D0.22%26hb_adid%3D67210b32c5d779e%26hb_bidder%3Dyahoossp%26anh%3Dadhesion&cust_params=wvr%3D3%26wie%3Dtop%26cndl%3D10%26cnrtt%3D0%26cntp%3Dna%26cnet%3D4g%26cnsd%3Dfalse%26wrc%3Dfr%26gpt_l%3D300%26wrap_l%3D1200%26ccp%3Dunknown%26sesdepth%3D1%26page_r%3D500%26idl_envtest%3Dna%26lipbtest%3Dna%26lotamePanoramaIdtest%3Dna%26uids%3Dpubcid%26uids_c%3D1%26waai%3D600%26waae%3D2000%26pbglobal%3Daaw%26tif%3Dtrue%26lui%3D2s%26wabtr%3Dsharethrough&sc=1&cookie=ID%3D3dc216fb1ad8fe38%3AT%3D1649740552%3AS%3DALNI_MZAR4t93baUY_HsCdnHyc9w-wUhiA&abxe=1&dt=1649740554432&lmt=1649740554&dlt=1649740551422&idt=649&biw=1600&bih=1200&adxs=315%2C791%2C1230%2C0&adys=80%2C942%2C175%2C1804&ucis=1%7C2%7C3%7C4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&url=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dthewaterwomanplus.com%26pcid%3D802%26rid%3D152%26a%3D0&ref=http%3A%2F%2Fthewaterwomanplus.com%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x0%7C417x0%7C339x0%7C1600x1804&msz=1600x0%7C417x0%7C339x0%7C728x0&fws=0%2C0%2C0%2C128&ohw=0%2C0%2C0%2C0&ga_vid=248144035.1649740552&ga_sid=1649740552&ga_hid=1945186641&ga_fc=true&btvi=0%7C0%7C0%7C1&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022040701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

07be35915b5654e88f9fa79ba9cca24ad3062c465629e0a79e5fdccffc492369

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:54 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27096
x-xss-protection: 0
google-lineitem-id: -1,-1,-1,-1
pragma: no-cache
server: cafe
google-creative-id: -1,-1,-1,-1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://simcast.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 7A66 6 KB
4 KB 104ms
26ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022040701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 12 Apr 2022 05:15:54 GMT
expires: Wed, 12 Apr 2023 05:15:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 55ms
55ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220406&jk=1300786470299441&bg=!fn2lfTnNAAZAkm7qYJI7ACkAdvg8WjM0hIn6c652EWfkofp10EnLEbIvOT2jbBiImxeWwNEK-6vLqwIAAABlUgAAAAFoAQeZAqvQAUqpgSDje1-aAbamn8glBpSEsnQ1q5eXr-TK_iR2vv8hdLiJEyi-OyU1SwzoQBd-QuJS8fgMy8eQhGYzhrGMLfzT-UofQv5tzkUFQHoWBIZLzK_e2pO5DiH7o80b-vWdGHeQtreEM_n561wyC8UwRCWXc9QOoksMyJNeLVLv00kOXFEhlST9U3S-k6OZg5GmOG2Ij7a5Ob_CmnFhO5gh-09ngjNLCAQ1pkL1Gp19SHRyGPCyMiDRKebX-LJDVegwUgLegKZOfF932F69AlNGEWGXREVnaEck2ibvH8vzfuVtfcOQIoUN7yba36jET3ae2cTfftDXdIglfVs9HWhY0uCZq3HmXKs625OUAcrWpWETDaMcoBq4OnMhfjBgtXMN4BCV22v7H6nzRyRvwlZNVRU59abUZxoB35tRK76AWhgqAASqR0DsGDZtuwXV5ne6ILlk6mJ_kM63o3xDupG2SdQCckAz_NroZPyuA1fbh_YmmzTXrLTEu0_jatOF_h7B4z4TGS26AtSP055hCnSVUlbltnhuFiOcZPcSWKfGY9QZLpD0zB--cRQ_e1VFQ30T45gUk2jUY4IQ_0aQp2kVC1gFOWDU7DqN1DqICI65bQb0EtXs4VPKyi7yXUurTzEo0bKBfq9jOPZZBgHotxDGfcu2UYMCVAfQ2liMR0jkVXP5el5ahl-kkkBPiNkixbsSxt1YAS_7qKuba0-TuF-o2NsXnhvyPvt_Xkk1vUvOysPV0GBOPpsv_bJBLVzLBmA7MK95WdmbwJdrhKvDVG_7FaeuNtHX3opPJd6iebtgGo1p7stC6h3285KLW66Exk73cug4XBmKr950lpTzrgZm2RY8cXe191nZs4PQQPJCgh-wvG07gDIifKL1oxj7kiRDWYWb4BsrVGztPw

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 2156 42 B
64 B 32ms
32ms Image
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame 2156 41 KB
15 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.509.0_en.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Sat, 09 Apr 2022 18:05:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 213008
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 09 Apr 2023 18:05:46 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 2156 0
20 B 57ms
57ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=video_impression_ping

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 2156 0
622 B 122ms
67ms Image
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst12mI0oEIbOUBLYXKBTggkqOpEcdIcBLNI7u98i17xa-CuubyXi_XuhPE3RCiqtp91dcNZIZVTUzOMooUdRO1indC3FOxBHOprwhzNV_iJG2V2WG64gnKr6QwGqRWuQyodWQwq2ybtIrhiZAONmn5Y4mRpesBWZSafKvqODiXsPuc4l8wepmIGt2YJ8_1Lj8-hK8s9rXazXeR916BFiTtP0Ukq17TmxhCDOsR0FMkQsuD76W15EaU7A8wSBHyyNdRL-YlyzQAEToZQbTa5pmugCDolEDtan-ZmYzwmAm7ru7Gi4AWX9_GRti_YvX8WWgKZySgUVjRfxZ8H6JVD8_zCfw6MAaRF3kHzuxVVkMcJA6w1h3t8jSLOOV8pHkIWg3N85Vsy3HiWYYE7MTVSIFqfkX2ajKWI_i3TLK3UDJhX-e9gOjzlR5bHc3jO5dpTwjeG6ayKGE3erEOLCVEDLCSU0MkpKffLRvsD4uMPgoFmwYj30XxFEWUfPv6tFZYIaD9D3CRx8MkLpwkQmmyy0N1det_V_FEdl0kHxh3lTLWYLp6WyGVCB5bGhxhfWgXyY4Ls_6LJHt3reAq2Vac73jPneUnaFJLfWu2b9Q1YV-B14h2Rm52fqt4eFjrWpx4312Qw-bMngxko0Yq8jit4kT_nqh5Ekv_PGIe-cLTzjERn6FOkm4YQev09NEMX6vhbAPDHQaVadgbnA8h2FtN_Ed1ref3cK-9vx_H9WLuKJXFb_n7W-I8fhwddj4Igev0BZpx1HBNJMVB6uffy_nC5iLx5JJivNsudc5lwvyccLenZaP-rU7s22Xw8MEXJfkN5SG2HY-9m3Vgt40CGlCIa7f4Bc7f_ixxD5n1Qkopn6skPcK0qoQRPzqtA3KNYEJ3NrwD8SIyYS0NGuhcj9ooLnwFq5CO2xCCQOrlhxLhcUUFjcb5qkSBa-eXumKDWpMgOZSbzepCOK-GTes530gAJzAVuIBL_XljQQo-IyM9V661YaTOHKkeKLXDaHPjnL-iBp2rkceHBjq0OEjzgwwcoac0Rb1tw2JCWS9bG4_33b93AY4OmKmdCrpUF29VaAjSLfykQfG1Snx_O_dXIsOjcbk39q2HjYVT79tDkdg3FrpVEq8jSoFixS8t0gpHcD7c0MnjFwD5xev13Nhvz8lYfoeBFUzMg2lyNFx6EQiw1gAg7yW6uXpgmMtCwfio&sai=AMfl-YSqqIe0PsA32GAcIKDv2_RSRpGtCDjrxBnjXYNXaqpq3Mdfhccb-GqhPce6i-Oicfquwzm2WlY-zAacmpzpOfDV_q2vIX7wf5G-nVJDTMfFIpCzXcOVn8XM50UTtGp9RCFVqiZ9anI5NXnaW2x44l8QkRA8ol1-6d-7v4wI3kc1upDkOIzzcGPeJRPtZwa6CdKKrkVbZ-UfEwXKej1bMQ&sig=Cg0ArKJSzDM4sdZYYeZ7EAE&uach_m=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&fbs_aeid=[gw_fbsaeid]&urlfix=1&sdkv=h.3.509.0&adurl=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Tue, 12 Apr 2022 05:15:54 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 pixel
googleads.g.doubleclick.net/xbbe/ Frame 2156 0
0 33ms
32ms Image
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COyovN8CEOWWpfsCGImdm8cBIAEwAQ&v=APEucNWTSaSPsed597pRLFpfcenabbT4K10Dp15IGA3wDSeeaBVrifsESIRV5pTvAHhcEnBdeOiHRGNeN-Oudg9LMsICC-SuRA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 2156 42 B
64 B 34ms
33ms Image
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CgmLICQtVYtPDPMqux_AP6Ia2uA-d94y1aefY2qnbD7_oor3AARABIPHr-0ZglYKAgJQHoAHxmpeaKMgBBakCZ3BdLDg-sj6oAwHIAxOYBACqBIsCT9Bu31xKIsvNX1ksP_pS-_ZPVxv32-pz_G2qAj4Ozk-t-0k3s3G9yiz1BB5OiICBLczVcDvtfdn4nrEBg8JW9QOEECShaSyztHA91h3iELSQ644wh_jFPErsJjlZi4ITs5aVtdbbPqhCxDVRIc336_LVrZeIcg1gAJeNHaGg7pQOQJQayq8Y_h6USSboIRSUJtk6N_HkqMpBezLO3CWR_8KrI-tndnbM6PZXH_eEqBdqC321eCSoZVTbWnH30YYEAFSaNaRu1SkAJMM6XVgU9G7mbuClN4F6wSlimWDM82F9_RGuXcHXE3RLOvuBsbTHoXga9hC1EcqkycwEUIL6XKE9lVbdJNC5Zvg9wAThxYu57wPgBAOQBgGgBnaAB_HS5_kCqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgdgAoDyAsB4AsBgAwBsBP2leEOyBP_iuLfA9ATANgTCogUAtgUAdAVAfgWAYAXAQ&sigh=wpPNZR2eeUs&label=vast_creativeview&ad_mt=0&acvw=sv%3D924%26cb%3Dima%26e%3D19%26nas%3D1%26sdk%3Dh%26p%3D200,20,628,781%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26at%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D30058%26vmtime%3D-1%26is%3D275%26cs%3D274%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D728%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D2,0,0,0,0%26avms%3Dexc%26qi%3D182204366%26psm%3D-2147483648%26psv%3D-2147483648%26psfv%3D-2147483648%26psa%3D0%26ptlt%3D1203%26pngs%3D9,14,15%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26ss%3D0.16%26t%3D1649740554365&sdkv=h.3.509.0&vci=CjwIAhIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1OTA3MDQxOTAyOTlAqgIKcAgBEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MjUyMzkwMjkyCTE2OTQzMDQzMEB7UjYI_QYQDyUAAPBBKAE6CzQxNzc3OTMzNy0xQgRHREJNSJ0CUABaEFlYdWJZRWZLTGJaRUJXdUkYAQ..

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMI-qrYveKN9wIVk-TVCh0stQ2DEAAYACCem-VQOhoI5Zal-wIQ4cWLue8DGP-K4t8DIOfY2qnbD0ITCJPsxL3ijfcCFUrXEQgdaIMN9w;dc_rmcid=CAASJORobd-JBtIozbZ92BSmPtc5WCdBY2bi79syT5NDgwADQTKiuA;eps=CIDhgBAQARgd;met...
ade.googlesyndication.com/ddm/activity/ Frame 2156 42 B
107 B 131ms
56ms Image
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI-qrYveKN9wIVk-TVCh0stQ2DEAAYACCem-VQOhoI5Zal-wIQ4cWLue8DGP-K4t8DIOfY2qnbD0ITCJPsxL3ijfcCFUrXEQgdaIMN9w;dc_rmcid=CAASJORobd-JBtIozbZ92BSmPtc5WCdBY2bi79syT5NDgwADQTKiuA;eps=CIDhgBAQARgd;met=1;acvw=sv%3D924%26cb%3Dima%26e%3D15%26nas%3D1%26sdk%3Dh%26p%3D200,20,628,781%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D30058%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D275%26ic%3D274%26cs%3D274%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D728%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D2,0,0,0,0%26avms%3Dexc%26qi%3D182204366%26psm%3D-2147483648%26psv%3D-2147483648%26psfv%3D-2147483648%26psa%3D0%26ptlt%3D1205%26pngs%3D9,14,15%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0.16%26t%3D1649740554365;ecn1=1;etm1=0;eid1=200101;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 2156 42 B
64 B 46ms
44ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuKLiOOixgPBAaAqLloGHZW58jO9aKqSOH8IXyDj6EeQiuAcb5ULLRg3Qo8K-ziBFbzOfwb9tTqRKx06OMvB2Wtj599V4ygAB-pYuVerxDYfiBx4fJ_0A&sai=AMfl-YR0YFBTSxg6PmeU7Hv4HPbbFdQywbdifkFwUSxiczeDOnyH50CqyloEo1fr7jirGEe2TcbtnteLbej5tluI0Z7x8EYjePG0JFg6-nXsa0y_2yBUCAhTunONFSo&sig=Cg0ArKJSzIGG7nkEO9jjEAE&cid=CAASJORobd-JBtIozbZ92BSmPtc5WCdBY2bi79syT5NDgwADQTKiuA&id=lidarv&acvw=sv%3D924%26cb%3Dima%26e%3D15%26nas%3D1%26sdk%3Dh%26p%3D200,20,628,781%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D30058%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D275%26ic%3D274%26cs%3D274%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D728%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D2,0,0,0,0%26avms%3Dexc%26qi%3D182204366%26psm%3D-2147483648%26psv%3D-2147483648%26psfv%3D-2147483648%26psa%3D0%26ptlt%3D1205%26pngs%3D9,14,15%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0.16%26t%3D1649740554365&avm=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMI-qrYveKN9wIVk-TVCh0stQ2DEAAYACCem-VQOhoI5Zal-wIQ4cWLue8DGP-K4t8DIOfY2qnbD0ITCJPsxL3ijfcCFUrXEQgdaIMN9w;dc_rmcid=CAASJORobd-JBtIozbZ92BSmPtc5WCdBY2bi79syT5NDgwADQTKiuA;eps=CIDhgBAQARgd;met...
ade.googlesyndication.com/ddm/activity/ Frame 2156 42 B
494 B 130ms
55ms Image
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI-qrYveKN9wIVk-TVCh0stQ2DEAAYACCem-VQOhoI5Zal-wIQ4cWLue8DGP-K4t8DIOfY2qnbD0ITCJPsxL3ijfcCFUrXEQgdaIMN9w;dc_rmcid=CAASJORobd-JBtIozbZ92BSmPtc5WCdBY2bi79syT5NDgwADQTKiuA;eps=CIDhgBAQARgd;met=1;acvw=sv%3D924%26cb%3Dima%26e%3D0%26nas%3D1%26sdk%3Dh%26p%3D200,20,628,781%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D30058%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D275%26i0%3D275%26ic%3D0%26cs%3D274%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D728%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D2,0,0,0,0%26avms%3Dexc%26qi%3D182204366%26psm%3D-2147483648%26psv%3D-2147483648%26psfv%3D-2147483648%26psa%3D0%26ptlt%3D1206%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0.16%26t%3D1649740554365;dc_rfl=1,https%253A%252F%252Fsimcast.com%252F%253Fd%253Dthewaterwomanplus.com%2526pcid%253D802%2526rid%253D152%2526a%253D0%240;ecn1=1;etm1=0;eid1=11;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 2156 42 B
64 B 35ms
34ms Image
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CgmLICQtVYtPDPMqux_AP6Ia2uA-d94y1aefY2qnbD7_oor3AARABIPHr-0ZglYKAgJQHoAHxmpeaKMgBBakCZ3BdLDg-sj6oAwHIAxOYBACqBIsCT9Bu31xKIsvNX1ksP_pS-_ZPVxv32-pz_G2qAj4Ozk-t-0k3s3G9yiz1BB5OiICBLczVcDvtfdn4nrEBg8JW9QOEECShaSyztHA91h3iELSQ644wh_jFPErsJjlZi4ITs5aVtdbbPqhCxDVRIc336_LVrZeIcg1gAJeNHaGg7pQOQJQayq8Y_h6USSboIRSUJtk6N_HkqMpBezLO3CWR_8KrI-tndnbM6PZXH_eEqBdqC321eCSoZVTbWnH30YYEAFSaNaRu1SkAJMM6XVgU9G7mbuClN4F6wSlimWDM82F9_RGuXcHXE3RLOvuBsbTHoXga9hC1EcqkycwEUIL6XKE9lVbdJNC5Zvg9wAThxYu57wPgBAOQBgGgBnaAB_HS5_kCqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgdgAoDyAsB4AsBgAwBsBP2leEOyBP_iuLfA9ATANgTCogUAtgUAdAVAfgWAYAXAQ&sigh=wpPNZR2eeUs&label=part2viewed&ad_mt=0&acvw=sv%3D924%26cb%3Dima%26e%3D0%26nas%3D1%26sdk%3Dh%26p%3D200,20,628,781%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D0%26pst%3D-1%26dur%3D30058%26vmtime%3D-1%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D275%26i0%3D275%26ic%3D0%26cs%3D274%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D728%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D2,0,0,0,0%26avms%3Dexc%26qi%3D182204366%26psm%3D-2147483648%26psv%3D-2147483648%26psfv%3D-2147483648%26psa%3D0%26ptlt%3D1206%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0.16%26t%3D1649740554365&sdkv=h.3.509.0&vci=CjwIAhIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1OTA3MDQxOTAyOTlAqgIKcAgBEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MjUyMzkwMjkyCTE2OTQzMDQzMEB7UjYI_QYQDyUAAPBBKAE6CzQxNzc3OTMzNy0xQgRHREJNSJ0CUABaEFlYdWJZRWZLTGJaRUJXdUkYAQ..

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI-qrYveKN9wIVk-TVCh0stQ2DEAAYACCem-VQOhoI5Zal-wIQ4cWLue8DGP-K4t8DIOfY2qnbD0ITCJPsxL3ijfcCFUrXEQgdaIMN9w;dc_rmcid=CAASJORobd-JBtIozbZ92BSmPtc5WCdBY2bi79syT5NDgwADQTKiuA;eps=CIDhgBAQARgd;met=1;acvw=sv%3D924%26cb%3Dima%26e%3D10%26nas%3D1%26sdk%3Dh%26p%3D200,20,628,781%26tos%3D13,0,0,0,0%26mtos%3D13,13,13,13,13%26amtos%3D0,0,0,0,0%26mcvt%3D13%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D13%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D13%26pst%3D-1%26dur%3D30058%26vmtime%3D-1%26dvs%3D13%26dfvs%3D13%26dvpt%3D13%26is%3D275%26i0%3D275%26ic%3D4096%26cs%3D4370%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D728%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D2,0,0,0,0%26avms%3Dexc%26qi%3D182204366%26psm%3D-2147483648%26psv%3D-2147483648%26psfv%3D-2147483648%26psa%3D0%26ptlt%3D1212%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,13,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0.16%26t%3D1649740554365;ecn1=1;etm1=0;eid1=16;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame 2156 42 B
64 B 34ms
33ms Image
image/gif 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CgmLICQtVYtPDPMqux_AP6Ia2uA-d94y1aefY2qnbD7_oor3AARABIPHr-0ZglYKAgJQHoAHxmpeaKMgBBakCZ3BdLDg-sj6oAwHIAxOYBACqBIsCT9Bu31xKIsvNX1ksP_pS-_ZPVxv32-pz_G2qAj4Ozk-t-0k3s3G9yiz1BB5OiICBLczVcDvtfdn4nrEBg8JW9QOEECShaSyztHA91h3iELSQ644wh_jFPErsJjlZi4ITs5aVtdbbPqhCxDVRIc336_LVrZeIcg1gAJeNHaGg7pQOQJQayq8Y_h6USSboIRSUJtk6N_HkqMpBezLO3CWR_8KrI-tndnbM6PZXH_eEqBdqC321eCSoZVTbWnH30YYEAFSaNaRu1SkAJMM6XVgU9G7mbuClN4F6wSlimWDM82F9_RGuXcHXE3RLOvuBsbTHoXga9hC1EcqkycwEUIL6XKE9lVbdJNC5Zvg9wAThxYu57wPgBAOQBgGgBnaAB_HS5_kCqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIDhgBAQARgdgAoDyAsB4AsBgAwBsBP2leEOyBP_iuLfA9ATANgTCogUAtgUAdAVAfgWAYAXAQ&sigh=wpPNZR2eeUs&label=admute&ad_mt=0&acvw=sv%3D924%26cb%3Dima%26e%3D10%26nas%3D1%26sdk%3Dh%26p%3D200,20,628,781%26tos%3D13,0,0,0,0%26mtos%3D13,13,13,13,13%26amtos%3D0,0,0,0,0%26mcvt%3D13%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D13%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D13%26pst%3D-1%26dur%3D30058%26vmtime%3D-1%26dvs%3D13%26dfvs%3D13%26dvpt%3D13%26is%3D275%26i0%3D275%26ic%3D4096%26cs%3D4370%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D728%26femvt%3D0%26emc%3D3%26emuc%3D0%26emb%3D2,0,0,0,0%26avms%3Dexc%26qi%3D182204366%26psm%3D-2147483648%26psv%3D-2147483648%26psfv%3D-2147483648%26psa%3D0%26ptlt%3D1212%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,13,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0.16%26t%3D1649740554365&sdkv=h.3.509.0&vci=CjwIAhIYcHViYWRzLmcuZG91YmxlY2xpY2submV0GgtBZFNlbnNlL0FkWCAEKgw1OTA3MDQxOTAyOTlAqgIKcAgBEhViaWQuZy5kb3VibGVjbGljay5uZXQaA0RCTSAEKgk1MjUyMzkwMjkyCTE2OTQzMDQzMEB7UjYI_QYQDyUAAPBBKAE6CzQxNzc3OTMzNy0xQgRHREJNSJ0CUABaEFlYdWJZRWZLTGJaRUJXdUkYAQ..

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 stn_trk.gif
s2l.sendtonews.com/ 26 B
186 B 104ms
103ms Ping
image/gif 52.205.234.143
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://s2l.sendtonews.com/stn_trk.gif?session=qhmTd_5Oq8se6qFt&instance=214611112&version=7.2.0&age=220412&ldt=AD_IMP&key=eKVKXbhX&seq=1&order=6&sm_id=1916518&visiblestatecd=I&soundcd=OFF&adX=true&lineItem=590704190299&adSystem=AdSense/AdX&firstLineItem=590704190299&firstAdSystem=AdSense/AdX&lineItemsGDFP=&adIndex=0&cid=12018&adServer=gam&iu=/92056281/simcast.com-premium&logAssertiveYield=false&rmt=ns
Requested by: Host: embed.sendtonews.com
URL: https://embed.sendtonews.com/stn-player/20220404/stn-player.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.205.234.143 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-205-234-143.compute-1.amazonaws.com
Software: Apache/2.4.41 (Ubuntu) /
Resource Hash: 3b7b8a4b411ddf8db9bacc2f3aabf406f8e4c0c087829b336ca331c40adfdff1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:54 GMT
last-modified: Wed, 23 Dec 2020 21:38:39 GMT
server: Apache/2.4.41 (Ubuntu)
accept-ranges: bytes
etag: "1a-5b72883b37f80"
content-length: 26
content-type: image/gif

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 96ms
29ms Preflight
application/json 178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Tue, 12 Apr 2022 05:15:54 GMT
expires: 0
pragma: no-cache
server-processing-duration-in-ticks: 1110
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

p2
sb.scorecardresearch.com/ Frame 87B8
Redirect Chain

https://sb.scorecardresearch.com/p?c1=2&c2=18065638&ns_type=hidden&ns_st_sv=6.3.4.190424&ns_st_smv=5.10&ns_st_it=c&ns_st_id=1649740553495&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns...
https://sb.scorecardresearch.com/p2?c1=2&c2=18065638&ns_type=hidden&ns_st_sv=6.3.4.190424&ns_st_smv=5.10&ns_st_it=c&ns_st_id=1649740553495&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&n...

43 B
263 B

20ms
19ms

Image
image/gif

99.86.4.32
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p2?c1=2&c2=18065638&ns_type=hidden&ns_st_sv=6.3.4.190424&ns_st_smv=5.10&ns_st_it=c&ns_st_id=1649740553495&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=30000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.3.4.190424&ns_st_pn=1&ns_st_tp=1&ns_st_ad=mid-roll&ns_st_ci=1916518&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_ap=0&ns_st_dap=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_st_ldw=0&ns_st_ldo=0&ns_ts=1649740554673&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=1178&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=va12&ns_st_ge=Sports&ns_st_st=SendtoNews&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Cheddar%20News&c3=sendtonews&c4=Business&c6=*null&c7=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dthewaterwomanplus.com%26pcid%3D802%26rid%3D152%26a%3D0&c8=&c9=
Requested by: Host: simcast.com
URL: https://simcast.com/?d=thewaterwomanplus.com&pcid=802&rid=152&a=0
Protocol: H2
Server: 99.86.4.32 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-32.fra6.r.cloudfront.net
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://simcast.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:54 GMT
via: 1.1 8e04f5d6c745b231c10fce7c2aa9c70e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
content-length: 43
x-amz-cf-id: JqWz4eT_wNT0TjJWEA1ffVSxpgvWde_LnX5cmanuTvwyBwJuRK3RmA==
x-cache: Miss from cloudfront
content-type: image/gif

Redirect headers

location: /p2?c1=2&c2=18065638&ns_type=hidden&ns_st_sv=6.3.4.190424&ns_st_smv=5.10&ns_st_it=c&ns_st_id=1649740553495&ns_st_ec=1&ns_st_sp=1&ns_st_sc=1&ns_st_psq=1&ns_st_asq=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=play&ns_st_po=0&ns_st_cl=30000&ns_st_pb=1&ns_st_mp=js_api&ns_st_mv=6.3.4.190424&ns_st_pn=1&ns_st_tp=1&ns_st_ad=mid-roll&ns_st_ci=1916518&ns_st_pt=0&ns_st_dpt=0&ns_st_ipt=0&ns_st_ap=0&ns_st_dap=0&ns_st_et=0&ns_st_det=0&ns_st_upc=0&ns_st_dupc=0&ns_st_iupc=0&ns_st_upa=0&ns_st_dupa=0&ns_st_iupa=0&ns_st_lpc=0&ns_st_dlpc=0&ns_st_lpa=0&ns_st_dlpa=0&ns_st_pa=0&ns_st_ldw=0&ns_st_ldo=0&ns_ts=1649740554673&ns_st_bc=0&ns_st_dbc=0&ns_st_bt=0&ns_st_dbt=0&ns_st_bp=0&ns_st_lt=1178&ns_st_skc=0&ns_st_dskc=0&ns_st_ska=0&ns_st_dska=0&ns_st_skd=0&ns_st_skt=0&ns_st_dskt=0&ns_st_pc=0&ns_st_dpc=0&ns_st_pp=0&ns_st_br=0&ns_st_rt=100&ns_st_ub=0&ns_st_ki=1200000&ns_st_pr=*null&ns_st_sn=*null&ns_st_en=*null&ns_st_ep=*null&ns_st_ct=va12&ns_st_ge=Sports&ns_st_st=SendtoNews&ns_st_ia=0&ns_st_ddt=*null&ns_st_tdt=*null&ns_st_pu=Cheddar%20News&c3=sendtonews&c4=Business&c6=*null&c7=https%3A%2F%2Fsimcast.com%2F%3Fd%3Dthewaterwomanplus.com%26pcid%3D802%26rid%3D152%26a%3D0&c8=&c9=
date: Tue, 12 Apr 2022 05:15:54 GMT
via: 1.1 8e04f5d6c745b231c10fce7c2aa9c70e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
content-length: 0
x-amz-cf-id: Ow1Tl7FA4QO6SvvPbbmQjWoMuVe0HreWkj8emfiPtzxFNbq1avECng==
x-cache: Miss from cloudfront

GET
H3 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame DE98 23 KB
9 KB 26ms
25ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://imasdk.googleapis.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 108919
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8727
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Sun, 10 Apr 2022 23:00:35 GMT
expires: Mon, 10 Apr 2023 23:00:35 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 287vsxWa92ZzAf4Hva6mMSSE5qc9GsoRRsyFmqSdVGI.js Show response
pagead2.googlesyndication.com/bg/ Frame DE98 36 KB
14 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/287vsxWa92ZzAf4Hva6mMSSE5qc9GsoRRsyFmqSdVGI.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dbceefb3159af7667301fe07bdaea6312484e6a73d1aca1146cc859aa49d5462

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Sun, 10 Apr 2022 16:31:14 GMT
content-encoding: br
x-content-type-options: nosniff
age: 132280
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13808
x-xss-protection: 0
last-modified: Mon, 04 Apr 2022 12:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Mon, 10 Apr 2023 16:31:14 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 2156 0
54 B 191ms
191ms Ping
image/gif 2607:f8b0:4007:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=ima&dmc=8&puid=2~l1voxilu&c=6163707405432&slotId=3081853702716&qqid=CJPsxL3ijfcCFUrXEQgdaIMN9w&gqid=CQtVYsnOOpGgx_APsayyyAc&fb=ima_html5-lima&sdkv=h.3.509.0&ppt=stnvideo%2Fplayer&mrd=4&aab=1&itv=1&gpm_i=11&gpm_c=11&gpm_a=10&smb=1000&br=893&mt=video%2Fmp4&vs=640x248&webm=0&vp9=0&vamt=application%2Fx-mpegurl%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4&hvmf=false&vms=1&bit=344&vsrc=web_video_ads&met.4=ff.l1voxiu8
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/js/core/bridge3.509.0_en.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4007:817::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:54 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DE98 0
20 B 54ms
54ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.3.509.0&bgai=BTi6DCgtVYvr9EpPJ1was6raYCAAAAAA4AeAEAg&bg=!U1ClUBTNAAZAkm7qYJI7ACkAdvg8WkH30K_1K-bIVbeGfra3jw15g23q5yMF83QS_vqn8e7JC1SoDAIAAABgUgAAAAJoAQeZAsXDsYOcEZ14MLAwxO9GWA6_YzJnLmD3G1eGuxXvGHoblU1Qr0UpuTYEnJK-f2rCC9I6dByCDhoMtzBDAgCtpAFsS0a78Blv-hOHTFnpHbsCtOjT7PLcVfaZXarN2yWkcCbnEjY3I7m46EMspLP-edMQrXwJP91KWzjEzmmHtqQLizziHvB-Oe4jTSUEx38RcbQ_QUsr32ZFKs4EEJgf2d7P3ybXLeN4QsmbiyMkTZUClsJtr3cxcJy_iF21IEubPFR7m9hrmvrqMOUpSO21xig0y6LiPr-FNCwXAQjr9D5sSURRvmezfjkriS3i9TkxKszIh0G_P1nJVNUKX5g2WU8Q6rE6aKDpdDOOSka2gPGVqwiy6v0n1I0FSNO09rK5TZa-LFO8lCZu7XKnlZw3hkMNs3IpQG-8souJfOBYeH-pX_C_ZzCltp99-fFsNracpT1qEMrCOTxVgUr0Sa49A-RzA9HVOflYFIznRJ4oRD-P4JYlbwG4ISRuj41LlPNrwyKyOu1uL8tXAu9GbShIj8hYp2qpCj2XGJFG_D-EVBEC9xdiLcevJlYmffr3NHF7h6oxc49TpZE6jt98zS_O8kd8uONxakauYzqf1XWJEoJWgmYfMtTk8fAG0rCpqKL7chBsLW_0yyIePmGY5DPc9kbk8kuCiIa7C4phFndcmv8ZODYD_Got2o3WCgYTaGeTgcgb2Oit3MFg171Xmmd4-qU8lPuRXdR6NrIIzynD494njVA8H9HJ1zh08YKyVT-18IIoqQCs3vGIFu8mRbeUrgscRF9c87iznbCJjA6ChCIrOpgW1Kv5xdz91TFi6PvpoQGJNxmK2VcBcng79V07rqz0xwU3zHstcIaiWH2dYen4MutB1QOjWLQTSh4Vn92nJt5-g1E1YU6mou9Q-bVubKfV8lIpLIkXEJ7D6PSwvsCpbbUoMSTG

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 17B1 6 KB
3 KB 52ms
25ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022040701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 12 Apr 2022 05:15:54 GMT
expires: Wed, 12 Apr 2023 05:15:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame F99A 6 KB
3 KB 34ms
21ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022040701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 12 Apr 2022 05:15:54 GMT
expires: Wed, 12 Apr 2023 05:15:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 73B9 6 KB
3 KB 33ms
24ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022040701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 12 Apr 2022 05:15:54 GMT
expires: Wed, 12 Apr 2023 05:15:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 container.html Show response
20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame C80F 6 KB
3 KB 29ms
23ms Document
text/html 2a00:1450:4001:801::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022040701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://simcast.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 12 Apr 2022 05:15:54 GMT
expires: Wed, 12 Apr 2023 05:15:54 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 3B8F 624 B
297 B 31ms
30ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGLzqmccBMAE&v=APEucNUPjghi3TPDLYz0fYBosFubD52Lnl3JttRQee062jQgrX4iu3ml23tKctSEe7RjL9y1YlGKZ4MnoV4yzaNqUSgR2GWstu9cRcTjAaQrCaQ2CCEc2EDooHb6w2jGIW9EIBP8zE1-h3WpxMG_rqq7rRDFFT2zm4meEzfoaR3nea6vcY1sotatnFWvzW9cxZgGes4E2O7IqBznntSxJNDIIecLovqiZw

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Apr 2022 05:15:55 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame F99A 78 KB
32 KB 61ms
60ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BnnamT98qcFm0lVFc2CPKhaylHPlz8XlsY7JZGR2mOm_IjjC1XpOMdXO8ZN6bd-0pKGZB1qyIMTEvegQEz4KCyEsZm0QZbWoOjrkUhUN-oMam5TeD9Q3i9yS5wvjI3h4VOfuMH2wAoHbuU6R3AJwsJYL5VDg&dbm_d=AKAmf-ALta7AJkH1KVODJ1uDgKT_okCviF8idL6jjETrkMsj1UdgHOy42aE5TsTodO061LHcoBCe7FJM1RZ8xg0yOYAlhDFH-Xu2WcP-uYHWPPS_uxg2frtOe1Fh1r41Rn-Z4rgoONFWqoiitSt8jaaFn1PDjYkeJLPe4KegOhu6kYZRFDE2GmmNImH0sA5eDD3s7DDLRplqYDSGXd3JyMvQ92GqHA_qqzJsBWywBDPrFFIWtk9DfknP-L9hEDSKD_w_jzxVYmt0Uqs7MnNtc3GxDru8Hzvx0NAAsLc5_i89fDUSlY_uB616dKMXev7zygCRAoKhTHSUyOhkjlSt0OjAWHteuAYbWj3iCpKVR_LfqwHWJOicbVTo9cwcJGK9GlpRM_EcXVuYuDse72SvZQDkkqs28X0tJ-FRKxoMfpf5EbHwv6dP-KdBMG8jiU6A_5Rgzy9Z4CIBmBNgsSErU7qFgsSs-2PTMBkBx9izpfo4arL45l6RGm2QlqtWZ9RRNrVPkbzahAd2BtiOO-rvedAiuXu31Fqv3aVJku7P4IX-f6uuK3Nm0Pt9YFtS7xlO4GGRib-KyLnie8Yk1xiSNoZgfQ2vSU4E4EMjBhQ-denUH2juLRxqVTY9HA3wYiaGMJPIS1gBqeJAuoIqMaKmEM69eQDB48LYp36DAUPZordY_fodK6Oo5jhqmToHDxAyR9ttnAdOFRsOtEYKb586-Rr70_81xuTnm21QAkTJMXCrEM4wQjNAErQ29Pq7wxd5qhg8hDP8WJwsrBip-Sa1qR1va7JtTGmTyvxiK-KprmjIanu-5oJYH0fWsButigOFvVEy0_PjdgETVvFTdI67K70k0uWyAdGj2DlqFQbx7IbGXuh4Z4QFI1SlamPtdhIn9cR8EpXUoAD5qTRw8J7Rii-DR_hVjVII1HbLJlct4PjliqbfOLKc8B-bDjs7vo1vKVE1VPy4m8WDXbwM1DrL9jAj4olIe6uqcM6GvHjnTeesS7hFEKuYUJeFMU8UWZF5pdWquDp-BpiAhwMWNBd9V1urFNNFZAZ1UxsR75BrK2nLXTqmY_fGG3c6BCdXII77YuHGJoe78fQiByNGjC5LKxXs3nw8zBpmf81yCnH2e8tIhGKmBSI55TAojwPaaQFEpLnTvMRBI1-mXi2Em9P4tgXTct0ZTETb6nxfd-hn7cu9L-gK665JFf3hWs_QPLjejPFn3kUUEYyviU5VZC7qx2kCRe9_Hhhqx4RAA_0xbUiUqueaSaX66RDm3SBhvxQQI96FpCYpqe9D1CXckfzmt_CiIF_BNpUfsSKxpw1H2J4KtZYblXVfckozc-2qcfgjBbg21qI34vEuVCsa1LL0823NGNwRV60DfHbVT0_7EbNwpELYI9Nj4eXMo8soYzhDE01t-BDQDVPnmRtHM3LnZXFNVnn19shFFQUux_-nFZTQ145i1tbu4S7ds7wgC2fVs8amGkmUPEm8voOtlLKaETKObpTpY0TNti1BvSCABw8RzkWBG8nG7ylFrQlXvnppKTVmSfigNHWaHol0xsa7mCJxxhXN3XqFVz2ju74BWVcCwuL0UHCcUdDVEVlcTwwnla7dzmgKF4EF_H4V1AszmUFfYWDy3Zy67ZtRwmHfrbZb3-58DuPtj7vE1xGYSM2UwCUaKJJQqllgBzFFcqmDyF2XYEuPxKm4tC-gnB_Y-QytC8gOe4v0kD6r90-oJgsCul7GOMy5CTPfRcv1SjJWVHYuuyFrD5kqVZ_H-qjCon7NhAmCwcEajSwMpPtLmDeEdG9TMkIk99MZFUiOKe7KNBsUP9fhyVHTdSpm7deneoOYsfc2snlkeK6iWKhukF1Fvh5Iv-fgx3a4fIm2NXC-Ug2uhjYlhuRFdcZYDTz70ugB0FaKKOBFgZah7hmked64W-DYkC2vmQUmxYwtz-5zq4F9IjrO73nnteHg7Uc1kmaDirGoygaZKiM1-UTO2otndAnTZCtOCvITSQxp2r6-z7eQDO8FpWTBOctQsrPMz-i6LRmeUrwiXs-tixLXCHvgo1FGuXPjr6POgG1ShZdo9pO9Ok3FLQeT7Mui7n1uV19ERAs6OIzmjD54YeAEyY4ceMAXMfRxOwFANCRNi0BrF_NMYaN3BlNK3zlf_r4lbPB3M8ofLTxoGh7w3WTtJwd4HG_nxx2_lLZrQDzkdwt4D6RRiX5MqBWwR06-h59-15Z6D1tftB23eNJzUsgcS4GIWWjBiAeUoe3k7Rb_X2Ki0xNXNuBwL8oU8oy-SAzYnbpQMacZ-wap5CXLlLnu2wbrADEYsdd5khDApTxYoeRcV0eFP32EkfiyrkblNqXnqHpqWJVqbHsgyH-iACHeSMPtPe1UEEgyuyvS_xX32v9-8qMbxP_TYy6JjAS7DtdtBUnuufqD8BkR2DLHApmDsa7zayc4zJzP9R85dOYaHFDhsf860UeCiYcJEL-mYF_tpSVtQmStEzYwLGCFhd19jBpht9CJ1i6hvRjzqp2fSBZbFdQEa1DKvpZ5fFTHpBhpc9ZLg7HplV86WPHhE8LvAjnfTCoRhk0DuH5t72K2hQcHpxsx4ozDLuKMk1YPa-chYrofiRy8mJS3hDWrcRIAt2LJRv_t-c6hfkv_lZ0EzpF_I2lsoTBc-Fipet1M73USEy9zTd8mq3G0qmNc6wsRTaxEyTsck_Awg9Bb_TiNgvrFSo2sshPGErOkAnX5WyUqdo5RuoaK2krUBHxxcnoLwqEvSb63FBtveKv8D7ROErdh8_vWtjwGwQE3Z9c3RGgdNyis451NiefQdTgki1LEomeZ1ly2Axs9RzIyli77r8rnr0KLcyeDRQUjaw5VjIHz1Rd0mpB8Mcp8NfTFr3Uw7Xu5XVkAmmtW6oHH8CZVKg_mx8m5l8WeJfLpbmcB10DZdbi1IPbQjDtbErBBz5KRVe77odbUc4Gr1nsuK2ogbqILzdlZ7QI45tWxkHcujiBmUP3vIo4Ny4MgnCW8OI18EZmTToxz8Kxc-Hzxyux2iAZmqm9gdT-NUZlXMT7JI7Lto63zaYFTnzQM9uFZKcVxCxvRy08gDF3UZhzrpXnfbiLl41LyC4lkoXE-LmgnuKlJ83RkxCVp2bQDeyRPA2fQ3Vg-1HVHc3Sm_nFBXWIMVuiwycgd1R_P2SI6Z2WGdzQ5hzVQq7kXjHddZ_hCTQF_gcgykWWJ65tViU-f94WIjmiJ1Y49adxnfQVWZkYVqYWd5K_Uoaz6u7k1Jxk&cid=CAASJORoaROLC9VswgcmwtXnzIuJ7F485FrSMASACRt0VAwf3ucLbg&rfl=1%2Chttps%253A%252F%252Fsimcast.com%252F%240

Requested by

Host: thewaterwomanplus.com
URL: http://thewaterwomanplus.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ca6bc0a9a66e4095cb7cbf8c2079d9499823430c264399d4367271efb5c1123f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33238
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame F99A 42 B
63 B 51ms
51ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AKvjY5NbJzG0nJG2Z2yTR2YeBvgwyD71OKM3QxZkgOmgRWNJj4n8mQdnKuH1EJR23iUl0_Bdg5QCxCs3shkYi2DClDNb8l4ZVtaVDG5FjaBKd4V_o

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220406/r20110914/client/ Frame F99A 3 KB
1 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220406/r20110914/client/window_focus_fy2021.js

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 04:53:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1342
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Apr 2022 04:53:33 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame F99A 119 KB
36 KB 55ms
48ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5c76c5cdd769bc7a048c8f65c56a7000adb29c8472d36eb4514af572a5ec5f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36908
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1649677559247379"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 12 Apr 2022 05:15:55 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220406/r20110914/client/ Frame F99A 15 KB
6 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220406/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6808c7f1192e091f9e9b4e15e28fa2a8904117ba54c11e51fc8eb9d179733e1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:14:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 98
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6368
x-xss-protection: 0
server: cafe
etag: 1861550861606854559
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Apr 2022 05:14:17 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame F99A 0
0 53ms
24ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS4hPEMegt4XcwpIdYTtWkOSzhbr90z75c72tqW0Deba5_UtuumpI4-balXLz9BO36k8ZAhY3U4N887UDUr7TN_Pw9F1A
Requested by: Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 0D6B 624 B
297 B 30ms
30ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGLzqmccBMAE&v=APEucNVtRNLMZocU14BHnav1dh3b3TDaNZ8HtpLqRccdtmYNp6DInDDM5XcUgGwMca2rbDppkmdlFW-Xqmr_MdMEu1SsSbCXmF-rhwolzJxdo5rgknsLnlse5gJVsSA-vkOQu6nGOZpgxY3pJdqN8A1SijNA_o5sr-SsS5cNFNmazjbyqcRzSdP8ckbVZsWmEizctxI8GELESh88bHaKRyT0Iou92gF86A

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Apr 2022 05:15:55 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 73B9 78 KB
32 KB 66ms
66ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D63qFSyBUaMRv2vO7adeJ-yfUHoPaDv_8fc8iaTp5kKThJ4vao7A3nzrw3IjJHeQkECymw3_tN-qZpHERCKJemYe5Z7pCQ1tOUU1aOgsFHh8N-iQBzI75KD-xfRJw0yVZRERNuTwnDbQ1mOvtxMAR_LwVl9g&dbm_d=AKAmf-BrsOU7oD9Mhy1hQ0wcFTuxFR7DUvjb_kyCmPTwGiEJB8izgDTESWkvCvk6USaKG5q7_5HFOG5tXjmx_55MlUKncPd2oHRksGkpv1OISWhqRHThodDANHVdDRFolL7iwRE-ZXiYmsrejpZvwx3lDzCPuauZ2arUYSgsM_S0HDidb5Fr6g_ViMbXAu4gB0H_6QMy13_Xe7iXMX6copfgO1wLnZzHOpyN3PYajV6FBmelM2R19dJyrld56a0S_6ot2DEO6IvWRgVOQlo6vsrkvJJ4uvdLunoc9glm9hwBDmiL0g3kgp5-JqI07TrxbJ6QLyftRS22s5c3bjtFjYDIznZWDI6AJlEu5VK4YkvRYxPfVAX374j7U5UJSzg5b2T9XPm51OhV1DhnyK5FITRP3XOOcE04HHo8awaDEOYM9bSAJlXr478Q13YGd1XAPHpWXvEs27H9Q-DfcKibgZRmJkEP8KEC0hBZIJZzGXBjsDXBT0K-WdpMjbJOtxZDZTJIOJjev8i4wy1hhsu8jVp2trw8smojUo5RJG_xPIpTYhcP55N_VFHEEutBcpFsYewcM1JqLyAvE7NCVDh7G6rlchJITVD9FlsEu4kcFcerYNYpsKeFhf9S7fCe1R-9x2wXLEL5GJNra9vbyWxsV4frIxXpk3PP2cIw_0SMi2ALkQELhBXtlHNhTKJ_qQhKKzq4N1IdmOZCNyPxXT6Ohj8t6OuwmdWxkj9OkEK512XHKNCXWEbQnEjfUQLc89byThkJ5XigC8b6oko8cWEpS4Xvywa1ND6vOnu_PcV8JP1uxVCsmFv7o6vRHZ-qANqJanhGqE52xMzJuqXPwooMNTaEJQ8JleLikSOIR9DW90yEJQ_edYyDBp-Cb1K91shUl2h5CcmsaGftYZ7q3MDfjEBqw36ChnOgO61aPJMfyZ-6bYux7SJqVsHGbPvrBfaSWYZzATFD0ptPmOVNfJrBCBkfmHQacOdIN4hDnvtqPa4n_KxA1GqqKOuK3eDHgQ_Kwn57a5G_HttZH71w5vQUH6cJdnuRmxGlqvoZFwpROyZ_jq8Bqg_elJOqxobp4VsWgxsu3obtnT2NKhNmBW4-pBBHK5NzCrhdrFRJKCs45bPZm3rSaSFesjTCzaOgS5UCrzbtVMxVeANlHk2igqoriSbymzNc9vT1aL-1FA2dPqMZavDyz2K-SaMJgoqZZEh8m_xrF3kP-jjcb6q37LSabR4Pknmc3VTkbjnO9NNaO_ropdrV7MBda-RGd8QJ03RK7I2Bdw3OAeQVlQJvgoUyA45WN_I8Lk23w2cyh3X75AoypHLSjQzRkJdx1wvawQFuuD7yuyCkw1kK84By3xEnXIaCEUrluJMA7ZRK8g9GJ-xTWFNEeZjXEQTisSrk-y_g6r5O8O9qJX9GknacKdGcN0DVSLiWGW-tw3AAofePTPd51MzstLRRlY1vKEZMWuRzpcWAeRowR9AZ2fP7lLOr4iskRY9ESPbPcMUhwtJBiD2AmE5rrZi1qr-ILBQhvgGFCYid9-wZn8HKKDU_nN8lFlkSi6hB2a-CGcV3eNsYlFx-odyiB-WkSalTSe6zoQcd7uBVIbKeT5MGSayiGQIRZ7fSP1ad-PchdP5_7SpMfIq61YrVLwECQqbBEr3JFW2epjXXLnMEAWEM18d53clBntRfn0fCnOi79T8Rci11unCIAnES0yxuaiRrfecp86p06xGuxuUfboi3iodfgu3r2af-Tw9xwsE2ccKnqRsPu9gw0wpTm40zjm-PAL_TKU3iF7oCwm8N9sbb3Vgh9cyeST9dxdzPScfNVlNbCjE2M0mJXH2F9U39elOdzyN2kkugqzRzQPWmFY3uDqcHxkPUg_KNUMDjABSnUSQEnd56JhL8TvIweAg0SKxLv-EVHJmQB3tNE8WXPlm6z9zp0G74Z5YD8hGhdzBL6WfGeWBlI14Ce-fe3wYWlZtL_S9JnPcnt2vuqAN-m-Ms0JzsrWGDg5EBScFt485AUafW1CFbGm8o09DKGbj7qjdcFGOS0c6bHaGElP8LWiz2j3z72qbW5uvTew20s7KA3ora0Uo6ddkmt7P6SyG_KDBp1lyFiBDRZOdNAqcmlS91TUKoPFO0JUx7YBxn59nsTgN3YaM1nD8iatPnYUcPfLkRxI2UbEwAgGYmT1vvr-qSu29ZKO3WEk35K-F-FzScrj3ZlfGFNiLy3aiTzVht-I_v5MtlAeQy2yPLCjKbDPpyGU_lp9dAl7Mh7YSGCX01xhrFbEIzNNdL74Q56IfpRF6pz3D8FlF_0Ftmo0uAoEzXcW2b6iRZwXLPM0VWNdZsd-vo_B0kjaxTIirT07Mxgh1-PR9INwLl2A30ufkzn-0EQSGZreoDEUg_3iCM6XuvrSuq5k_KVPtEpnJfBd70Ctf2O4dAUMwP7seDDqK2-374VSXzBf51cWKDUbpKKsZB2DuMT8e270gBEToF6QIYxWFG6n59-PkgwacwcIu-u5YyFLWh3CveRCHAWE3xC6po0YM5FFUenwTnXImcwPJTmsDkUfxaaOILmacwnojYzlE5t22dJ1CE75qiIDWwX1wv7FQ9AXUOnoHkxqHpc2L2dmmnzeyK69KsIOxpbIReW4a_wkwUC1IRP7t-szos6JoMJHT4aAoST86CqctWoBBsO8Ub8yzt6HQoiJE40987xQgqSStTQaNv0ulZQbVc2DGdengUaYwvQ77bhif6L2krE0DYzqc44weeUuhwvojJcSQNh3uRdWPEx-JptSugGr6cBJdpBpXIz8WIXMQ3EsLaofuwQYVbfscTjewypigmb3XqmAkzwe4eVrAnLKg5KiK8KF_ccYrmppolgBqHyidXgCylpbm-W4n8zTc0-2mmj9QVPHUNYu4LCoWyzQGhAJmxj6AibfZ-jCfHP60qUj1P_0YcbJH4dzj9U2UnyZXYYpagWO-cvDWUm9JbLL_ZHbTU6Gt_mdc9yDcCFYIM7IAv6o4fdqEDaaSaDzdU9R7CKR2gUcY7aluataa403XF9QcZpZkOW2Lytfwd3mXEeWhT2-qHjMTRdaqI7Renob6TO1pfpqgLIPOUWDk5UkCIlw6176PkDnbZN3xEyMj5i5PwoJ9LALcZBk-5SR9V5z9auGR4QvuZoAF8TXyGUzuYe1aat2EbVaxs7crnmcFU-XXKCebjKkAGYsUJ9lLHDdBjsQXkLB1iKqCWA_0aYfjcbon9pwwRxqSrekJVi2UVEfMhl3Y&cid=CAASJORoui0INwtkAbY8JhQNewo5BqiJW82BEDNbtyqyolEJ59YtXA&rfl=1%2Chttps%253A%252F%252Fsimcast.com%252F%240

Requested by

Host: thewaterwomanplus.com
URL: http://thewaterwomanplus.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1f84f017c5abc81c0d9e49304bebae36f598e029231130070c68ce0a55f2eddd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33203
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 73B9 42 B
63 B 52ms
51ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Dqe61G_scIPcD2AvdAeT79-La8G2fpdRqwOH2Sx_ACRrfLulAKI_jLTuH8vkPZBxWm9javtdlcE4F25uG1cR1J2WXUYw8XJFZeGDUF5EDDXSHqMR4

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220406/r20110914/client/ Frame 73B9 3 KB
1 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220406/r20110914/client/window_focus_fy2021.js

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 04:53:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1342
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Apr 2022 04:53:33 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 73B9 119 KB
37 KB 29ms
29ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5c76c5cdd769bc7a048c8f65c56a7000adb29c8472d36eb4514af572a5ec5f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36908
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1649677559247379"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 12 Apr 2022 05:15:55 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220406/r20110914/client/ Frame 73B9 15 KB
6 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220406/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6808c7f1192e091f9e9b4e15e28fa2a8904117ba54c11e51fc8eb9d179733e1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:14:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 98
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6368
x-xss-protection: 0
server: cafe
etag: 1861550861606854559
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Apr 2022 05:14:17 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 73B9 0
0 47ms
25ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQVXi9apj6qIH6MtDXOUC_aZ9P67nT1W3HJNNzd4I346gMYG1DmvZju-9NeTkGf0guUjFfgQkHpyEzXBWuneLHPlRe4Dg
Requested by: Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 261C 640 B
316 B 32ms
31ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CMr9xPwCEM2D95ADGPvfkMcBMAE&v=APEucNWkgYey_iir4l3fH0OVzOfuSJE8-73g9ITBWeCOUzdT3R5yxEd2zoJs6Q1rc9WCsiaUWr2Wq_OQh5EZHyqHxfgslLM_6PE93tvZq6YuY66w968sTyizDc3s_v4w6lKFqMGXh6qKe200zpPNz7lYcFu60au_cnaVhUSJeVX7VJjb1SLsD05mG1cIXZMlYElAS-HEMorerHZfVm40tC2PCPjG_ZojcQ

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 295
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 12 Apr 2022 05:15:55 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame C80F 56 KB
27 KB 72ms
72ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CXwWvqWQto-W2WMaT8ycoM9MArsEl_C43DmMCCubLDz07opa0CWHoDdHgDBYwFB3x-ggxSVkCZs-k1-jKXK-nDyX3Muw&cry=1&dbm_d=AKAmf-B4yR4DhUC_qe2mZ8MkBanKq4REv8Pcgus7F1Elgxc4L0Z4KH4jcN1VmrOXC8gMi8IFXLHrEOtoJn9xeawzTaVq2OAUUy0XLVX3S904CDRu3vXyQW7P4XirqTDdOVgmjI86OXQIbmcXoOX_xGb3hpGsjxLk6izX-mFCFYUNLBENA0K2EZqqGCAD5KxwnErwaeCQsl_SLlr8uYkmcD2vYlj8JF7-OH7hbsc8FOdNDWB13vv1C2Dvu17upeOuBWhqy5gVxENR5cXKv8hCJwmz2QzOPp8v4fIsbeLtgXIVkwA_NAAYDIy5ftdWaqcMj6fAzbr7r8wSKGcWEuZWW6Loa_rlOT4LmuKBletzzisw6H0eyONyRq3qj5Ku1H8CLnnANGzHVQR0VJ1CZqO91pnExMtNe_sFJDiXq65vJWJ2GWPvITGmHt8T03CljPxlsc52JbFcGlPtGgxh1aReKQlphFcpGoJwCnc7dg-_FLP6LbgIbgyGdXy2DaXA579u-3c69C_Rs5lsNseWoixfuMTqgtYtPQK8gb5uLS2fHEG3HhCRw1yNkgLbRrxVpkKhtJ7XU-zaxPTUuqQfgn8NknnZ8G6gF-diPCJw4RRuiR99M1tReMDMQDcYthyrcQgUYhAOKPlSNO7uG5mn_4VR4IjIg59_G7MR8yOV70LPtslOnV-aCvx0sv91nEOMnwho5nCNPocZBjVqSwmkIs4ZRM8axgijGOwbb_XgZGGjSG9uZVxJ7soYDsryek7lkiF8_e-JLGESc36gOZ_5Badd7fCgKdPM8t1VwB7spOHQyXqd2ZkrmXIH5sXVMQ7HpQXFI-Pq4xaJ0y34Gm9MwnpdVpJ3Mpm7VieQSeH4GceZwauLfmuvkLVjtsl-c-3vh95yPQUV-MfSj5rW0FWBFxE38Rm1l1z2qvBFYsmQEEqiWwH0s1qTj7fqjS36fSWNgw25xVyo0tQ7icAyjhz6vndEq0snROVelNiySp_g3AI27x-wehzDoytQRDmex5bG1TDDf42pl1iP-JAa2u44J4Vdxa-teRh-ceC30i3mTvWAPD51dQGJca_mtlWlFdR3RxOu4GapZMYQD7rjzYIprSxQ2xILY-pL-bQWKpkxiN62mPmg2UjD6qRNKbqaQ7B3ZXHoeo0_TWxDVHl-6-M3m9yYByvMrf0CHFFDd6A08BB-YF6avUf5fTCsvdsAXSfkxZWR1gLmfg8o_A4qU4uLf4oXbCF3Nc34UipOkgwCvZLzZQ5KdZHIhTs26siHALucPtCOgFMeoR9KtSNkxxc1KixllWQBioQM1bk8l2cI-kDHjGh854pC_lqZvW3ie1Dps0GsgfcASoYXYLx5uCKz9J8ROzHknMbskL7G4lSRGfif-yjUmNE4m7w6wxgZttp_HlS7C3j13wknDx1WoDq_xujkJj8c73gk9PfuWwIk-3CSz3C4cTUkLhya6CfTw7lSOStjk-rro5teEjHpSxmG0owvGY-51ubI8l4qJNtdvgINmH8mV1Li9gNDvKZIZZntB6ttHb-6J7b-s4lDxMAcWf5yNnpb4s4pPcPlzmxe90uzlTD944N96DwuFaeEejr58Cn73w-lg8K18Q7epkXr7h5Fo_3bDs5WvyoxqfejoBMZ3P20bNjTpSUCU4pyXdTspAd37KkHzeh3rfro_5KHL6Cb6WsBMT2h7S3SokGEq4OfFUmY_Z0qPCJSXQw6kaziO3LxyMdx6kjfD9AplMqmf4tl7Cw7EP2Z3ui5K9_HHFZKz2plxDr9TpT2oveUKn6HdK9Y1wJVXfdAE3fgilo1y-HkRqG-phO9LdkuhrkQj82TVfbmwKzM6cuzm5VfvpYLwUZE5Lp5TeJvtN-vxNBCvpTCvw_xhyDfgBwUnud7eCMRzSUJFBJ9JvdufwHwXYM5N6vy4fEEnFbWSwZMU_HATXIwBNk68e661TLS-nHfHMAyGQ4zKmQELJskO2nNQAYS-A4o_k8jdM-Mih1nJR1VigN5KMY95p-0R6w9OSRZSc8MShE-uLiDXp8i8XtFwBKHsIJtKcVv-n66UGlbv7HU1fBxq45Vd3q6fM1antlM-GEdlgjrgu3aiSfqAvxzROnYrnXL27S4U-fWr0fqth0vOW6dNzK4Y4Fx1cHST0KTNXJnqORydQFvqHYUwLG3VUqcvbVXfniWMCeoKZ_aZqpivGP8JuDMyGu_RJaizG_ihLHzzJEa5nwWz-fuUp1Xiqe5BNfgyHT93715Ki-jUAZxMpnilVhR3iv4BV3kj5riDDsyFgebBn6qWXktmCoFjjEKWd15-FFuX60euBUVEixrY6SJKjB1GkBxw87eLf-jGZBqPkRwb-PdM4WbJE8AuzxJDKmlH3avzdjJd8986RLe5v48jdfJowVqLSrhtdRycNk5U4Kw15TJxOyjzHDu32Z9YngnYez8a6EOHSx1IKTGNWADMTz__rpU_rY0gxDlLp4qsaGymgEAKHLF8WSuwG7iA1OJNkllOpkV8p4xleNLGJcWro4P24NUJfZ-5GxT53GL298yBCgJhuX1rGNlky9JEpEYvCtq6GKXVWMb0ASw7ZRwbcUgnLUBQLpFpAkpCEfi1eky_3WS7_Aa6wwf7H6HcYxfKZhhIViiwrZzge7GBpIMWWT37K3oHs9JwmT1j2jyHfNJZ_QiVjJz-AtLTyXI1ZAmKMdQgYQPHYE6_enWbo8LzPpcQiCtZwSEkNFYM99zzUzCIr1IO2Ezg9c36qhmJmnZ2EjRW5VlipHn8yWT_9bjRTtb8xaHYc9E7xqDO7n7Zg4fTA0a_5gMK5dfNf1mygOMTVU9JwpqIQndzzAu8qLz7LasIa0O9O0bKcwj4UE3Bq8CNblnwpWxcvRUrlggxw-Q3hFBCYnKFy3HzCIU3gn6JZ_TjTUUc6Mx5sYXC3ia-J9O2cZHcOK2ZylX3ir3K1ywdoo0iGYGPyb1ZjZS5Ex9EYto3ZozR_NR96HQ0TAGMmO2bRRyWZX-PT61BSNa7WcqA1hNq_0qClEXypipTYydOCzwJdgvNowSho1fZ8y0PkqkMdGCpTk7ehMbuPwyr1b2LlJpX9ZVwn6zFmiMED22JZdq0aaxPyr0Lluzk3SQO52YjEMQLIY-q8J-VM9NqaXFEN4UYGcp86grh5CiGkRVB5Ob9NB_663nQJlR-3vgL7E8sUhPOYsRuyaDiXK3ZjnkuxaxKkXEuZ3n&cid=CAASJORoQT88WRT0sY5qg-1Y8_j7GCUpciAyyV4mzbfCffwR5TTdCQ&rfl=1%2Chttps%253A%252F%252Fsimcast.com%252F%240

Requested by

Host: thewaterwomanplus.com
URL: http://thewaterwomanplus.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

31365528012c50381d8d9934f97be59cf9fdd8213f4816eedc78ddbb256acd85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27399
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame C80F 42 B
63 B 52ms
51ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BmhXV8N5prxGG6jWwdY9MWt1ySEZ5DSUCpAEzarAWIH2VBtuyjOKfzEs5DORhgDZMdPvZyK7rJhJbnF3pq7TH8tepV2eB9lf2-tZIJKahwycOqKVc

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220406/r20110914/client/ Frame C80F 3 KB
1 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220406/r20110914/client/window_focus_fy2021.js

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 04:53:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1342
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Apr 2022 04:53:33 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C80F 119 KB
36 KB 31ms
31ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5c76c5cdd769bc7a048c8f65c56a7000adb29c8472d36eb4514af572a5ec5f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36908
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1649677559247379"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 12 Apr 2022 05:15:55 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220406/r20110914/client/ Frame C80F 15 KB
6 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220406/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6808c7f1192e091f9e9b4e15e28fa2a8904117ba54c11e51fc8eb9d179733e1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:14:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 98
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6368
x-xss-protection: 0
server: cafe
etag: 1861550861606854559
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Apr 2022 05:14:17 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 17B1 0
0 58ms
58ms Fetch
text/html 142.250.186.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CViWXCgtVYs_PHpa_3gPx972oDcme0rFc1Z2R93DAjbcBEAEgAGCVgoCAlAeCARdjYS1wdWItMTA2Mjk3Mjg2MTU1MzMwM6AB1bbS6gPIAQmpAv5aNDN1PbI-4AIAqAMBqgSfAk_QeDpX1LBOq39EAhWaPgaMXzMtYVSw58j3a71UbEd7Ih8YPvHJLzz2Kn7-Rt1MT40NFBnZEeSMOA3oRk7a9fssxvIPDoG_H304sSZw9zhFNXShtmDRGz0ZGFJVy0yd-bApoTJMAlbWDkmmzKiT220RMHWGZNRF4cd_ybOwXZxPkPBtGm-YbcsHnwF4UeoUALW3xwd_Gisyc6RdxhcQHFf8vaXLJ1DfydGlhyLjhlxZV3Jc9iWgWoCzAyVAoQ1g6PGOotOxdG1q2r3y9Q9rARgSHypwOG6kXZYF8xiAlPpn-py5DCzkTgNp6nLEa5CZO8Rg2YAWzN7VSb2Re6op1erI9iItOuOhn7UMTqTjL6t1XAv_XVu77H_3-FDNcxeO4AQBgAayvfC81qy2xF6gBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAYAKA_oLAggBgAwB0BUBgBcBshccChoSFHB1Yi0xMDYyOTcyODYxNTUzMzAzGIHUHA&sigh=5cAX9Ltx9Z0&uach_m=[UACH]&cid=CAQSOwCNIrLMSQxP4fhVLpBe6UBfGfW4p8FaSTb-xd2z2n1H7aKF0iIfR4N3PGtnV15c0ylcccsCb7BfW7ojGAE
Requested by: Host: thewaterwomanplus.com
URL: http://thewaterwomanplus.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s05-in-f2.1e100.net
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
H2 200 notify
rtb.fr.eu.criteo.com/google/auction/ Frame 17B1 0
0 111ms
32ms Fetch 2a02:2638::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=U8TkEev_CsoH-gGdg2ICAgAAANzcIsRkPmtirXdIVgk5jtsQCgtVYt0ngKUiuov4T5-ZABI&wp=YlULCgAHp88Kd5-WAA978VLGWkASddHnjJEspA

Requested by

Host: thewaterwomanplus.com
URL: http://thewaterwomanplus.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:54 GMT
server: Kestrel
server-processing-duration-in-ticks: 237293
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 5AE6 138 KB
45 KB 126ms
55ms Document
text/html 2a02:2638::b
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=YlULCgAHp88Kd5-WAA978VLGWkASddHnjJEspA&u=%7CoooCoySMqr8XkHmxgSGJBhJC%2BhJ%2BVo8fyofSW869N10%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ66URtX1gfQsB7PXt8PBrVICWZYsqhnD-SWAkU5iipPPFKTJzI_AQkQ4fZ8EuCdGwrJbjQdVUL0ZnR3o8Uu7xwMxs2tYvkEsU0O7DgiYDxUzGOhlscQhbmVE9-gqc6sNwtaEVwqMBQEvpH4VLMCfsWuJ_YJwlIGjykqyiqQr7OZDCc_TwMKAuCh5XkSf5t9Ff8J_5HKM_NTFnAda8Dptz_AJ8EGunWancSdHNXwuRHWf6WcARhLAhrMdONVG8SUgRPe-LVbsPmyf-DjHEX0zJWOl03MUPyzaR_n6Ik0rhdEjXxBGn3tcocAqDJQTOoCnt8I2LOzjjUVcY6QDTEWzZ3_IEoTYxTvnlB5iFc6xfdm3ONT8jGvSMWxF7RVpVaIs9iQmFvxU6YXu1swcJLfDGzfOqf0-OFUGI1K1KWKu3S19jjKV4krWa05g&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCARzMCgtVYs_PHpa_3gPx972oDcme0rFc1Z2R93DAjbcBEAEgAGCVgoCAlAeCARdjYS1wdWItMTA2Mjk3Mjg2MTU1MzMwM6AB1bbS6gPIAQmpAv5aNDN1PbI-4AIAqAMBqgSiAk_QeDpX1LBOq39EAhWaPgaMXzMtYVSw58j3a71UbEd7Ih8YPvHJLzz2Kn7-Rt1MT40NFBnZEeSMOA3oRk7a9fssxvIPDoG_H304sSZw9zhFNXShtmDRGz0ZGFJVy0yd-bApoTJMAlbWDkmmzKiT220RMHWGZNRF4cd_ybOwXZxPkPBtGm-YbcsHnwF4UeoUALW3xwd_Gisyc6RdxhcQHFf8vaXLJ1DfydGlhyLjhlxZV3Jc9iWgWoCzAyVAoQ1g6PGOotOxdG1q2r3y9Q9rARgSHypwOG6kXZYF8xiAlPpn-py5DCzkTgNp6nLEa5CZO8Rg2YAWzN7VSf-TWjiuWnbbSb45mTOcOU0FWq5VJYVt3r83YP1JU2Hb4NVn9wQxNPRx4AQBgAayvfC81qy2xF6gBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3jIC28ei-VTWIWFmZPkmkqRtrcTw%26client%3Dca-pub-1062972861553303%26adurl%3D

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::b , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

faf18c45e08c15346dadec317d7cf03836b2e3f809f95bf818193a1fdf7623e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Tue, 12 Apr 2022 05:15:55 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=45vV1g4I9gU4nhACA9vjBPDK2bcjd2NSOm41hqoRWeZrivWKdyws5O1K-AMO7H3eizeAuUft98Xb1lbXZ-vy1LS1bpx8nvMRJvvLuPGOQfv22DAOdR4ksD510h13j7XUNkj1KRzGlrnD_Sv6zsjTy2AI6w-jyN4v2kl93B-2hK9l_fuio7T0k5MnoullV8BN3GI34ymfShgm3kphn4IpLMhiAk-aOXtnwx5-_PxeG2tAFDAwKfjDy8cWhbCw3xM6gO92Aw"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 29988391
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220406/r20110914/client/ Frame 17B1 3 KB
1 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220406/r20110914/client/window_focus_fy2021.js

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 04:53:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1342
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Apr 2022 04:53:33 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 9199 1 KB
749 B 21ms
19ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 84131
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 11 Apr 2022 05:53:44 GMT
etag: 48472445140208031
expires: Tue, 12 Apr 2022 05:53:44 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 17B1 119 KB
36 KB 58ms
52ms Script
text/javascript 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

872.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

sffe /

Resource Hash

a5c76c5cdd769bc7a048c8f65c56a7000adb29c8472d36eb4514af572a5ec5f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36908
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1649677559247379"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Tue, 12 Apr 2022 05:15:55 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20220406/r20110914/client/ Frame 17B1 15 KB
6 KB 24ms
20ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220406/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6808c7f1192e091f9e9b4e15e28fa2a8904117ba54c11e51fc8eb9d179733e1c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:14:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 98
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6368
x-xss-protection: 0
server: cafe
etag: 1861550861606854559
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Apr 2022 05:14:17 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 17B1 0
0 39ms
26ms Image
text/html 2a00:1450:4001:830::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSJAvkYDn7oTnTUsnF0KhxThc8zyh5l2V0Bb27_CPEZqPn5DVq2Rvafmw9kmkJ6yW7RhUaf_i-C7CgZA0Nd_eDwP32KjQ
Requested by: Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:830::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
H3 200 ext.js Show response
tpc.googlesyndication.com/safeframe/1-0-38/js/ Frame 17B1 22 KB
7 KB 24ms
22ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/safeframe/1-0-38/js/ext.js

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0bcac89d72d5f0b2bef20f815406384ff05489e4294acee57409060c2eccffc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 13:55:08 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 55247
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7022
x-xss-protection: 0
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Tue, 11 Apr 2023 13:55:08 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3B8F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKQc80y0d8RT1swRiDmuZFg&google_cver=1

43 B
1014 B

65ms
32ms

Image
image/gif

23.35.236.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKQc80y0d8RT1swRiDmuZFg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGLzqmccBMAE&v=APEucNUPjghi3TPDLYz0fYBosFubD52Lnl3JttRQee062jQgrX4iu3ml23tKctSEe7RjL9y1YlGKZ4MnoV4yzaNqUSgR2GWstu9cRcTjAaQrCaQ2CCEc2EDooHb6w2jGIW9EIBP8zE1-h3WpxMG_rqq7rRDFFT2zm4meEzfoaR3nea6vcY1sotatnFWvzW9cxZgGes4E2O7IqBznntSxJNDIIecLovqiZw
Protocol: HTTP/1.1
Server: 23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 12 Apr 2022 05:15:55 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 12 Apr 2022 05:15:55 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKQc80y0d8RT1swRiDmuZFg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 3B8F
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YlULCzoxAefP5fjQSglQlgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKQc80y0d8RT1swRiDmuZFg&google_cver=1

43 B
894 B

22ms
22ms

Image
image/gif

23.35.236.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKQc80y0d8RT1swRiDmuZFg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGLzqmccBMAE&v=APEucNUPjghi3TPDLYz0fYBosFubD52Lnl3JttRQee062jQgrX4iu3ml23tKctSEe7RjL9y1YlGKZ4MnoV4yzaNqUSgR2GWstu9cRcTjAaQrCaQ2CCEc2EDooHb6w2jGIW9EIBP8zE1-h3WpxMG_rqq7rRDFFT2zm4meEzfoaR3nea6vcY1sotatnFWvzW9cxZgGes4E2O7IqBznntSxJNDIIecLovqiZw
Protocol: HTTP/1.1
Server: 23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 12 Apr 2022 05:15:55 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 12 Apr 2022 05:15:55 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKQc80y0d8RT1swRiDmuZFg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 3B8F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESENSPPKDrTHIY_puo52Inrg4&google_cver=1

43 B
1008 B

24ms
23ms

Image
image/gif

185.33.220.216
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESENSPPKDrTHIY_puo52Inrg4&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGLzqmccBMAE&v=APEucNUPjghi3TPDLYz0fYBosFubD52Lnl3JttRQee062jQgrX4iu3ml23tKctSEe7RjL9y1YlGKZ4MnoV4yzaNqUSgR2GWstu9cRcTjAaQrCaQ2CCEc2EDooHb6w2jGIW9EIBP8zE1-h3WpxMG_rqq7rRDFFT2zm4meEzfoaR3nea6vcY1sotatnFWvzW9cxZgGes4E2O7IqBznntSxJNDIIecLovqiZw

Protocol

HTTP/1.1

Server

185.33.220.216 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 12 Apr 2022 05:15:55 GMT
X-Proxy-Origin: 217.114.215.133; 217.114.215.133; 872.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 9142495c-3f68-4a87-8e5c-80e19d849b56
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESENSPPKDrTHIY_puo52Inrg4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 3B8F
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjUxMzIwMDM5MzU3NzAyOTIzMA%3D%3D

170 B
188 B

54ms
30ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjUxMzIwMDM5MzU3NzAyOTIzMA%3D%3D

Requested by

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

872.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 12 Apr 2022 05:15:55 GMT
X-Proxy-Origin: 217.114.215.133; 217.114.215.133; 872.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: f1e4703a-98a9-44da-84dd-ef7ca858bc42
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjUxMzIwMDM5MzU3NzAyOTIzMA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 0D6B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKQc80y0d8RT1swRiDmuZFg&google_cver=1

43 B
1014 B

25ms
23ms

Image
image/gif

23.35.236.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKQc80y0d8RT1swRiDmuZFg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGLzqmccBMAE&v=APEucNVtRNLMZocU14BHnav1dh3b3TDaNZ8HtpLqRccdtmYNp6DInDDM5XcUgGwMca2rbDppkmdlFW-Xqmr_MdMEu1SsSbCXmF-rhwolzJxdo5rgknsLnlse5gJVsSA-vkOQu6nGOZpgxY3pJdqN8A1SijNA_o5sr-SsS5cNFNmazjbyqcRzSdP8ckbVZsWmEizctxI8GELESh88bHaKRyT0Iou92gF86A
Protocol: HTTP/1.1
Server: 23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 12 Apr 2022 05:15:55 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 12 Apr 2022 05:15:55 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKQc80y0d8RT1swRiDmuZFg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 0D6B
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YlULCzoxAefP5fjQSglQlgAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKQc80y0d8RT1swRiDmuZFg&google_cver=1

43 B
894 B

23ms
23ms

Image
image/gif

23.35.236.247
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKQc80y0d8RT1swRiDmuZFg&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGLzqmccBMAE&v=APEucNVtRNLMZocU14BHnav1dh3b3TDaNZ8HtpLqRccdtmYNp6DInDDM5XcUgGwMca2rbDppkmdlFW-Xqmr_MdMEu1SsSbCXmF-rhwolzJxdo5rgknsLnlse5gJVsSA-vkOQu6nGOZpgxY3pJdqN8A1SijNA_o5sr-SsS5cNFNmazjbyqcRzSdP8ckbVZsWmEizctxI8GELESh88bHaKRyT0Iou92gF86A
Protocol: HTTP/1.1
Server: 23.35.236.247 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-35-236-247.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 12 Apr 2022 05:15:55 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 12 Apr 2022 05:15:55 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEKQc80y0d8RT1swRiDmuZFg&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 0D6B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESENSPPKDrTHIY_puo52Inrg4&google_cver=1

43 B
1008 B

53ms
28ms

Image
image/gif

185.33.220.216
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESENSPPKDrTHIY_puo52Inrg4&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGLzqmccBMAE&v=APEucNVtRNLMZocU14BHnav1dh3b3TDaNZ8HtpLqRccdtmYNp6DInDDM5XcUgGwMca2rbDppkmdlFW-Xqmr_MdMEu1SsSbCXmF-rhwolzJxdo5rgknsLnlse5gJVsSA-vkOQu6nGOZpgxY3pJdqN8A1SijNA_o5sr-SsS5cNFNmazjbyqcRzSdP8ckbVZsWmEizctxI8GELESh88bHaKRyT0Iou92gF86A

Protocol

HTTP/1.1

Server

185.33.220.216 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 12 Apr 2022 05:15:55 GMT
X-Proxy-Origin: 217.114.215.133; 217.114.215.133; 872.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: a3c8798d-9a7f-4214-8484-d7dc6023f483
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESENSPPKDrTHIY_puo52Inrg4&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0D6B
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjUxMzIwMDM5MzU3NzAyOTIzMA%3D%3D

170 B
188 B

29ms
27ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjUxMzIwMDM5MzU3NzAyOTIzMA%3D%3D

Requested by

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 12 Apr 2022 05:15:55 GMT
X-Proxy-Origin: 217.114.215.133; 217.114.215.133; 872.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: f477e340-f4b9-4922-ac67-25497b577feb
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjUxMzIwMDM5MzU3NzAyOTIzMA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3

200

sd
us-u.openx.net/w/1.0/ Frame 261C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFVZW5LGQSSztKjS0SVBEOk&google_cver=1

43 B
61 B

4007ms
3987ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFVZW5LGQSSztKjS0SVBEOk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMr9xPwCEM2D95ADGPvfkMcBMAE&v=APEucNWkgYey_iir4l3fH0OVzOfuSJE8-73g9ITBWeCOUzdT3R5yxEd2zoJs6Q1rc9WCsiaUWr2Wq_OQh5EZHyqHxfgslLM_6PE93tvZq6YuY66w968sTyizDc3s_v4w6lKFqMGXh6qKe200zpPNz7lYcFu60au_cnaVhUSJeVX7VJjb1SLsD05mG1cIXZMlYElAS-HEMorerHZfVm40tC2PCPjG_ZojcQ
Protocol: H3
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/18.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:59 GMT
via: 1.1 google
server: OXGW/18.0.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEFVZW5LGQSSztKjS0SVBEOk&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 261C 43 B
305 B 81ms
35ms Image
image/gif 35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMr9xPwCEM2D95ADGPvfkMcBMAE&v=APEucNWkgYey_iir4l3fH0OVzOfuSJE8-73g9ITBWeCOUzdT3R5yxEd2zoJs6Q1rc9WCsiaUWr2Wq_OQh5EZHyqHxfgslLM_6PE93tvZq6YuY66w968sTyizDc3s_v4w6lKFqMGXh6qKe200zpPNz7lYcFu60au_cnaVhUSJeVX7VJjb1SLsD05mG1cIXZMlYElAS-HEMorerHZfVm40tC2PCPjG_ZojcQ
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/18.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
content-encoding: gzip
server: OXGW/18.0.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
via: 1.1 google
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 261C
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEKjiKhe0kf1sJUo9RzGDG3s&google_cver=1

23 B
172 B

45ms
44ms

Image
image/gif

104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEKjiKhe0kf1sJUo9RzGDG3s&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMr9xPwCEM2D95ADGPvfkMcBMAE&v=APEucNWkgYey_iir4l3fH0OVzOfuSJE8-73g9ITBWeCOUzdT3R5yxEd2zoJs6Q1rc9WCsiaUWr2Wq_OQh5EZHyqHxfgslLM_6PE93tvZq6YuY66w968sTyizDc3s_v4w6lKFqMGXh6qKe200zpPNz7lYcFu60au_cnaVhUSJeVX7VJjb1SLsD05mG1cIXZMlYElAS-HEMorerHZfVm40tC2PCPjG_ZojcQ
Protocol: H2
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
cache-control: max-age=0, no-cache, no-store
expires: Tue, 12 Apr 2022 05:15:55 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESEKjiKhe0kf1sJUo9RzGDG3s&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 261C 23 B
172 B 124ms
45ms Image
image/gif 104.111.242.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CMr9xPwCEM2D95ADGPvfkMcBMAE&v=APEucNWkgYey_iir4l3fH0OVzOfuSJE8-73g9ITBWeCOUzdT3R5yxEd2zoJs6Q1rc9WCsiaUWr2Wq_OQh5EZHyqHxfgslLM_6PE93tvZq6YuY66w968sTyizDc3s_v4w6lKFqMGXh6qKe200zpPNz7lYcFu60au_cnaVhUSJeVX7VJjb1SLsD05mG1cIXZMlYElAS-HEMorerHZfVm40tC2PCPjG_ZojcQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.242.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-242-245.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
cache-control: max-age=0, no-cache, no-store
expires: Tue, 12 Apr 2022 05:15:55 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

GET /
google2waycm.netmng.com/cm/ Frame 9199 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9199
Redirect Chain

https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEEFuKNx4YiRMcNp1VX1Qdsk&google_cver=1&google_push=AYg5qPIEGm5n6xC_Ya1N68A8oJFoS2eb0hzQ5d_2o9vjxhVZ7PC_l4WzdpTxdRBrCVzb5ZBzrpmbFmFPPLppy2tF...
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPIEGm5n6xC_Ya1N68A8oJFoS2eb0hzQ5d_2o9vjxhVZ7PC_l4WzdpTxdRBrCVzb5ZBzrpmbFmFPPLppy2tFDASFzFmERzQ

170 B
188 B

28ms
27ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPIEGm5n6xC_Ya1N68A8oJFoS2eb0hzQ5d_2o9vjxhVZ7PC_l4WzdpTxdRBrCVzb5ZBzrpmbFmFPPLppy2tFDASFzFmERzQ

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 12 Apr 2022 05:15:55 GMT
Server: MT3 4335 2c68c00 master ord-pixel-x33 config:1.0.0
Access-Control-Allow-Origin: *
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=&google_push=AYg5qPIEGm5n6xC_Ya1N68A8oJFoS2eb0hzQ5d_2o9vjxhVZ7PC_l4WzdpTxdRBrCVzb5ZBzrpmbFmFPPLppy2tFDASFzFmERzQ
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Keep-Alive: timeout=360
Content-Length: 0
Expires: Tue, 12 Apr 2022 05:15:54 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9199
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEP2IXBDMIcfHFcJdSxbLvM4&google_cver=1&google_push=AYg5qPLf2mJhvHDkpov6RxSt90wSnyGEedYUnQoJkJxDIinGOVQQs-5OxPENZKO2mmH8cYt2g4BGH6qJ0gDFoduR...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=y6B-w8p7T7eGE3AQV_aCSA2&google_push=AYg5qPLf2mJhvHDkpov6RxSt90wSnyGEedYUnQoJkJxDIinGOVQQs-5OxPENZKO2mmH8cYt2g4BGH6qJ0gDFoduRt1Pg7KPHuBo

170 B
188 B

54ms
29ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=y6B-w8p7T7eGE3AQV_aCSA2&google_push=AYg5qPLf2mJhvHDkpov6RxSt90wSnyGEedYUnQoJkJxDIinGOVQQs-5OxPENZKO2mmH8cYt2g4BGH6qJ0gDFoduRt1Pg7KPHuBo

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 12 Apr 2022 05:15:55 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.15.12
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=y6B-w8p7T7eGE3AQV_aCSA2&google_push=AYg5qPLf2mJhvHDkpov6RxSt90wSnyGEedYUnQoJkJxDIinGOVQQs-5OxPENZKO2mmH8cYt2g4BGH6qJ0gDFoduRt1Pg7KPHuBo
x-host: tde-deliveryengine-production-6ff4b889bb-7qgvf
alt-svc: clear
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9199
Redirect Chain

https://c.eu1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_gid=CAESELaWswBhRUyJYrE6BWKQZ2c&google_cver=1&google_push=AYg5qPIllnR4TUnpVWRccUewGVqKaVT5f-FUWCyBlI4frNhvkXcEmaYnHveKR-X1wsh6i3vxO_nWx3x9pE...
https://c.eu1.dyntrk.com/adx/ga/us.php?dynk=ga2ex&google_gid=CAESELaWswBhRUyJYrE6BWKQZ2c&google_cver=1&google_push=AYg5qPIllnR4TUnpVWRccUewGVqKaVT5f-FUWCyBlI4frNhvkXcEmaYnHveKR-X1wsh6i3vxO_nWx3x9pE...
https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=AYg5qPIllnR4TUnpVWRccUewGVqKaVT5f-FUWCyBlI4frNhvkXcEmaYnHveKR-X1wsh6i3vxO_nWx3x9pEoW9Ud8cpBlwoeiSNDA&google_hm=

170 B
188 B

29ms
27ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=AYg5qPIllnR4TUnpVWRccUewGVqKaVT5f-FUWCyBlI4frNhvkXcEmaYnHveKR-X1wsh6i3vxO_nWx3x9pEoW9Ud8cpBlwoeiSNDA&google_hm=

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 12 Apr 2022 05:15:55 GMT
server: nginx
access-control-allow-origin: *
transfer-encoding: chunked
access-control-allow-methods: POST, GET, OPTIONS
p3p: CP="NOI DEV OUR BUS UNI"
location: https://cm.g.doubleclick.net/pixel?google_nid=dynadmic&google_push=AYg5qPIllnR4TUnpVWRccUewGVqKaVT5f-FUWCyBlI4frNhvkXcEmaYnHveKR-X1wsh6i3vxO_nWx3x9pEoW9Ud8cpBlwoeiSNDA&google_hm=
cache-control: no-cache
content-type: text/html; charset=UTF-8
access-control-allow-headers: Origin
keep-alive: timeout=10

GET
H3 200 dot.gif
s0.2mdn.net/ Frame 9199 43 B
65 B 55ms
26ms Image
image/gif 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESEE7nUOsog5mfbLwvY-CDQew&google_cver=1&google_push=AYg5qPK7ndxsLL8EATzrisBHaLHuUbvjVhircWh5lQ8YTUm8e98rhFDlL-YiULDqzMds4WbwG2vpAWgFR660oKzDL-wK52SCuD3L

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 13 Apr 2022 05:15:55 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9199
Redirect Chain

https://sync.srv.stackadapt.com/sync?nid=154&google_gid=CAESELYjDJ1WI-wWJCCdJYfRSF4&google_cver=1&google_push=AYg5qPJd6Am8fqe81ylIV4YEdBvBiFDDL5W-2pK_7wWOEWpac8_tGOD3dkGphBftNWZIS3OpUVEsvFnrHIS6onX...
https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=YfKULu1OSIFYq6TFiU1qRNly14U&google_push=AYg5qPJd6Am8fqe81ylIV4YEdBvBiFDDL5W-2pK_7wWOEWpac8_tGOD3dkGphBftNWZIS3OpUVEsvFnrHIS6on...

170 B
188 B

26ms
26ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=YfKULu1OSIFYq6TFiU1qRNly14U&google_push=AYg5qPJd6Am8fqe81ylIV4YEdBvBiFDDL5W-2pK_7wWOEWpac8_tGOD3dkGphBftNWZIS3OpUVEsvFnrHIS6onXvvWxLDkz0HI1o

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=stackadapt_usd&google_hm=YfKULu1OSIFYq6TFiU1qRNly14U&google_push=AYg5qPJd6Am8fqe81ylIV4YEdBvBiFDDL5W-2pK_7wWOEWpac8_tGOD3dkGphBftNWZIS3OpUVEsvFnrHIS6onXvvWxLDkz0HI1o
Date: Tue, 12 Apr 2022 05:15:55 GMT
Connection: keep-alive
Content-Length: 242
Content-Type: text/html; charset=utf-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9199
Redirect Chain

https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEM...
https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=AYg5qPL0r2KN9CGdLzY-PJddlkOzOMRV1doTxVlgTmQ9Au0ONuXmSYFp-S2hB_HI6C-qaOl9B4GHBo11_-6jHD1JEqpdOBUylMx_&redir=https%3A%2F%2Fcm.g.doubl...
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPL0r2KN9CGdLzY-PJddlkOzOMRV1doTxVlgTmQ9Au0ONuXmSYFp-S2hB_HI6C-qaOl9B4GHBo11_-6jHD1JEqpdOBUylMx_&google_hm=

170 B
188 B

27ms
25ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPL0r2KN9CGdLzY-PJddlkOzOMRV1doTxVlgTmQ9Au0ONuXmSYFp-S2hB_HI6C-qaOl9B4GHBo11_-6jHD1JEqpdOBUylMx_&google_hm=

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: Tengine
etag: OPTOUT
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=AYg5qPL0r2KN9CGdLzY-PJddlkOzOMRV1doTxVlgTmQ9Au0ONuXmSYFp-S2hB_HI6C-qaOl9B4GHBo11_-6jHD1JEqpdOBUylMx_&google_hm=
cache-control: no-store, no-cache, must-revalidate
expires: 0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame 9199 0
232 B 56ms
25ms Image
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IlSJcyUiVIptNm8xcdG4DbEdFSIxZaTTAu4JM_eK5Pyqj68g0E4LBel4sfMcfjlRXw5epV

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame F99A 106 KB
37 KB 44ms
18ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: thewaterwomanplus.com
URL: http://thewaterwomanplus.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
Origin: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 09:31:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71089
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 12 Apr 2022 09:31:06 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220406/r20110914/elements/html/ Frame F99A 8 KB
3 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220406/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BnnamT98qcFm0lVFc2CPKhaylHPlz8XlsY7JZGR2mOm_IjjC1XpOMdXO8ZN6bd-0pKGZB1qyIMTEvegQEz4KCyEsZm0QZbWoOjrkUhUN-oMam5TeD9Q3i9yS5wvjI3h4VOfuMH2wAoHbuU6R3AJwsJYL5VDg&dbm_d=AKAmf-ALta7AJkH1KVODJ1uDgKT_okCviF8idL6jjETrkMsj1UdgHOy42aE5TsTodO061LHcoBCe7FJM1RZ8xg0yOYAlhDFH-Xu2WcP-uYHWPPS_uxg2frtOe1Fh1r41Rn-Z4rgoONFWqoiitSt8jaaFn1PDjYkeJLPe4KegOhu6kYZRFDE2GmmNImH0sA5eDD3s7DDLRplqYDSGXd3JyMvQ92GqHA_qqzJsBWywBDPrFFIWtk9DfknP-L9hEDSKD_w_jzxVYmt0Uqs7MnNtc3GxDru8Hzvx0NAAsLc5_i89fDUSlY_uB616dKMXev7zygCRAoKhTHSUyOhkjlSt0OjAWHteuAYbWj3iCpKVR_LfqwHWJOicbVTo9cwcJGK9GlpRM_EcXVuYuDse72SvZQDkkqs28X0tJ-FRKxoMfpf5EbHwv6dP-KdBMG8jiU6A_5Rgzy9Z4CIBmBNgsSErU7qFgsSs-2PTMBkBx9izpfo4arL45l6RGm2QlqtWZ9RRNrVPkbzahAd2BtiOO-rvedAiuXu31Fqv3aVJku7P4IX-f6uuK3Nm0Pt9YFtS7xlO4GGRib-KyLnie8Yk1xiSNoZgfQ2vSU4E4EMjBhQ-denUH2juLRxqVTY9HA3wYiaGMJPIS1gBqeJAuoIqMaKmEM69eQDB48LYp36DAUPZordY_fodK6Oo5jhqmToHDxAyR9ttnAdOFRsOtEYKb586-Rr70_81xuTnm21QAkTJMXCrEM4wQjNAErQ29Pq7wxd5qhg8hDP8WJwsrBip-Sa1qR1va7JtTGmTyvxiK-KprmjIanu-5oJYH0fWsButigOFvVEy0_PjdgETVvFTdI67K70k0uWyAdGj2DlqFQbx7IbGXuh4Z4QFI1SlamPtdhIn9cR8EpXUoAD5qTRw8J7Rii-DR_hVjVII1HbLJlct4PjliqbfOLKc8B-bDjs7vo1vKVE1VPy4m8WDXbwM1DrL9jAj4olIe6uqcM6GvHjnTeesS7hFEKuYUJeFMU8UWZF5pdWquDp-BpiAhwMWNBd9V1urFNNFZAZ1UxsR75BrK2nLXTqmY_fGG3c6BCdXII77YuHGJoe78fQiByNGjC5LKxXs3nw8zBpmf81yCnH2e8tIhGKmBSI55TAojwPaaQFEpLnTvMRBI1-mXi2Em9P4tgXTct0ZTETb6nxfd-hn7cu9L-gK665JFf3hWs_QPLjejPFn3kUUEYyviU5VZC7qx2kCRe9_Hhhqx4RAA_0xbUiUqueaSaX66RDm3SBhvxQQI96FpCYpqe9D1CXckfzmt_CiIF_BNpUfsSKxpw1H2J4KtZYblXVfckozc-2qcfgjBbg21qI34vEuVCsa1LL0823NGNwRV60DfHbVT0_7EbNwpELYI9Nj4eXMo8soYzhDE01t-BDQDVPnmRtHM3LnZXFNVnn19shFFQUux_-nFZTQ145i1tbu4S7ds7wgC2fVs8amGkmUPEm8voOtlLKaETKObpTpY0TNti1BvSCABw8RzkWBG8nG7ylFrQlXvnppKTVmSfigNHWaHol0xsa7mCJxxhXN3XqFVz2ju74BWVcCwuL0UHCcUdDVEVlcTwwnla7dzmgKF4EF_H4V1AszmUFfYWDy3Zy67ZtRwmHfrbZb3-58DuPtj7vE1xGYSM2UwCUaKJJQqllgBzFFcqmDyF2XYEuPxKm4tC-gnB_Y-QytC8gOe4v0kD6r90-oJgsCul7GOMy5CTPfRcv1SjJWVHYuuyFrD5kqVZ_H-qjCon7NhAmCwcEajSwMpPtLmDeEdG9TMkIk99MZFUiOKe7KNBsUP9fhyVHTdSpm7deneoOYsfc2snlkeK6iWKhukF1Fvh5Iv-fgx3a4fIm2NXC-Ug2uhjYlhuRFdcZYDTz70ugB0FaKKOBFgZah7hmked64W-DYkC2vmQUmxYwtz-5zq4F9IjrO73nnteHg7Uc1kmaDirGoygaZKiM1-UTO2otndAnTZCtOCvITSQxp2r6-z7eQDO8FpWTBOctQsrPMz-i6LRmeUrwiXs-tixLXCHvgo1FGuXPjr6POgG1ShZdo9pO9Ok3FLQeT7Mui7n1uV19ERAs6OIzmjD54YeAEyY4ceMAXMfRxOwFANCRNi0BrF_NMYaN3BlNK3zlf_r4lbPB3M8ofLTxoGh7w3WTtJwd4HG_nxx2_lLZrQDzkdwt4D6RRiX5MqBWwR06-h59-15Z6D1tftB23eNJzUsgcS4GIWWjBiAeUoe3k7Rb_X2Ki0xNXNuBwL8oU8oy-SAzYnbpQMacZ-wap5CXLlLnu2wbrADEYsdd5khDApTxYoeRcV0eFP32EkfiyrkblNqXnqHpqWJVqbHsgyH-iACHeSMPtPe1UEEgyuyvS_xX32v9-8qMbxP_TYy6JjAS7DtdtBUnuufqD8BkR2DLHApmDsa7zayc4zJzP9R85dOYaHFDhsf860UeCiYcJEL-mYF_tpSVtQmStEzYwLGCFhd19jBpht9CJ1i6hvRjzqp2fSBZbFdQEa1DKvpZ5fFTHpBhpc9ZLg7HplV86WPHhE8LvAjnfTCoRhk0DuH5t72K2hQcHpxsx4ozDLuKMk1YPa-chYrofiRy8mJS3hDWrcRIAt2LJRv_t-c6hfkv_lZ0EzpF_I2lsoTBc-Fipet1M73USEy9zTd8mq3G0qmNc6wsRTaxEyTsck_Awg9Bb_TiNgvrFSo2sshPGErOkAnX5WyUqdo5RuoaK2krUBHxxcnoLwqEvSb63FBtveKv8D7ROErdh8_vWtjwGwQE3Z9c3RGgdNyis451NiefQdTgki1LEomeZ1ly2Axs9RzIyli77r8rnr0KLcyeDRQUjaw5VjIHz1Rd0mpB8Mcp8NfTFr3Uw7Xu5XVkAmmtW6oHH8CZVKg_mx8m5l8WeJfLpbmcB10DZdbi1IPbQjDtbErBBz5KRVe77odbUc4Gr1nsuK2ogbqILzdlZ7QI45tWxkHcujiBmUP3vIo4Ny4MgnCW8OI18EZmTToxz8Kxc-Hzxyux2iAZmqm9gdT-NUZlXMT7JI7Lto63zaYFTnzQM9uFZKcVxCxvRy08gDF3UZhzrpXnfbiLl41LyC4lkoXE-LmgnuKlJ83RkxCVp2bQDeyRPA2fQ3Vg-1HVHc3Sm_nFBXWIMVuiwycgd1R_P2SI6Z2WGdzQ5hzVQq7kXjHddZ_hCTQF_gcgykWWJ65tViU-f94WIjmiJ1Y49adxnfQVWZkYVqYWd5K_Uoaz6u7k1Jxk&cid=CAASJORoaROLC9VswgcmwtXnzIuJ7F485FrSMASACRt0VAwf3ucLbg&rfl=1%2Chttps%253A%252F%252Fsimcast.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:13:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 146
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Apr 2022 05:13:29 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220406/r20110914/ Frame F99A 25 KB
10 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220406/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

738b0dff97289a490e0472cca7d25e291a7ea70c850bfee1e264e9ad87a4a97b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:12:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 193
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9790
x-xss-protection: 0
server: cafe
etag: 8169034061967891973
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Apr 2022 05:12:42 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 73B9 106 KB
37 KB 23ms
21ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: thewaterwomanplus.com
URL: http://thewaterwomanplus.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
Origin: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 09:31:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 71089
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 12 Apr 2022 09:31:06 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220406/r20110914/elements/html/ Frame 73B9 8 KB
3 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220406/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-D63qFSyBUaMRv2vO7adeJ-yfUHoPaDv_8fc8iaTp5kKThJ4vao7A3nzrw3IjJHeQkECymw3_tN-qZpHERCKJemYe5Z7pCQ1tOUU1aOgsFHh8N-iQBzI75KD-xfRJw0yVZRERNuTwnDbQ1mOvtxMAR_LwVl9g&dbm_d=AKAmf-BrsOU7oD9Mhy1hQ0wcFTuxFR7DUvjb_kyCmPTwGiEJB8izgDTESWkvCvk6USaKG5q7_5HFOG5tXjmx_55MlUKncPd2oHRksGkpv1OISWhqRHThodDANHVdDRFolL7iwRE-ZXiYmsrejpZvwx3lDzCPuauZ2arUYSgsM_S0HDidb5Fr6g_ViMbXAu4gB0H_6QMy13_Xe7iXMX6copfgO1wLnZzHOpyN3PYajV6FBmelM2R19dJyrld56a0S_6ot2DEO6IvWRgVOQlo6vsrkvJJ4uvdLunoc9glm9hwBDmiL0g3kgp5-JqI07TrxbJ6QLyftRS22s5c3bjtFjYDIznZWDI6AJlEu5VK4YkvRYxPfVAX374j7U5UJSzg5b2T9XPm51OhV1DhnyK5FITRP3XOOcE04HHo8awaDEOYM9bSAJlXr478Q13YGd1XAPHpWXvEs27H9Q-DfcKibgZRmJkEP8KEC0hBZIJZzGXBjsDXBT0K-WdpMjbJOtxZDZTJIOJjev8i4wy1hhsu8jVp2trw8smojUo5RJG_xPIpTYhcP55N_VFHEEutBcpFsYewcM1JqLyAvE7NCVDh7G6rlchJITVD9FlsEu4kcFcerYNYpsKeFhf9S7fCe1R-9x2wXLEL5GJNra9vbyWxsV4frIxXpk3PP2cIw_0SMi2ALkQELhBXtlHNhTKJ_qQhKKzq4N1IdmOZCNyPxXT6Ohj8t6OuwmdWxkj9OkEK512XHKNCXWEbQnEjfUQLc89byThkJ5XigC8b6oko8cWEpS4Xvywa1ND6vOnu_PcV8JP1uxVCsmFv7o6vRHZ-qANqJanhGqE52xMzJuqXPwooMNTaEJQ8JleLikSOIR9DW90yEJQ_edYyDBp-Cb1K91shUl2h5CcmsaGftYZ7q3MDfjEBqw36ChnOgO61aPJMfyZ-6bYux7SJqVsHGbPvrBfaSWYZzATFD0ptPmOVNfJrBCBkfmHQacOdIN4hDnvtqPa4n_KxA1GqqKOuK3eDHgQ_Kwn57a5G_HttZH71w5vQUH6cJdnuRmxGlqvoZFwpROyZ_jq8Bqg_elJOqxobp4VsWgxsu3obtnT2NKhNmBW4-pBBHK5NzCrhdrFRJKCs45bPZm3rSaSFesjTCzaOgS5UCrzbtVMxVeANlHk2igqoriSbymzNc9vT1aL-1FA2dPqMZavDyz2K-SaMJgoqZZEh8m_xrF3kP-jjcb6q37LSabR4Pknmc3VTkbjnO9NNaO_ropdrV7MBda-RGd8QJ03RK7I2Bdw3OAeQVlQJvgoUyA45WN_I8Lk23w2cyh3X75AoypHLSjQzRkJdx1wvawQFuuD7yuyCkw1kK84By3xEnXIaCEUrluJMA7ZRK8g9GJ-xTWFNEeZjXEQTisSrk-y_g6r5O8O9qJX9GknacKdGcN0DVSLiWGW-tw3AAofePTPd51MzstLRRlY1vKEZMWuRzpcWAeRowR9AZ2fP7lLOr4iskRY9ESPbPcMUhwtJBiD2AmE5rrZi1qr-ILBQhvgGFCYid9-wZn8HKKDU_nN8lFlkSi6hB2a-CGcV3eNsYlFx-odyiB-WkSalTSe6zoQcd7uBVIbKeT5MGSayiGQIRZ7fSP1ad-PchdP5_7SpMfIq61YrVLwECQqbBEr3JFW2epjXXLnMEAWEM18d53clBntRfn0fCnOi79T8Rci11unCIAnES0yxuaiRrfecp86p06xGuxuUfboi3iodfgu3r2af-Tw9xwsE2ccKnqRsPu9gw0wpTm40zjm-PAL_TKU3iF7oCwm8N9sbb3Vgh9cyeST9dxdzPScfNVlNbCjE2M0mJXH2F9U39elOdzyN2kkugqzRzQPWmFY3uDqcHxkPUg_KNUMDjABSnUSQEnd56JhL8TvIweAg0SKxLv-EVHJmQB3tNE8WXPlm6z9zp0G74Z5YD8hGhdzBL6WfGeWBlI14Ce-fe3wYWlZtL_S9JnPcnt2vuqAN-m-Ms0JzsrWGDg5EBScFt485AUafW1CFbGm8o09DKGbj7qjdcFGOS0c6bHaGElP8LWiz2j3z72qbW5uvTew20s7KA3ora0Uo6ddkmt7P6SyG_KDBp1lyFiBDRZOdNAqcmlS91TUKoPFO0JUx7YBxn59nsTgN3YaM1nD8iatPnYUcPfLkRxI2UbEwAgGYmT1vvr-qSu29ZKO3WEk35K-F-FzScrj3ZlfGFNiLy3aiTzVht-I_v5MtlAeQy2yPLCjKbDPpyGU_lp9dAl7Mh7YSGCX01xhrFbEIzNNdL74Q56IfpRF6pz3D8FlF_0Ftmo0uAoEzXcW2b6iRZwXLPM0VWNdZsd-vo_B0kjaxTIirT07Mxgh1-PR9INwLl2A30ufkzn-0EQSGZreoDEUg_3iCM6XuvrSuq5k_KVPtEpnJfBd70Ctf2O4dAUMwP7seDDqK2-374VSXzBf51cWKDUbpKKsZB2DuMT8e270gBEToF6QIYxWFG6n59-PkgwacwcIu-u5YyFLWh3CveRCHAWE3xC6po0YM5FFUenwTnXImcwPJTmsDkUfxaaOILmacwnojYzlE5t22dJ1CE75qiIDWwX1wv7FQ9AXUOnoHkxqHpc2L2dmmnzeyK69KsIOxpbIReW4a_wkwUC1IRP7t-szos6JoMJHT4aAoST86CqctWoBBsO8Ub8yzt6HQoiJE40987xQgqSStTQaNv0ulZQbVc2DGdengUaYwvQ77bhif6L2krE0DYzqc44weeUuhwvojJcSQNh3uRdWPEx-JptSugGr6cBJdpBpXIz8WIXMQ3EsLaofuwQYVbfscTjewypigmb3XqmAkzwe4eVrAnLKg5KiK8KF_ccYrmppolgBqHyidXgCylpbm-W4n8zTc0-2mmj9QVPHUNYu4LCoWyzQGhAJmxj6AibfZ-jCfHP60qUj1P_0YcbJH4dzj9U2UnyZXYYpagWO-cvDWUm9JbLL_ZHbTU6Gt_mdc9yDcCFYIM7IAv6o4fdqEDaaSaDzdU9R7CKR2gUcY7aluataa403XF9QcZpZkOW2Lytfwd3mXEeWhT2-qHjMTRdaqI7Renob6TO1pfpqgLIPOUWDk5UkCIlw6176PkDnbZN3xEyMj5i5PwoJ9LALcZBk-5SR9V5z9auGR4QvuZoAF8TXyGUzuYe1aat2EbVaxs7crnmcFU-XXKCebjKkAGYsUJ9lLHDdBjsQXkLB1iKqCWA_0aYfjcbon9pwwRxqSrekJVi2UVEfMhl3Y&cid=CAASJORoui0INwtkAbY8JhQNewo5BqiJW82BEDNbtyqyolEJ59YtXA&rfl=1%2Chttps%253A%252F%252Fsimcast.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:13:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 146
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Apr 2022 05:13:29 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220406/r20110914/ Frame 73B9 25 KB
10 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220406/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

738b0dff97289a490e0472cca7d25e291a7ea70c850bfee1e264e9ad87a4a97b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:12:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 193
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9790
x-xss-protection: 0
server: cafe
etag: 8169034061967891973
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Apr 2022 05:12:42 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220406/r20110914/ Frame C80F 25 KB
10 KB 21ms
19ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220406/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-CXwWvqWQto-W2WMaT8ycoM9MArsEl_C43DmMCCubLDz07opa0CWHoDdHgDBYwFB3x-ggxSVkCZs-k1-jKXK-nDyX3Muw&cry=1&dbm_d=AKAmf-B4yR4DhUC_qe2mZ8MkBanKq4REv8Pcgus7F1Elgxc4L0Z4KH4jcN1VmrOXC8gMi8IFXLHrEOtoJn9xeawzTaVq2OAUUy0XLVX3S904CDRu3vXyQW7P4XirqTDdOVgmjI86OXQIbmcXoOX_xGb3hpGsjxLk6izX-mFCFYUNLBENA0K2EZqqGCAD5KxwnErwaeCQsl_SLlr8uYkmcD2vYlj8JF7-OH7hbsc8FOdNDWB13vv1C2Dvu17upeOuBWhqy5gVxENR5cXKv8hCJwmz2QzOPp8v4fIsbeLtgXIVkwA_NAAYDIy5ftdWaqcMj6fAzbr7r8wSKGcWEuZWW6Loa_rlOT4LmuKBletzzisw6H0eyONyRq3qj5Ku1H8CLnnANGzHVQR0VJ1CZqO91pnExMtNe_sFJDiXq65vJWJ2GWPvITGmHt8T03CljPxlsc52JbFcGlPtGgxh1aReKQlphFcpGoJwCnc7dg-_FLP6LbgIbgyGdXy2DaXA579u-3c69C_Rs5lsNseWoixfuMTqgtYtPQK8gb5uLS2fHEG3HhCRw1yNkgLbRrxVpkKhtJ7XU-zaxPTUuqQfgn8NknnZ8G6gF-diPCJw4RRuiR99M1tReMDMQDcYthyrcQgUYhAOKPlSNO7uG5mn_4VR4IjIg59_G7MR8yOV70LPtslOnV-aCvx0sv91nEOMnwho5nCNPocZBjVqSwmkIs4ZRM8axgijGOwbb_XgZGGjSG9uZVxJ7soYDsryek7lkiF8_e-JLGESc36gOZ_5Badd7fCgKdPM8t1VwB7spOHQyXqd2ZkrmXIH5sXVMQ7HpQXFI-Pq4xaJ0y34Gm9MwnpdVpJ3Mpm7VieQSeH4GceZwauLfmuvkLVjtsl-c-3vh95yPQUV-MfSj5rW0FWBFxE38Rm1l1z2qvBFYsmQEEqiWwH0s1qTj7fqjS36fSWNgw25xVyo0tQ7icAyjhz6vndEq0snROVelNiySp_g3AI27x-wehzDoytQRDmex5bG1TDDf42pl1iP-JAa2u44J4Vdxa-teRh-ceC30i3mTvWAPD51dQGJca_mtlWlFdR3RxOu4GapZMYQD7rjzYIprSxQ2xILY-pL-bQWKpkxiN62mPmg2UjD6qRNKbqaQ7B3ZXHoeo0_TWxDVHl-6-M3m9yYByvMrf0CHFFDd6A08BB-YF6avUf5fTCsvdsAXSfkxZWR1gLmfg8o_A4qU4uLf4oXbCF3Nc34UipOkgwCvZLzZQ5KdZHIhTs26siHALucPtCOgFMeoR9KtSNkxxc1KixllWQBioQM1bk8l2cI-kDHjGh854pC_lqZvW3ie1Dps0GsgfcASoYXYLx5uCKz9J8ROzHknMbskL7G4lSRGfif-yjUmNE4m7w6wxgZttp_HlS7C3j13wknDx1WoDq_xujkJj8c73gk9PfuWwIk-3CSz3C4cTUkLhya6CfTw7lSOStjk-rro5teEjHpSxmG0owvGY-51ubI8l4qJNtdvgINmH8mV1Li9gNDvKZIZZntB6ttHb-6J7b-s4lDxMAcWf5yNnpb4s4pPcPlzmxe90uzlTD944N96DwuFaeEejr58Cn73w-lg8K18Q7epkXr7h5Fo_3bDs5WvyoxqfejoBMZ3P20bNjTpSUCU4pyXdTspAd37KkHzeh3rfro_5KHL6Cb6WsBMT2h7S3SokGEq4OfFUmY_Z0qPCJSXQw6kaziO3LxyMdx6kjfD9AplMqmf4tl7Cw7EP2Z3ui5K9_HHFZKz2plxDr9TpT2oveUKn6HdK9Y1wJVXfdAE3fgilo1y-HkRqG-phO9LdkuhrkQj82TVfbmwKzM6cuzm5VfvpYLwUZE5Lp5TeJvtN-vxNBCvpTCvw_xhyDfgBwUnud7eCMRzSUJFBJ9JvdufwHwXYM5N6vy4fEEnFbWSwZMU_HATXIwBNk68e661TLS-nHfHMAyGQ4zKmQELJskO2nNQAYS-A4o_k8jdM-Mih1nJR1VigN5KMY95p-0R6w9OSRZSc8MShE-uLiDXp8i8XtFwBKHsIJtKcVv-n66UGlbv7HU1fBxq45Vd3q6fM1antlM-GEdlgjrgu3aiSfqAvxzROnYrnXL27S4U-fWr0fqth0vOW6dNzK4Y4Fx1cHST0KTNXJnqORydQFvqHYUwLG3VUqcvbVXfniWMCeoKZ_aZqpivGP8JuDMyGu_RJaizG_ihLHzzJEa5nwWz-fuUp1Xiqe5BNfgyHT93715Ki-jUAZxMpnilVhR3iv4BV3kj5riDDsyFgebBn6qWXktmCoFjjEKWd15-FFuX60euBUVEixrY6SJKjB1GkBxw87eLf-jGZBqPkRwb-PdM4WbJE8AuzxJDKmlH3avzdjJd8986RLe5v48jdfJowVqLSrhtdRycNk5U4Kw15TJxOyjzHDu32Z9YngnYez8a6EOHSx1IKTGNWADMTz__rpU_rY0gxDlLp4qsaGymgEAKHLF8WSuwG7iA1OJNkllOpkV8p4xleNLGJcWro4P24NUJfZ-5GxT53GL298yBCgJhuX1rGNlky9JEpEYvCtq6GKXVWMb0ASw7ZRwbcUgnLUBQLpFpAkpCEfi1eky_3WS7_Aa6wwf7H6HcYxfKZhhIViiwrZzge7GBpIMWWT37K3oHs9JwmT1j2jyHfNJZ_QiVjJz-AtLTyXI1ZAmKMdQgYQPHYE6_enWbo8LzPpcQiCtZwSEkNFYM99zzUzCIr1IO2Ezg9c36qhmJmnZ2EjRW5VlipHn8yWT_9bjRTtb8xaHYc9E7xqDO7n7Zg4fTA0a_5gMK5dfNf1mygOMTVU9JwpqIQndzzAu8qLz7LasIa0O9O0bKcwj4UE3Bq8CNblnwpWxcvRUrlggxw-Q3hFBCYnKFy3HzCIU3gn6JZ_TjTUUc6Mx5sYXC3ia-J9O2cZHcOK2ZylX3ir3K1ywdoo0iGYGPyb1ZjZS5Ex9EYto3ZozR_NR96HQ0TAGMmO2bRRyWZX-PT61BSNa7WcqA1hNq_0qClEXypipTYydOCzwJdgvNowSho1fZ8y0PkqkMdGCpTk7ehMbuPwyr1b2LlJpX9ZVwn6zFmiMED22JZdq0aaxPyr0Lluzk3SQO52YjEMQLIY-q8J-VM9NqaXFEN4UYGcp86grh5CiGkRVB5Ob9NB_663nQJlR-3vgL7E8sUhPOYsRuyaDiXK3ZjnkuxaxKkXEuZ3n&cid=CAASJORoQT88WRT0sY5qg-1Y8_j7GCUpciAyyV4mzbfCffwR5TTdCQ&rfl=1%2Chttps%253A%252F%252Fsimcast.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

738b0dff97289a490e0472cca7d25e291a7ea70c850bfee1e264e9ad87a4a97b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:12:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 193
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9790
x-xss-protection: 0
server: cafe
etag: 8169034061967891973
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Apr 2022 05:12:42 GMT

GET
H3 200 1148971295797792987
s0.2mdn.net/simgad/ Frame C80F 28 KB
29 KB 27ms
25ms Image
image/jpeg 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/simgad/1148971295797792987

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7df00e008881bdfd11808ae1b2699f7b84b45836fe2788b69763203d94356a7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 14:05:12 GMT
x-content-type-options: nosniff
age: 54643
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29160
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 16:26:32 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 11 Apr 2023 14:05:12 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220406/r20110914/elements/html/ Frame C80F 8 KB
3 KB 28ms
24ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220406/r20110914/elements/html/omrhp.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:13:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 146
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 26 Apr 2022 05:13:29 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame C80F 0
27 B 78ms
50ms Ping
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstC2bNTfGhku7NN6t1kqFz1_w0Yf1Pi-sfXPXV2bUNauMfw2xerip5leJtlcJV1kfZmqZ9mvw5GG7WDiv3WwsMjn9zav4beNsIYKU1yt5Ez5PZVAfeK9odECGgwk6lmRlbNga4FcTOTBKXBs9tT6VsFeQ59e58HSlWAz9PloC_4d-dkiWdI_IFvMol280ud3dTLoaJ2qQStt0nd5uUONBvHRDXRrYBSgJk6vJRhJuU2fkvX10uKPZ5IC67og_Q1zi3RkmfgpJk2Ru9588yfbBcMBqLfa8AIbFX0TNu79qfgaLT-jwPcZonNqE_xmOd9ubfrMnRiCvOxYWHesS4cWHWM5NcRI6MOVaHrRmfKdNYxdkMv0hAP8Ezo8LOgDIHv1z1Go6v8rqj2tfdsDKlirQ6N1EOSzMVafRkqHqrRRsH7IQkuTbpY-QIGe2kDCphOMVeIig7JKjNqOs--ANeU4WWgGT5y2-dBadDsXI1t8H5fBuRXYWQlmf_lSMfewnzJO5USTIExGxyz3U1MTxdanHhDMrhEOvKdx1zDJfMJ81dTQWhL1TWa-2rtkFUKhuD9fjlEM3Rngi1CQmHUKfTR7zFIRXFpCfL5c0UIJM8h-98SoGOMTmlIoze8YFTngYL15WOZUzCVdgVOIiWzjqeg0TfQ1M_5fLBC7sy_MwcJlfR5V1ACszyMX_shs0wRDjqqE7h1I05xgZY3zsYKlSVVYxn01abOM2p3bFbiPU2SVYZG6QKkH1WGulTgL5BiRBRfbnAKPARsNdWyWewAJszG3AxiqBe3trxUSIvnzEzznQDf2AHr93wVQg6SX3TiPbbu-EpvrR1sy3WsN5LX1u0PqhW604lBuAUgubry0YBUjkv2Le7RKI5VI89L_-dBuULv3P1Dw84lFhb8wf0tuh2YsigPTodVyRFGIh5rUu0vugipE194HWq4QYVrLu7VRp2JIZdgbaR8awPwJA_mSt7pcbq6Z-hExvI5F3-3dxDnkk3_PRJEMW6Bg7a8VT_lUIs6h4gF_M5f9v10niSV1hiXKBNymrvgechVFMJ8H6jjijp-r1MrcPJWw7TZ0wDEDcrheqoYwCPYaQHupDWUB6hImFQEWS3b8HXr01p05OahKk_ZqMhmmE6GHyXCdfLdL3a7mvx-hWw9JZ_3CHhfGkhR9M9bVswAl-p-o6Nln0PHfWXWg_Kjmhx6DqkhvdqBiiEMn0rAYvIZI1XLo2qbVyzQFWsaSOa-D9LdwIF-IcerXIE&sai=AMfl-YRRnvnAzzVcZqxxS2NGT3BUpASdc9Y3mtd1XjpncN3PfD6CQsYjmJs8IHZlzA8JgUzefQhMdsN-M7W-ViT4LO56AqlqDQUqaz5dAr9dDJlvhozXEUqIm8QrKGIc2X7nh0CXg-Jl9kALt2HE0mo4T0PwDRUQSgq3zfyYD5azctf71P4OmKtpYXLDM7ihWaKe_oGQjzRWm-XTVkBWY2tDvg&sig=Cg0ArKJSzCBy4qz9meTzEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=1&cbvp=1&cstd=0&cisv=r20220406.85496&adurl=

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Tue, 12 Apr 2022 05:15:55 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame C80F 41 KB
15 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 13:55:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 55245
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 11 Apr 2023 13:55:10 GMT

GET
DATA 200
OK truncated
/ Frame 17B1 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ab07f851c8416020f8a89329ef5e104f2d67ea29fcdbd925538c79e49af362ee

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 5AE6 2 KB
1 KB 85ms
27ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YlULCgAHp88Kd5-WAA978VLGWkASddHnjJEspA&u=%7CoooCoySMqr8XkHmxgSGJBhJC%2BhJ%2BVo8fyofSW869N10%3D%7C&c1=zhOks3zwNR2QJkrtGpxDD0z6RaFAlAQ66URtX1gfQsB7PXt8PBrVICWZYsqhnD-SWAkU5iipPPFKTJzI_AQkQ4fZ8EuCdGwrJbjQdVUL0ZnR3o8Uu7xwMxs2tYvkEsU0O7DgiYDxUzGOhlscQhbmVE9-gqc6sNwtaEVwqMBQEvpH4VLMCfsWuJ_YJwlIGjykqyiqQr7OZDCc_TwMKAuCh5XkSf5t9Ff8J_5HKM_NTFnAda8Dptz_AJ8EGunWancSdHNXwuRHWf6WcARhLAhrMdONVG8SUgRPe-LVbsPmyf-DjHEX0zJWOl03MUPyzaR_n6Ik0rhdEjXxBGn3tcocAqDJQTOoCnt8I2LOzjjUVcY6QDTEWzZ3_IEoTYxTvnlB5iFc6xfdm3ONT8jGvSMWxF7RVpVaIs9iQmFvxU6YXu1swcJLfDGzfOqf0-OFUGI1K1KWKu3S19jjKV4krWa05g&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCARzMCgtVYs_PHpa_3gPx972oDcme0rFc1Z2R93DAjbcBEAEgAGCVgoCAlAeCARdjYS1wdWItMTA2Mjk3Mjg2MTU1MzMwM6AB1bbS6gPIAQmpAv5aNDN1PbI-4AIAqAMBqgSiAk_QeDpX1LBOq39EAhWaPgaMXzMtYVSw58j3a71UbEd7Ih8YPvHJLzz2Kn7-Rt1MT40NFBnZEeSMOA3oRk7a9fssxvIPDoG_H304sSZw9zhFNXShtmDRGz0ZGFJVy0yd-bApoTJMAlbWDkmmzKiT220RMHWGZNRF4cd_ybOwXZxPkPBtGm-YbcsHnwF4UeoUALW3xwd_Gisyc6RdxhcQHFf8vaXLJ1DfydGlhyLjhlxZV3Jc9iWgWoCzAyVAoQ1g6PGOotOxdG1q2r3y9Q9rARgSHypwOG6kXZYF8xiAlPpn-py5DCzkTgNp6nLEa5CZO8Rg2YAWzN7VSf-TWjiuWnbbSb45mTOcOU0FWq5VJYVt3r83YP1JU2Hb4NVn9wQxNPRx4AQBgAayvfC81qy2xF6gBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3jIC28ei-VTWIWFmZPkmkqRtrcTw%26client%3Dca-pub-1062972861553303%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 07 Apr 2023 05:15:55 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 5AE6 2 KB
1 KB 90ms
31ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 07 Apr 2023 05:15:55 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 5AE6 308 B
636 B 73ms
31ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Fri, 07 Apr 2023 05:15:55 GMT

GET
H2 200 back_button.svg
static.criteo.net/flash/icon/ Frame 5AE6 507 B
835 B 70ms
28ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8f9a7962cf58f27b89c0627d094ee1b631ec118675f9eae1dc06031353360422

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
last-modified: Thu, 01 Apr 2021 14:03:13 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "6065d2a1-1fb"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 507
expires: Fri, 07 Apr 2023 05:15:55 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/m/delivery/ Frame 5AE6 43 B
348 B 107ms
32ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/m/delivery/lg.php?cppv=3&cpp=jILCNhqWWNuguC0czQLQn84vFk3FNuHElqPpvUuAevRiVtcNQ32J0SxrjUFo3RTuOtb1UV6CCOaN0s7GN_WiCxMLw2qQAjszcNlyKXiwfRogD7d_5bEAInUZNGBKv5wZg9TKHgO4n1sNuEeta_F48mwpNJ3L9ZKkpBVyYIrgdx6DVSckyypNqG3zEdafBqKCYS4_6tVPbuj8v6csI_208Y78TQhAL8YpSPyer8UXXvZUTr2O5bg88aNyE8NUsvDI5zEStLN6skU1Vy5LlCpQYjuLJxyuUGtsiQrabEuAGqJspLbrRjaFykKFCu2hTfqMK7ZB4D15n3wu1P5tJrpsXfV6Ku2aaRJe94Bzp5Hrj6ionHDs51mng7R8otMFAPBzOxVxAZJHgyPRZIcYEr3OX6FUH-EGZjgt-hwi7YcuEpRthppxCr3IFk2S5wdzqll9xvwGFQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:53 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2272749
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame C80F 0
26 B 44ms
44ms Ping
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 12 Apr 2022 05:15:55 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 714A 8 KB
3 KB 20ms
19ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c955b03f3c0bab4ac70836d576a425ca53f96ffd1d3485c2b873ae26c1366f98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 593342
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2851
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Apr 2022 08:26:53 GMT
expires: Wed, 05 Apr 2023 08:26:53 GMT
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame F99A 0
27 B 49ms
49ms Ping
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstJ8KlePDfZ5TTB2HV1VVo7_OGWciux0CzZPhQKoeBZk9hhRLpOt7jW2f_ep25KOgcMkTzOheLX5hkeA9zl-2MED-37tvaLf2G24EtJhSiMWSyoFQ8PTkA5s-Pa1bGCXdCLslY3Z7XBQo3aOSN04nc-nkuKMXX1eFDK4LJHoAzSfBSmsS9XXzrLVXbxMJ1azZliNhpFywzjtHVV-bABYD-0hbn7kaxu7grkMpIOAh8VA54W7P71jSRKxRrPtKZQ1Gj0Ws82vnMLwO_lMykL9L1xEuXjSu6Ecw8rMykZPMo4VCDJIEXQMVO8UxvunuscHBZOYlBMke_0KFkZG1Nk-M-hzDsUzUtQus7Fmoa28O4wHK4K1Z2vDFWWgYDodSgkiJGxCPcS9CJwu-SdSRrISOL_-_83XoTvr3cJbGUrSb1_T2VkZqpEKuvS6k_XaMoF1zmB93SGSeMRMyDnr4OxkSC-LXDFzo_IWQtM4N-yv8XtoqFAOuJ1o6_yecCdR8KUBPsG8kccIae2M02iTdW3cD8AMbr0E1SjqU_l29tbrUg9AbgEu0GyBjlZmIYhGFG_plt-DZwFgc7TXJYYr9upE9DHcMXgYfbEOmptSEBSvpQF1rtpquKFOqGsxLElzO8y_6TK15146_mc91Fyo6Z5zvhB45hd519aVbkZH0EnIsQzHstJCGjkFlj481mX8uV2yt7qcKaVPlWoygj2YxkOiy_n1tH47Tmvn_QyTZ6NuMeKTHCbkNAbn9gFEnjO-ong50--oYMZGDjS0PMxusFY-iDgOFq48V3pgSQXoQKQ_e4jiryJg5IaArcsvkk5Vz1KI174JahFHDvBe3WjgDB8qMHQUHqunni5846vNSLQ7ffW_a84smUXyB0ZXDpWqp5T-bV68iRxYHOkqHKgT8idUyaKIw-1Krd1J9Bz3-OjhY3oL5gAWjz59MuaF1QQvKIFyZ8R0e2sCCY94m3camBbfNkZOGFOHXxLojbm2m8QN7EQY2LA9uN-oXQVtSTCCKlR3NvhY7b_9imI3b4MgvscpQAhYeSAC3GAFYGdsrKak-KiVZtOMVzYhn4JHTYcCc2f6-cr3MKzfayiYBxVuPW_au9Qc5BJmPH8tB9KzwZZIPjoTPmXjrfDyWYuTAI8yefmAGvB-pemAjaB47vyu0zRNYVrsoxyzcUOKLKzdMBAykfP2hTPOaqGVCA7yET7BZAzoy6a-XzipppA2BabFAk74MPBxpPIgorR3adfuU3aTr9LoEtHRU3xoiO7j4qDS09YW96TyHTvoNM&sai=AMfl-YQB-UuXgyflQQPHZAiElGsXjVwemuAcVhn1Me1hzrmamguZ8UrpL2_cx7fZ-M8UuXwoNgHVwJ0ETWlutgLPj-pWkxPACzlnycLmteCJ-aeIO7BlNdGu7XHoGS2Ed_03iebix95HtEW1Z9WG1giKdUiq3dZyFacRN7yvdh8tG0MK1LsvvQy-2lPXqcFQtAbBQY_ApVBP2adjOmVR5uK-TQ&sig=Cg0ArKJSzCJvVcPLMtIdEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=142&cbvp=1&cstd=140&cisv=r20220406.16498&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=

Requested by

Host: thewaterwomanplus.com
URL: http://thewaterwomanplus.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Tue, 12 Apr 2022 05:15:55 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame F99A 41 KB
15 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 13:55:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 55245
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 11 Apr 2023 13:55:10 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 1170 1 KB
749 B 19ms
18ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 84131
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 11 Apr 2022 05:53:44 GMT
etag: 48472445140208031
expires: Tue, 12 Apr 2022 05:53:44 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame D6BC 1 KB
749 B 18ms
18ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 84131
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 11 Apr 2022 05:53:44 GMT
etag: 48472445140208031
expires: Tue, 12 Apr 2022 05:53:44 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame F99A 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 955a9bf7690f947417c3107967446c11d16517e380598f9c13b8d53e13991c52

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame C80F 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5dc70d60585918b30c90a549e57bdcf405405f3d675271298c64724650108167

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 4A92 8 KB
3 KB 19ms
18ms Document
text/html 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c955b03f3c0bab4ac70836d576a425ca53f96ffd1d3485c2b873ae26c1366f98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 593342
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2851
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 05 Apr 2022 08:26:53 GMT
expires: Wed, 05 Apr 2023 08:26:53 GMT
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 73B9 0
27 B 50ms
49ms Ping
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvHRe7U8m5gJc8ZPbU6-GQgk_uySYKhuggcx1qLWJCC6djIQMigEJd_p4cQi8soRgjyZshgxRFkpF_LB5UEd53ugrlStc8CLLS9rhdtz57AkFJxehsHqmL-zsOPMEN82gKPwXZfzkyUhry_aYKkLL5mGQjh3Us0wa4UFjq6nOiZOeq3SLKednyZI1jdLvaQwS1D1-5LG2ABb0Dane14fXiIxdwQVCenjNxRA3LWyYGyDtTqY_JkbQf4JaV8P9ZzBhAxPqJhkVcTE_iGr1NmVSurVJoCWnGYMpPr2FnO386t4XCdpWfiUMabYdei8uFmLzf2j4QwqttL8IoDEy8CN5ZFPtzrFb1AtL9rjmCbUTo3NeUHGZRxZ46jZ9aVpxZmYymNzCUGS4Vu7Nhpxc40FBhtAUTR3X8elwqni3ikMdya05CE18m67JmpH10bFaEj3sIw_2bdy2mP0Fe7W1kWlJbymmUhrdsGfsR2s2GpItoQy87GajkmI7mrNaOgwGTVE_RRn0jujgMazzrv8V_GNDZljQCSzhqEijGyXxTr9VCgV0hPDNNSXlQEy1qnWLGAqS6ueVZ-DvK6Ze_C7XxF9r9cvCIK94v8IUqnLf9w9eRIonAxXPFZTLU7jWf1ppanTzJSJ5imbi22dRW90MwB2Gw89Kq1QwhCl6OHIPi1DorBFGldsJ6DSVhL6brGirzXTU6CQgGvbFuFPq5Xt1hK1xC7sU7qXmG-UsWpVgMpVOHEaTy5p0EDNMEZnD77WHFQyCJKYENdBR634WYMQy1sdfuvc1YlMuT7OmKUlNxSJh8Z-uXOJAdy0McAu-hpPDlBdwBecGCdVcMZLY-Ts8cQmF_P3HGBC_qo37tUMgkeMo0gbE0d_-ZWMUp7YKf7I2UsSLsdJqaWSGoA3-BqrZOzl2z9HQEsufjTsyaUnbiOhOiZwdItP_3dQ2I8kYLnPFYHUYFIfTtzV0Q7kt8LtYONOEoSLwiSQZ8rPKKfjhJLEey898l-u9O2OQQ_EE4QdY2d2zjYIfFyDT8Jluj0Aqcug913evO-RV9KfI-sgn_RE_9g5DB7-jD7JaVDtjTj1gxfQxCRNKJXPA1a7MWxt47rzf2DOB_LFSOpiCd33EedWy9axCKbCWfXrus8F0C4GKRniI61Imuhq8h1ZK92kCdIcBzN-Pa1IseySNeCGbi8M2tfLts0autfo2Njq3Nmw9qEuipF-daiKt_DpwbBaHOSFQVWPp0MEClHQCnB-nd_J_6dNgGPE9NP_vtufnPM4L2qs1s9r8JVvLAtFkxD&sai=AMfl-YTYQC73pEUJQrJ4AVSonNP-QHwVPBKp5t-BDyCv2LUx7ff0HrKGvVYGcJsOS_TpoPsJmx1-Y_7ow7AAYFTbb38yK-VHFXwEOk3O67twKTf6zSlCh4vFBqQTmsalDo1Kua4i9i153IxOiPTP9BtSS7BbmNJohADp4QPWiv-LRJwNXymciYnQKWnN9Ekl9X3K8fdsoegif_hdQYhjTel9Yg&sig=Cg0ArKJSzP2z213krDipEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=152&cbvp=1&cstd=150&cisv=r20220406.89838&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=

Requested by

Host: thewaterwomanplus.com
URL: http://thewaterwomanplus.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Tue, 12 Apr 2022 05:15:55 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 5AE6 12 KB
5 KB 31ms
31ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 91095
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4420
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UclIR7qAtY%2F6cBS8Z8ZK12t6xDCXyMlk7NiUqDsSif09RRkfuViAcp1yeWF1M%2FbFQOsaWMvafAwnk%2FBjMYXZX7vniuweVUUuKUyaADyq386XcJCJEiHaapl4W6zrI%2Bo6XtIrlS87LiyxE99Vvv0y6xQm"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6fa97ca71e299b9a-FRA
expires: Sun, 02 Apr 2023 05:15:55 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 5AE6 12 KB
6 KB 28ms
28ms Script
text/javascript 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 07 Apr 2023 05:15:55 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 5AE6 22 KB
23 KB 116ms
50ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?m=0&partner=37056&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F71884%2F210503%2Fbadd208e1ed6411693f9d386d7e56e4c_bett1_1200x628_display_01.jpg&v=3&s=YEj1DQWmbsrIehlpwOzfnDRE

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

846bd48d42ee1faacae0f2735f4493c9e90134f170239ac8fb1c860d4d7b7528

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29483320
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 23006
expires: Sun, 19 Mar 2023 11:04:36 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 5AE6 23 KB
23 KB 128ms
61ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?m=0&partner=37056&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F71884%2F210503%2F7e4b707f678a4abb8054b847999ee8c6_bett1_1200x628_display_02.jpg&v=3&s=ifP7q8ln3ghpl9nQWGEsYhVw

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

ef3880edc009cb91f2ef4d668cae69cf9e0852b40c70b02255a0a30883fafdd5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:54 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29520314
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 23486
expires: Sun, 19 Mar 2023 21:21:09 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 5AE6 46 KB
46 KB 144ms
78ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?m=0&partner=37056&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F71884%2F210503%2Fa75af13e26a34f20a67613a8d0116415_bett1_1200x628_display_03.jpg&v=3&s=AKFRJBw2M85_FTLESvsmWuvu

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

6df4a2c33f4cbeee0d0a06fb302c628c7f90c6c2d44c4a0b3456a3af5cb88939

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:54 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29488400
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 46630
expires: Sun, 19 Mar 2023 12:29:15 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 5AE6 27 KB
28 KB 175ms
110ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?m=0&partner=37056&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F71884%2F210503%2F6ff29f90f3c5422bae923bca83820c71_bett1_1200x628_display_04.jpg&v=3&s=vStZc4CosctJS1O5FR-oeCsc

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

a1362bbc415d44c1fd8d62e34afc009ed1f6b95aa44129c68e93e956d1ed0147

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:54 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29563720
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 27982
expires: Mon, 20 Mar 2023 09:24:35 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 5AE6 15 KB
16 KB 182ms
116ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?m=0&partner=37056&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F71884%2F210503%2F4975c3bdf5d44c51a752f4f57603501f_bett1_1200x628_display_05.jpg&v=3&s=r_CtwtXLPCCYJAll7Tb8nn9c

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

3e5307f211f6fd312c7150ed99232ad5c242927069012926f78c56ee84e26671

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:54 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29510358
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 15618
expires: Sun, 19 Mar 2023 18:35:14 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 5AE6 20 KB
20 KB 166ms
100ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?m=0&partner=37056&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F71884%2F210503%2F15e9fcd6de2a4bf2acc37db157a32c40_bett1_1200x628_display_07.jpg&v=3&s=zqnbbyGcuc_OhApBMFX8ku51

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

1c37b2235910c9309da43b4549f3288359d638bb651d5163d2e127c46a90e4a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:54 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29493240
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 20152
expires: Sun, 19 Mar 2023 13:49:55 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 5AE6 21 KB
22 KB 79ms
78ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?m=0&partner=37056&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F71884%2F210503%2F56ef295e4e604f9f888936ecbb10b8a9_bett1_1200x628_display_06.jpg&v=3&s=nsS6akLr26L5IthoyEltNidm

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

db4f4828d13f4997e816c063f0612af818922a54b7e1ab35f46dac8ce62a9d93

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:54 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29867610
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 21844
expires: Thu, 23 Mar 2023 21:49:25 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 5AE6 18 KB
18 KB 79ms
77ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?m=0&partner=37056&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F71884%2F210503%2F5c09d7986aac48c4be618e5ae406660f_bett1_1200x628_display_08.jpg&v=3&s=heFyPB-QXYmrTddIwD1TeMd5

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

7095c68481c6ccc000179fdb970462c4085c8af4e3080d6216d737d489e5f3b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29468135
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 18414
expires: Sun, 19 Mar 2023 06:51:30 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 5AE6 40 KB
41 KB 86ms
85ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=496&m=0&partner=37056&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F37056%2F210512%2Fb4368c5d2e8040308e267cdb5a1ec0ee_logo_de_1200x1200.png&v=3&w=1936&s=UfS3HKQvq00d2m_rQUcwEPwe

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

12ce6f0dbf4f3c5e13e975e2028c6a9a644e2170b0e408191753f99e24d2c212

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:54 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=28936749
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 41282
expires: Mon, 13 Mar 2023 03:15:04 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 5AE6 0
128 B 103ms
31ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=45vV1g4I9gU4nhACA9vjBPDK2bcjd2NSOm41hqoRWeZrivWKdyws5O1K-AMO7H3eizeAuUft98Xb1lbXZ-vy1LS1bpx8nvMRJvvLuPGOQfv22DAOdR4ksD510h13j7XUNkj1KRzGlrnD_Sv6zsjTy2AI6w-jyN4v2kl93B-2hK9l_fuio7T0k5MnoullV8BN3GI34ymfShgm3kphn4IpLMhiAk-aOXtnwx5-_PxeG2tAFDAwKfjDy8cWhbCw3xM6gO92Aw&sds=2&rev=81123&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 12 Apr 2022 05:15:55 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 5AE6 2 KB
1 KB 27ms
26ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 07 Apr 2023 05:15:55 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 5AE6 2 KB
1 KB 29ms
29ms Image
image/svg+xml 2a02:2638::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 07 Apr 2023 05:15:55 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 73B9 41 KB
15 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 13:55:10 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 55245
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 11 Apr 2023 13:55:10 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 6B31 1 KB
749 B 20ms
19ms Document
text/html 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 84131
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Mon, 11 Apr 2022 05:53:44 GMT
etag: 48472445140208031
expires: Tue, 12 Apr 2022 05:53:44 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 73B9 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e8e4b763bca8b8817c5df61128ea190b16cf53e6902652ed37f0749bdad6d19f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame F5BA 22 KB
8 KB 19ms
18ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 55245
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 11 Apr 2022 13:55:10 GMT
expires: Tue, 11 Apr 2023 13:55:10 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 714A 236 KB
63 KB 28ms
27ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 12 Apr 2022 05:15:55 GMT

GET
H3 200 TEF_o2Business_22-03_DigitalPhone_300x250.js Show response
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 714A 29 KB
5 KB 20ms
20ms Script
application/x-javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/TEF_o2Business_22-03_DigitalPhone_300x250.js?1648630454057

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3a836b6682459d0345db14efc03d72e6f7619ae016339eb09f8757798dcb939b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5359
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 4A92 236 KB
63 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 12 Apr 2022 05:15:55 GMT

GET
H3 200 TEF_o2Business_22-03_DigitalPhone_300x250.js Show response
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 4A92 29 KB
5 KB 26ms
25ms Script
application/x-javascript 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/TEF_o2Business_22-03_DigitalPhone_300x250.js?1648630454057

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3a836b6682459d0345db14efc03d72e6f7619ae016339eb09f8757798dcb939b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5359
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 1C69 22 KB
8 KB 21ms
20ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 55245
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 11 Apr 2022 13:55:10 GMT
expires: Tue, 11 Apr 2023 13:55:10 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 css
fonts.googleapis.com/ Frame 5AE6 4 KB
652 B 64ms
34ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400%7CRoboto+Condensed:400&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek,latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

73c474cca9b08f94c4d99a5778a92c4f759ecc24236bae01afa61ae9c09e5e7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Tue, 12 Apr 2022 05:06:22 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Tue, 12 Apr 2022 05:15:55 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 12 Apr 2022 05:15:55 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 52CC 22 KB
8 KB 25ms
25ms Document
text/html 2a00:1450:4001:812::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 55245
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Mon, 11 Apr 2022 13:55:10 GMT
expires: Tue, 11 Apr 2023 13:55:10 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET /
google2waycm.netmng.com/cm/ Frame 1170 0
0

GET
H2 200 dpixel
cms.quantserve.com/ Frame 1170 35 B
464 B 91ms
20ms Image
image/gif 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENdC8SCI6UXMAACjWQ0_meo&google_cver=1&google_push=AYg5qPK308mLw5jVd5bcyGq9RZ19sBdTimLwGhrfxys05Owq1MYZSu696bgy43t500BJ8ptvb192_GBA_JWAplflp4sp384Q5eI

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1170
Redirect Chain

https://ssp.adriver.ru/cgi-bin/sync.cgi?ssp_id=10&external_id=&google_gid=CAESEIm1C7mX5FiBr_gl5_Nr7yA&google_cver=1&google_push=AYg5qPI9Pw8PE96inJd_D94JJIJ7clO8_fTPoywK9WjyK8X5JF8YpfLNpRS0q7uSDM3mN...
https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPI9Pw8PE96inJd_D94JJIJ7clO8_fTPoywK9WjyK8X5JF8YpfLNpRS0q7uSDM3mNbx7sHTxW8kbMT5aM6SB0EqU9ytEWco&google_hm=QS0zUHM5bjFJSUtZSUVTeWpZb...

170 B
188 B

26ms
26ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPI9Pw8PE96inJd_D94JJIJ7clO8_fTPoywK9WjyK8X5JF8YpfLNpRS0q7uSDM3mNbx7sHTxW8kbMT5aM6SB0EqU9ytEWco&google_hm=QS0zUHM5bjFJSUtZSUVTeWpZb2xUYmc=

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AYg5qPI9Pw8PE96inJd_D94JJIJ7clO8_fTPoywK9WjyK8X5JF8YpfLNpRS0q7uSDM3mNbx7sHTxW8kbMT5aM6SB0EqU9ytEWco&google_hm=QS0zUHM5bjFJSUtZSUVTeWpZb2xUYmc=
Date: Tue, 12 Apr 2022 05:15:56 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1170
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEAXXtpTuygL447erpzkg0iM&google_cver=1&google_push=AYg5qPL2VCEkvIUnGdaiAB_t3uCOIJn_JRCdySLbg-Ye2NyZytWu2jtIHbgrU3Ht72lpeAYOgSl...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFWT1hKTEItMTMtSE1ISA==&google_push=AYg5qPL2VCEkvIUnGdaiAB_t3uCOIJn_JRCdySLbg-Ye2NyZytWu2jtIHbgrU3Ht72lpeAYOgSlxyWFomRU6X6Tm21zs_sShSg

170 B
188 B

29ms
26ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFWT1hKTEItMTMtSE1ISA==&google_push=AYg5qPL2VCEkvIUnGdaiAB_t3uCOIJn_JRCdySLbg-Ye2NyZytWu2jtIHbgrU3Ht72lpeAYOgSlxyWFomRU6X6Tm21zs_sShSg

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFWT1hKTEItMTMtSE1ISA==&google_push=AYg5qPL2VCEkvIUnGdaiAB_t3uCOIJn_JRCdySLbg-Ye2NyZytWu2jtIHbgrU3Ht72lpeAYOgSlxyWFomRU6X6Tm21zs_sShSg
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
Expires: 0

GET
H/1.1 200
OK sync
dsp.adkernel.com/ Frame 1170 42 B
233 B 315ms
99ms Image
image/gif 174.137.133.49
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsp.adkernel.com/sync?exchange=11&google_gid=CAESEDDkGPwb57Zlp6Ji_AUuVBA&google_cver=1&google_push=AYg5qPIVDacbIakXpQwAq2XneTRrKnm5rAhn0VTIK7qWaWnHWaO7wRKRGSUQWy4rH37BOdHf8PpFL4Lx2KY7N3mgXfyZ4LnY0-c
Requested by: Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.49 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 12 Apr 2022 05:15:55 GMT
Server: nginx
Age: 0
Content-Type: image/gif
Cache-Control: no-store
Connection: keep-alive
Content-Length: 42

GET
H/1.1 200
OK us
sync.go.sonobi.com/ Frame 1170 0
478 B 125ms
23ms Image
text/plain 178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsonobi%26google_push%3DAYg5qPLN7EY_DM47uPSqx1LR-F6Vnf8DYKh9Dlp-d04N2C1UdWJQtX7JtUmoVvQioCPXx3Ra4MfRfqT8EaiDRilOu9rX2RIeF1U%26google_hm%3D%5BUID%5D&google_gid=CAESECAwkQiwMangtR1JnEnwHJA&google_cver=1

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 Rijswijk, Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-sync.go.sonobi.com

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 12 Apr 2022 05:15:55 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-129
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame 1170 0
75 B 136ms
26ms Image
text/plain 185.86.137.121
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEOmsl5ptR_MmgjZt4qGGCvw&google_cver=1&google_push=AYg5qPLA4_AApvJDJKWZUsoqmi3dZVgagsPLxf3t06f6TBYthmuNIaAgKFjsAcKoN5u0nnJ0uJbVcS52gWrkv-VCVpU5jLMmL4A
Requested by: Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.137.121 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:54 GMT
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 1170 0
12 B 26ms
24ms Image
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KHbgkNDVTeneOQas1ohHtST_KS6SwyvmZqPGq6hfNZJ1Iv0AIA92xi5ORKXpjV6WSxzjn-

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 dpixel
cms.quantserve.com/ Frame D6BC 35 B
464 B 88ms
20ms Image
image/gif 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENdC8SCI6UXMAACjWQ0_meo&google_cver=1&google_push=AYg5qPI0uijxqaKT4uu6igK34jZW62jmYWM7AExGFU--tWVk8FXnEGzVVjibfwdmseYueKI6IH5MUtO6r9mAzstrAPgMGMWNSAdS

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D6BC
Redirect Chain

https://px.ads.linkedin.com/setuid?partner=googleadxdb&google_gid=CAESEJXoDBOE3DSyn0fhLnp4QLQ&google_cver=1&google_push=AYg5qPJi7gVwXr9RtbfvKry1-9Frncq0K0q0toRVKDNMjj3wABFBMKVO5zaOZP9YKigHg5h8TiZDk...
https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AYg5qPJi7gVwXr9RtbfvKry1-9Frncq0K0q0toRVKDNMjj3wABFBMKVO5zaOZP9YKigHg5h8TiZDkEF0wPdF19_Aup_01kaaITI

170 B
188 B

26ms
25ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AYg5qPJi7gVwXr9RtbfvKry1-9Frncq0K0q0toRVKDNMjj3wABFBMKVO5zaOZP9YKigHg5h8TiZDkEF0wPdF19_Aup_01kaaITI

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 12 Apr 2022 05:15:55 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 754AAAEA4BB04DF6BB1B15B1C7B792D0 Ref B: FRAEDGE0908 Ref C: 2022-04-12T05:15:55Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://cm.g.doubleclick.net/pixel?google_nid=linkedin&google_push=AYg5qPJi7gVwXr9RtbfvKry1-9Frncq0K0q0toRVKDNMjj3wABFBMKVO5zaOZP9YKigHg5h8TiZDkEF0wPdF19_Aup_01kaaITI
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXcbifKp7f/Ndt3AINcfg==

GET gg_pixel
sync.adaptv.advertising.com/ Frame D6BC 0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D6BC
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEIQAUGg2Yc1dJQ5CpJ_Ozgs&google_cver=1&google_push=AYg5qPLXzSU2LRD6punEV9xxkUq7JvHLlcjD1BRkp2AFX2hFgMTjCVdEE_PP2xhRqSZrMODe5Kxy24FxFoMdScLdFcfgutF...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEIQAUGg2Yc1dJQ5CpJ_Ozgs&google_cver=1&google_push=AYg5qPLXzSU2LRD6punEV9xxkUq7JvHLlcjD1BRkp2AFX2hFgMTjCVdEE_PP2xhRqSZrMODe5Kxy24FxFoMdScLdFcfgu...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPLXzSU2LRD6punEV9xxkUq7JvHLlcjD1BRkp2AFX2hFgMTjCVdEE_PP2xhRqSZrMODe5Kxy24FxFoMdScLdFcfgutFuNnZQ

170 B
188 B

26ms
26ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPLXzSU2LRD6punEV9xxkUq7JvHLlcjD1BRkp2AFX2hFgMTjCVdEE_PP2xhRqSZrMODe5Kxy24FxFoMdScLdFcfgutFuNnZQ

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=AYg5qPLXzSU2LRD6punEV9xxkUq7JvHLlcjD1BRkp2AFX2hFgMTjCVdEE_PP2xhRqSZrMODe5Kxy24FxFoMdScLdFcfgutFuNnZQ
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame D6BC
Redirect Chain

https://b1sync.zemanta.com/usersync/googleadx/?google_gid=CAESEKUmYdgFKamXK0GiBIMqacU&google_cver=1&google_push=AYg5qPLFajdg53UY4pA2pcFhAiMdVda5XcitO4GvsU2isY4E4CxYYGRZKnbxvjbtVdo1WO3yBu4hz6-XE5SSS...
https://b1sync.zemanta.com/usersync/googleadx/?google_cver=1&google_gid=CAESEKUmYdgFKamXK0GiBIMqacU&google_push=AYg5qPLFajdg53UY4pA2pcFhAiMdVda5XcitO4GvsU2isY4E4CxYYGRZKnbxvjbtVdo1WO3yBu4hz6-XE5SSS...
https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AYg5qPLFajdg53UY4pA2pcFhAiMdVda5XcitO4GvsU2isY4E4CxYYGRZKnbxvjbtVdo1WO3yBu4hz6-XE5SSSemMfgZxLyuJ_kqi&google_hm=cmhydnVBWjlFNXQwTklK...

170 B
188 B

26ms
25ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AYg5qPLFajdg53UY4pA2pcFhAiMdVda5XcitO4GvsU2isY4E4CxYYGRZKnbxvjbtVdo1WO3yBu4hz6-XE5SSSemMfgZxLyuJ_kqi&google_hm=cmhydnVBWjlFNXQwTklKY0VKbjM=

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 12 Apr 2022 05:15:56 GMT
P3p: CP="We do not support P3P header."
Location: https://cm.g.doubleclick.net/pixel?google_nid=zemanta&google_push=AYg5qPLFajdg53UY4pA2pcFhAiMdVda5XcitO4GvsU2isY4E4CxYYGRZKnbxvjbtVdo1WO3yBu4hz6-XE5SSSemMfgZxLyuJ_kqi&google_hm=cmhydnVBWjlFNXQwTklKY0VKbjM=
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=utf-8
Content-Length: 236
Expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 204 pub
cs.chocolateplatform.com/ Frame D6BC 0
68 B 421ms
99ms Image
text/plain 159.203.145.121
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.chocolateplatform.com/pub?pid=ebda&google_gid=CAESEPLv3Qdf94pU9eULf2GU6-A&google_cver=1&google_push=AYg5qPKudE2IbWYRKJuGXnMEEQCF4qWNN4uUoXXxppRfSZxdIp4C6oW1HX4Vysjnt5bCFy0IlFzyHjHDZs7ynQxQG93x-1nPh-ZF
Requested by: Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 159.203.145.121 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Chocolate Cookie Sync Powered by Vdopia /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
server: Chocolate Cookie Sync Powered by Vdopia

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame D6BC 0
12 B 31ms
24ms Image
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13L27F9cBANV1TXcaQPLpXoaxYrMBZQvT66CelS7VfJhm9TPxCqci9x22menkL2hyw

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 dpixel
cms.quantserve.com/ Frame 6B31 35 B
465 B 73ms
19ms Image
image/gif 2620:116:800d:21:8c6e:cf2c:8d6:9fb5
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESENdC8SCI6UXMAACjWQ0_meo&google_cver=1&google_push=AYg5qPJsVjaE1-RXR2sglCGVamxrgFpgqRv-Ns5yKC_kbGk2G__ctkPDEE7nkKUmCNtlS7XBHf2Lt8-ZOpkFIQ08DMf_Z2MHEPg

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:8c6e:cf2c:8d6:9fb5 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame 6B31 0
191 B 123ms
33ms Image
text/plain 66.155.71.150
COGECO-PEER1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEHx0oKu1lh85ZzUVK1Kxm0g&google_cver=1&google_push=AYg5qPL766Suy_RAjakMRY7LO1yJZGds6iwxrh8MSU1RzBXookwQHWaB1vkfYRuSOpWhrVZ613rH69u9iWaoWizNHhYKAI7zSxZe
Requested by: Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 66.155.71.150 Portsmouth, United Kingdom, ASN13768 (COGECO-PEER1, CA),
Reverse DNS
Software: AC1.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:54 GMT
cache-control: max-age=0,no-cache,no-store
server: AC1.1
p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6B31
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEF14RjAn6Y4LL8aiy8R4Sag&google_cver=1&google_push=AYg5qPJCN3vvXnEGUGzGVRwzW4SwZpzNH9aCiQxv4FGTj2s_p_qUe8UdIRkDGJpNtGwvtonmEOweoc-hmwy1uYY6OLjd...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEF14RjAn6Y4LL8aiy8R4Sag&google_cver=1&google_push=AYg5qPJCN3vvXnEGUGzGVRwzW4SwZpzNH9aCiQxv4FGTj2s_p_qUe8UdIRkDGJpNtGwvtonmEOweoc-hmwy1uY...
https://r.scoota.co/sync?ssp=bidswitch&bidswitch_ssp_id=google
https://r.scoota.co/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=google
https://x.bidswitch.net/sync?dsp_id=29&expires=30&user_id=091d3ef2-0c92-4b4a-a58b-f1273b993b36&ssp=google
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJCN3vvXnEGUGzGVRwzW4SwZpzNH9aCiQxv4FGTj2s_p_qUe8UdIRkDGJpNtGwvtonmEOweoc-hmwy1uYY6OLjdS695wg0&google_hm=dHLPubhgTDecnTrFV5nKXQ==

170 B
188 B

26ms
25ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJCN3vvXnEGUGzGVRwzW4SwZpzNH9aCiQxv4FGTj2s_p_qUe8UdIRkDGJpNtGwvtonmEOweoc-hmwy1uYY6OLjdS695wg0&google_hm=dHLPubhgTDecnTrFV5nKXQ==

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:56 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJCN3vvXnEGUGzGVRwzW4SwZpzNH9aCiQxv4FGTj2s_p_qUe8UdIRkDGJpNtGwvtonmEOweoc-hmwy1uYY6OLjdS695wg0&google_hm=dHLPubhgTDecnTrFV5nKXQ==
Date: Tue, 12 Apr 2022 05:15:56 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6B31
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEAXXtpTuygL447erpzkg0iM&google_cver=1&google_push=AYg5qPITvMlf8EGM1ul0Xdedz751YZt8dG_xXLckKDVjru66NaZ4KpqeNSsOk9UktARiQTOh_nR...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFWT1hKTEUtTS1EOVdN&google_push=AYg5qPITvMlf8EGM1ul0Xdedz751YZt8dG_xXLckKDVjru66NaZ4KpqeNSsOk9UktARiQTOh_nRCzHLB45-UyL5T5QNILZ2XbYb_

170 B
188 B

26ms
24ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFWT1hKTEUtTS1EOVdN&google_push=AYg5qPITvMlf8EGM1ul0Xdedz751YZt8dG_xXLckKDVjru66NaZ4KpqeNSsOk9UktARiQTOh_nRCzHLB45-UyL5T5QNILZ2XbYb_

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDFWT1hKTEUtTS1EOVdN&google_push=AYg5qPITvMlf8EGM1ul0Xdedz751YZt8dG_xXLckKDVjru66NaZ4KpqeNSsOk9UktARiQTOh_nRCzHLB45-UyL5T5QNILZ2XbYb_
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 3bafef7aa4e37890defcd73f0a080481
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6B31
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEBqajqaR_U5-bDhY6NH0aaE&google_cver=1&google_push=AYg5qPLCHc8hznzr8fLt6f6sZvNcFtmHUMGp2nZh7hesN9tKwSscXsRSdFVIQfpi73esrNj2LF3nJS0C5ZJ92jcf...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPLCHc8hznzr8fLt6f6sZvNcFtmHUMGp2nZh7hesN9tKwSscXsRSdFVIQfpi73esrNj2LF3nJS0C5ZJ92jcflAbRiNApKYGZ

170 B
188 B

26ms
26ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPLCHc8hznzr8fLt6f6sZvNcFtmHUMGp2nZh7hesN9tKwSscXsRSdFVIQfpi73esrNj2LF3nJS0C5ZJ92jcflAbRiNApKYGZ

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Tue, 12 Apr 2022 05:15:55 GMT
via: 1.1 62dc260e32d7b9197a4511447f6a264a.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA6-C1
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AYg5qPLCHc8hznzr8fLt6f6sZvNcFtmHUMGp2nZh7hesN9tKwSscXsRSdFVIQfpi73esrNj2LF3nJS0C5ZJ92jcflAbRiNApKYGZ
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: RRzmeKAIUXrzAe1gYu19BnGKBogK_AzqeUauAVsH79_EQ3QQnTinSA==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 6B31
Redirect Chain

https://sm.rtb.mts.ru/p?ssp=googleban&pm=1&google_gid=CAESEISaV9bNucMda5dJuFPvT4k&google_cver=1&google_push=AYg5qPJ0q7MnOUtBjjHPlhh8BxDsLdAOcHcxfmWiGgfKWbYU2c7aP-gMxSMZR_XxubWNGZEwdkKHHRw_tZEjCUmsG...
https://sm.rtb.mts.ru/match/second?ssp=12&google_push=AYg5qPJ0q7MnOUtBjjHPlhh8BxDsLdAOcHcxfmWiGgfKWbYU2c7aP-gMxSMZR_XxubWNGZEwdkKHHRw_tZEjCUmsGrHtIzQAJXo4fA&exu=CAESEISaV9bNucMda5dJuFPvT4k
https://tech.rtb.mts.ru/?dsp_uid=dac0fb2c-1789-45e0-85b7-ec86de61cfcf&return_url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dstream_llc%26id%3Ddac0fb2c-1789-45e0-85b7-ec86de61cfcf%26g...
https://cm.g.doubleclick.net/pixel?google_nid=stream_llc&id=dac0fb2c-1789-45e0-85b7-ec86de61cfcf&google_push=AYg5qPJ0q7MnOUtBjjHPlhh8BxDsLdAOcHcxfmWiGgfKWbYU2c7aP-gMxSMZR_XxubWNGZEwdkKHHRw_tZEjCUms...

170 B
188 B

25ms
25ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stream_llc&id=dac0fb2c-1789-45e0-85b7-ec86de61cfcf&google_push=AYg5qPJ0q7MnOUtBjjHPlhh8BxDsLdAOcHcxfmWiGgfKWbYU2c7aP-gMxSMZR_XxubWNGZEwdkKHHRw_tZEjCUmsGrHtIzQAJXo4fA

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Tue, 12 Apr 2022 05:15:55 GMT
Server: nginx/1.20.2
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=stream_llc&id=dac0fb2c-1789-45e0-85b7-ec86de61cfcf&google_push=AYg5qPJ0q7MnOUtBjjHPlhh8BxDsLdAOcHcxfmWiGgfKWbYU2c7aP-gMxSMZR_XxubWNGZEwdkKHHRw_tZEjCUmsGrHtIzQAJXo4fA
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

GET
H2 204 um
cs.emxdgt.com/ Frame 6B31 0
59 B 176ms
29ms Image
text/html 18.195.155.181
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.emxdgt.com/um?ssp=google_ob&google_gid=CAESEGZ0d9rrjrOODI6LVmVTK4A&google_cver=1&google_push=AYg5qPJreALyxQCwihTULSAh1Iy7tJq-HXInfnlN8MdOMOR32sMGIcZV8Y-c1NZ34_euLnbGfX5HhAc6uxOGrwjxgtOXszPoQDpQsA
Requested by: Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.155.181 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:54 GMT
content-length: 0
content-type: text/html

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 6B31 0
12 B 34ms
31ms Image
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IuwrbsIC4giIUlNl4BiJkQaXZlmNwQ88OjC_JLngF4KgvqaukgZ4Qk2CWOHZtqNm1gdbEujK8

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:55 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 badge.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 714A 647 B
674 B 20ms
19ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/badge.png?1648630454048

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bd0a4b69c75836d702bbb1b23a1073a4b2700696636fd316bfa6951275ba3cea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 647
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 bg_img.jpg
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 714A 24 KB
24 KB 29ms
26ms Image
image/jpeg 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/bg_img.jpg?1648630454048

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bfa897fcf98209c6a47be5d29223fcf433d8bdca1d27d269bdcdea2152d84e7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24394
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 bubblespritesheettiny.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 714A 26 KB
26 KB 27ms
25ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/bubblespritesheettiny.png?1648630454048

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25280083af87c8d6dbc6ff5bb926bf9d0d373d244cead76893430166b8df0bd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27068
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 714A 660 B
687 B 27ms
25ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/cta.png?1648630454048

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6391d8f50155e52f4c19d7c2d3002282146bfbe9f186ca62067215568ec51d4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 660
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 714A 2 KB
2 KB 30ms
28ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/logo.png?1648630454048

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bae4a5df5ad2928d29b1664add68f4cc8070c283864945b9243cd09867270d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1554
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 typo_01_1.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 714A 843 B
870 B 28ms
26ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/typo_01_1.png?1648630454048

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

63c6ce29acfc3dea165a10129a80604495ac91dd503c39902031083a905b3ba4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 843
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 typo_01_2.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 714A 902 B
929 B 29ms
27ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/typo_01_2.png?1648630454048

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82a9948086efe27efb38cdbeb7508bd2ad08319d69a2fae33bab65705bfe291b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 902
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 typo_01_3.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 714A 795 B
822 B 28ms
27ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/typo_01_3.png?1648630454048

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b47ef927561a77bc135b5f621c7fee9c3985004689c23d74fc3fcb421b9384b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 795
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 typo_02_1.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 714A 838 B
865 B 28ms
26ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/typo_02_1.png?1648630454048

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2d4917e73617b7542f1c206cf5cf5b8f395c387584ff8c071eb75c4fe4f5746

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 838
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 typo_02_2.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 714A 636 B
663 B 27ms
25ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/typo_02_2.png?1648630454048

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dfe66806b8d550d1aaff91d79b3bff67a841f4a0fb5ff84acad77c4f3315c4ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 636
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame F99A 0
26 B 44ms
43ms Ping
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstJ8KlePDfZ5TTB2HV1VVo7_OGWciux0CzZPhQKoeBZk9hhRLpOt7jW2f_ep25KOgcMkTzOheLX5hkeA9zl-2MED-37tvaLf2G24EtJhSiMWSyoFQ8PTkA5s-Pa1bGCXdCLslY3Z7XBQo3aOSN04nc-nkuKMXX1eFDK4LJHoAzSfBSmsS9XXzrLVXbxMJ1azZliNhpFywzjtHVV-bABYD-0hbn7kaxu7grkMpIOAh8VA54W7P71jSRKxRrPtKZQ1Gj0Ws82vnMLwO_lMykL9L1xEuXjSu6Ecw8rMykZPMo4VCDJIEXQMVO8UxvunuscHBZOYlBMke_0KFkZG1Nk-M-hzDsUzUtQus7Fmoa28O4wHK4K1Z2vDFWWgYDodSgkiJGxCPcS9CJwu-SdSRrISOL_-_83XoTvr3cJbGUrSb1_T2VkZqpEKuvS6k_XaMoF1zmB93SGSeMRMyDnr4OxkSC-LXDFzo_IWQtM4N-yv8XtoqFAOuJ1o6_yecCdR8KUBPsG8kccIae2M02iTdW3cD8AMbr0E1SjqU_l29tbrUg9AbgEu0GyBjlZmIYhGFG_plt-DZwFgc7TXJYYr9upE9DHcMXgYfbEOmptSEBSvpQF1rtpquKFOqGsxLElzO8y_6TK15146_mc91Fyo6Z5zvhB45hd519aVbkZH0EnIsQzHstJCGjkFlj481mX8uV2yt7qcKaVPlWoygj2YxkOiy_n1tH47Tmvn_QyTZ6NuMeKTHCbkNAbn9gFEnjO-ong50--oYMZGDjS0PMxusFY-iDgOFq48V3pgSQXoQKQ_e4jiryJg5IaArcsvkk5Vz1KI174JahFHDvBe3WjgDB8qMHQUHqunni5846vNSLQ7ffW_a84smUXyB0ZXDpWqp5T-bV68iRxYHOkqHKgT8idUyaKIw-1Krd1J9Bz3-OjhY3oL5gAWjz59MuaF1QQvKIFyZ8R0e2sCCY94m3camBbfNkZOGFOHXxLojbm2m8QN7EQY2LA9uN-oXQVtSTCCKlR3NvhY7b_9imI3b4MgvscpQAhYeSAC3GAFYGdsrKak-KiVZtOMVzYhn4JHTYcCc2f6-cr3MKzfayiYBxVuPW_au9Qc5BJmPH8tB9KzwZZIPjoTPmXjrfDyWYuTAI8yefmAGvB-pemAjaB47vyu0zRNYVrsoxyzcUOKLKzdMBAykfP2hTPOaqGVCA7yET7BZAzoy6a-XzipppA2BabFAk74MPBxpPIgorR3adfuU3aTr9LoEtHRU3xoiO7j4qDS09YW96TyHTvoNM&sai=AMfl-YQB-UuXgyflQQPHZAiElGsXjVwemuAcVhn1Me1hzrmamguZ8UrpL2_cx7fZ-M8UuXwoNgHVwJ0ETWlutgLPj-pWkxPACzlnycLmteCJ-aeIO7BlNdGu7XHoGS2Ed_03iebix95HtEW1Z9WG1giKdUiq3dZyFacRN7yvdh8tG0MK1LsvvQy-2lPXqcFQtAbBQY_ApVBP2adjOmVR5uK-TQ&sig=Cg0ArKJSzCJvVcPLMtIdEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=421&vt=11&dtpt=279&dett=3&cstd=140&cisv=r20220406.16498&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=

Requested by

Host: thewaterwomanplus.com
URL: http://thewaterwomanplus.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 12 Apr 2022 05:15:55 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 VZx5lKL-R1DYt4uczQuO7ewneocOxZLDwOE_DB7Gp_E.js Show response
pagead2.googlesyndication.com/bg/ Frame F5BA 35 KB
13 KB 20ms
19ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/VZx5lKL-R1DYt4uczQuO7ewneocOxZLDwOE_DB7Gp_E.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

559c7994a2fe4750d8b78b9ccd0b8eedec277a870ec592c3c0e13f0c1ec6a7f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 18:37:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38326
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13564
x-xss-protection: 0
last-modified: Mon, 04 Apr 2022 12:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 11 Apr 2023 18:37:09 GMT

GET
H3 200 ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2
fonts.gstatic.com/s/robotocondensed/v24/ Frame 5AE6 15 KB
15 KB 47ms
20ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotocondensed/v24/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400%7CRoboto+Condensed:400&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek,latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b4fac99c39b9ee2693d87a2508d0c7d4b4859072966616bd1f6e18c5b2f9d36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 06 Apr 2022 19:30:27 GMT
x-content-type-options: nosniff
age: 467128
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15700
x-xss-protection: 0
last-modified: Wed, 26 Jan 2022 19:13:59 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 06 Apr 2023 19:30:27 GMT

GET
H3 200 badge.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 4A92 647 B
674 B 22ms
19ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/badge.png?1648630454048

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bd0a4b69c75836d702bbb1b23a1073a4b2700696636fd316bfa6951275ba3cea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 647
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 bg_img.jpg
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 4A92 24 KB
24 KB 23ms
19ms Image
image/jpeg 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/bg_img.jpg?1648630454048

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bfa897fcf98209c6a47be5d29223fcf433d8bdca1d27d269bdcdea2152d84e7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24394
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 bubblespritesheettiny.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 4A92 26 KB
26 KB 26ms
22ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/bubblespritesheettiny.png?1648630454048

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25280083af87c8d6dbc6ff5bb926bf9d0d373d244cead76893430166b8df0bd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27068
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 4A92 660 B
687 B 28ms
24ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/cta.png?1648630454048

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6391d8f50155e52f4c19d7c2d3002282146bfbe9f186ca62067215568ec51d4d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 660
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 4A92 2 KB
2 KB 28ms
24ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/logo.png?1648630454048

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bae4a5df5ad2928d29b1664add68f4cc8070c283864945b9243cd09867270d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1554
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 typo_01_1.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 4A92 843 B
870 B 28ms
24ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/typo_01_1.png?1648630454048

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

63c6ce29acfc3dea165a10129a80604495ac91dd503c39902031083a905b3ba4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 843
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 typo_01_2.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 4A92 902 B
929 B 28ms
24ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/typo_01_2.png?1648630454048

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82a9948086efe27efb38cdbeb7508bd2ad08319d69a2fae33bab65705bfe291b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 902
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 typo_01_3.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 4A92 795 B
822 B 28ms
25ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/typo_01_3.png?1648630454048

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b47ef927561a77bc135b5f621c7fee9c3985004689c23d74fc3fcb421b9384b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 795
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 typo_02_1.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 4A92 838 B
865 B 29ms
25ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/typo_02_1.png?1648630454048

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2d4917e73617b7542f1c206cf5cf5b8f395c387584ff8c071eb75c4fe4f5746

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 838
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 typo_02_2.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 4A92 636 B
663 B 29ms
25ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/typo_02_2.png?1648630454048

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dfe66806b8d550d1aaff91d79b3bff67a841f4a0fb5ff84acad77c4f3315c4ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 636
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 73B9 0
26 B 43ms
41ms Ping
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsvHRe7U8m5gJc8ZPbU6-GQgk_uySYKhuggcx1qLWJCC6djIQMigEJd_p4cQi8soRgjyZshgxRFkpF_LB5UEd53ugrlStc8CLLS9rhdtz57AkFJxehsHqmL-zsOPMEN82gKPwXZfzkyUhry_aYKkLL5mGQjh3Us0wa4UFjq6nOiZOeq3SLKednyZI1jdLvaQwS1D1-5LG2ABb0Dane14fXiIxdwQVCenjNxRA3LWyYGyDtTqY_JkbQf4JaV8P9ZzBhAxPqJhkVcTE_iGr1NmVSurVJoCWnGYMpPr2FnO386t4XCdpWfiUMabYdei8uFmLzf2j4QwqttL8IoDEy8CN5ZFPtzrFb1AtL9rjmCbUTo3NeUHGZRxZ46jZ9aVpxZmYymNzCUGS4Vu7Nhpxc40FBhtAUTR3X8elwqni3ikMdya05CE18m67JmpH10bFaEj3sIw_2bdy2mP0Fe7W1kWlJbymmUhrdsGfsR2s2GpItoQy87GajkmI7mrNaOgwGTVE_RRn0jujgMazzrv8V_GNDZljQCSzhqEijGyXxTr9VCgV0hPDNNSXlQEy1qnWLGAqS6ueVZ-DvK6Ze_C7XxF9r9cvCIK94v8IUqnLf9w9eRIonAxXPFZTLU7jWf1ppanTzJSJ5imbi22dRW90MwB2Gw89Kq1QwhCl6OHIPi1DorBFGldsJ6DSVhL6brGirzXTU6CQgGvbFuFPq5Xt1hK1xC7sU7qXmG-UsWpVgMpVOHEaTy5p0EDNMEZnD77WHFQyCJKYENdBR634WYMQy1sdfuvc1YlMuT7OmKUlNxSJh8Z-uXOJAdy0McAu-hpPDlBdwBecGCdVcMZLY-Ts8cQmF_P3HGBC_qo37tUMgkeMo0gbE0d_-ZWMUp7YKf7I2UsSLsdJqaWSGoA3-BqrZOzl2z9HQEsufjTsyaUnbiOhOiZwdItP_3dQ2I8kYLnPFYHUYFIfTtzV0Q7kt8LtYONOEoSLwiSQZ8rPKKfjhJLEey898l-u9O2OQQ_EE4QdY2d2zjYIfFyDT8Jluj0Aqcug913evO-RV9KfI-sgn_RE_9g5DB7-jD7JaVDtjTj1gxfQxCRNKJXPA1a7MWxt47rzf2DOB_LFSOpiCd33EedWy9axCKbCWfXrus8F0C4GKRniI61Imuhq8h1ZK92kCdIcBzN-Pa1IseySNeCGbi8M2tfLts0autfo2Njq3Nmw9qEuipF-daiKt_DpwbBaHOSFQVWPp0MEClHQCnB-nd_J_6dNgGPE9NP_vtufnPM4L2qs1s9r8JVvLAtFkxD&sai=AMfl-YTYQC73pEUJQrJ4AVSonNP-QHwVPBKp5t-BDyCv2LUx7ff0HrKGvVYGcJsOS_TpoPsJmx1-Y_7ow7AAYFTbb38yK-VHFXwEOk3O67twKTf6zSlCh4vFBqQTmsalDo1Kua4i9i153IxOiPTP9BtSS7BbmNJohADp4QPWiv-LRJwNXymciYnQKWnN9Ekl9X3K8fdsoegif_hdQYhjTel9Yg&sig=Cg0ArKJSzP2z213krDipEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=409&vt=11&dtpt=257&dett=3&cstd=150&cisv=r20220406.89838&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=

Requested by

Host: thewaterwomanplus.com
URL: http://thewaterwomanplus.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 12 Apr 2022 05:15:55 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 VZx5lKL-R1DYt4uczQuO7ewneocOxZLDwOE_DB7Gp_E.js Show response
pagead2.googlesyndication.com/bg/ Frame 1C69 35 KB
13 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/VZx5lKL-R1DYt4uczQuO7ewneocOxZLDwOE_DB7Gp_E.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

559c7994a2fe4750d8b78b9ccd0b8eedec277a870ec592c3c0e13f0c1ec6a7f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 18:37:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38326
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13564
x-xss-protection: 0
last-modified: Mon, 04 Apr 2022 12:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 11 Apr 2023 18:37:09 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 5AE6 15 KB
15 KB 26ms
25ms Font
font/woff2 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.eu.criteo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Fri, 08 Apr 2022 01:46:21 GMT
x-content-type-options: nosniff
age: 358174
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 08 Apr 2023 01:46:21 GMT

GET
H3 200 VZx5lKL-R1DYt4uczQuO7ewneocOxZLDwOE_DB7Gp_E.js Show response
pagead2.googlesyndication.com/bg/ Frame 52CC 35 KB
13 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/VZx5lKL-R1DYt4uczQuO7ewneocOxZLDwOE_DB7Gp_E.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

559c7994a2fe4750d8b78b9ccd0b8eedec277a870ec592c3c0e13f0c1ec6a7f1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 11 Apr 2022 18:37:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 38326
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13564
x-xss-protection: 0
last-modified: Mon, 04 Apr 2022 12:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 11 Apr 2023 18:37:09 GMT

GET
H3 200 typo_02_3.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 714A 617 B
644 B 22ms
21ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/typo_02_3.png?1648630454048

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ceab57c0ac7560e29c40a091c5d02b9ad45226c1f712487949d4a4814597e8ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 617
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 typo_03.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 714A 3 KB
3 KB 21ms
20ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/typo_03.png?1648630454048

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8db6eb08f17b61cffa681b3b9452bc4b0160777440d3dd64571d92f9d5f43605

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2661
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 typo_02_3.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 4A92 617 B
644 B 19ms
18ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/typo_02_3.png?1648630454048

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ceab57c0ac7560e29c40a091c5d02b9ad45226c1f712487949d4a4814597e8ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 617
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 200 typo_03.png
s0.2mdn.net/sadbundle/1673573227426754979/ Frame 4A92 3 KB
3 KB 20ms
20ms Image
image/png 2a00:1450:4001:810::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1673573227426754979/typo_03.png?1648630454048

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8db6eb08f17b61cffa681b3b9452bc4b0160777440d3dd64571d92f9d5f43605

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1673573227426754979/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 05 Apr 2022 08:26:53 GMT
x-content-type-options: nosniff
age: 593342
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2661
x-xss-protection: 0
last-modified: Fri, 01 Apr 2022 09:43:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 05 Apr 2023 08:26:53 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F5BA 0
20 B 55ms
55ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BzBjKCwtVYrnSBvmK7_UP-ui62AsAAAAAOAHgBAI&bg=!QkGlQQXNAAZAkm7qYJI7ACkAdvg8Wl_6Hu9teWpSKFC2YqNtsSmYo_PeLjsnz2kn1ZSy-0hY2wMPrAIAAAD3UgAAAAJoAQcKACm8vNBTyTT0zgdFGcRYsJMQqKnYlA7Wy3EDECxASamGSaficwvalt-Iq5kC6rCd28b9CLyQH9XVD8ZIVesEOIvtXq8WfyQtuHrv9DK24WZwXnl7sMQSNK5919wA32mjRxyTouXKxIN2IkXo5_sgdvT0FaQAfmRZzwcp8HjgAqik75jN6Fu_hqN8JyT4FDlGogEomrfgb-YPhoPBdloSH3Y2eEKlVm4Xhq7qEF4xVclJpNHxwppnJgw1QTW8jxSfXnu4FMgT3eg36IynxRpdROx7dVoF_tgcZK2kEVytfyjQriwYVrLMizAEJeGbqN0Ww53IXIFr8aXCz4ig3fp5M440oMUmlMWYs_EWL2CAXNNEDcaz8FMu4vk4No-QbJ9PQQsyeaBlbDH5MskqkDHRtTm32xdUXt4-KodUyCHdjPpqrxCtWZayHbuRWqDNSdpfDUoxsBqGFkpKxopr1rrv3h8SikWAbMGK62bKH6881W3AdlDmW1M7RNzdEDHLYVtKDa1EitQv0SLvclZVFoBQ2rkYlReJ_7Jo8T7nZcYGqMjlgzJtzGLUnfTW4vAdY-8CaqZ2I35DaXi5J6Bd1VnMHuzzXKfudyb-19czv7MSUAQV50vEalaNH4DrniF1y__AqKjRtasoSYXgsVZevOhTi0zMh1hANfEp95lTegitYL8_91TwgYn2Mw4Goe3w5qDMFE8r0LGESR-Jrj6hq2I723zNzud38lTBkVuHX4DtL2OaV3gUPAH1gqlGKSk5csST-0npa2lUWmeTyZObs784OgaeVGO2r7p2b1NIi5kG8o02QC8WGCwdnrdQccXOt4PAxzAqnWjacGesqU6SqwiFadD-ssz0WtTrDOuJ8ns4o9sUFWiBVNOJeq2IJP9X9lumdlQi_-pmNWKJEbSMgFpAzt-GV1TbuXMaeYL4CnqCmG7lglVRu4F5yiKzfYBg7nWcq92uVE-gULzPpsrv3PoYO5DIzYixiv51p_ZjnSpSljxJDY831e9OGH-C_WebeFY7jNAs9_Wmh4AftCwVawSJfHg4dkb0fPXN

Requested by

Host: 20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com
URL: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1C69 0
20 B 56ms
56ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B0aU5CwtVYtT9Bcil9u8PjJqysAgAAAAAOAHgBAI&bg=!VlWlVRHNAAZAkm7qYJI7ACkAdvg8Wj8YHkcB65l1fplPXc4KTXj0hPbOl_uZdbcJer6311tUmEGH3gIAAADmUgAAAAFoAQcKAJI5lUPWfl2jIw3kgMudA0Pm3LjrpcpbHcOagczldFjKandrd0XaMc0ro9vFZvOtFPRjrZGVs89PMH41Qj0aDGDv4gFeyrZ0AZejn9CCvKzsO4CHGT8Bb6gOCtUWf9cUBxY3dmVTjKpY9jK5IpN3p0kef1UtN7hla_fwL8zzag1sH2scFl-Y_UdX7ai5WCgOUQMdAJkC4ZxiClVgaAFoXOr1YQcL4tq0FWySrKUcs47DkGtICRpC5YuEmJrIcwrvpWKTfXzF5l3wwnM2NeUIVCsjBD1GZJsB7Y5_-5P3xYUxvIu8zeWa9-2eJ_csZwM9iBnBGrlueW4v9FTD1vuScHDqx2MTqYTwbx1ePLYOBKufSR2WmJNjP_TFAqleKjWEsoLHkcQ_u82YymKxXAgcdHPlptcChWQeu5wy5AH3clzQFPwQs6P5SwNfYb8yhJoHveAJ4JgVtEmmyZF6_zYmmgovLp4CJnP7ODn0-8wInEmCPbUvV1V0MlM-bNkDf990cIo1E-wIwxXdLuEXEiK2TyEzsT2y-HfsZzCyRXnocBl0BKpcHmRLumvl3Rk4fmxhK4lM6f08dm25FnyRuPc-uZaj9loAeETk_vi0IbXM9xVx6pReYGumHvUaoN8y98ZgEdZISu09IW1vwCmWuWze8Tmhgxzcy1Ac4fIRvHOMtaBxLRhGwvIMguOD9hwULRGaruVmdmbDPObU5EmZbNIB9dPoGILOmWY6dTRyqD4I7W70cqooFdUk0Fa9i9WJCYKYa1Wh1ClOekcn3jmGWvD2blPhdMXdAdUf5bQNnAzs039F13kvLOOywpQGIcfRxThdW2p-qGoo5wRYLxnKtwD8VrfchbEVuzc-fiomP2-_QypZ_SotIU-V_69IQmj1DAXRmM0_rwuOMgo4NRXAs3AaHbFbeVEB6LEwZUyXnkiiqA9TIYRyaLRcu7lxLRKl_lboVoGb65hYF7V-KCokPfWftydAqU_NoFbxoTg-l1aNIxNNioFuNxVdapM8pBQP2dNh9LXcq97fNXD1RvaHe6069AoGcJHbub5qOPSyos4sJg5talB8bbrE4jR6lDwCGMhMFTcxDRYYIjml4rECy3cp6hMj7AD-C9hurXdqPbkHP4VNYlRTPE82Wbe81PjfRP-UnHZAxUnTUKcBEVPBtqtF4yHy3-cQNcpi

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 52CC 0
20 B 54ms
54ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bd-rZCwtVYv2QBtil9u8PjteGkA4AAAAAOAHgBAI&bg=!JySlJGDNAAZAkm7qYJI7ACkAdvg8WmLFN2YdprV7zIVgN4BIuc32VcUOQQsvGrOE7_jmrRo-O-M7YAIAAADSUgAAAAJoAQeZAvExeA4dDgOVhQ2qhnu0-j8MGhU6hFg8FtYLN0CZcZVNudfv52q4d8lJDrowVUvohRxj-r7-RSd14E4MRatviBWUK2HKwaB7yOkCr04a-_RejxZOoaipnrASrBHwrqd_Eor5AUIGHspSx9SZ6uoW49kycNr8_YdzGePJEQEyFv_6l9qJY9vX_VL9Z4VBA8lUYtV9RlsGsrzCrqF_sQIYqR-9swGmKssXStfk7_FjsMdPrkUE9KPPT3OI8U7WmT0Sxrr9wgLT-asXxcDcP0PS_DFmP07nACExcVHPquVkMa0VlkqH_zUQthTi8e5R0lFLl1hPLbDAmVhGTL5Qo0oxubaK3DfXn8QDJed7a3tZEPLzM_Obn4bysWCqjMnvar6Vu6hEe4Taj_U-aESgSTsnLNPMk9-kT8v5-NaNLlzsMnoqyBJC0fIWBa2lDG6bxp2i9GCEt9wLgt4F4O5hQHLRRWIxOzcyD9SQj6BpAHVgWNIUsVjOL8ea3Iu_cxUT0-jyziLIoXx2eMN3LgONu5AZdLQSeu7tGLxQWy-YAF_DiCeTzmnzx1nG3iY9xIZ9jP5date_w7FHTi_5_jsxj0_SdMXqDbUk3osAN7qJEVu-fF5fS-WKHlb6PKzGalKQR0bpm9caV32P0l4rAU9wx7Ph3OsIFy-Gs3rNH6I6s0hmZ1MQGz49Uv6nFvjaAdvYMLrpmxiTq34BTWoLi55GQnmp-DjtdXl1ETrPEuACK-A2USy1bnMbH7MvcQvdoCS2xjC64cRdwISejHAD9LjwffL12-gsruQa5fKPARx9cVT-SYBlicoQb4xZRgRFg8t6yfH1MRFupa2ZarqyXPG4p0EEvmhLyCOu8QoDbC5-tBFzA6CvdFBxfoMJsHqpZlXuwRuZF1ntUciI9bCP0O_AVqjoQXF7D8o2buBciNMx1tQYmVdLdF2ndu5h_y3lYfpWfF6jEr7S43Sxac9uuKPUl9yM7svRObvjjsgmu4Fcw5p8OtEGhLI

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 17B1 42 B
64 B 40ms
40ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjss8KPwCZkQ-s4lI5zrSkL_jddZagQVyX83RRJDjpSArAOztDD9eJxMl3oHmrApepevr048vVpWVouCwi1PavCsG&sig=Cg0ArKJSzFFeJNEaYPf0EAE&cid=CAASF-RoyjPzMj6acOcixttoc9aLNS8N0vYo&id=lidar2&mcvt=1001&p=80,315,330,1285&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20220411&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3965337665&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1649740554982&rpt=213&isd=0&lsd=0&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:56 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame C80F 42 B
64 B 48ms
47ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst1EDGmVzIgSoWltQepOApUXbf-hXHxBXBPRhlH8A9LbEoBdXEDBh2BOvkbcLofUjV90TdVrF-hoxdf-gu7ojFj_nOFd7Aj6dApLwGE5oNGtwZCvUeM0g&sai=AMfl-YQWbets1c2Wdyw0K-fZbnG51-EoFHHR6uv9SeJsQl_mf0fIxqAszQigWDYdjS3yqZIpfMx2x4bljgo-HU9PE7T4-xPU3iMFUhcmMJaNEMvNRiZcY7il7mloluE&sig=Cg0ArKJSzBCnsVUiJDbgEAE&cid=CAASJORoQT88WRT0sY5qg-1Y8_j7GCUpciAyyV4mzbfCffwR5TTdCQ&id=lidar2&mcvt=1007&p=1110,436,1200,1164&mtos=1007,1007,1007,1007,1007&tos=1007,0,0,0,0&v=20220411&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1861010398&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1649740555004&rpt=341&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:56 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 73B9 42 B
64 B 48ms
47ms Fetch
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsswy-nGKedP-SxV47JY9xRa7nCekCXT9W8N1g11j32n9SK3tBdB58okwXm0ISBhDIsV_0xBkJ43Jukfn9zFkiAb_7f1LSrO8Px7uAPVjnIOWvTl9dvO3Q&sai=AMfl-YSO8ThTlPDKtMkLyNEZGJoVrXTJaxsHxiRk1gMhqOWXJuHw-MMTFBUQKHP7Lx_rOWCw7ffmuVdG_2KQI129k7FY7ojSR-lhf56S8g0D5WHlw5fGvsvmV4m8TDg&sig=Cg0ArKJSzM9fuGEdZO7GEAE&cid=CAASJORoui0INwtkAbY8JhQNewo5BqiJW82BEDNbtyqyolEJ59YtXA&id=lidar2&mcvt=1001&p=425,1250,675,1550&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20220411&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=489656950&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1649740555000&rpt=424&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20e71bd0b6bcc4d8a72d35a6c9f780f1.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:56 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 5AE6 0
127 B 31ms
31ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Tue, 12 Apr 2022 05:15:55 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H3 200 dc_oe=ChMI-qrYveKN9wIVk-TVCh0stQ2DEAAYACCem-VQOhoI5Zal-wIQ4cWLue8DGP-K4t8DIOfY2qnbD0ITCJPsxL3ijfcCFUrXEQgdaIMN9w;dc_rmcid=CAASJORobd-JBtIozbZ92BSmPtc5WCdBY2bi79syT5NDgwADQTKiuA;eps=CIDhgBAQARgd;met...
ade.googlesyndication.com/ddm/activity/ Frame 2156 42 B
63 B 82ms
55ms Image
image/gif 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI-qrYveKN9wIVk-TVCh0stQ2DEAAYACCem-VQOhoI5Zal-wIQ4cWLue8DGP-K4t8DIOfY2qnbD0ITCJPsxL3ijfcCFUrXEQgdaIMN9w;dc_rmcid=CAASJORobd-JBtIozbZ92BSmPtc5WCdBY2bi79syT5NDgwADQTKiuA;eps=CIDhgBAQARgd;met=1;acvw=sv%3D924%26cb%3Dima%26e%3D9%26nas%3D1%26sdk%3Dh%26p%3D450,20,878,781%26tos%3D2124,0,0,0,0%26mtos%3D2124,2124,2124,2124,2124%26amtos%3D0,0,0,0,0%26mcvt%3D2124%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D2124%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D478%26pst%3D448%26dur%3D30058%26vmtime%3D2059%26dtos%3D2124%26dtoss%3D1%26dvs%3D2111%26dfvs%3D2111%26dvpt%3D2111%26is%3D275%26i0%3D275%26ic%3D16777217%26cs%3D16781587%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D728%26femvt%3D0%26emc%3D13%26emuc%3D0%26emb%3D12,0,0,0,0%26avms%3Dexc%26qi%3D182204366%26psm%3D-2147483641%26psv%3D-2147483641%26psfv%3D-2147483641%26psa%3D0%26ptlt%3D3323%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,2124,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.16%26t%3D1649740554365;ecn1=1;etm1=0;eid1=200000;

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:56 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 2156 42 B
64 B 47ms
47ms Image
image/gif 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuKLiOOixgPBAaAqLloGHZW58jO9aKqSOH8IXyDj6EeQiuAcb5ULLRg3Qo8K-ziBFbzOfwb9tTqRKx06OMvB2Wtj599V4ygAB-pYuVerxDYfiBx4fJ_0A&sai=AMfl-YR0YFBTSxg6PmeU7Hv4HPbbFdQywbdifkFwUSxiczeDOnyH50CqyloEo1fr7jirGEe2TcbtnteLbej5tluI0Z7x8EYjePG0JFg6-nXsa0y_2yBUCAhTunONFSo&sig=Cg0ArKJSzIGG7nkEO9jjEAE&cid=CAASJORobd-JBtIozbZ92BSmPtc5WCdBY2bi79syT5NDgwADQTKiuA&id=lidarv&acvw=sv%3D924%26cb%3Dima%26e%3D9%26nas%3D1%26sdk%3Dh%26p%3D450,20,878,781%26tos%3D2124,0,0,0,0%26mtos%3D2124,2124,2124,2124,2124%26amtos%3D0,0,0,0,0%26mcvt%3D2124%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D2124%26gmm%3D4%26efpf%3D2%26nmt%3D1%26tcm%3D0%26bt%3D478%26pst%3D448%26dur%3D30058%26vmtime%3D2059%26dtos%3D2124%26dtoss%3D1%26dvs%3D2111%26dfvs%3D2111%26dvpt%3D2111%26is%3D275%26i0%3D275%26ic%3D16777217%26cs%3D16781587%26c%3D1%26mc%3D1%26nc%3D1%26mv%3D0%26nv%3D0%26lte%3D1%26ces%26femt%3D728%26femvt%3D0%26emc%3D13%26emuc%3D0%26emb%3D12,0,0,0,0%26avms%3Dexc%26qi%3D182204366%26psm%3D-2147483641%26psv%3D-2147483641%26psfv%3D-2147483641%26psa%3D0%26ptlt%3D3323%26pngs%3D9,14,15s%26veid%3Dxdi%3A0,amp%3A0%26ssb%3D0,0,0,0,0,0,0,0,0,2124,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.16%26t%3D1649740554365

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://imasdk.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 12 Apr 2022 05:15:56 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 5AE6 22 KB
23 KB 27ms
27ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

846bd48d42ee1faacae0f2735f4493c9e90134f170239ac8fb1c860d4d7b7528

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 12 Apr 2022 05:15:56 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=29483319
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 23006
expires: Sun, 19 Mar 2023 11:04:36 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 5AE6 23 KB
23 KB 27ms
27ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS