termalfurdok.com Open in urlscan Pro
87.76.31.107 Public Scan

Software

cafe /

Resource Hash

00fc36efa80984040cbe5d8e3e179cd766718ef2f8ef7109998b4ec2eb204772

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Timing-Allow-Origin: *
Date: Sat, 02 Oct 2021 22:55:44 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: cafe
ETag: 10800777988912704457
Vary: Accept-Encoding, Origin
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: private, max-age=3600
Cross-Origin-Resource-Policy: cross-origin
Content-Disposition: attachment; filename="f.txt"
Content-Type: text/javascript; charset=UTF-8
Content-Length: 50861
X-XSS-Protection: 0
Expires: Sat, 02 Oct 2021 22:55:44 GMT

GET
H/1.1 200
OK smush-lazy-load.min.js Show response
termalfurdok.com/en/wp-content/plugins/wp-smushit/app/assets/js/ 8 KB
8 KB 86ms
31ms Script
application/javascript 87.76.31.107
FOURD-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://termalfurdok.com/en/wp-content/plugins/wp-smushit/app/assets/js/smush-lazy-load.min.js?ver=3.9.0
Requested by: Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/
Protocol: HTTP/1.1
Server: 87.76.31.107 , United States, ASN31463 (FOURD-AS, GB),
Reverse DNS: odin.uk-webservers.com
Software: Apache /
Resource Hash: f65784e5e7332dc1e4bbeacbec70fdeef4a1bea84f16ce2ee144999719d195ce

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: termalfurdok.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: */*
Referer: http://termalfurdok.com/en/spa-hotels-in-budapest/
Connection: keep-alive
Cache-Control: no-cache
Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/en/spa-hotels-in-budapest/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 02 Oct 2021 22:55:44 GMT
Last-Modified: Sat, 18 Sep 2021 09:45:33 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 7922

GET
H/1.1 200
OK wp-embed.min.js Show response
termalfurdok.com/en/wp-includes/js/ 1 KB
2 KB 90ms
29ms Script
application/javascript 87.76.31.107
FOURD-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://termalfurdok.com/en/wp-includes/js/wp-embed.min.js?ver=5.8.1
Requested by: Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/
Protocol: HTTP/1.1
Server: 87.76.31.107 , United States, ASN31463 (FOURD-AS, GB),
Reverse DNS: odin.uk-webservers.com
Software: Apache /
Resource Hash: 5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: termalfurdok.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: */*
Referer: http://termalfurdok.com/en/spa-hotels-in-budapest/
Connection: keep-alive
Cache-Control: no-cache
Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/en/spa-hotels-in-budapest/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 02 Oct 2021 22:55:44 GMT
Last-Modified: Wed, 06 Jan 2021 20:59:24 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 1426

GET
DATA 200
OK truncated
/ 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/gif

GET
H/1.1 200
OK ubuntu-v11-latin-ext_latin-regular.woff2
termalfurdok.com/en/wp-content/themes/poseidon/assets/fonts/ 65 KB
65 KB 29ms
29ms Font
font/woff2 87.76.31.107
FOURD-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://termalfurdok.com/en/wp-content/themes/poseidon/assets/fonts/ubuntu-v11-latin-ext_latin-regular.woff2
Requested by: Host: termalfurdok.com
URL: http://termalfurdok.com/en/wp-content/themes/poseidon/assets/css/custom-fonts.css?ver=20180413
Protocol: HTTP/1.1
Server: 87.76.31.107 , United States, ASN31463 (FOURD-AS, GB),
Reverse DNS: odin.uk-webservers.com
Software: Apache /
Resource Hash: 9738e74b15ccfde5d94d73c5f7fff840e1c58027b9e4a34c4be6a198ea590daf

Request headers

Pragma: no-cache
Origin: http://termalfurdok.com
Accept-Encoding: gzip, deflate
Host: termalfurdok.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: */*
Cache-Control: no-cache
Referer: http://termalfurdok.com/en/wp-content/themes/poseidon/assets/css/custom-fonts.css?ver=20180413
Connection: keep-alive
Referer: http://termalfurdok.com/en/wp-content/themes/poseidon/assets/css/custom-fonts.css?ver=20180413
Origin: http://termalfurdok.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 02 Oct 2021 22:55:44 GMT
Last-Modified: Sun, 13 Jan 2019 17:11:08 GMT
Server: Apache
Content-Type: font/woff2
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=95
Content-Length: 66640

GET
H/1.1 200
OK raleway-v12-latin-ext_latin-700.woff2
termalfurdok.com/en/wp-content/themes/poseidon/assets/fonts/ 32 KB
32 KB 29ms
29ms Font
font/woff2 87.76.31.107
FOURD-AS

General

Check archive.org

Show headers Download Go to

Full URL: http://termalfurdok.com/en/wp-content/themes/poseidon/assets/fonts/raleway-v12-latin-ext_latin-700.woff2
Requested by: Host: termalfurdok.com
URL: http://termalfurdok.com/en/wp-content/themes/poseidon/assets/css/custom-fonts.css?ver=20180413
Protocol: HTTP/1.1
Server: 87.76.31.107 , United States, ASN31463 (FOURD-AS, GB),
Reverse DNS: odin.uk-webservers.com
Software: Apache /
Resource Hash: b2b6ba4b6ceeeae0efb23f67b9ae53bdc72ffb7bd149e0f63104d855712a506c

Request headers

Pragma: no-cache
Origin: http://termalfurdok.com
Accept-Encoding: gzip, deflate
Host: termalfurdok.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: */*
Cache-Control: no-cache
Referer: http://termalfurdok.com/en/wp-content/themes/poseidon/assets/css/custom-fonts.css?ver=20180413
Connection: keep-alive
Referer: http://termalfurdok.com/en/wp-content/themes/poseidon/assets/css/custom-fonts.css?ver=20180413
Origin: http://termalfurdok.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 02 Oct 2021 22:55:44 GMT
Last-Modified: Sun, 13 Jan 2019 17:11:08 GMT
Server: Apache
Content-Type: font/woff2
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 32548

GET
DATA 200
OK truncated
/ 14 KB
14 KB Font
application/x-font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1cfd32e37f8aba263101f06e8f702adfaef55a6601857cf5e2c6dd0b0388dcd6

Request headers

Referer: http://termalfurdok.com/
Origin: http://termalfurdok.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: application/x-font-woff;charset=utf-8

GET
H/1.1 200
OK flexiproduct.js Show response
aff.bstatic.com/static/affiliate_base/js/ 6 KB
3 KB 48ms
18ms Script
application/javascript 5.57.16.90
BOOKING-BV Bookin...

General

Check archive.org

Show headers Download Go to

Full URL

http://aff.bstatic.com/static/affiliate_base/js/flexiproduct.js?v=1633215344378

Requested by

Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/

Protocol

HTTP/1.1

Server

5.57.16.90 Amsterdam, Netherlands, ASN43996 (BOOKING-BV Booking.com, NL),

Reverse DNS

bstatic.com

Software

nginx /

Resource Hash

c553ef7271334af93285181e0b891ecc964712f12d02af54ecee9c58354c71e6

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:44 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 10:19:54 GMT
server: nginx
etag: W/"5e39454a-186e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
transfer-encoding: chunked
timing-allow-origin: *
nel: {"report_to":"default","max_age":600}
x-xss-protection: 1; mode=block
expires: Mon, 01 Nov 2021 22:55:44 GMT

GET
H/1.1 200
OK flexiproduct.js Show response
aff.bstatic.com/static/affiliate_base/js/ 6 KB
3 KB 54ms
22ms Script
application/javascript 5.57.16.90
BOOKING-BV Bookin...

General

Check archive.org

Show headers Download Go to

Full URL

http://aff.bstatic.com/static/affiliate_base/js/flexiproduct.js?v=1633215344379

Requested by

Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/

Protocol

HTTP/1.1

Server

5.57.16.90 Amsterdam, Netherlands, ASN43996 (BOOKING-BV Booking.com, NL),

Reverse DNS

bstatic.com

Software

nginx /

Resource Hash

c553ef7271334af93285181e0b891ecc964712f12d02af54ecee9c58354c71e6

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:44 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 10:19:54 GMT
server: nginx
etag: W/"5e39454a-186e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
transfer-encoding: chunked
timing-allow-origin: *
nel: {"report_to":"default","max_age":600}
x-xss-protection: 1; mode=block
expires: Mon, 01 Nov 2021 22:55:44 GMT

GET
H/1.1 200
OK cropped-termalfurdok-logo-250.jpg
termalfurdok.com/en/wp-content/uploads/2019/01/ 3 KB
4 KB 28ms
28ms Image
image/jpeg 87.76.31.107
FOURD-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://termalfurdok.com/en/wp-content/uploads/2019/01/cropped-termalfurdok-logo-250.jpg
Requested by: Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/
Protocol: HTTP/1.1
Server: 87.76.31.107 , United States, ASN31463 (FOURD-AS, GB),
Reverse DNS: odin.uk-webservers.com
Software: Apache /
Resource Hash: f319292820be9751b940fc4abf36e5a12d516283322d41b2524d5429ccb54da9

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: termalfurdok.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://termalfurdok.com/en/spa-hotels-in-budapest/
Connection: keep-alive
Cache-Control: no-cache
Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/en/spa-hotels-in-budapest/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 02 Oct 2021 22:55:44 GMT
Last-Modified: Sat, 26 Jan 2019 15:15:14 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 3390

GET
H/1.1 200
OK Danubius-Margitsziget-840x560.jpg
termalfurdok.com/en/wp-content/uploads/2021/02/ 103 KB
103 KB 30ms
30ms Image
image/jpeg 87.76.31.107
FOURD-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: http://termalfurdok.com/en/wp-content/uploads/2021/02/Danubius-Margitsziget-840x560.jpg
Requested by: Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/
Protocol: HTTP/1.1
Server: 87.76.31.107 , United States, ASN31463 (FOURD-AS, GB),
Reverse DNS: odin.uk-webservers.com
Software: Apache /
Resource Hash: 89a4e3406020fb566a309395edfa75e18333c18c63363b08cc569215b9557bdb

Request headers

Pragma: no-cache
Accept-Encoding: gzip, deflate
Host: termalfurdok.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://termalfurdok.com/en/spa-hotels-in-budapest/
Connection: keep-alive
Cache-Control: no-cache
Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/en/spa-hotels-in-budapest/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Date: Sat, 02 Oct 2021 22:55:44 GMT
Last-Modified: Mon, 15 Feb 2021 22:22:32 GMT
Server: Apache
Content-Type: image/jpeg
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=94
Content-Length: 105441

GET
H2 200 show_ads_impl_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/ 257 KB
95 KB 112ms
70ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/show_ads_impl_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3523f4564607513e81b5fd0c6612a4e7dd94cce6830b24843bcb79b277d253ca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 97121
x-xss-protection: 0
server: cafe
etag: 1204139040078545873
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sat, 02 Oct 2021 22:55:44 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210927/r20190131/ Frame FCFB 10 KB
5 KB 32ms
9ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210927/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8806d9eaf9e8ca89fa2404e8cb66a9fa115e0a0f687ad0dcd91cabce4c2179c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210927/r20190131/zrt_lookup.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://termalfurdok.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Fri, 01 Oct 2021 23:50:07 GMT
expires: Fri, 15 Oct 2021 23:50:07 GMT
content-type: text/html; charset=UTF-8
etag: 297313706323796346
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4617
x-xss-protection: 0
age: 83137
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200
OK

flexiproduct.html Show response
www.booking.com/ Frame 3F62
Redirect Chain

http://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344458&
https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344458&

90 KB
36 KB

246ms
225ms

Document
text/html

37.10.0.220
BOOKING-BV Bookin...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344458&

Requested by

Host: aff.bstatic.com
URL: http://aff.bstatic.com/static/affiliate_base/js/flexiproduct.js?v=1633215344378

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

37.10.0.220 , Netherlands, ASN43996 (BOOKING-BV Booking.com, NL),

Reverse DNS

Software

nginx /

Resource Hash

ea922d3ee4bb41d831f2c1c6ef6bc4e829091bcfa0b00c46d67e8152d8038674

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: www.booking.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://termalfurdok.com/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/

Response headers

server: nginx
date: Sat, 02 Oct 2021 22:55:44 GMT
content-type: text/html; charset=UTF-8
content-length: 36213
cache-control: private
vary: User-Agent, Accept-Encoding
content-encoding: br
nel: {"report_to":"default","max_age":604800}
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"group":"default","max_age":604800}
set-cookie: _pxhd=m5m5nqsWzYjDl8a1xDn917bboSobXCrmE2bOC8nC62vifSl8yBGMQYmU9GdEvInbnITisoqDJe4aFRU8fRQdjA%3D%3D%3AvCKPEJ0PvcKlXSxBvddEzZQupyLcEKnIWAKzcxKNKX8mhOJJK-rW57WyjOuqrNr8HsPPmyRc7hQ0ySBbKyHMRxjDTEdaGextr9Vcq5GGcLA%3D; path=/; expires=Sun, 02-Oct-2022 22:55:44 GMT bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzkhhYkWbWhUNGi8Mf67MyRUB0%2FZCxgE%2FmN2UZhCB8mzyIAhzBPU0Cfov8oPuhKI15KbMT0myw1LF6kshc8GWrSrvHkJV6lg7W7nemqFq3VF0Pn6pkY9CnWFNKYEK8fR1hIWFbQUGuEWkEr%2Bp9Ywnr5x; domain=.booking.com; path=/; expires=Thu, 01-Oct-2026 22:55:44 GMT; Secure; HTTPOnly; SameSite=None
strict-transport-security: max-age=604800
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

Redirect headers

server: nginx
date: Sat, 02 Oct 2021 22:55:44 GMT
transfer-encoding: chunked
location: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344458&
content-security-policy-report-only: frame-ancestors 'none'; report-uri https://reports.booking.com/csp_violation?type=report&tag=112&pid=148aa1385ba10084&e=UmFuZG9tSVYkc2RlIyh9YRXtvWBsZHB6V-Jh6sqVBe8YBtG3dZY9MvUNWqZCb8DegeMA3nUG4vU&f=0&s=0;
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

flexiproduct.html Show response
www.booking.com/ Frame ED52
Redirect Chain

http://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344459&
https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344459&

90 KB
37 KB

227ms
206ms

Document
text/html

37.10.0.220
BOOKING-BV Bookin...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344459&

Requested by

Host: aff.bstatic.com
URL: http://aff.bstatic.com/static/affiliate_base/js/flexiproduct.js?v=1633215344378

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

37.10.0.220 , Netherlands, ASN43996 (BOOKING-BV Booking.com, NL),

Reverse DNS

Software

nginx /

Resource Hash

e4980a894e746df7b02c9ca2a6eaff9464131fe732a451218ce0071052d550b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: www.booking.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: http://termalfurdok.com/
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/

Response headers

server: nginx
date: Sat, 02 Oct 2021 22:55:44 GMT
content-type: text/html; charset=UTF-8
content-length: 36305
cache-control: private
vary: Accept-Encoding, User-Agent
content-encoding: br
nel: {"max_age":604800,"report_to":"default"}
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":604800,"group":"default"}
set-cookie: _pxhd=pbaxcdX9%2FlZ6P7fOiH7CsFx%2F7G0h7btjeIrVKqT-pS-8RnJC72oVzgCmTzfYqYLM8N%2FCZd2GTAoRPvVOL3e-PA%3D%3D%3Avro0Ij5wwGKE3ZIgWxZ%2F5Ov097SgqLfWM0q7zPNcwpQikwQOTIMoE752MDHpy-rs2iF1jrHRJTyGRRkpoB8DQWp3pQjk1kTEpmCuB%2FtYmKU%3D; path=/; expires=Sun, 02-Oct-2022 22:55:44 GMT bkng=11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbKE7bjkbYWzl4f7x2DZd7NKuVtQMztB1zmiPzjc%2B%2BZ0pkmcr0csE5stRw0VwHPyNWCTLhLpWllxitxZ75xIfCc4WeykS7dd3jcwV1ZZIpaFRFOUtKIxEQbJnIUhDuwpuD%2B2S8kvEra7njPrqX%2B%2Bof7Bp9dmwnIBOz; domain=.booking.com; path=/; expires=Thu, 01-Oct-2026 22:55:44 GMT; Secure; HTTPOnly; SameSite=None
strict-transport-security: max-age=604800
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

Redirect headers

server: nginx
date: Sat, 02 Oct 2021 22:55:44 GMT
transfer-encoding: chunked
location: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344459&
content-security-policy-report-only: frame-ancestors 'none'; report-uri https://reports.booking.com/csp_violation?type=report&tag=112&pid=0ebaa138239a00b2&e=UmFuZG9tSVYkc2RlIyh9YRXtvWBsZHB6V-Jh6sqVBe_XWXkPUpqx99H_WgSOGfJS_DnO4HAUYkg&f=0&s=0;
x-xss-protection: 1; mode=block

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 206 B
661 B 54ms
16ms Script
text/javascript 216.58.212.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=termalfurdok.com&callback=_gfp_s_&client=ca-pub-1872235783335290

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.162 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f2.1e100.net

Software

cafe /

Resource Hash

51f10a87f839b480e469c1aa114a01de32c35837a306d7000550b22dbe706b05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 195
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
570 B 38ms
15ms Script
application/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=termalfurdok.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 02 Oct 2021 22:55:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame E9C8 78 KB
27 KB 557ms
557ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=197&slotname=2957124963&adk=1956586784&adf=1298624447&pi=t.ma~as.2957124963&w=787&fwrn=4&lmt=1633215344&rafmt=11&psa=0&format=787x197&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&wgl=1&dt=1633215344441&bpp=4&bdt=256&idt=170&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&correlator=8513168085096&frm=20&pv=2&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=192&ady=1764&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=DPuA2G4kkN&p=http%3A//termalfurdok.com&dtd=187

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7d05ae55758d823bc92097942a83b629069c399ced7c3aeffd99e2d2bcaeacb1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1872235783335290&output=html&h=197&slotname=2957124963&adk=1956586784&adf=1298624447&pi=t.ma~as.2957124963&w=787&fwrn=4&lmt=1633215344&rafmt=11&psa=0&format=787x197&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&wgl=1&dt=1633215344441&bpp=4&bdt=256&idt=170&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&correlator=8513168085096&frm=20&pv=2&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=192&ady=1764&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=DPuA2G4kkN&p=http%3A//termalfurdok.com&dtd=187
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://termalfurdok.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 02 Oct 2021 22:55:45 GMT
server: cafe
content-length: 27644
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 02-Oct-2021 23:10:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 02 Oct 2021 22:55:45 GMT
cache-control: private

GET
H/1.1 204
No Content gen_204
pagead2.googlesyndication.com/pagead/ 0
459 B 22ms
21ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://pagead2.googlesyndication.com/pagead/gen_204?id=ach_evt&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&tn=HEADER&id=masthead&cls=site-header%20clearfix&ign=false&pw=1600&ph=1200&x=0&y=0

Requested by

Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/

Protocol

HTTP/1.1

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 02 Oct 2021 22:55:44 GMT
X-Content-Type-Options: nosniff
Server: cafe
Timing-Allow-Origin: *
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: no-cache, must-revalidate
Cross-Origin-Resource-Policy: cross-origin
Content-Type: image/gif
Content-Length: 0
X-XSS-Protection: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 486A 265 KB
53 KB 766ms
766ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&adk=1812271804&adf=3025194257&lmt=1633215344&plat=2%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&ea=0&flash=0&pra=7&wgl=1&dt=1633215344453&bpp=1&bdt=268&idt=181&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&prev_fmts=787x197&nras=1&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&pvsid=1693012635705270&pem=666&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=2&uci=a!2&fsb=1&dtd=187

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/show_ads_impl_fy2019.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fe8344224cf0cbd92986a193656794634c1ffc8c6aa8c1afd1a61625f6e1ba58

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1872235783335290&output=html&adk=1812271804&adf=3025194257&lmt=1633215344&plat=2%3A16777216%2C3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32&format=0x0&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&ea=0&flash=0&pra=7&wgl=1&dt=1633215344453&bpp=1&bdt=268&idt=181&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&prev_fmts=787x197&nras=1&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&pvsid=1693012635705270&pem=666&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=23&ifi=2&uci=a!2&fsb=1&dtd=187
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://termalfurdok.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 02 Oct 2021 22:55:45 GMT
server: cafe
content-length: 54053
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Sat, 02-Oct-2021 23:10:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 02 Oct 2021 22:55:45 GMT
cache-control: private

GET
H2 200 82b674edb949dddf78e02d76e8593771bf2e85d5.css
cf.bstatic.com/static/affiliate_base/css/flexifonts_cloudfront_sd/ Frame ED52 1 KB
1015 B 46ms
7ms Stylesheet
text/css 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/static/affiliate_base/css/flexifonts_cloudfront_sd/82b674edb949dddf78e02d76e8593771bf2e85d5.css

Requested by

Host: www.booking.com
URL: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344459&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b40bd50a4795ccd4a8b88ff70fb14074d2f0bf599e072e98ccd302cfeb436b8a

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 02:55:21 GMT
content-encoding: br
nel: {"report_to":"default","max_age":600}
age: 1540823
via: 1.1 ab985bb6f3435d42701015dfa6015878.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Fri, 05 Jun 2020 14:42:31 GMT
server: nginx
etag: W/"5eda59d7-51a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P5
timing-allow-origin: *
x-amz-cf-id: IuQHAXGN61Ii3XbAgtV1BzWD8b7zTr1JJ8CZRBQxjYjONNovxy1CoA==
expires: Fri, 15 Oct 2021 02:55:21 GMT

GET
H2 200 f6d29e089da85314827d24b5e412d273b710cf84.css
cf.bstatic.com/static/affiliate_base/css/flexi_common_base_cloudfront_sd/ Frame ED52 11 KB
3 KB 46ms
7ms Stylesheet
text/css 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/static/affiliate_base/css/flexi_common_base_cloudfront_sd/f6d29e089da85314827d24b5e412d273b710cf84.css

Requested by

Host: www.booking.com
URL: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344459&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3c37aa402d060ff9a8c441cd6918a1859cb6358eee091d9b7a7a6b12447e74b

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 17:58:57 GMT
content-encoding: br
nel: {"report_to":"default","max_age":600}
age: 1745807
via: 1.1 ab985bb6f3435d42701015dfa6015878.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Fri, 05 Jun 2020 10:23:33 GMT
server: nginx
etag: W/"5eda1d25-2ae3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P5
timing-allow-origin: *
x-amz-cf-id: bjYpBezptmqZhbZH8VQ1tfp1ZquWEL6ZxQJmCLAFisozjfzvIa8nQg==
expires: Tue, 12 Oct 2021 17:58:57 GMT

GET
H2 200 0579e1e4d20e28f92adaba484f8f11a42e2b5e68.css
cf.bstatic.com/static/affiliate_base/css/flexi_common_elems_cloudfront_sd/ Frame ED52 13 KB
3 KB 46ms
8ms Stylesheet
text/css 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/static/affiliate_base/css/flexi_common_elems_cloudfront_sd/0579e1e4d20e28f92adaba484f8f11a42e2b5e68.css

Requested by

Host: www.booking.com
URL: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344459&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

0fe3b9faabb14dd0bf83ae0848aa86f1520857f00c96913cc1217bd04909da12

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 22:35:42 GMT
content-encoding: br
nel: {"report_to":"default","max_age":600}
age: 1815602
via: 1.1 ab985bb6f3435d42701015dfa6015878.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Wed, 10 Apr 2019 11:21:19 GMT
server: nginx
etag: W/"5cadd1af-32e1"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P5
timing-allow-origin: *
x-amz-cf-id: rXcZjK4iwFLd36zQXqLAT6fCBdBMCdCpWjFDJTmjcE4rEzddTCj-hA==
expires: Mon, 11 Oct 2021 22:35:42 GMT

GET
H2 200 3eb8e6d9f9a04e3583a9e8d949a559d3fad5c8c4.css
cf.bstatic.com/static/affiliate_base/css/flexi_product_nsb/ Frame ED52 952 B
1 KB 46ms
8ms Stylesheet
text/css 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/static/affiliate_base/css/flexi_product_nsb/3eb8e6d9f9a04e3583a9e8d949a559d3fad5c8c4.css

Requested by

Host: www.booking.com
URL: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344459&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

601642ecd5e7a89187e12278ef792ecfe176c4553f7dc792557177a4048488e2

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 12:03:27 GMT
via: 1.1 ab985bb6f3435d42701015dfa6015878.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
age: 2285537
x-cache: Hit from cloudfront
content-length: 952
x-xss-protection: 1; mode=block
last-modified: Wed, 10 Apr 2019 11:21:19 GMT
server: nginx
etag: "5cadd1af-3b8"
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P5
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: H_tu9DpAwQaKQOrBLu5XVBPdRVwNpmB31hiz8BJg6oDeSv3P_pAxrg==
expires: Wed, 06 Oct 2021 12:03:27 GMT

GET
H2 200 ebc3273565b5e682ccaf01872d2e046749306442.png
cf.bstatic.com/static/img/affiliate_base/flexi/booking_logo_blue/ Frame ED52 3 KB
3 KB 9ms
7ms Image
image/png 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cf.bstatic.com/static/img/affiliate_base/flexi/booking_logo_blue/ebc3273565b5e682ccaf01872d2e046749306442.png

Requested by

Host: www.booking.com
URL: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344459&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

69f81eea02cf09defcdb0c916f7ca869498f0d7045318c8ebfe469d2872cbbfa

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 04 Sep 2021 02:29:33 GMT
via: 1.1 ab985bb6f3435d42701015dfa6015878.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
age: 2492771
x-cache: Hit from cloudfront
content-length: 2904
x-xss-protection: 1; mode=block
last-modified: Wed, 10 Apr 2019 11:21:50 GMT
server: nginx
etag: "5cadd1ce-b58"
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P5
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: uvFGV5SzEPAcdXL6UIuUtmGvevURWpmf-4FObc9OzxBfG_cphroo3w==
expires: Mon, 04 Oct 2021 02:29:33 GMT

GET
H2 200 2e1059de66c6a928c4ea7e843b9ffbd51cc3e15d.js Show response
cf.bstatic.com/static/affiliate_base/js/flexiproduct_core_cloudfront_sd/ Frame ED52 123 KB
39 KB 47ms
9ms Script
application/javascript 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/static/affiliate_base/js/flexiproduct_core_cloudfront_sd/2e1059de66c6a928c4ea7e843b9ffbd51cc3e15d.js

Requested by

Host: www.booking.com
URL: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344459&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

0b01b0858503cb5946f0c5c1b7c59a3be705eab43b2c6ce1526a7a7509ac63b9

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.booking.com/
Origin: https://www.booking.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:49:39 GMT
content-encoding: br
nel: {"report_to":"default","max_age":600}
age: 2127965
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Tue, 04 Feb 2020 10:19:54 GMT
server: nginx
etag: W/"5e39454a-1ecfc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P5
timing-allow-origin: *
x-amz-cf-id: HucsyzFpWAYV_Njn5hglh7mt7ROCaBd8XnGnIgAfZ9NG_BdyRF1GAQ==
expires: Fri, 08 Oct 2021 07:49:39 GMT

GET
H2 200 eb78197b2eee9a032c319d91a6e1c581e295f284.js Show response
cf.bstatic.com/static/affiliate_base/js/flexiproduct_core_components_cloudfront_sd/ Frame ED52 33 KB
11 KB 55ms
18ms Script
application/javascript 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/static/affiliate_base/js/flexiproduct_core_components_cloudfront_sd/eb78197b2eee9a032c319d91a6e1c581e295f284.js

Requested by

Host: www.booking.com
URL: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344459&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

fd0370177238527421278d27eb652e22a25d20784438f81f114b09f5a349e06d

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.booking.com/
Origin: https://www.booking.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 20:58:07 GMT
content-encoding: br
nel: {"report_to":"default","max_age":600}
age: 1475857
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Tue, 04 Feb 2020 10:19:54 GMT
server: nginx
etag: W/"5e39454a-84eb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P5
timing-allow-origin: *
x-amz-cf-id: fInAjKyAHjHT8LHNL76oK1NhcI2BJIkhjAmSxozPU8_jDnxigaVuAA==
expires: Fri, 15 Oct 2021 20:58:07 GMT

GET
H2 200 a620a252f1d0110ab972e81348133431e8486098.js Show response
cf.bstatic.com/static/affiliate_base/js/flexi_nsb_cloudfront_sd/ Frame ED52 2 KB
1 KB 18ms
16ms Script
application/javascript 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/static/affiliate_base/js/flexi_nsb_cloudfront_sd/a620a252f1d0110ab972e81348133431e8486098.js

Requested by

Host: www.booking.com
URL: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344459&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

9afc14c1ac2584619b29bf2232f3ddd9da032d3acdf769e48ff7736f55a16e4e

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.booking.com/
Origin: https://www.booking.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 17:22:51 GMT
content-encoding: br
nel: {"report_to":"default","max_age":600}
age: 1575173
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Tue, 04 Feb 2020 10:19:54 GMT
server: nginx
etag: W/"5e39454a-903"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P5
timing-allow-origin: *
x-amz-cf-id: f8vUj2HF6WIyZG8811HD_JtS7MIej5IK5tTqWNrtDHXUuNY1fCElGQ==
expires: Thu, 14 Oct 2021 17:22:51 GMT

GET
H2 200 7e03f1178ca725d97fdd726255c96b3e71b660d2.js Show response
cf.bstatic.com/static/affiliate_base/js/flexi_responsive_cloudfront_sd/ Frame ED52 392 B
968 B 18ms
16ms Script
application/javascript 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/static/affiliate_base/js/flexi_responsive_cloudfront_sd/7e03f1178ca725d97fdd726255c96b3e71b660d2.js

Requested by

Host: www.booking.com
URL: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344459&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

ec9e5f73690e9e6f199bdb463ce1ecd83960019884fdef77d916c3a8aa14a76e

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.booking.com/
Origin: https://www.booking.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 10:09:53 GMT
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
age: 1428354
x-cache: Hit from cloudfront
content-length: 392
x-xss-protection: 1; mode=block
last-modified: Tue, 04 Feb 2020 10:19:54 GMT
server: nginx
etag: "5e39454a-188"
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P5
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: hwhslxHwRpwrAMqRv-2UJLZ3YsRqjBmHNGR3yXTnnqp0e750IXzJbg==
expires: Sat, 16 Oct 2021 10:09:50 GMT

GET
H2 200 82b674edb949dddf78e02d76e8593771bf2e85d5.css
cf.bstatic.com/static/affiliate_base/css/flexifonts_cloudfront_sd/ Frame 3F62 1 KB
1014 B 33ms
8ms Stylesheet
text/css 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/static/affiliate_base/css/flexifonts_cloudfront_sd/82b674edb949dddf78e02d76e8593771bf2e85d5.css

Requested by

Host: www.booking.com
URL: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344458&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b40bd50a4795ccd4a8b88ff70fb14074d2f0bf599e072e98ccd302cfeb436b8a

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 02:55:21 GMT
content-encoding: br
nel: {"report_to":"default","max_age":600}
age: 1540823
via: 1.1 ab985bb6f3435d42701015dfa6015878.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Fri, 05 Jun 2020 14:42:31 GMT
server: nginx
etag: W/"5eda59d7-51a"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P5
timing-allow-origin: *
x-amz-cf-id: 0c7nFIhEuYMVuszJXhjfLtyGY_-dx44BJtuYPOJeHd1_PEEwdf5pYg==
expires: Fri, 15 Oct 2021 02:55:21 GMT

GET
H2 200 f6d29e089da85314827d24b5e412d273b710cf84.css
cf.bstatic.com/static/affiliate_base/css/flexi_common_base_cloudfront_sd/ Frame 3F62 11 KB
3 KB 33ms
9ms Stylesheet
text/css 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/static/affiliate_base/css/flexi_common_base_cloudfront_sd/f6d29e089da85314827d24b5e412d273b710cf84.css

Requested by

Host: www.booking.com
URL: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344458&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3c37aa402d060ff9a8c441cd6918a1859cb6358eee091d9b7a7a6b12447e74b

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 17:58:57 GMT
content-encoding: br
nel: {"report_to":"default","max_age":600}
age: 1745807
via: 1.1 ab985bb6f3435d42701015dfa6015878.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Fri, 05 Jun 2020 10:23:33 GMT
server: nginx
etag: W/"5eda1d25-2ae3"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P5
timing-allow-origin: *
x-amz-cf-id: Jsk1b13fOMc4Qy4SBYEeoY-i-j1cpR8J4RLbf-uHBMFrkJASScKmRA==
expires: Tue, 12 Oct 2021 17:58:57 GMT

GET
H2 200 0579e1e4d20e28f92adaba484f8f11a42e2b5e68.css
cf.bstatic.com/static/affiliate_base/css/flexi_common_elems_cloudfront_sd/ Frame 3F62 13 KB
3 KB 34ms
9ms Stylesheet
text/css 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/static/affiliate_base/css/flexi_common_elems_cloudfront_sd/0579e1e4d20e28f92adaba484f8f11a42e2b5e68.css

Requested by

Host: www.booking.com
URL: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344458&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

0fe3b9faabb14dd0bf83ae0848aa86f1520857f00c96913cc1217bd04909da12

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 11 Sep 2021 22:35:42 GMT
content-encoding: br
nel: {"report_to":"default","max_age":600}
age: 1815602
via: 1.1 ab985bb6f3435d42701015dfa6015878.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Wed, 10 Apr 2019 11:21:19 GMT
server: nginx
etag: W/"5cadd1af-32e1"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P5
timing-allow-origin: *
x-amz-cf-id: 9XE59kLl2umE64HXzx4bDPCYOfdK4gJJ1bhmP03UIUniE0qA-OMewg==
expires: Mon, 11 Oct 2021 22:35:42 GMT

GET
H2 200 3eb8e6d9f9a04e3583a9e8d949a559d3fad5c8c4.css
cf.bstatic.com/static/affiliate_base/css/flexi_product_nsb/ Frame 3F62 952 B
1 KB 33ms
9ms Stylesheet
text/css 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/static/affiliate_base/css/flexi_product_nsb/3eb8e6d9f9a04e3583a9e8d949a559d3fad5c8c4.css

Requested by

Host: www.booking.com
URL: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344458&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

601642ecd5e7a89187e12278ef792ecfe176c4553f7dc792557177a4048488e2

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Mon, 06 Sep 2021 12:03:27 GMT
via: 1.1 ab985bb6f3435d42701015dfa6015878.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
age: 2285537
x-cache: Hit from cloudfront
content-length: 952
x-xss-protection: 1; mode=block
last-modified: Wed, 10 Apr 2019 11:21:19 GMT
server: nginx
etag: "5cadd1af-3b8"
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P5
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: QjXGgjd9i3oAM-_gIj1cPEgrS-Dh9k1_5ADBIqet3DQJAOLWlA8KWg==
expires: Wed, 06 Oct 2021 12:03:27 GMT

GET
H2 200 ebc3273565b5e682ccaf01872d2e046749306442.png
cf.bstatic.com/static/img/affiliate_base/flexi/booking_logo_blue/ Frame 3F62 3 KB
3 KB 9ms
8ms Image
image/png 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cf.bstatic.com/static/img/affiliate_base/flexi/booking_logo_blue/ebc3273565b5e682ccaf01872d2e046749306442.png

Requested by

Host: www.booking.com
URL: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344458&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

69f81eea02cf09defcdb0c916f7ca869498f0d7045318c8ebfe469d2872cbbfa

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 04 Sep 2021 02:29:33 GMT
via: 1.1 ab985bb6f3435d42701015dfa6015878.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
age: 2492771
x-cache: Hit from cloudfront
content-length: 2904
x-xss-protection: 1; mode=block
last-modified: Wed, 10 Apr 2019 11:21:50 GMT
server: nginx
etag: "5cadd1ce-b58"
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P5
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: TwWFzjFq9rGKUndEQaD0Ozro9aQtbCxqFiBeuvlDNtlUdj3r69BetQ==
expires: Mon, 04 Oct 2021 02:29:33 GMT

GET
H2 200 2e1059de66c6a928c4ea7e843b9ffbd51cc3e15d.js Show response
cf.bstatic.com/static/affiliate_base/js/flexiproduct_core_cloudfront_sd/ Frame 3F62 123 KB
39 KB 43ms
20ms Script
application/javascript 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/static/affiliate_base/js/flexiproduct_core_cloudfront_sd/2e1059de66c6a928c4ea7e843b9ffbd51cc3e15d.js

Requested by

Host: www.booking.com
URL: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344458&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

0b01b0858503cb5946f0c5c1b7c59a3be705eab43b2c6ce1526a7a7509ac63b9

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.booking.com/
Origin: https://www.booking.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 08 Sep 2021 07:49:39 GMT
content-encoding: br
nel: {"report_to":"default","max_age":600}
age: 2127965
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Tue, 04 Feb 2020 10:19:54 GMT
server: nginx
etag: W/"5e39454a-1ecfc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P5
timing-allow-origin: *
x-amz-cf-id: 9VHvKi3Z3CGEH1A1SHY_5pDthkTHyWWUdbi4JB2mJC1pRq3qdHM0XQ==
expires: Fri, 08 Oct 2021 07:49:39 GMT

GET
H2 200 eb78197b2eee9a032c319d91a6e1c581e295f284.js Show response
cf.bstatic.com/static/affiliate_base/js/flexiproduct_core_components_cloudfront_sd/ Frame 3F62 33 KB
11 KB 49ms
26ms Script
application/javascript 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/static/affiliate_base/js/flexiproduct_core_components_cloudfront_sd/eb78197b2eee9a032c319d91a6e1c581e295f284.js

Requested by

Host: www.booking.com
URL: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344458&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

fd0370177238527421278d27eb652e22a25d20784438f81f114b09f5a349e06d

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.booking.com/
Origin: https://www.booking.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 15 Sep 2021 20:58:07 GMT
content-encoding: br
nel: {"report_to":"default","max_age":600}
age: 1475857
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Tue, 04 Feb 2020 10:19:54 GMT
server: nginx
etag: W/"5e39454a-84eb"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P5
timing-allow-origin: *
x-amz-cf-id: knCwM-ESzfGvfpn6qAZWWg0LeRlAznAD4z5CVw0e-tEttUv2PAoPow==
expires: Fri, 15 Oct 2021 20:58:07 GMT

GET
H2 200 a620a252f1d0110ab972e81348133431e8486098.js Show response
cf.bstatic.com/static/affiliate_base/js/flexi_nsb_cloudfront_sd/ Frame 3F62 2 KB
1 KB 18ms
17ms Script
application/javascript 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/static/affiliate_base/js/flexi_nsb_cloudfront_sd/a620a252f1d0110ab972e81348133431e8486098.js

Requested by

Host: www.booking.com
URL: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344458&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

9afc14c1ac2584619b29bf2232f3ddd9da032d3acdf769e48ff7736f55a16e4e

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.booking.com/
Origin: https://www.booking.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Tue, 14 Sep 2021 17:22:51 GMT
content-encoding: br
nel: {"report_to":"default","max_age":600}
age: 1575173
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Tue, 04 Feb 2020 10:19:54 GMT
server: nginx
etag: W/"5e39454a-903"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P5
timing-allow-origin: *
x-amz-cf-id: jIDVFkJV0TnhzYGdR3CRKCxJws2D5GVSxLBqHNoayF6bfW-fg4taBQ==
expires: Thu, 14 Oct 2021 17:22:51 GMT

GET
H2 200 7e03f1178ca725d97fdd726255c96b3e71b660d2.js Show response
cf.bstatic.com/static/affiliate_base/js/flexi_responsive_cloudfront_sd/ Frame 3F62 392 B
967 B 19ms
17ms Script
application/javascript 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/static/affiliate_base/js/flexi_responsive_cloudfront_sd/7e03f1178ca725d97fdd726255c96b3e71b660d2.js

Requested by

Host: www.booking.com
URL: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344458&

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

ec9e5f73690e9e6f199bdb463ce1ecd83960019884fdef77d916c3a8aa14a76e

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.booking.com/
Origin: https://www.booking.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 16 Sep 2021 10:09:53 GMT
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
age: 1428354
x-cache: Hit from cloudfront
content-length: 392
x-xss-protection: 1; mode=block
last-modified: Tue, 04 Feb 2020 10:19:54 GMT
server: nginx
etag: "5e39454a-188"
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P5
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: dsKNmAMqTKlr6ksxHr0XfhDHsAgOgbPJUMzY4wo-svwjp7JOYgfAMA==
expires: Sat, 16 Oct 2021 10:09:50 GMT

GET
H2 200 750fa5bec9bde5e6e09115b5970b8106f73a5646.woff
cf.bstatic.com/static/fonts/flexi/flexi/ Frame 3F62 8 KB
8 KB 10ms
9ms Font
application/font-woff 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/static/fonts/flexi/flexi/750fa5bec9bde5e6e09115b5970b8106f73a5646.woff

Requested by

Host: cf.bstatic.com
URL: https://cf.bstatic.com/static/affiliate_base/css/flexifonts_cloudfront_sd/82b674edb949dddf78e02d76e8593771bf2e85d5.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

727b71610239254fbeb9000a4774cf87b96bdd0c7eab1b781d67aa916ab6426e

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cf.bstatic.com/static/affiliate_base/css/flexifonts_cloudfront_sd/82b674edb949dddf78e02d76e8593771bf2e85d5.css
Origin: https://www.booking.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 12:25:42 GMT
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
age: 1765803
x-cache: Hit from cloudfront
content-length: 7772
x-xss-protection: 1; mode=block
last-modified: Wed, 10 Apr 2019 11:21:49 GMT
server: nginx
etag: "5cadd1cd-1e5c"
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P5
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: HXd-dc2YZa26EaBsHNGtF2UJItS1Z06x6pbBMtcvR7rCOu3c7EAWSw==
expires: Tue, 12 Oct 2021 12:25:42 GMT

GET
H2 200 750fa5bec9bde5e6e09115b5970b8106f73a5646.woff
cf.bstatic.com/static/fonts/flexi/flexi/ Frame ED52 8 KB
8 KB 8ms
7ms Font
application/font-woff 18.66.112.41
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/static/fonts/flexi/flexi/750fa5bec9bde5e6e09115b5970b8106f73a5646.woff

Requested by

Host: cf.bstatic.com
URL: https://cf.bstatic.com/static/affiliate_base/css/flexifonts_cloudfront_sd/82b674edb949dddf78e02d76e8593771bf2e85d5.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.112.41 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

727b71610239254fbeb9000a4774cf87b96bdd0c7eab1b781d67aa916ab6426e

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://cf.bstatic.com/static/affiliate_base/css/flexifonts_cloudfront_sd/82b674edb949dddf78e02d76e8593771bf2e85d5.css
Origin: https://www.booking.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 12 Sep 2021 12:25:42 GMT
via: 1.1 ffdf2668ac264ec6d8784ccc7453073c.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
age: 1765803
x-cache: Hit from cloudfront
content-length: 7772
x-xss-protection: 1; mode=block
last-modified: Wed, 10 Apr 2019 11:21:49 GMT
server: nginx
etag: "5cadd1cd-1e5c"
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: application/font-woff
access-control-allow-origin: *
cache-control: max-age=2592000
x-amz-cf-pop: FRA56-P5
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: UigZo4f2Buq5mCLlrsgvCXqpxzCkfgM90-FYhxwQAgTQSP0HCnSB9Q==
expires: Tue, 12 Oct 2021 12:25:42 GMT

GET
H/1.1 200
OK fp_view Show response
www.booking.com/affiliate/ Frame ED52 12 B
888 B 92ms
92ms XHR
application/json 37.10.0.220
BOOKING-BV Bookin...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.booking.com/affiliate/fp_view?aid=1741284&target_aid=1741284&product_type=nsb

Requested by

Host: cf.bstatic.com
URL: https://cf.bstatic.com/static/affiliate_base/js/flexiproduct_core_cloudfront_sd/2e1059de66c6a928c4ea7e843b9ffbd51cc3e15d.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

37.10.0.220 , Netherlands, ASN43996 (BOOKING-BV Booking.com, NL),

Reverse DNS

Software

nginx /

Resource Hash

587fa9763e3d74ded3b64a843905f5541690582aad4976207e03743a7fb5f70e

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
X-Booking-CSRF: sBtZYQAAAAA=lrp5tGBN5_p_3J8p_uGaKgeZDzmc9sKWzdLN34XXejQgUSQmxVTcVGoELO96eLwJ_J2NwO0Mvo_DvpTmbpTV4-TgbpUyHcnQWVW59xi_Sa72GKx0Ox9ME2nrGhD_Zy5ezq1k7nlHB-bSPawzOVurVX_898j_yO4jrUoq3bLZym8yuDf2OlyHoUcVpGB_WsaWckK0mv_QLfQiUqWu
Referer: https://www.booking.com/flexiproduct.html?product=nsb&w=100%25&h=auto&lang=en&aid=1741284&target_aid=1741284&df_num_properties=3&fid=1633215344459&
X-Requested-With: XMLHttpRequest
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:45 GMT
transfer-encoding: chunked
x-content-options: nosniff
server: nginx
x-xss-protection: 1; mode=block
strict-transport-security: max-age=604800
content-type: application/json; charset=UTF-8

GET
H2 200 13471153336493675190
tpc.googlesyndication.com/simgad/ Frame E9C8 10 KB
10 KB 37ms
15ms Image
image/png 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/13471153336493675190?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qkXuaNZ46gXOvts3TTLumCbQC3AQg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=197&slotname=2957124963&adk=1956586784&adf=1298624447&pi=t.ma~as.2957124963&w=787&fwrn=4&lmt=1633215344&rafmt=11&psa=0&format=787x197&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&wgl=1&dt=1633215344441&bpp=4&bdt=256&idt=170&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&correlator=8513168085096&frm=20&pv=2&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=192&ady=1764&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=DPuA2G4kkN&p=http%3A//termalfurdok.com&dtd=187

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78feb82facb9dba50234a029caba6508ccb60cca10033a4665e3641ac197a29c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Wed, 29 Sep 2021 14:00:59 GMT
x-content-type-options: nosniff
age: 291286
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10176
x-xss-protection: 0
last-modified: Wed, 17 Feb 2021 15:41:26 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 29 Sep 2022 14:00:59 GMT

GET
H2 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/ Frame E9C8 18 KB
8 KB 30ms
7ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

da48b97b44f32bd333c5ca822e07f0997269db7bbd7e85f514035e02a57624f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:47:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 509
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7607
x-xss-protection: 0
server: cafe
etag: 5036643633216217121
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:47:16 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame E9C8 3 KB
1 KB 30ms
12ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:42:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 789
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:42:36 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E9C8 122 KB
37 KB 31ms
30ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

867ff39044c47d580bde0bfc1e95bfcc25c21738c79351591641a83a56dc6d3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
server: sffe
etag: "1633087504575570"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Sat, 02 Oct 2021 22:55:45 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame E9C8 14 KB
6 KB 27ms
8ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f430df1926f8f2c1211de662c1070de2b98259bfc9bbdd8cf70c7b53d6777cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:35:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1187
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6194
x-xss-protection: 0
server: cafe
etag: 2541472377268313288
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:35:58 GMT

GET
H2 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame E9C8 27 KB
11 KB 32ms
13ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a672e695dab08ffadbea7f0e77f1a723eefff684ae0cdabe2ca3b7a141554c3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 14:44:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29464
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11096
x-xss-protection: 0
server: cafe
etag: 8885281346021324493
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 14:44:41 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame E9C8 0
0 19ms
19ms Fetch
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CMiHPcONYYabEJ9WrrASipLOYDOqWqqdgnYX4uogNq97tu40OEAEgrLHYB2DJBqAB5pKnxwPIAQKoAwHIA8kEqgT4AU_QlrnY3rtEt_pNTHvb7hUsAvszMto6Gw2VDXIVLrLyNdESvxSaReD3x4NAJNCpY0Gai7wNJXdYygMfVVhqy4klAz_kmKus0Yj9p_hLiebgwvJHw6wX6YHSCkkXF6JGSfS1wA6bVnAJiRd0LdxtxD_Q7WX3XxLf3jobCpgh9bTN7CohLfVMhW5vGJCVWr0d6b7L-kg0y1fjONc8Pcx0iO0Mmo1Gdmw6PokIpO6epHtlmnV6tHzddQFy5F87RFziqd5ISZVNIdIrZ9XQk6PmNSci_Sxn6sdhraVBUww2S45Ld8ueHLXr_eAdQcwqnGZ1DoCraMniT3gTwAT23JnokAOSBQQIBBgBkgUECAUYBKAGAoAHgu3YOKgH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgH1ckbqAemvhvYBwHyBwQQptQ80ggHCIBhEAEYX4AKAcgLAdgTDNAVAZgWAYAXAbIXHAoaCAASFHB1Yi0xODcyMjM1NzgzMzM1MjkwGAA&sigh=VkvuWeLa8E8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=197&slotname=2957124963&adk=1956586784&adf=1298624447&pi=t.ma~as.2957124963&w=787&fwrn=4&lmt=1633215344&rafmt=11&psa=0&format=787x197&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&wgl=1&dt=1633215344441&bpp=4&bdt=256&idt=170&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&correlator=8513168085096&frm=20&pv=2&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=192&ady=1764&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=DPuA2G4kkN&p=http%3A//termalfurdok.com&dtd=187
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sat, 02 Oct 2021 22:55:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Sat, 02 Oct 2021 22:55:45 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame BEC2 143 B
163 B 7ms
6ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=197&slotname=2957124963&adk=1956586784&adf=1298624447&pi=t.ma~as.2957124963&w=787&fwrn=4&lmt=1633215344&rafmt=11&psa=0&format=787x197&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&wgl=1&dt=1633215344441&bpp=4&bdt=256&idt=170&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&correlator=8513168085096&frm=20&pv=2&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=192&ady=1764&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=DPuA2G4kkN&p=http%3A//termalfurdok.com&dtd=187
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkw5xUgZpqmzjGTvWC-V8jrJkqyuhuYkHyQ0xctFxMAqQtGdOAQpXkSBqg4aj0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=197&slotname=2957124963&adk=1956586784&adf=1298624447&pi=t.ma~as.2957124963&w=787&fwrn=4&lmt=1633215344&rafmt=11&psa=0&format=787x197&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&wgl=1&dt=1633215344441&bpp=4&bdt=256&idt=170&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&correlator=8513168085096&frm=20&pv=2&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&rplot=4&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=192&ady=1764&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeEbr%7C&abl=CS&pfx=0&fu=128&bc=23&ifi=1&uci=a!1&btvi=1&fsb=1&xpc=DPuA2G4kkN&p=http%3A//termalfurdok.com&dtd=187

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sat, 02 Oct 2021 22:34:13 GMT
server: safe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 1292
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame E9C8 218 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6d4d7cc240586cd3d786cbdbf5308f08249ef3daf4c5fd5589d4b833573cae29

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame BEC2
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
16 B

15ms
15ms

Document
text/html

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

safe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkw5xUgZpqmzjGTvWC-V8jrJkqyuhuYkHyQ0xctFxMAqQtGdOAQpXkSBqg4aj0; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 02 Oct 2021 22:55:45 GMT
server: safe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Sat, 02-Oct-2021 23:55:45 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 02 Oct 2021 22:55:45 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 02 Oct 2021 22:55:45 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 BPTeJxusP8cOnE_s5L3ABe2tIpKd1NVDJBlhKS7pwaI.js Show response
pagead2.googlesyndication.com/bg/ Frame 8C67 35 KB
13 KB 23ms
8ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/BPTeJxusP8cOnE_s5L3ABe2tIpKd1NVDJBlhKS7pwaI.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04f4de271bac3fc70e9c4fece4bdc005edad22929dd4d543241961292ee9c1a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 16:24:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23481
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13343
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 10:18:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sun, 02 Oct 2022 16:24:24 GMT

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/ 141 KB
51 KB 36ms
31ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/reactive_library_fy2019.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecdc037bbf824d8874a0177b6f20ccd51540a589a7b015c53eae199a770d91f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52249
x-xss-protection: 0
server: cafe
etag: 8168734258521389743
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Sat, 02 Oct 2021 22:55:45 GMT

GET
H/1.1 204
No Content gen_204
pagead2.googlesyndication.com/pagead/ 0
459 B 21ms
21ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://pagead2.googlesyndication.com/pagead/gen_204?id=rasra::pm&rt=8%2C1&c=ca-pub-1872235783335290

Requested by

Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/

Protocol

HTTP/1.1

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 02 Oct 2021 22:55:45 GMT
X-Content-Type-Options: nosniff
Server: cafe
Timing-Allow-Origin: *
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: no-cache, must-revalidate
Cross-Origin-Resource-Policy: cross-origin
Content-Type: image/gif
Content-Length: 0
X-XSS-Protection: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 204
No Content gen_204
pagead2.googlesyndication.com/pagead/ 0
459 B 22ms
22ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://pagead2.googlesyndication.com/pagead/gen_204?id=ama_success&c=5&wpc=ca-pub-1872235783335290&warn=12%2C13&w=1600&h=1200&eatf=false&reatf=false&a=6%2C1%2C5%2C7&apv=20210928_113528&sat=1632956194463&afm=0&as_count=1&d_count=0&ng_count=0&am_count=5&atf_count=0&mdns=0.041&alldns=0.290&allp=137&fd=(0%2C32%2C20)%2C(1%2C0%2C0)%2C(2%2C0%2C0)&pgh=4859&su=termalfurdok.com&pvc=1693012635705270&r=0.1

Requested by

Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/

Protocol

HTTP/1.1

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 02 Oct 2021 22:55:45 GMT
X-Content-Type-Options: nosniff
Server: cafe
Timing-Allow-Origin: *
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: no-cache, must-revalidate
Cross-Origin-Resource-Policy: cross-origin
Content-Type: image/gif
Content-Length: 0
X-XSS-Protection: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 204
No Content gen_204
pagead2.googlesyndication.com/pagead/ 0
459 B 21ms
15ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://pagead2.googlesyndication.com/pagead/gen_204?id=ama_opt&c=5&wpc=ca-pub-1872235783335290&warn=12%2C13&w=1600&h=1200&eatf=false&reatf=false&a=6%2C1%2C5%2C7&apv=20210928_113528&sat=1632956194463&afm=0&as_count=1&d_count=0&ng_count=0&am_count=5&atf_count=0&mdns=0.041&alldns=0.290&allp=137&fd=(0%2C32%2C20)%2C(1%2C0%2C0)%2C(2%2C0%2C0)&pgh=4859&su=termalfurdok.com&sl=pbr~pbp&ab=0&rr=1&oab=1&sab=0&ls=0&op=71&rp=0&fap=0~1~26~28~31~34~37~38~40~44~48~49~52~53~54~55~58~59~60~65~67&fad=11&fmd=0&vap=1~26~28~34~37~38~40~44~48~49~52~54~55~58~60~65~67&vad=3&vmd=0&pap=1~26~28~38~44&pad=0&pmd=0&psq=1~26~28~38~44&pvc=1693012635705270&r=0.1

Requested by

Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/

Protocol

HTTP/1.1

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 02 Oct 2021 22:55:45 GMT
X-Content-Type-Options: nosniff
Server: cafe
Timing-Allow-Origin: *
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: no-cache, must-revalidate
Cross-Origin-Resource-Policy: cross-origin
Content-Type: image/gif
Content-Length: 0
X-XSS-Protection: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 59ms
25ms Script
application/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=termalfurdok.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 02 Oct 2021 22:55:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame C12D 70 KB
27 KB 622ms
621ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=389585034&adf=4164852396&pi=t.aa~a.245933387~rp.1&w=787&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=787x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0&nras=2&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=192&ady=2503&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=TJiKRZhQkM&p=http%3A//termalfurdok.com&dtd=14

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6373ea085ceb1e749bff8a3800c04ac61d9497cb0235794715f6eb8f79d8469f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=389585034&adf=4164852396&pi=t.aa~a.245933387~rp.1&w=787&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=787x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0&nras=2&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=192&ady=2503&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=TJiKRZhQkM&p=http%3A//termalfurdok.com&dtd=14
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://termalfurdok.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkw5xUgZpqmzjGTvWC-V8jrJkqyuhuYkHyQ0xctFxMAqQtGdOAQpXkSBqg4aj0; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 02 Oct 2021 22:55:46 GMT
server: cafe
content-length: 27432
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame DA2D 69 KB
27 KB 618ms
618ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=3823540373&adf=1126500945&pi=t.aa~a.3220379706~rp.4&w=365&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=365x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280&nras=3&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=1043&ady=1775&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=xhyBgfMwU9&p=http%3A//termalfurdok.com&dtd=24

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e0b963e4323a2fe19acb0c3505d8417480f36872f93dbde98f77a686cf5ef8ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=3823540373&adf=1126500945&pi=t.aa~a.3220379706~rp.4&w=365&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=365x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280&nras=3&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=1043&ady=1775&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=xhyBgfMwU9&p=http%3A//termalfurdok.com&dtd=24
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://termalfurdok.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkw5xUgZpqmzjGTvWC-V8jrJkqyuhuYkHyQ0xctFxMAqQtGdOAQpXkSBqg4aj0; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 02 Oct 2021 22:55:46 GMT
server: cafe
content-length: 27234
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 4D8E 96 KB
30 KB 734ms
734ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=83859408&adf=4214651320&pi=t.aa~a.1838705564~rp.2&w=1200&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=1200x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280%2C365x280&nras=4&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=200&ady=4198&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=TLpFX7P9Hh&p=http%3A//termalfurdok.com&dtd=27

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

da7e5d9b0ba7eae8552e1faf26677d7e9603c6543c3036397e2673a5a08f7320

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CPOsi6TprPMCFZUMiwodKK8KZw&gqi=ceNYYYnEHsiU3gO9jYJQ&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=83859408&adf=4214651320&pi=t.aa~a.1838705564~rp.2&w=1200&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=1200x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280%2C365x280&nras=4&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=200&ady=4198&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=TLpFX7P9Hh&p=http%3A//termalfurdok.com&dtd=27
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://termalfurdok.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkw5xUgZpqmzjGTvWC-V8jrJkqyuhuYkHyQ0xctFxMAqQtGdOAQpXkSBqg4aj0; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CPOsi6TprPMCFZUMiwodKK8KZw&gqi=ceNYYYnEHsiU3gO9jYJQ&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 02 Oct 2021 22:55:46 GMT
server: cafe
content-length: 30369
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 8BCB 70 KB
27 KB 1090ms
1090ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=3864395381&adf=3475064796&pi=t.aa~a.1455942147~rp.3&w=355&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=355x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280%2C365x280%2C1200x280&nras=5&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=1048&ady=3348&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=TiZn1T36sm&p=http%3A//termalfurdok.com&dtd=31

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

605bba9ed364c66730568d1b4f0d3c5154fdf5a3e6890364dfddcc3dffacb1d6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=3864395381&adf=3475064796&pi=t.aa~a.1455942147~rp.3&w=355&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=355x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280%2C365x280%2C1200x280&nras=5&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=1048&ady=3348&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=TiZn1T36sm&p=http%3A//termalfurdok.com&dtd=31
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://termalfurdok.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkw5xUgZpqmzjGTvWC-V8jrJkqyuhuYkHyQ0xctFxMAqQtGdOAQpXkSBqg4aj0; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 02 Oct 2021 22:55:46 GMT
server: cafe
content-length: 27310
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame E399 94 KB
30 KB 571ms
570ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=90&adk=2743202993&adf=1839787983&pi=t.aa~a.2087457157~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=1200x90&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=0&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280%2C365x280%2C1200x280%2C355x280&nras=6&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=200&ady=4098&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=qcfkULGDXD&p=http%3A//termalfurdok.com&dtd=34

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1f6f10797363c89763a92446542be7c5fd2b5d71d39149bee251c2df67ab174b

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CO3Ci6TprPMCFYfAdwodMqEGtA&gqi=ceNYYe7zHtft3wOX8KyoDw&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/ads?client=ca-pub-1872235783335290&output=html&h=90&adk=2743202993&adf=1839787983&pi=t.aa~a.2087457157~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=1200x90&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=0&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280%2C365x280%2C1200x280%2C355x280&nras=6&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=200&ady=4098&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=qcfkULGDXD&p=http%3A//termalfurdok.com&dtd=34
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://termalfurdok.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkw5xUgZpqmzjGTvWC-V8jrJkqyuhuYkHyQ0xctFxMAqQtGdOAQpXkSBqg4aj0; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CO3Ci6TprPMCFYfAdwodMqEGtA&gqi=ceNYYe7zHtft3wOX8KyoDw&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Sat, 02 Oct 2021 22:55:46 GMT
server: cafe
content-length: 30219
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 204
No Content gen_204
pagead2.googlesyndication.com/pagead/ 0
459 B 22ms
21ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://pagead2.googlesyndication.com/pagead/gen_204?id=rasra::pr&rt=8%2C1&c=ca-pub-1872235783335290

Requested by

Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/

Protocol

HTTP/1.1

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 02 Oct 2021 22:55:45 GMT
X-Content-Type-Options: nosniff
Server: cafe
Timing-Allow-Origin: *
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control: no-cache, must-revalidate
Cross-Origin-Resource-Policy: cross-origin
Content-Type: image/gif
Content-Length: 0
X-XSS-Protection: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/ Frame FFB5 10 KB
5 KB 6ms
6ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8806d9eaf9e8ca89fa2404e8cb66a9fa115e0a0f687ad0dcd91cabce4c2179c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://termalfurdok.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkw5xUgZpqmzjGTvWC-V8jrJkqyuhuYkHyQ0xctFxMAqQtGdOAQpXkSBqg4aj0; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 02 Oct 2021 04:03:35 GMT
expires: Sat, 16 Oct 2021 04:03:35 GMT
content-type: text/html; charset=UTF-8
etag: 297313706323796346
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4617
x-xss-protection: 0
age: 67930
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/ Frame 4DA4 10 KB
5 KB 6ms
6ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f10.1e100.net

Software

cafe /

Resource Hash

8806d9eaf9e8ca89fa2404e8cb66a9fa115e0a0f687ad0dcd91cabce4c2179c6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://termalfurdok.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkw5xUgZpqmzjGTvWC-V8jrJkqyuhuYkHyQ0xctFxMAqQtGdOAQpXkSBqg4aj0; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 02 Oct 2021 04:03:35 GMT
expires: Sat, 16 Oct 2021 04:03:35 GMT
content-type: text/html; charset=UTF-8
etag: 297313706323796346
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4617
x-xss-protection: 0
age: 67930
cache-control: public, max-age=1209600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 css2
fonts.googleapis.com/ Frame FFB5 4 KB
1 KB 41ms
15ms Stylesheet
text/css 142.250.185.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.74 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ab7475d461d9f613ef90faa375ec3387987dd7536af23c13cacd6be9c0c0e370

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 02 Oct 2021 21:18:14 GMT
server: ESF
date: Sat, 02 Oct 2021 22:55:45 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Sat, 02 Oct 2021 22:55:45 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame FFB5 205 B
764 B 31ms
5ms Image
image/png 142.250.186.67
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f3.1e100.net

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 18:41:17 GMT
x-content-type-options: nosniff
age: 15268
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sun, 02 Oct 2022 18:41:17 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame FFB5 604 B
695 B 31ms
6ms Image
image/png 142.250.186.67
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f3.1e100.net

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 16:01:54 GMT
x-content-type-options: nosniff
age: 24831
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Tue, 22 Oct 2019 18:15:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Sun, 02 Oct 2022 16:01:54 GMT

GET
H3 200 interstitial_ad_frame_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/elements/html/ Frame FFB5 17 KB
8 KB 37ms
14ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/elements/html/interstitial_ad_frame_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f0c966edfc6ce40ca892f7e2bc53a95bd27cb94ac8b6fa61fcb30457ff214600

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 21:21:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 5679
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7655
x-xss-protection: 0
server: cafe
etag: 17297134792721902632
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 21:21:06 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 4DA4 0
0 18ms
18ms Fetch
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cxth1cONYYZLJKJLu3gPTxorgDOqWqqdgu5Whr5ANq97tu40OEAEgrLHYB2DJBqAB5pKnxwPIAQKoAwHIA8kEqgSCAk_QaMqti6Z_LCkRcVadL1Q3sIF-oAwB0AutAWARL4E7_a-reg-zwhS--9tLQQ8w5byucjQcB6r4zN0RFd6PzYJRzk7bj7gUWN7DzaUqqw77fHFa2f76H81gvdZhQq8R9Lb7bhDf8Wzy3g_C8sPaMLywUuh85zv3aGZfdja1beCEKoZ0VmoDCnSoQx2-UvJge6mBLlp612h5QtSWBbaW5LFkEmgGtzirq7Tv13FG0iANnWp1FybVxDSUvtZ86t2e15kdeU8zGXWa_8Irk7lMpJ5_hyIYrgO0sfuQPOJIg3EEw_lh4gAjIZrIclZIy5xodAlEltu8x43geIeSjhiw8uaUNsAE9tyZ6JADkgUECAQYAZIFBAgFGASgBgKAB4Lt2DioB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-6WsQKoB9XJG6gHpr4b2AcB8gcFEJ-OlAHSCAcIgGEQARhfgAoByAsB2BMM0BUBmBYBgBcBshccChoIABIUcHViLTE4NzIyMzU3ODMzMzUyOTAYAA&sigh=bcMxRYtyqfs

Requested by

Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sat, 02 Oct 2021 22:55:45 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/ Frame 4DA4 18 KB
7 KB 33ms
16ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

da48b97b44f32bd333c5ca822e07f0997269db7bbd7e85f514035e02a57624f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:47:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 509
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7607
x-xss-protection: 0
server: cafe
etag: 5036643633216217121
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:47:16 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame 4DA4 3 KB
1 KB 41ms
24ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:42:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 789
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:42:36 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4DA4 122 KB
37 KB 18ms
18ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

867ff39044c47d580bde0bfc1e95bfcc25c21738c79351591641a83a56dc6d3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
server: sffe
etag: "1633087504575570"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Sat, 02 Oct 2021 22:55:45 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame 4DA4 14 KB
6 KB 34ms
18ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f430df1926f8f2c1211de662c1070de2b98259bfc9bbdd8cf70c7b53d6777cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:35:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1187
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6194
x-xss-protection: 0
server: cafe
etag: 2541472377268313288
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:35:58 GMT

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame 4DA4 27 KB
11 KB 40ms
24ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a672e695dab08ffadbea7f0e77f1a723eefff684ae0cdabe2ca3b7a141554c3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 14:44:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29464
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11096
x-xss-protection: 0
server: cafe
etag: 8885281346021324493
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 14:44:41 GMT

GET
H3 200 12952964647363050475
tpc.googlesyndication.com/simgad/ Frame 4DA4 6 KB
6 KB 34ms
18ms Image
image/png 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/12952964647363050475?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qmwTcicX41eYwyGt09KKg5ah75G0A

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f10.1e100.net

Software

sffe /

Resource Hash

ff3bcceb9028cba273d88befd3b6870db5d0ae689c7195487ac418246fcfe343

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 14:14:31 GMT
x-content-type-options: nosniff
age: 117674
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5961
x-xss-protection: 0
last-modified: Wed, 17 Feb 2021 15:56:43 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 01 Oct 2022 14:14:31 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame B46D 3 KB
580 B 30ms
16ms Stylesheet
text/css 142.250.185.74
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.74 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32b5c88160bab78ae20a39de4a8abe015f4f4c5d48be8300a6686d32a570ccfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Sat, 02 Oct 2021 21:07:26 GMT
server: ESF
date: Sat, 02 Oct 2021 22:55:45 GMT
x-frame-options: SAMEORIGIN
report-to: {"group":"AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
cross-origin-opener-policy-report-only: same-origin; report-to="AZM8iraMxxUfRnRum-EGst9UuHcPNVSf9Kp1_90wIgU"
expires: Sat, 02 Oct 2021 22:55:45 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame B46D 1 KB
879 B 13ms
13ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2911b334d84ae35bdef7cb396241b38425398b6ae5f91f13a72943e805309ab6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:24:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1859
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 852
x-xss-protection: 0
server: cafe
etag: 14170629819630813772
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:24:46 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/ Frame B46D 18 KB
7 KB 13ms
13ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/abg_lite_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

da48b97b44f32bd333c5ca822e07f0997269db7bbd7e85f514035e02a57624f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:47:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 509
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7607
x-xss-protection: 0
server: cafe
etag: 5036643633216217121
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:47:16 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame B46D 3 KB
1 KB 13ms
13ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:42:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 789
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:42:36 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame B46D 122 KB
37 KB 15ms
15ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

867ff39044c47d580bde0bfc1e95bfcc25c21738c79351591641a83a56dc6d3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
server: sffe
etag: "1633087504575570"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Sat, 02 Oct 2021 22:55:45 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame B46D 14 KB
6 KB 13ms
13ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f430df1926f8f2c1211de662c1070de2b98259bfc9bbdd8cf70c7b53d6777cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:35:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1187
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6194
x-xss-protection: 0
server: cafe
etag: 2541472377268313288
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:35:58 GMT

GET
H3 200 a05f1579543550f3e279366fb116adbd.js Show response
www.gstatic.com/mysidia/ Frame B46D 27 KB
11 KB 21ms
7ms Script
text/javascript 142.250.186.67
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/a05f1579543550f3e279366fb116adbd.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.67 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s05-in-f3.1e100.net

Software

sffe /

Resource Hash

6cd4fdef93aef355d2c534bc7de3d08d9723234a1b0cf6161652193f34e4f820

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 30 Sep 2021 15:25:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 199829
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11147
x-xss-protection: 0
last-modified: Tue, 28 Sep 2021 01:21:31 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="mysidia"
expires: Wed, 29 Dec 2021 15:25:16 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 924D 143 B
163 B 7ms
7ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkw5xUgZpqmzjGTvWC-V8jrJkqyuhuYkHyQ0xctFxMAqQtGdOAQpXkSBqg4aj0; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sat, 02 Oct 2021 22:53:54 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 111
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 4DA4 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 0b2ae1e729f6e20a85ac278bacbcf38e967a76225a07b06de2ad63ef9c81753d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A637 143 B
163 B 6ms
6ms Document
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/s?v=r20120211
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkw5xUgZpqmzjGTvWC-V8jrJkqyuhuYkHyQ0xctFxMAqQtGdOAQpXkSBqg4aj0; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Response headers

content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Sat, 02 Oct 2021 22:53:54 GMT
server: cafe
content-length: 145
x-xss-protection: 0
cache-control: public, max-age=3600
age: 111
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4DA4 0
20 B 16ms
15ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?v=3&s=pagead&action=loadimgad&it=bdt.268,req.187,bpp.1,fb.1142,e2e.1289,fs.1135,reqs.1136,ress.1142,rese.1142&srt=7&e=&id=csi_pagead&gqid=cONYYdvZJ5ux3gPQgZOYAg&qqid=CJLB16PprPMCFRK3dwodU6MCzA&rt=ol.147

Requested by

Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:45 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 924D
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
17 B

23ms
23ms

Document
text/html

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkw5xUgZpqmzjGTvWC-V8jrJkqyuhuYkHyQ0xctFxMAqQtGdOAQpXkSBqg4aj0; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 02 Oct 2021 22:55:45 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Sat, 02-Oct-2021 23:55:45 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 02 Oct 2021 22:55:45 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 02 Oct 2021 22:55:45 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame A637
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si

0
17 B

50ms
50ms

Document
text/html

142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /pagead/drt/si
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUkw5xUgZpqmzjGTvWC-V8jrJkqyuhuYkHyQ0xctFxMAqQtGdOAQpXkSBqg4aj0; test_cookie=CheckForPermission; DSID=NO_DATA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 02 Oct 2021 22:55:45 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: DSID=NO_DATA; expires=Sat, 02-Oct-2021 23:55:45 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; domain=.doubleclick.net; path=/; expires=Fri, 01-Aug-2008 22:45:55 GMT; SameSite=none; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Sat, 02 Oct 2021 22:55:45 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Sat, 02 Oct 2021 22:55:45 GMT
server: safe
content-length: 246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 BPTeJxusP8cOnE_s5L3ABe2tIpKd1NVDJBlhKS7pwaI.js Show response
pagead2.googlesyndication.com/bg/ Frame 1027 35 KB
13 KB 6ms
6ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/BPTeJxusP8cOnE_s5L3ABe2tIpKd1NVDJBlhKS7pwaI.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20210927/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04f4de271bac3fc70e9c4fece4bdc005edad22929dd4d543241961292ee9c1a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 16:24:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23481
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13343
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 10:18:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sun, 02 Oct 2022 16:24:24 GMT

GET
H3 200 ssrh.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame E399 84 KB
29 KB 14ms
14ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/ssrh.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=90&adk=2743202993&adf=1839787983&pi=t.aa~a.2087457157~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=1200x90&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=0&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280%2C365x280%2C1200x280%2C355x280&nras=6&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=200&ady=4098&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=qcfkULGDXD&p=http%3A//termalfurdok.com&dtd=34

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9b5312cb2f154f2bd64ee8746195a63df254d10bfd107a61eec3d5d38dd48bff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 04:35:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 66007
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30063
x-xss-protection: 0
server: cafe
etag: 16132151104434394549
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 03 Oct 2021 04:35:39 GMT

GET
H2 200 615155484575903256_5569703044244887428.jpeg
static.doubleclick.net/dynamic/5/65138550/ Frame E399 27 KB
27 KB 55ms
17ms Image
image/jpeg 142.250.184.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/65138550/615155484575903256_5569703044244887428.jpeg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fcafffff801480ba1499d2a9b9a4e85c1d11b7fcf0ad1516aa185a54e8d6bea0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 05:25:34 GMT
x-content-type-options: nosniff
age: 63012
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27559
x-xss-protection: 0
last-modified: Fri, 01 Oct 2021 10:39:59 GMT
server: sffe
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-programmable"
expires: Sun, 02 Oct 2022 05:25:34 GMT

GET
H2 200 2066005473843201386_16805239477766748029.jpeg
static.doubleclick.net/dynamic/5/65138550/ Frame E399 18 KB
19 KB 45ms
8ms Image
image/jpeg 142.250.184.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/65138550/2066005473843201386_16805239477766748029.jpeg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae528abae33b097616cac8acc48c6c3921ba5b5f2730a70ec400e37608bbc739

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 11:06:12 GMT
x-content-type-options: nosniff
age: 42574
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18578
x-xss-protection: 0
last-modified: Fri, 01 Oct 2021 10:40:05 GMT
server: sffe
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-programmable"
expires: Sun, 02 Oct 2022 11:06:12 GMT

GET
H2 200 4251540239517823723_2322199337926650162.jpeg
static.doubleclick.net/dynamic/5/65138550/ Frame E399 23 KB
24 KB 49ms
13ms Image
image/jpeg 142.250.184.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/65138550/4251540239517823723_2322199337926650162.jpeg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

27e5db89cf8b1c48cb0ed0aef17ac10ad1855cb62fd14dbc7dad2f247637165e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:43:27 GMT
x-content-type-options: nosniff
age: 739
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23959
x-xss-protection: 0
last-modified: Fri, 01 Oct 2021 10:28:37 GMT
server: sffe
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-programmable"
expires: Sun, 02 Oct 2022 22:43:27 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/ Frame E399 18 KB
7 KB 14ms
13ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

da48b97b44f32bd333c5ca822e07f0997269db7bbd7e85f514035e02a57624f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:47:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 510
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7607
x-xss-protection: 0
server: cafe
etag: 5036643633216217121
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:47:16 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame E399 3 KB
1 KB 15ms
14ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:42:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 790
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:42:36 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E399 122 KB
37 KB 23ms
22ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

867ff39044c47d580bde0bfc1e95bfcc25c21738c79351591641a83a56dc6d3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
server: sffe
etag: "1633087504575570"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Sat, 02 Oct 2021 22:55:46 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame E399 14 KB
6 KB 15ms
14ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f430df1926f8f2c1211de662c1070de2b98259bfc9bbdd8cf70c7b53d6777cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:35:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1188
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6194
x-xss-protection: 0
server: cafe
etag: 2541472377268313288
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:35:58 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame E399 0
0 15ms
15ms Image
text/html 216.58.212.164
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSarABvVIrlGD-BVEhGkpHEohp2ZHyqiQotdnx3FIDpmnply61sFnlmP2SMUb3KZw3aFR_ciS92R0INcTl0Vu6SXYqUCg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=90&adk=2743202993&adf=1839787983&pi=t.aa~a.2087457157~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=1200x90&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=0&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280%2C365x280%2C1200x280%2C355x280&nras=6&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=200&ady=4098&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=qcfkULGDXD&p=http%3A//termalfurdok.com&dtd=34
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.58.212.164 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f164.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 10124421203004885384
tpc.googlesyndication.com/simgad/ Frame E399 8 KB
8 KB 14ms
13ms Image
image/png 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10124421203004885384

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

484ec1c347c17d7d3b98d5058aa5d90bb5c7315f3a67f44611e902de4be50831

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 10:25:50 GMT
x-content-type-options: nosniff
age: 44996
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8502
x-xss-protection: 0
last-modified: Tue, 08 Oct 2019 11:54:50 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 02 Oct 2022 10:25:50 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame E399 0
0 17ms
17ms Fetch
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CtoZ9ceNYYa3GH4eB3wOywpqgC_D_gYVlyvL-hJULg5PwqowTEAEgrLHYB2DJBqABsLqh1wPIAQmoAwHIA8sEqgT3AU_QX5gIQud_admN8Sffc5N2-NV9W4Po9d-ssm9irToi9j9BfuTTuO_cYlwYO2jLfNueC-9bzWe0JCX5ZBp3oEDz9tT1qpaiYwPbCL5i7qdrDevSVRKRw9M4z0OCMDcjpGcjwOdYA3aM5lxcZ8lPFRsbnUwSM8__VrnX_o74ivUYQ2Eb1KhBEvlyqok8Pohch7oxv70JJHz5cah5DxxJbHbK80NhAgiEb_ux8WSAtFDyo5V6EpziOazoQ2xgEfegFRatZTVv3SNCt0SRu5Ox-YX09XcQphOVSmZ-pL_QQIWWkXDcGOhtS86mHb3a7Ohy0TC-t2RV0aTABP_AwLL5AZIFBAgEGAGSBQQIBRgEoAYugAetg652qAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAemvhvYBwDyBwQQ4dcZ0ggHCIBhEAEYX4AKAcgLAdgTDIgUBNAVAYAXAbIXHAoaCAASFHB1Yi0xODcyMjM1NzgzMzM1MjkwGAA&sigh=o5t8R5d9MxM&template_id=494

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=90&adk=2743202993&adf=1839787983&pi=t.aa~a.2087457157~rp.1&w=1200&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=1200x90&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=0&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280%2C365x280%2C1200x280%2C355x280&nras=6&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=200&ady=4098&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=7&uci=a!7&btvi=6&fsb=1&xpc=qcfkULGDXD&p=http%3A//termalfurdok.com&dtd=34
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sat, 02 Oct 2021 22:55:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 14079855542345729536
tpc.googlesyndication.com/simgad/ Frame C12D 17 KB
17 KB 14ms
14ms Image
image/png 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/14079855542345729536?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qkx0AST9IeWHe6Z20BNe2f7Q7qGIQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=389585034&adf=4164852396&pi=t.aa~a.245933387~rp.1&w=787&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=787x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0&nras=2&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=192&ady=2503&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=TJiKRZhQkM&p=http%3A//termalfurdok.com&dtd=14

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e0b018d7514908d8572bc888726ef7d51aa8d70e4fc0cb89e7fde1c74fe04b62

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sun, 26 Sep 2021 07:19:12 GMT
x-content-type-options: nosniff
last-modified: Wed, 14 Oct 2020 21:21:08 GMT
server: sffe
age: 574594
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17155
x-xss-protection: 0
expires: Mon, 26 Sep 2022 07:19:12 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/ Frame C12D 18 KB
7 KB 13ms
13ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

da48b97b44f32bd333c5ca822e07f0997269db7bbd7e85f514035e02a57624f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:47:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 510
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7607
x-xss-protection: 0
server: cafe
etag: 5036643633216217121
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:47:16 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame C12D 3 KB
1 KB 14ms
13ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:42:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 790
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:42:36 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame C12D 122 KB
37 KB 19ms
19ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

867ff39044c47d580bde0bfc1e95bfcc25c21738c79351591641a83a56dc6d3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
server: sffe
etag: "1633087504575570"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Sat, 02 Oct 2021 22:55:46 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame C12D 14 KB
6 KB 14ms
13ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f430df1926f8f2c1211de662c1070de2b98259bfc9bbdd8cf70c7b53d6777cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:35:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1188
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6194
x-xss-protection: 0
server: cafe
etag: 2541472377268313288
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:35:58 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame C12D 0
0 16ms
15ms Image
text/html 216.58.212.164
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQpjnzpJtJU4DZOLv82sc7fAsoUcMgykjAiKZY706RwEv2MWTeawDHnKzl3kMJkFtz0Wo-5-pNKBdr5-heoDnA90KTVkA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=389585034&adf=4164852396&pi=t.aa~a.245933387~rp.1&w=787&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=787x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0&nras=2&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=192&ady=2503&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=TJiKRZhQkM&p=http%3A//termalfurdok.com&dtd=14
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.58.212.164 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f164.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame C12D 27 KB
11 KB 15ms
14ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a672e695dab08ffadbea7f0e77f1a723eefff684ae0cdabe2ca3b7a141554c3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 14:44:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29465
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11096
x-xss-protection: 0
server: cafe
etag: 8885281346021324493
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 14:44:41 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame C12D 0
0 20ms
19ms Fetch
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C252OceNYYbyzHqKm3gPt6qmQB-qWqqdgjfPdircMq97tu40OEAEgrLHYB2DJBqAB5pKnxwPIAQKoAwHIA8kEqgT7AU_QinHWEUH3rdciGEf-FqR3Bf2KVLuWWwRG_2dMYQqf4P5BjxGe8SRYotHmd8JmSNZ8Rj4okrSr2v_Vj0fJb5o1_eP6bCRomwlx-tJEsHrSoByGtZUsLH6_7eCOzq528H0vyS1RAFjQNwd8LpcgbZO6sLwb66eM4ewhR4sAWmRWlHqBANl4BrAxq0ApFpg68e3mH8JYaZnqCmYnZNmEdgEaLbKVAhEMf0D5fvnJ8Tuldz1wAEWMjjCKqv2Pyn2z73i3iUrkz7sB4o6230R1SQqLv637KOkcPC4pR6bVY8QJm0wymHp88UugjifxUMMJNGpExnlvtVJlp-mpwAT23JnokAOSBQQIBBgBkgUECAUYBKAGAoAHgu3YOKgH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgH1ckbqAemvhvYBwHyBwQQyPk80ggHCIBhEAEYX4AKAcgLAdgTDNAVAZgWAYAXAbIXHAoaCAASFHB1Yi0xODcyMjM1NzgzMzM1MjkwGAA&sigh=RUspfSymw40

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=389585034&adf=4164852396&pi=t.aa~a.245933387~rp.1&w=787&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=787x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0&nras=2&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=192&ady=2503&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=TJiKRZhQkM&p=http%3A//termalfurdok.com&dtd=14
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sat, 02 Oct 2021 22:55:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 10799725182716819364
tpc.googlesyndication.com/daca_images/simgad/ Frame DA2D 21 KB
22 KB 14ms
14ms Image
image/png 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/10799725182716819364

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=3823540373&adf=1126500945&pi=t.aa~a.3220379706~rp.4&w=365&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=365x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280&nras=3&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=1043&ady=1775&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=xhyBgfMwU9&p=http%3A//termalfurdok.com&dtd=24

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4e576a3a742c1527ea83fe8ee60d5956143649668bc31f1e92d6b4fbc2540960

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 05:46:15 GMT
x-content-type-options: nosniff
age: 148171
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22010
x-xss-protection: 0
last-modified: Thu, 25 Feb 2021 23:19:04 GMT
server: sffe
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 01 Oct 2022 05:46:15 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/ Frame DA2D 18 KB
7 KB 13ms
13ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

da48b97b44f32bd333c5ca822e07f0997269db7bbd7e85f514035e02a57624f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:47:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 510
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7607
x-xss-protection: 0
server: cafe
etag: 5036643633216217121
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:47:16 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame DA2D 3 KB
1 KB 15ms
14ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:42:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 790
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:42:36 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame DA2D 122 KB
37 KB 26ms
26ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

867ff39044c47d580bde0bfc1e95bfcc25c21738c79351591641a83a56dc6d3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
server: sffe
etag: "1633087504575570"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Sat, 02 Oct 2021 22:55:46 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame DA2D 14 KB
6 KB 14ms
13ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f430df1926f8f2c1211de662c1070de2b98259bfc9bbdd8cf70c7b53d6777cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:35:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1188
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6194
x-xss-protection: 0
server: cafe
etag: 2541472377268313288
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:35:58 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame DA2D 0
0 16ms
15ms Image
text/html 216.58.212.164
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSPlPr5rM6rZaBnrfTv5_ys91t053SfJ3Zw0Rs8Z3oxM9JkdmORBJqbpbekEVaDksvCCeP7J1R0Aiup6lA4je9wuJx46Q
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=3823540373&adf=1126500945&pi=t.aa~a.3220379706~rp.4&w=365&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=365x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280&nras=3&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=1043&ady=1775&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=xhyBgfMwU9&p=http%3A//termalfurdok.com&dtd=24
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.58.212.164 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f164.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame DA2D 27 KB
11 KB 15ms
14ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a672e695dab08ffadbea7f0e77f1a723eefff684ae0cdabe2ca3b7a141554c3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 14:44:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29465
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11096
x-xss-protection: 0
server: cafe
etag: 8885281346021324493
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 14:44:41 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame DA2D 0
0 18ms
18ms Fetch
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CshVOceNYYY-ZH8qT3gP7pYKoA-Ov9-Bih4zT4KcN3dkeEAEgrLHYB2DJBqABu-O8nwPIAQKoAwHIA8kEqgT6AU_QTgk9vbQDLYv38RU35o-vKOx8I3Ka6DieF0RRm3SYErsdMsufpTZyAqf2eSjFMeM3c89APgzgZe2TR_xTfvsKzjs6fut_C5-dzW6JUSxQ5c6d0W8FyfeTgoiPiOcVDL_Lops3pxuO9_ziXc-tNxX97kCZzLk5pFsy24EsBy6EOlHizTOz1kDXsykWefbdjQwqpLmKcJjFk_d1OffoeXGCtKphSzrarBwxYB-kK3EbA8NYBGM4FGX1BTuu3RYb1L6nzyHVk00aylxHirkgkqbHALza7yKRd8ymbgveVCDbGKNm2mTBIr_MfdIYjNchho_WG9xPhd080gPABOO_s76UAZIFBAgEGAGSBQQIBRgEoAYCgAetnMNgqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfulrECqAfVyRuoB6a-G9gHAfIHBBCXsi7SCAcIgGEQARhfgAoByAsB2BMM0BUBmBYBgBcBshccChoIABIUcHViLTE4NzIyMzU3ODMzMzUyOTAYAA&sigh=M7gjIy4tn-8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=3823540373&adf=1126500945&pi=t.aa~a.3220379706~rp.4&w=365&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=365x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280&nras=3&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=1043&ady=1775&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=xhyBgfMwU9&p=http%3A//termalfurdok.com&dtd=24
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sat, 02 Oct 2021 22:55:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

POST
H3 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame E399 0
20 B 30ms
16ms Other
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CO3Ci6TprPMCFYfAdwodMqEGtA&gqi=ceNYYe7zHtft3wOX8KyoDw&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame E399 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 266a93591886b5aaebcb6710c0d3d775ca72cb9827589de2455e14d75d251b04

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame DCD5 1 KB
749 B 7ms
7ms Document
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 02 Oct 2021 08:58:57 GMT
expires: Sun, 03 Oct 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 50209
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame DFD0 1 KB
749 B 7ms
6ms Document
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 02 Oct 2021 08:58:57 GMT
expires: Sun, 03 Oct 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 50209
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame C12D 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 531f64ad0b90501dd751af5590fabd8e0f424ff7ef5be7b70be18284819d2c2b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame DA2D 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8172169197b941223b20ca3a995693ce0c2508af837fcb2e117de81d4858813a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 BPTeJxusP8cOnE_s5L3ABe2tIpKd1NVDJBlhKS7pwaI.js Show response
pagead2.googlesyndication.com/bg/ Frame E87A 35 KB
13 KB 7ms
7ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/BPTeJxusP8cOnE_s5L3ABe2tIpKd1NVDJBlhKS7pwaI.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04f4de271bac3fc70e9c4fece4bdc005edad22929dd4d543241961292ee9c1a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 16:24:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23482
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13343
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 10:18:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sun, 02 Oct 2022 16:24:24 GMT

GET
H3 200 ssrh.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame 4D8E 84 KB
29 KB 14ms
13ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/ssrh.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=83859408&adf=4214651320&pi=t.aa~a.1838705564~rp.2&w=1200&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=1200x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280%2C365x280&nras=4&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=200&ady=4198&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=TLpFX7P9Hh&p=http%3A//termalfurdok.com&dtd=27

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9b5312cb2f154f2bd64ee8746195a63df254d10bfd107a61eec3d5d38dd48bff

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 04:35:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 66007
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30063
x-xss-protection: 0
server: cafe
etag: 16132151104434394549
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Sun, 03 Oct 2021 04:35:39 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DCD5
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPKMU6TAeeUyFcxCD0GJf5TYIGIIzx2gk-PV5WF...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVZqamNnQUFCZENpNTFiZA&google_push=AYg5qPKMU6TAeeUyFcxCD0GJf5TYIGIIzx2gk-PV5WFi4x49sB0Bbh9dJhN-BP7J0TwY2hcfhTL7-qr6Ywz8TFS05Vr01RDuWKij

170 B
188 B

24ms
24ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVZqamNnQUFCZENpNTFiZA&google_push=AYg5qPKMU6TAeeUyFcxCD0GJf5TYIGIIzx2gk-PV5WFi4x49sB0Bbh9dJhN-BP7J0TwY2hcfhTL7-qr6Ywz8TFS05Vr01RDuWKij

Requested by

Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WVZqamNnQUFCZENpNTFiZA&google_push=AYg5qPKMU6TAeeUyFcxCD0GJf5TYIGIIzx2gk-PV5WFi4x49sB0Bbh9dJhN-BP7J0TwY2hcfhTL7-qr6Ywz8TFS05Vr01RDuWKij
Date: Sat, 02 Oct 2021 22:55:46 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 sync
odr.mookie1.com/t/v2/ Frame DCD5 43 B
609 B 71ms
23ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2/sync?tagid=V2_4531&src.visitorid=CAESEIZSGGmeot-R0KUGTptaAe8&google_push=AYg5qPIZkxGwX30BK6Tbqm1O_P96M1yKebn-vWpg0V0KNkz_sSwUGHpSwGhkuRhNRYFtoDTLU_PEfgqye8dKgaq8js2lVCofI0RX&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=389585034&adf=4164852396&pi=t.aa~a.245933387~rp.1&w=787&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=787x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0&nras=2&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=192&ady=2503&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=TJiKRZhQkM&p=http%3A//termalfurdok.com&dtd=14
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:46 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DCD5
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEP8PYG8jCbywMVc2a3xk2wo&google_cver=1&google_push=AYg5qPKA5RbXt1BQ_HYtRQ8OBg2dzI5O1jrG9o-4uBPBhQwo6chAdc0ZacwrVnTWEDUk0ff1-QIA1m6Pl_0eGt91U5wZlVVRYYTR
https://rtb.openx.net/sync/dds?google_gid=CAESEP8PYG8jCbywMVc2a3xk2wo&google_cver=1&google_push=AYg5qPKA5RbXt1BQ_HYtRQ8OBg2dzI5O1jrG9o-4uBPBhQwo6chAdc0ZacwrVnTWEDUk0ff1-QIA1m6Pl_0eGt91U5wZlVVRYYTR&...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKA5RbXt1BQ_HYtRQ8OBg2dzI5O1jrG9o-4uBPBhQwo6chAdc0ZacwrVnTWEDUk0ff1-QIA1m6Pl_0eGt91U5wZlVVRYYTR&google_hm=QNJ0pcR4zDEXpjmYAbYJVw==

170 B
188 B

42ms
24ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKA5RbXt1BQ_HYtRQ8OBg2dzI5O1jrG9o-4uBPBhQwo6chAdc0ZacwrVnTWEDUk0ff1-QIA1m6Pl_0eGt91U5wZlVVRYYTR&google_hm=QNJ0pcR4zDEXpjmYAbYJVw==

Requested by

Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:45 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPKA5RbXt1BQ_HYtRQ8OBg2dzI5O1jrG9o-4uBPBhQwo6chAdc0ZacwrVnTWEDUk0ff1-QIA1m6Pl_0eGt91U5wZlVVRYYTR&google_hm=QNJ0pcR4zDEXpjmYAbYJVw==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: face7o03b5ce6p762fqp1g3mljk13h59

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DCD5
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=Z4kjAdt7T3SCORbZRKWtHQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

23ms
23ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=Z4kjAdt7T3SCORbZRKWtHQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLdkgoJEWSmAwTnj3GtrNpe_aByvJr8bvFUxQ2vv65j9A2vSrivB4Hl0g1mpxAo1EpxERwKXkzrpelh527J5XW8qNfVzz0

Requested by

Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=Z4kjAdt7T3SCORbZRKWtHQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPLdkgoJEWSmAwTnj3GtrNpe_aByvJr8bvFUxQ2vv65j9A2vSrivB4Hl0g1mpxAo1EpxERwKXkzrpelh527J5XW8qNfVzz0
date: Sat, 02 Oct 2021 22:55:45 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DCD5
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESECKOz03rffOLVSyZVdmyEXs&google_cver=1&google_push=AYg5qPIch9ES0VeVpz6f5SajTPXHWetRvIndN9jU_5AMJy68UTwOaIhZhodTwvqyXtWa8XdSQz1...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VBRThZSjctOC1KMlhM&google_push=AYg5qPIch9ES0VeVpz6f5SajTPXHWetRvIndN9jU_5AMJy68UTwOaIhZhodTwvqyXtWa8XdSQz1m65vPy-JQPbzVP1BuzTio1jGu

170 B
188 B

45ms
24ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VBRThZSjctOC1KMlhM&google_push=AYg5qPIch9ES0VeVpz6f5SajTPXHWetRvIndN9jU_5AMJy68UTwOaIhZhodTwvqyXtWa8XdSQz1m65vPy-JQPbzVP1BuzTio1jGu

Requested by

Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VBRThZSjctOC1KMlhM&google_push=AYg5qPIch9ES0VeVpz6f5SajTPXHWetRvIndN9jU_5AMJy68UTwOaIhZhodTwvqyXtWa8XdSQz1m65vPy-JQPbzVP1BuzTio1jGu
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4b510f0cc5fcbc9800016ef543086418
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame DCD5
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AYg5qPKjJf8xrxHRcxfkHdJ0W4FelbohL4P3v10vDuU7dioCzQJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AYg5qPKjJf8xrxHRcxfkHdJ0W4FelbohL4P3v10vDuU7dioCzQJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AYg5qPKjJf8xrxHRcxfkHdJ0W4FelbohL4P3v10vDuU7dioCzQJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AYg5qPKjJf8xrxHRcxfkHdJ0W4FelbohL4P3v10vDuU7dioCzQJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AYg5qPKjJf8xrxHRcxfkHdJ0W4FelbohL4P3v10vDuU7dioCzQJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AYg5qPKjJf8xrxHRcxfkHdJ0W4FelbohL4P3v10vDuU7dioCzQJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AYg5qPKjJf8xrxHRcxfkHdJ0W4FelbohL4P3v10vDuU7dioCzQJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AYg5qPKjJf8xrxHRcxfkHdJ0W4FelbohL4P3v10vDuU7dioCzQJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AYg5qPKjJf8xrxHRcxfkHdJ0W4FelbohL4P3v10vDuU7dioCzQJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AYg5qPKjJf8xrxHRcxfkHdJ0W4FelbohL4P3v10vDuU7dioCzQJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AYg5qPKjJf8xrxHRcxfkHdJ0W4FelbohL4P3v10vDuU7dioCzQJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AYg5qPKjJf8xrxHRcxfkHdJ0W4FelbohL4P3v10vDuU7dioCzQJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AYg5qPKjJf8xrxHRcxfkHdJ0W4FelbohL4P3v10vDuU7dioCzQJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AYg5qPKjJf8xrxHRcxfkHdJ0W4FelbohL4P3v10vDuU7dioCzQJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AYg5qPKjJf8xrxHRcxfkHdJ0W4FelbohL4P3v10vDuU7dioCzQJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AYg5qPKjJf8xrxHRcxfkHdJ0W4FelbohL4P3v10vDuU7dioCzQJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AYg5qPKjJf8xrxHRcxfkHdJ0W4FelbohL4P3v10vDuU7dioCzQJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AYg5qPKjJf8xrxHRcxfkHdJ0W4FelbohL4P3v10vDuU7dioCzQJ...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AYg5qPKjJf8xrxHRcxfkHdJ0W4FelbohL4P3v10vDuU7dioCzQJ...

0
0

GET
H2 204 /
cc.adingo.jp/adx/push/ Frame DCD5 0
44 B 686ms
223ms Image
text/plain 52.68.53.67
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.adingo.jp/adx/push/?google_gid=CAESEFzU8jXy6L-Pb5llwE7Ozz8&google_cver=1&google_push=AYg5qPJYDyibH3wpKXIL9IN5qWwj3u5ZXOIhE867sfDC4jbm0V6wOEuJEqTbC3LiFOUb6rYg9R7V5hez7a8u2nDh7ntEjwHCP8hj
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=389585034&adf=4164852396&pi=t.aa~a.245933387~rp.1&w=787&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=787x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0&nras=2&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=192&ady=2503&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=3&uci=a!3&btvi=2&fsb=1&xpc=TJiKRZhQkM&p=http%3A//termalfurdok.com&dtd=14
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.68.53.67 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-68-53-67.ap-northeast-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:46 GMT
server: awselb/2.0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame DCD5 0
244 B 54ms
12ms Image
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KhvV1lWulqvhxX8WW5ql6tyFHGo2wbSKH5HANPtdKhg6kHFEcQk-sNxjml9udLbIKxuPqn

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:46 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 dpixel
cms.quantserve.com/ Frame DFD0 35 B
463 B 42ms
6ms Image
image/gif 91.228.74.189
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEPizScXnAqf5HOmO_xLq9Og&google_cver=1&google_push=AYg5qPLiVmXGGAnGXC4Ujo3awHExtuebF4hClUlxTCnHYc7tlgiAzzyecCTYTFjwydVvYRtCXP0z2P3Un40qu22Wjo9_bq-PouSD

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

91.228.74.189 , United Kingdom, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:46 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DFD0
Redirect Chain

https://d.agkn.com/pixel/2175/?google_gid=CAESELf4eQAGirr7W0g74rL-mnM&google_cver=1&google_push=AYg5qPKH4sQl7yJSuWq0lp-2LnSbccoHAhbRvcpbTTJNrV8SKoOgUS_AU7IXSz1rS6rGaZWdho7Xv3SFCvjcTuYJEEeHr1hsUZvD
https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPKH4sQl7yJSuWq0lp-2LnSbccoHAhbRvcpbTTJNrV8SKoOgUS_AU7IXSz1rS6rGaZWdho7Xv3SFCvjcTuYJEEeHr1hsUZvD&google_hm=Q0FFU0VMZjRlUUFHaXJyN...

170 B
188 B

44ms
26ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPKH4sQl7yJSuWq0lp-2LnSbccoHAhbRvcpbTTJNrV8SKoOgUS_AU7IXSz1rS6rGaZWdho7Xv3SFCvjcTuYJEEeHr1hsUZvD&google_hm=Q0FFU0VMZjRlUUFHaXJyN1cwZzc0ckwtbW5N

Requested by

Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sat, 02 Oct 2021 22:55:45 GMT
Server: Apache-Coyote/1.1
P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=ak_dmp&google_push=AYg5qPKH4sQl7yJSuWq0lp-2LnSbccoHAhbRvcpbTTJNrV8SKoOgUS_AU7IXSz1rS6rGaZWdho7Xv3SFCvjcTuYJEEeHr1hsUZvD&google_hm=Q0FFU0VMZjRlUUFHaXJyN1cwZzc0ckwtbW5N
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DFD0
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEP8PYG8jCbywMVc2a3xk2wo&google_cver=1&google_push=AYg5qPIE-4XWnrmJC4ewKuvj_62t2DpKEChRZNjEE7CnqpN7ACpuLUk6dsjTCvXGmUPkJ_N3G2Zh89hiWIs6iZHQbOd-4qQXQp0
https://rtb.openx.net/sync/dds?google_gid=CAESEP8PYG8jCbywMVc2a3xk2wo&google_cver=1&google_push=AYg5qPIE-4XWnrmJC4ewKuvj_62t2DpKEChRZNjEE7CnqpN7ACpuLUk6dsjTCvXGmUPkJ_N3G2Zh89hiWIs6iZHQbOd-4qQXQp0&o...
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIE-4XWnrmJC4ewKuvj_62t2DpKEChRZNjEE7CnqpN7ACpuLUk6dsjTCvXGmUPkJ_N3G2Zh89hiWIs6iZHQbOd-4qQXQp0&google_hm=QNJ0pcR4zDEXpjmYAbYJVw==

170 B
188 B

43ms
25ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIE-4XWnrmJC4ewKuvj_62t2DpKEChRZNjEE7CnqpN7ACpuLUk6dsjTCvXGmUPkJ_N3G2Zh89hiWIs6iZHQbOd-4qQXQp0&google_hm=QNJ0pcR4zDEXpjmYAbYJVw==

Requested by

Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:46 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPIE-4XWnrmJC4ewKuvj_62t2DpKEChRZNjEE7CnqpN7ACpuLUk6dsjTCvXGmUPkJ_N3G2Zh89hiWIs6iZHQbOd-4qQXQp0&google_hm=QNJ0pcR4zDEXpjmYAbYJVw==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: vvb85ojt9h4c5ni6cthr6e3llqb521ma

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DFD0
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=62M2awpNQ4qpzkyPIve9Uw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

24ms
24ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=62M2awpNQ4qpzkyPIve9Uw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK_g92fYs5zSqsuaqT_QWYkoBa56IPL0r_r6zUx3RYQDpYJmA7ybDVbmlK-FSHaIS9rvIyOHxMeHg0zb_gU-RhxyRFcNM2d

Requested by

Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=62M2awpNQ4qpzkyPIve9Uw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK_g92fYs5zSqsuaqT_QWYkoBa56IPL0r_r6zUx3RYQDpYJmA7ybDVbmlK-FSHaIS9rvIyOHxMeHg0zb_gU-RhxyRFcNM2d
date: Sat, 02 Oct 2021 22:55:45 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DFD0
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESECKOz03rffOLVSyZVdmyEXs&google_cver=1&google_push=AYg5qPIPfm6ed-JnLfpKg-1Z_OF2U1LZRdixpwFKdm2G6i3AM08ggtWU1VXLTojjXpLl7V40VSp...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VBRThZSjgtMjQtQktYRw==&google_push=AYg5qPIPfm6ed-JnLfpKg-1Z_OF2U1LZRdixpwFKdm2G6i3AM08ggtWU1VXLTojjXpLl7V40VSp9Wue9Pk1ISwEyBoo-olkPNvtB

170 B
188 B

46ms
26ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VBRThZSjgtMjQtQktYRw==&google_push=AYg5qPIPfm6ed-JnLfpKg-1Z_OF2U1LZRdixpwFKdm2G6i3AM08ggtWU1VXLTojjXpLl7V40VSp9Wue9Pk1ISwEyBoo-olkPNvtB

Requested by

Host: termalfurdok.com
URL: http://termalfurdok.com/en/spa-hotels-in-budapest/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VBRThZSjgtMjQtQktYRw==&google_push=AYg5qPIPfm6ed-JnLfpKg-1Z_OF2U1LZRdixpwFKdm2G6i3AM08ggtWU1VXLTojjXpLl7V40VSp9Wue9Pk1ISwEyBoo-olkPNvtB
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4b510f0cc5fcbc9800016ef543086418
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame DFD0
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_push=AYg5qPLsPHM2u7GwkNkGW2sBZuGK3z-mh1kXTjhtbfSc2OPky3CT1fcNXyv247OzfUa3Re2dY-o3J_AsgvHzF3Vzwz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_push=AYg5qPLsPHM2u7GwkNkGW2sBZuGK3z-mh1kXTjhtbfSc2OPky3CT1fcNXyv247OzfUa3Re2dY-o3J_AsgvHzF3Vzwz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_push=AYg5qPLsPHM2u7GwkNkGW2sBZuGK3z-mh1kXTjhtbfSc2OPky3CT1fcNXyv247OzfUa3Re2dY-o3J_AsgvHzF3Vzwz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_push=AYg5qPLsPHM2u7GwkNkGW2sBZuGK3z-mh1kXTjhtbfSc2OPky3CT1fcNXyv247OzfUa3Re2dY-o3J_AsgvHzF3Vzwz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_push=AYg5qPLsPHM2u7GwkNkGW2sBZuGK3z-mh1kXTjhtbfSc2OPky3CT1fcNXyv247OzfUa3Re2dY-o3J_AsgvHzF3Vzwz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_push=AYg5qPLsPHM2u7GwkNkGW2sBZuGK3z-mh1kXTjhtbfSc2OPky3CT1fcNXyv247OzfUa3Re2dY-o3J_AsgvHzF3Vzwz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_push=AYg5qPLsPHM2u7GwkNkGW2sBZuGK3z-mh1kXTjhtbfSc2OPky3CT1fcNXyv247OzfUa3Re2dY-o3J_AsgvHzF3Vzwz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_push=AYg5qPLsPHM2u7GwkNkGW2sBZuGK3z-mh1kXTjhtbfSc2OPky3CT1fcNXyv247OzfUa3Re2dY-o3J_AsgvHzF3Vzwz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_push=AYg5qPLsPHM2u7GwkNkGW2sBZuGK3z-mh1kXTjhtbfSc2OPky3CT1fcNXyv247OzfUa3Re2dY-o3J_AsgvHzF3Vzwz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_push=AYg5qPLsPHM2u7GwkNkGW2sBZuGK3z-mh1kXTjhtbfSc2OPky3CT1fcNXyv247OzfUa3Re2dY-o3J_AsgvHzF3Vzwz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_push=AYg5qPLsPHM2u7GwkNkGW2sBZuGK3z-mh1kXTjhtbfSc2OPky3CT1fcNXyv247OzfUa3Re2dY-o3J_AsgvHzF3Vzwz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_push=AYg5qPLsPHM2u7GwkNkGW2sBZuGK3z-mh1kXTjhtbfSc2OPky3CT1fcNXyv247OzfUa3Re2dY-o3J_AsgvHzF3Vzwz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_push=AYg5qPLsPHM2u7GwkNkGW2sBZuGK3z-mh1kXTjhtbfSc2OPky3CT1fcNXyv247OzfUa3Re2dY-o3J_AsgvHzF3Vzwz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_push=AYg5qPLsPHM2u7GwkNkGW2sBZuGK3z-mh1kXTjhtbfSc2OPky3CT1fcNXyv247OzfUa3Re2dY-o3J_AsgvHzF3Vzwz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_push=AYg5qPLsPHM2u7GwkNkGW2sBZuGK3z-mh1kXTjhtbfSc2OPky3CT1fcNXyv247OzfUa3Re2dY-o3J_AsgvHzF3Vzwz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_push=AYg5qPLsPHM2u7GwkNkGW2sBZuGK3z-mh1kXTjhtbfSc2OPky3CT1fcNXyv247OzfUa3Re2dY-o3J_AsgvHzF3Vzwz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_push=AYg5qPLsPHM2u7GwkNkGW2sBZuGK3z-mh1kXTjhtbfSc2OPky3CT1fcNXyv247OzfUa3Re2dY-o3J_AsgvHzF3Vzwz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_push=AYg5qPLsPHM2u7GwkNkGW2sBZuGK3z-mh1kXTjhtbfSc2OPky3CT1fcNXyv247OzfUa3Re2dY-o3J_AsgvHzF3Vzwz...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_push=AYg5qPLsPHM2u7GwkNkGW2sBZuGK3z-mh1kXTjhtbfSc2OPky3CT1fcNXyv247OzfUa3Re2dY-o3J_AsgvHzF3Vzwz...

0
0

GET
H2 204 /
cc.adingo.jp/adx/push/ Frame DFD0 0
43 B 675ms
224ms Image
text/plain 52.68.53.67
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.adingo.jp/adx/push/?google_gid=CAESEFzU8jXy6L-Pb5llwE7Ozz8&google_cver=1&google_push=AYg5qPJQaNVTGpjpR5GP4zitblywCASN-NXy-9J6yAtufIRjF1gK0ACY6HOZUCf-AhzKhi7ts05FWUWrs66TfkXKvzz7cwB0MF0
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=3823540373&adf=1126500945&pi=t.aa~a.3220379706~rp.4&w=365&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=365x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280&nras=3&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=1043&ady=1775&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=4&uci=a!4&btvi=3&fsb=1&xpc=xhyBgfMwU9&p=http%3A//termalfurdok.com&dtd=24
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.68.53.67 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-68-53-67.ap-northeast-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:46 GMT
server: awselb/2.0

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame DFD0 0
49 B 44ms
12ms Image
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IuMwF82byTbp9N8b5It-iQxOgeP9I7D6wuZlpO7s5gywLgqMKYKMhk_LId1-NT-EadY5sW

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:46 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 615155484575903256_5569703044244887428.jpeg
static.doubleclick.net/dynamic/5/65138550/ Frame 4D8E 27 KB
27 KB 52ms
27ms Image
image/jpeg 142.250.184.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/65138550/615155484575903256_5569703044244887428.jpeg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fcafffff801480ba1499d2a9b9a4e85c1d11b7fcf0ad1516aa185a54e8d6bea0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 05:25:34 GMT
x-content-type-options: nosniff
age: 63012
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27559
x-xss-protection: 0
last-modified: Fri, 01 Oct 2021 10:39:59 GMT
server: sffe
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-programmable"
expires: Sun, 02 Oct 2022 05:25:34 GMT

GET
H3 200 945150795263010520_16674526489308184915.jpeg
static.doubleclick.net/dynamic/5/65138550/ Frame 4D8E 21 KB
21 KB 77ms
53ms Image
image/jpeg 142.250.184.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/65138550/945150795263010520_16674526489308184915.jpeg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a504b5557ea2e0a130cb0cd5c8b2439744ea3f8cf087ea765b1c494a27c648b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:46 GMT
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21908
x-xss-protection: 0
last-modified: Fri, 01 Oct 2021 10:39:22 GMT
server: sffe
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-programmable"
expires: Sun, 02 Oct 2022 22:55:46 GMT

GET
H3 200 4863540175992718779_459703618579515280.jpeg
static.doubleclick.net/dynamic/5/65138550/ Frame 4D8E 21 KB
21 KB 40ms
17ms Image
image/jpeg 142.250.184.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/65138550/4863540175992718779_459703618579515280.jpeg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3f177934e615b9dddddfc0e6834e9db263275c9cfe9a5bb2400e58f9111b2ade

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 10:09:32 GMT
x-content-type-options: nosniff
age: 45974
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21795
x-xss-protection: 0
last-modified: Fri, 01 Oct 2021 10:39:55 GMT
server: sffe
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-programmable"
expires: Sun, 02 Oct 2022 10:09:32 GMT

GET
H3 200 2066005473843201386_16805239477766748029.jpeg
static.doubleclick.net/dynamic/5/65138550/ Frame 4D8E 18 KB
18 KB 43ms
21ms Image
image/jpeg 142.250.184.230
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.doubleclick.net/dynamic/5/65138550/2066005473843201386_16805239477766748029.jpeg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ae528abae33b097616cac8acc48c6c3921ba5b5f2730a70ec400e37608bbc739

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 11:06:12 GMT
x-content-type-options: nosniff
age: 42574
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18578
x-xss-protection: 0
last-modified: Fri, 01 Oct 2021 10:40:05 GMT
server: sffe
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="ads-programmable"
expires: Sun, 02 Oct 2022 11:06:12 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/ Frame 4D8E 18 KB
7 KB 16ms
14ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

da48b97b44f32bd333c5ca822e07f0997269db7bbd7e85f514035e02a57624f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:47:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 510
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7607
x-xss-protection: 0
server: cafe
etag: 5036643633216217121
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:47:16 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame 4D8E 3 KB
1 KB 16ms
15ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:42:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 790
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:42:36 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4D8E 122 KB
37 KB 38ms
37ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

867ff39044c47d580bde0bfc1e95bfcc25c21738c79351591641a83a56dc6d3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
server: sffe
etag: "1633087504575570"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Sat, 02 Oct 2021 22:55:46 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame 4D8E 14 KB
6 KB 16ms
14ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f430df1926f8f2c1211de662c1070de2b98259bfc9bbdd8cf70c7b53d6777cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:35:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1188
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6194
x-xss-protection: 0
server: cafe
etag: 2541472377268313288
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:35:58 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 4D8E 0
0 18ms
17ms Image
text/html 216.58.212.164
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaT0FaCbN0a9PjA4kY103JWuYUoMTFXL-0SL86ZyFitS4DGOFcXrdPcN7RzBd2KJwqLi-mLnoRsweM3buudzjZe1YgwmjA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=83859408&adf=4214651320&pi=t.aa~a.1838705564~rp.2&w=1200&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=1200x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280%2C365x280&nras=4&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=200&ady=4198&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=TLpFX7P9Hh&p=http%3A//termalfurdok.com&dtd=27
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.58.212.164 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f164.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 BPTeJxusP8cOnE_s5L3ABe2tIpKd1NVDJBlhKS7pwaI.js Show response
pagead2.googlesyndication.com/bg/ Frame 7735 35 KB
13 KB 9ms
9ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/BPTeJxusP8cOnE_s5L3ABe2tIpKd1NVDJBlhKS7pwaI.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04f4de271bac3fc70e9c4fece4bdc005edad22929dd4d543241961292ee9c1a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 16:24:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23482
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13343
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 10:18:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sun, 02 Oct 2022 16:24:24 GMT

GET
H3 200 10124421203004885384
tpc.googlesyndication.com/simgad/ Frame 4D8E 8 KB
8 KB 15ms
15ms Image
image/png 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/10124421203004885384

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

484ec1c347c17d7d3b98d5058aa5d90bb5c7315f3a67f44611e902de4be50831

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 10:25:50 GMT
x-content-type-options: nosniff
age: 44996
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8502
x-xss-protection: 0
last-modified: Tue, 08 Oct 2019 11:54:50 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 02 Oct 2022 10:25:50 GMT

GET
H3 200 BPTeJxusP8cOnE_s5L3ABe2tIpKd1NVDJBlhKS7pwaI.js Show response
pagead2.googlesyndication.com/bg/ Frame 0255 35 KB
13 KB 9ms
8ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/BPTeJxusP8cOnE_s5L3ABe2tIpKd1NVDJBlhKS7pwaI.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04f4de271bac3fc70e9c4fece4bdc005edad22929dd4d543241961292ee9c1a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 16:24:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23482
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13343
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 10:18:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sun, 02 Oct 2022 16:24:24 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 4D8E 0
0 23ms
19ms Fetch
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CH6oQceNYYbOwH5WZrASo3qq4BvD_gYVlyvL-hJULg5PwqowTEAEgrLHYB2DJBqABsLqh1wPIAQmoAwHIA8sEqgT4AU_Ql7V752aEdr6kAqoZxVdcbMNkiQnZTuXjx9JWFWdSVp238wep3qLM9dau4xpr8MWTri2AjVCKJzNOEknTk4FLgugj9vpz7NdXhA0kOqNWnpjD8dN0aN1RfHqWBSAvDMOzvI2Jg2Yb1yWbWovPD_tVDSV4lU9Le5K19CEFSmE_K2AHLQhQUHfhSTttE4dKi5ESOBFtO_oVonlTNdyQRoXcqqym1RBv0xpx92Kl9SFNJchbU3OXaAKzRTHBdS0fWhzF7Bz2ER0qCM7jygmzqwbbUdyU4tZGmzWTe5aJwTXMMIV8n9DTGj_DfLE4Y-nA2kIgj0_p5O_pwAT_wMCy-QGSBQQIBBgBkgUECAUYBKAGLoAHrYOudqgH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgHpr4b2AcA8gcEEJCPIdIIBwiAYRABGF-ACgHICwHYEwyIFATQFQGAFwGyFxwKGggAEhRwdWItMTg3MjIzNTc4MzMzNTI5MBgA&sigh=-rssAY0UivU&template_id=494

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=83859408&adf=4214651320&pi=t.aa~a.1838705564~rp.2&w=1200&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=1200x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280%2C365x280&nras=4&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=200&ady=4198&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=5&uci=a!5&btvi=4&fsb=1&xpc=TLpFX7P9Hh&p=http%3A//termalfurdok.com&dtd=27
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sat, 02 Oct 2021 22:55:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 4D8E 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9cac4e071f31d57a3664ba4caa9ff5077127fa4769c4f864e6740a456f9906da

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

POST
H3 204 gen_csp
pagead2.googlesyndication.com/pagead/ Frame 4D8E 0
20 B 15ms
15ms Other
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CPOsi6TprPMCFZUMiwodKK8KZw&gqi=ceNYYYnEHsiU3gO9jYJQ&layout=/pagead/gadgets/in_page_full_auto_V1/Responsive_Monte_GpaSingleIframe.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 BPTeJxusP8cOnE_s5L3ABe2tIpKd1NVDJBlhKS7pwaI.js Show response
pagead2.googlesyndication.com/bg/ Frame CD95 35 KB
13 KB 7ms
6ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/BPTeJxusP8cOnE_s5L3ABe2tIpKd1NVDJBlhKS7pwaI.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04f4de271bac3fc70e9c4fece4bdc005edad22929dd4d543241961292ee9c1a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 16:24:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23482
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13343
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 10:18:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sun, 02 Oct 2022 16:24:24 GMT

GET
H3 200 419529799728636613
tpc.googlesyndication.com/daca_images/simgad/ Frame 8BCB 21 KB
21 KB 15ms
14ms Image
image/png 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/419529799728636613

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=3864395381&adf=3475064796&pi=t.aa~a.1455942147~rp.3&w=355&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=355x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280%2C365x280%2C1200x280&nras=5&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=1048&ady=3348&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=TiZn1T36sm&p=http%3A//termalfurdok.com&dtd=31

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2db8d6e6f1de293344dddb85f9c6581221a6caebaccb337996fcb65fb47deef4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Fri, 01 Oct 2021 18:21:33 GMT
x-content-type-options: nosniff
age: 102853
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21901
x-xss-protection: 0
last-modified: Sat, 13 Feb 2021 17:42:16 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 01 Oct 2022 18:21:33 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/ Frame 8BCB 18 KB
7 KB 13ms
13ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

da48b97b44f32bd333c5ca822e07f0997269db7bbd7e85f514035e02a57624f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:47:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 510
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7607
x-xss-protection: 0
server: cafe
etag: 5036643633216217121
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:47:16 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame 8BCB 3 KB
1 KB 15ms
14ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c178b294f465f8c802b3f20752a384d2304c8628f8908d30ff13d02e861c2442

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:42:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 790
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1358
x-xss-protection: 0
server: cafe
etag: 15351394696698642166
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:42:36 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8BCB 122 KB
37 KB 28ms
27ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

867ff39044c47d580bde0bfc1e95bfcc25c21738c79351591641a83a56dc6d3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37872
x-xss-protection: 0
server: sffe
etag: "1633087504575570"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="active-view-scs-read-write-acl"
expires: Sat, 02 Oct 2021 22:55:46 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame 8BCB 14 KB
6 KB 14ms
13ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4f430df1926f8f2c1211de662c1070de2b98259bfc9bbdd8cf70c7b53d6777cd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:35:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1188
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6194
x-xss-protection: 0
server: cafe
etag: 2541472377268313288
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 22:35:58 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 8BCB 0
0 16ms
15ms Image
text/html 216.58.212.164
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSx5aVNJ5FIW5sWtCnGXhwOc3zNalaiL0gVM93SqhoWcZHmigsQFFqVjcsBBzfke5DQRyaKvvupKeoS_NE8F7q_PhXiJg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=3864395381&adf=3475064796&pi=t.aa~a.1455942147~rp.3&w=355&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=355x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280%2C365x280%2C1200x280&nras=5&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=1048&ady=3348&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=TiZn1T36sm&p=http%3A//termalfurdok.com&dtd=31
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.58.212.164 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: ams15s22-in-f164.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 one_click_handler_one_afma_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/ Frame 8BCB 27 KB
11 KB 15ms
14ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210928/r20110914/client/one_click_handler_one_afma_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a672e695dab08ffadbea7f0e77f1a723eefff684ae0cdabe2ca3b7a141554c3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 14:44:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29465
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11096
x-xss-protection: 0
server: cafe
etag: 8885281346021324493
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Sat, 16 Oct 2021 14:44:41 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 8BCB 0
0 20ms
19ms Fetch
text/html 142.250.185.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C1_43ceNYYYu-H5WMjuwPheq1iAvjr_fgYqGb5tPBDt3ZHhABIKyx2AdgyQagAbvjvJ8DyAECqAMByAPJBKoE-gFP0EYaHsuXAyhEp0zzvcJa4tySg0LLsMz9dydqqCvpxjVV1-6jZayUo81Gh0kt2lpHP7DHwi3Mp6VZscASa9-d9o2uNiDeZsDd9nFYhX12NbCzx7nqS3eaMQEB1KKVcpedMlL2EjPYEewEfCGIoH-EdD8GYRK3plVPgQJ5H3rguVy5cVREa-1KADkIelJv5e3J-q0QQnbIYll3m81U8Vtd0W3061IQjmk8fFuiV0lE7KOqkzmiiqBJBuMHGS4fD6fPvI0_QGbBv2rdNDiXzFv_V8GhHcr8sFl34ox-s8o3BpEUB7XNTV3Gk0bq5FogBQyNYwVDqe4bjlgPwATjv7O-lAGSBQQIBBgBkgUECAUYBKAGAoAHrZzDYKgH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7paxAqgH1ckbqAemvhvYBwHyBwQQnccI0ggHCIBhEAEYX4AKAcgLAdgTDNAVAZgWAYAXAbIXHAoaCAASFHB1Yi0xODcyMjM1NzgzMzM1MjkwGAA&sigh=KepIA4dEoX8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=3864395381&adf=3475064796&pi=t.aa~a.1455942147~rp.3&w=355&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=355x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280%2C365x280%2C1200x280&nras=5&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=1048&ady=3348&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=TiZn1T36sm&p=http%3A//termalfurdok.com&dtd=31
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Sat, 02 Oct 2021 22:55:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame FE02 1 KB
749 B 7ms
6ms Document
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Sat, 02 Oct 2021 08:58:57 GMT
expires: Sun, 03 Oct 2021 08:58:57 GMT
content-type: text/html; charset=ISO-8859-1
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 50209
cache-control: public, max-age=86400
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FE02
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEPizScXnAqf5HOmO_xLq9Og&google_cver=1&google_push=AYg5qPL1PUWw7o8gX7SKmsI_pSBdhTZ55dahoRzyksi_LUn8RfdkLoZ_ik...
https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPL1PUWw7o8gX7SKmsI_pSBdhTZ55dahoRzyksi_LUn8RfdkLoZ_ikTY-BNAnIMOFk5cHx-CYUox91AK_veSsekNHUCuvYKE&google_hm=kEqpFv...

170 B
188 B

24ms
24ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPL1PUWw7o8gX7SKmsI_pSBdhTZ55dahoRzyksi_LUn8RfdkLoZ_ikTY-BNAnIMOFk5cHx-CYUox91AK_veSsekNHUCuvYKE&google_hm=kEqpFvOBGj8BOTdY1sWHeg

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?gdpr=1&google_nid=B765081F39B1F7&google_push=AYg5qPL1PUWw7o8gX7SKmsI_pSBdhTZ55dahoRzyksi_LUn8RfdkLoZ_ikTY-BNAnIMOFk5cHx-CYUox91AK_veSsekNHUCuvYKE&google_hm=kEqpFvOBGj8BOTdY1sWHeg
pragma: no-cache
date: Sat, 02 Oct 2021 22:55:46 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 0
strict-transport-security: max-age=86400
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FE02
Redirect Chain

https://rtb.openx.net/sync/dds?google_gid=CAESEP8PYG8jCbywMVc2a3xk2wo&google_cver=1&google_push=AYg5qPLMx5B19ZXpQdVtlImh7USn8UIID-F30OguhlQKL0B1p_wEmxf45TBaaJAu03OSwnPulqVpcn5GZOvqKAK24nvBtTxa4iIs
https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLMx5B19ZXpQdVtlImh7USn8UIID-F30OguhlQKL0B1p_wEmxf45TBaaJAu03OSwnPulqVpcn5GZOvqKAK24nvBtTxa4iIs&google_hm=QNJ0pcR4zDEXpjmYAbYJVw==

170 B
188 B

23ms
23ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLMx5B19ZXpQdVtlImh7USn8UIID-F30OguhlQKL0B1p_wEmxf45TBaaJAu03OSwnPulqVpcn5GZOvqKAK24nvBtTxa4iIs&google_hm=QNJ0pcR4zDEXpjmYAbYJVw==

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:45 GMT
via: 1.1 google
server: Cowboy
access-control-allow-origin: null
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
location: https://cm.g.doubleclick.net/pixel?google_nid=open&google_push=AYg5qPLMx5B19ZXpQdVtlImh7USn8UIID-F30OguhlQKL0B1p_wEmxf45TBaaJAu03OSwnPulqVpcn5GZOvqKAK24nvBtTxa4iIs&google_hm=QNJ0pcR4zDEXpjmYAbYJVw==
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-request-id: 3lkcpldabpcrg53qjoc0lskn9f6ojgd1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FE02
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=62M2awpNQ4qpzkyPIve9Uw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

23ms
23ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=62M2awpNQ4qpzkyPIve9Uw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJDndyDfwSuwtKrYLpWgK6-kssa80pQu3VEt4Zm4XKeBbQIofpBCcLK5k2Yrz-wy3t0pbDli0m3pfV37N16nFtTdU4nGXAe

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=62M2awpNQ4qpzkyPIve9Uw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPJDndyDfwSuwtKrYLpWgK6-kssa80pQu3VEt4Zm4XKeBbQIofpBCcLK5k2Yrz-wy3t0pbDli0m3pfV37N16nFtTdU4nGXAe
date: Sat, 02 Oct 2021 22:55:45 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FE02
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESECKOz03rffOLVSyZVdmyEXs&google_cver=1&google_push=AYg5qPKskE28sWmRahF5X64OKwp0vEwjHNT0d1RzdggiNEMSSS0GXk5A--OjZM6epcb-PM9H873...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VBRThZUjctMU8tMTdZUg==&google_push=AYg5qPKskE28sWmRahF5X64OKwp0vEwjHNT0d1RzdggiNEMSSS0GXk5A--OjZM6epcb-PM9H873gyMSf6QKfU90TYSL-1MiZrhUw

170 B
188 B

23ms
23ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VBRThZUjctMU8tMTdZUg==&google_push=AYg5qPKskE28sWmRahF5X64OKwp0vEwjHNT0d1RzdggiNEMSSS0GXk5A--OjZM6epcb-PM9H873gyMSf6QKfU90TYSL-1MiZrhUw

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:46 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1VBRThZUjctMU8tMTdZUg==&google_push=AYg5qPKskE28sWmRahF5X64OKwp0vEwjHNT0d1RzdggiNEMSSS0GXk5A--OjZM6epcb-PM9H873gyMSf6QKfU90TYSL-1MiZrhUw
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 4b510f0cc5fcbc9800016ef543086418
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame FE02
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESENIq21yHZAzkOqVyJOG0Y5Y&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_cver=1&google_push=AYg5qPJ3Fr3QK2QUK_S9VcHK9D_ARX7WYlZjUuuxyzTdRAWXOun5AM9ML0bcgmowFfXogPL7JGyD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_cver=1&google_push=AYg5qPJ3Fr3QK2QUK_S9VcHK9D_ARX7WYlZjUuuxyzTdRAWXOun5AM9ML0bcgmowFfXogPL7JGyD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_cver=1&google_push=AYg5qPJ3Fr3QK2QUK_S9VcHK9D_ARX7WYlZjUuuxyzTdRAWXOun5AM9ML0bcgmowFfXogPL7JGyD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_cver=1&google_push=AYg5qPJ3Fr3QK2QUK_S9VcHK9D_ARX7WYlZjUuuxyzTdRAWXOun5AM9ML0bcgmowFfXogPL7JGyD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_cver=1&google_push=AYg5qPJ3Fr3QK2QUK_S9VcHK9D_ARX7WYlZjUuuxyzTdRAWXOun5AM9ML0bcgmowFfXogPL7JGyD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_cver=1&google_push=AYg5qPJ3Fr3QK2QUK_S9VcHK9D_ARX7WYlZjUuuxyzTdRAWXOun5AM9ML0bcgmowFfXogPL7JGyD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_cver=1&google_push=AYg5qPJ3Fr3QK2QUK_S9VcHK9D_ARX7WYlZjUuuxyzTdRAWXOun5AM9ML0bcgmowFfXogPL7JGyD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_cver=1&google_push=AYg5qPJ3Fr3QK2QUK_S9VcHK9D_ARX7WYlZjUuuxyzTdRAWXOun5AM9ML0bcgmowFfXogPL7JGyD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_cver=1&google_push=AYg5qPJ3Fr3QK2QUK_S9VcHK9D_ARX7WYlZjUuuxyzTdRAWXOun5AM9ML0bcgmowFfXogPL7JGyD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_cver=1&google_push=AYg5qPJ3Fr3QK2QUK_S9VcHK9D_ARX7WYlZjUuuxyzTdRAWXOun5AM9ML0bcgmowFfXogPL7JGyD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_cver=1&google_push=AYg5qPJ3Fr3QK2QUK_S9VcHK9D_ARX7WYlZjUuuxyzTdRAWXOun5AM9ML0bcgmowFfXogPL7JGyD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_cver=1&google_push=AYg5qPJ3Fr3QK2QUK_S9VcHK9D_ARX7WYlZjUuuxyzTdRAWXOun5AM9ML0bcgmowFfXogPL7JGyD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_cver=1&google_push=AYg5qPJ3Fr3QK2QUK_S9VcHK9D_ARX7WYlZjUuuxyzTdRAWXOun5AM9ML0bcgmowFfXogPL7JGyD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_cver=1&google_push=AYg5qPJ3Fr3QK2QUK_S9VcHK9D_ARX7WYlZjUuuxyzTdRAWXOun5AM9ML0bcgmowFfXogPL7JGyD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_cver=1&google_push=AYg5qPJ3Fr3QK2QUK_S9VcHK9D_ARX7WYlZjUuuxyzTdRAWXOun5AM9ML0bcgmowFfXogPL7JGyD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_cver=1&google_push=AYg5qPJ3Fr3QK2QUK_S9VcHK9D_ARX7WYlZjUuuxyzTdRAWXOun5AM9ML0bcgmowFfXogPL7JGyD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_cver=1&google_push=AYg5qPJ3Fr3QK2QUK_S9VcHK9D_ARX7WYlZjUuuxyzTdRAWXOun5AM9ML0bcgmowFfXogPL7JGyD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_cver=1&google_push=AYg5qPJ3Fr3QK2QUK_S9VcHK9D_ARX7WYlZjUuuxyzTdRAWXOun5AM9ML0bcgmowFfXogPL7JGyD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_cver=1&google_push=AYg5qPJ3Fr3QK2QUK_S9VcHK9D_ARX7WYlZjUuuxyzTdRAWXOun5AM9ML0bcgmowFfXogPL7JGyD...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YVjjcr7rnurFzKCphdSDBgAABKQAAAAB&google_cver=1&google_push=AYg5qPJ3Fr3QK2QUK_S9VcHK9D_ARX7WYlZjUuuxyzTdRAWXOun5AM9ML0bcgmowFfXogPL7JGyD...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame FE02 43 B
296 B 138ms
21ms Image
image/gif 35.177.148.143
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESENIeBhW-Z4uwlZZ7imFHxlU&google_cver=1&google_push=AYg5qPKRFU9gZ8f6noDdayfgZjHdEXgxPM8uYY21bkciUXQy3JflC1RRVGyJQLIL4yMEIi6FhufJoFtZJxTks7--LjZ-tyvwpFn1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=3864395381&adf=3475064796&pi=t.aa~a.1455942147~rp.3&w=355&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=355x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280%2C365x280%2C1200x280&nras=5&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=1048&ady=3348&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=TiZn1T36sm&p=http%3A//termalfurdok.com&dtd=31
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.177.148.143 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-177-148-143.eu-west-2.compute.amazonaws.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:46 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H2 204 /
cc.adingo.jp/adx/push/ Frame FE02 0
43 B 360ms
224ms Image
text/plain 52.68.53.67
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.adingo.jp/adx/push/?google_gid=CAESEFzU8jXy6L-Pb5llwE7Ozz8&google_cver=1&google_push=AYg5qPLn-M9LR6ymqcrbdXreEk0DBjjEUAWUT8ey1yVoY2SIg9XgQ32oNLZRqaroE_2Rstwdztv5n5WYYCMgSOegyN3CwrLUeqgq
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1872235783335290&output=html&h=280&adk=3864395381&adf=3475064796&pi=t.aa~a.1455942147~rp.3&w=355&fwrn=4&fwrnh=100&lmt=1633215345&rafmt=1&to=qs&pwprc=4716338912&psa=1&format=355x280&url=http%3A%2F%2Ftermalfurdok.com%2Fen%2Fspa-hotels-in-budapest%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&dt=1633215345463&bpp=1&bdt=1278&idt=-M&shv=r20210927&mjsv=m202109270101&ptt=9&saldr=aa&abxe=1&cookie=ID%3Da5da3aedb5e2a6db-2254619683c9000b%3AT%3D1633215344%3ART%3D1633215344%3AS%3DALNI_Ma4MGkLVRO9uzHb1_QGMr19TdLlCw&prev_fmts=787x197%2C0x0%2C787x280%2C365x280%2C1200x280&nras=5&correlator=8513168085096&frm=20&pv=1&ga_vid=186992990.1633215345&ga_sid=1633215345&ga_hid=1355032657&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_java=0&u_nplug=3&u_nmime=4&adx=1048&ady=3348&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=31062580%2C42530893%2C31062944&oid=2&psts=AGkb-H-ul8aGlUPnC2or83wLlhVCs9rMCX7TWabG-G8MfpMi7fPMl-bcgXo1JAtxqbV-9pKeObdxcDY3O94&pvsid=1693012635705270&pem=666&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=23&ifi=6&uci=a!6&btvi=5&fsb=1&xpc=TiZn1T36sm&p=http%3A//termalfurdok.com&dtd=31
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.68.53.67 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-68-53-67.ap-northeast-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:46 GMT
server: awselb/2.0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame FE02 0
12 B 21ms
20ms Image
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JBQP7tZXDwoD40ZKXkxajQAlni5QbWqWUeDg_wynFeJO-0STZBx8ZV7Y4n7wedNq1LksNl

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:46 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
DATA 200
OK truncated
/ Frame 8BCB 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bee9b41cd89ee41168225fa9cbd8ffd3a489f15de304b9d4994950429598f597

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 11 KB
8 KB 21ms
21ms XHR
application/json 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20210927&st=env

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

69296817a69cd23e629bec5fb426d7c09898f7f71b3c6ee802fbf87bdbf70a20

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

timing-allow-origin: *
date: Sat, 02 Oct 2021 22:55:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8555
x-xss-protection: 0

GET
H3 200 BPTeJxusP8cOnE_s5L3ABe2tIpKd1NVDJBlhKS7pwaI.js Show response
pagead2.googlesyndication.com/bg/ Frame 2AAD 35 KB
13 KB 6ms
6ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/BPTeJxusP8cOnE_s5L3ABe2tIpKd1NVDJBlhKS7pwaI.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04f4de271bac3fc70e9c4fece4bdc005edad22929dd4d543241961292ee9c1a2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 16:24:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 23482
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13343
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 10:18:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Sun, 02 Oct 2022 16:24:24 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 32ms
32ms Script
text/javascript 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202109270101/show_ads_impl_fy2019.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a5ead9037af4a0e749e217f63b25a25493a7705e17d98f04b336ab1370a353db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Sat, 02 Oct 2021 22:55:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1624308425655142"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6467
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Sat, 02 Oct 2021 22:55:46 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/224/ Frame E255 12 KB
5 KB 14ms
13ms Document
text/html 172.217.18.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.18.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f164.1e100.net

Software

sffe /

Resource Hash

4fa0156d693856f79289525c8e4db988a188d55ce0283351c96d811c7ce3e2c3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/224/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://termalfurdok.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5029
date: Sat, 02 Oct 2021 17:15:47 GMT
expires: Sun, 02 Oct 2022 17:15:47 GMT
last-modified: Wed, 02 Jun 2021 17:09:45 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 20399
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 8505 783 B
533 B 16ms
16ms Document
text/html 216.58.212.164
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.164 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

389f6810a2cd5518a44bb051f11206234a6817214400317859a6e25c4c228e24

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-HfO+/MzcnSkOmWNaepZkVg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.google.com
:scheme: https
:path: /recaptcha/api2/aframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
accept-language: de-DE,de;q=0.9
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://termalfurdok.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy-report-only: require-corp; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Sat, 02 Oct 2021 22:55:46 GMT
date: Sat, 02 Oct 2021 22:55:46 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-HfO+/MzcnSkOmWNaepZkVg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 511
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 8505 0
0 32ms
31ms Image
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&li=gda_r20210927&jk=1693012635705270&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s08-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H3 200 WAz-nyaJu9uVRUq8NsxhsXGtXViWwv7lV4sP3qP2SqA.js Show response
pagead2.googlesyndication.com/bg/ Frame E255 35 KB
13 KB 6ms
6ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WAz-nyaJu9uVRUq8NsxhsXGtXViWwv7lV4sP3qP2SqA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/224/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

580cfe9f2689bbdb95454abc36cc61b171ad5d5896c2fee5578b0fdea3f64aa0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

date: Thu, 30 Sep 2021 06:58:22 GMT
content-encoding: br
x-content-type-options: nosniff
age: 230244
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13388
x-xss-protection: 0
last-modified: Mon, 20 Sep 2021 23:08:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Fri, 30 Sep 2022 06:58:22 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4DA4 42 B
64 B 17ms
17ms Fetch
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuGfsH9YRPmJR-RXUuy43ej80oB6Um_oL68tVciCl_lnEGET2jmVecMFkoujzoVYXAcUwsk-DfB923UR8t45xMkKyZ9MYO0yV0yptk1KuVqJrQraJE&sai=AMfl-YQ_6rv85OmxD--2xa4lrhSlVoCilp815sxxbrOVJ9ywZpfzR4X3gC9ybC6wlvRTj1n7kgttBZ-lsxhO&sig=Cg0ArKJSzLapA64fu7STEAE&id=lidar2&mcvt=1003&p=0,0,124,1005&mtos=87,749,1003,1107,1226&tos=87,662,254,104,119&v=20211001&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=4&adk=1812271801&rs=2&met=mue&la=0&cr=0&vs=4&r=v&rst=1633215345588&rpt=110

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 02 Oct 2021 22:55:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 22ms
22ms Image
text/html 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=224&t=2&li=gda_r20210927&jk=1693012635705270&bg=!pqWlpeHNAAZNQyuQTUM7ACkAdvg8WteoG0G8USGtNuhf2A7VRJCllOzvKojwJwClQcrjFkim43lIcAIAAABqUgAAAApoAQcKAG4rsCD1juDfHPt1ZHKTyfsKyHgWNwx2IIiuRYAn2b9HdsjHSh0IYiLZwyALZwdMV1pEwEjXL6EAQZe3SgtNSQtJW1_T0QPa0gSKlAH8H4yPYGqh57TWfAUgXKd5ihnJZ2QRqKax0WcHEYWaj3sDRpkCzVW9YewmRNqJZ90O4jJebZqgGQIKbFLXtUSEVs0817HILAObLamDi-jUeRVmdDxCzyKFeOLb0HtAr5wflxK5laeGhXfJbrLvBSmFpVJLFKsYudZkkzBiCU_f4JHuBLAR14e5WACCiy6YCwe4H2ht0uAX8ZNtKlUKfJDopGchrClS3TEv1Dm1C6gAWeuWsVKYcBzrLvJX0lDISibm-vNRAiejEs-JTd_rmysbCVTX6T8FZSFtBSS_zr_7_-PuA8mtZW7AWn9hBqOFYuqMSky3Qf52hulK_TO1AY71V4LixIWO_BTowMbfbd0iRXfcJGkNPbMAwiQv6FANkgYsMYq_feclgrV4ijLvCj4a8cyAfmZLYL05PUXxaU062o6O5t1UQeOBMT5q4p8QToNY_ONPxOkxBo5JPHYivrZL2XR8_PWnZYSgA961xXqytM8ggA84Ef5vGiVW-1nA8tHDsO2lqx3tAgY6GjPzSi7B5CfhBOxl61qOpMo07IDrCP5GFpgZxoyaQgF2NMLcuKB8L7qTOTSrHotO4bKAnLif5UEohaY9SYZ7DfGwQbXxEdRe4bQQXPVBytGG5iWkk151Ur0RRXQDoO3IVpz02AS_gE8fLzyDgrphj5aDZJ9ERy22PbCMWVS4ul9VnJ9NzTGk_q3j4QD96BtA9pc3lkKJUsmG6LvA_ZTsdwnv0Ra4DxiZn4A7-rkhRZVPeUi78cIfxrgI22e7ddwAOeYxzacejNMNrcMm-Wk4hJ34BlPwjcFORV2tgtG3QwyAhOtrHacHcmX04vrEOd-UdUWWWKB4xELOSGKs0MGSoeP0oKMGmwOaSy3GYzogc_edd2bysWLyI1TjvcbEwY7LX9UnBrFusjojsqhozPGgrBnjoKqoLY4W5hYisZfXpr0T3Kg0OurKaW91kd_CHoDPzi_d6FHhk9z8mjqb0r9ycvn9bafMIWIL5g
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s08-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: http://termalfurdok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36

Response headers

GET
H/1.1 204
No Content gen_204
pagead2.googlesyndication.com/pagead/ 0
459 B 22ms
22ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

http://pagead2.googlesyndication.com/pagead/gen_204?id=ama_stats&wpc=ca-pub-1872235783335290&su=termalfurdok.com&eid=42530893&doc=complete&pg_h=5013&pg_w=1600&pg_hs=5013&c=1&aa_c=5&av_h=234.500&av_w=915.729&av_a=194848.073&all_s=10&b=3051.922&all_b=535.203&d=0.039&all_d=0.281&ard=0.019&all_ard=0.146&dt=d

Protocol

HTTP/1.1

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS