www.reisekostenabrechnung.com Open in urlscan Pro
2606:4700:3031::ac43:c4ab Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://cdn-1.reisekostenabrechnung.com/
Effective URL:
https://www.reisekostenabrechnung.com/
Submission: On March 17 via automatic, source certstream-suspicious (March 17th 2021, 9:33:59 pm UTC)

Summary HTTP 355 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 40 IPs in 11 countries across 46 domains to perform 355 HTTP transactions. The main IP is 2606:4700:3031::ac43:c4ab, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.reisekostenabrechnung.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 6th 2020. Valid for: a year.

This is the only time www.reisekostenabrechnung.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3036::6815:3444	13335 (CLOUDFLAR...) (CLOUDFLARENET)
69	2606:4700:303... 2606:4700:3031::ac43:c4ab	13335 (CLOUDFLAR...) (CLOUDFLARENET)
25	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
3	2606:4700:e4:... 2606:4700:e4::ac40:a708	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	13.226.158.204 13.226.158.204	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:827::2008	15169 (GOOGLE) (GOOGLE)
1	2600:9000:206... 2600:9000:206f:a200:2:cb38:840:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:800::200e	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
51	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:827::2001	15169 (GOOGLE) (GOOGLE)
26	2a00:1450:400... 2a00:1450:4001:809::2001	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
5	3.127.76.126 3.127.76.126	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
12 37	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
6 14	104.108.145.8 104.108.145.8	16625 (AKAMAI-AS) (AKAMAI-AS)
65	2a00:1450:400... 2a00:1450:4001:813::2006	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f01... 2a03:2880:f01c:8004:face:b00c:0:8c	32934 (FACEBOOK) (FACEBOOK)
1	13.226.159.104 13.226.159.104	16509 (AMAZON-02) (AMAZON-02)
8	142.250.186.130 142.250.186.130	15169 (GOOGLE) (GOOGLE)
3	142.250.74.198 142.250.74.198	15169 (GOOGLE) (GOOGLE)
1 1	2001:678:cb4:... 2001:678:cb4:bbbb::11	56396 (TURN) (TURN)
1	46.228.164.11 46.228.164.11	56396 (TURN) (TURN)
2 2	35.186.193.173 35.186.193.173	15169 (GOOGLE) (GOOGLE)
2 2	35.190.0.66 35.190.0.66	15169 (GOOGLE) (GOOGLE)
1 1	80.64.106.147 80.64.106.147	20764 (RASCOM-AS...) (RASCOM-AS CJSC RASCOM ISP)
2	178.162.133.149 178.162.133.149	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
1 1	185.86.137.121 185.86.137.121	201081 (SMARTADSE...) (SMARTADSERVER)
1	18.179.156.111 18.179.156.111	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700::68... 2606:4700::6810:125e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 3	3.120.242.149 3.120.242.149	16509 (AMAZON-02) (AMAZON-02)
2 2	35.210.53.219 35.210.53.219	19527 (GOOGLE-2) (GOOGLE-2)
1 1	13.226.159.36 13.226.159.36	16509 (AMAZON-02) (AMAZON-02)
2 2	3.126.56.137 3.126.56.137	16509 (AMAZON-02) (AMAZON-02)
1 2	52.17.202.120 52.17.202.120	16509 (AMAZON-02) (AMAZON-02)
5 8	185.33.220.244 185.33.220.244	29990 (ASN-APPNEX) (ASN-APPNEX)
4	37.157.6.245 37.157.6.245	198622 (ADFORM) (ADFORM)
1	34.255.248.151 34.255.248.151	16509 (AMAZON-02) (AMAZON-02)
2	35.173.0.225 35.173.0.225	14618 (AMAZON-AES) (AMAZON-AES)
1	2a00:1450:400... 2a00:1450:4001:810::2004	15169 (GOOGLE) (GOOGLE)
13	37.157.6.234 37.157.6.234	198622 (ADFORM) (ADFORM)
1	2620:116:800d... 2620:116:800d:21:f916:5049:f87f:108e	16509 (AMAZON-02) (AMAZON-02)
1 1	99.80.199.35 99.80.199.35	16509 (AMAZON-02) (AMAZON-02)
1	213.155.156.182 213.155.156.182	1299 (TELIANET ...) (TELIANET Telia Carrier)
2 2	217.66.147.170 217.66.147.170	29209 (SPBMTS-AS...) (SPBMTS-AS Malaya Monetnaya Street 2-A)
1 1	213.87.44.207 213.87.44.207	13174 (MTSNET Mo...) (MTSNET Moscow)
1 1	18.193.131.107 18.193.131.107	16509 (AMAZON-02) (AMAZON-02)
2 2	193.0.160.128 193.0.160.128	54312 (ROCKETFUEL) (ROCKETFUEL)
1 2	195.54.48.26 195.54.48.26	12516 (WEBORAMA ...) (WEBORAMA Weborama provides Internet Services)
2 2	23.37.42.216 23.37.42.216	16625 (AKAMAI-AS) (AKAMAI-AS)
1 1	31.172.81.160 31.172.81.160	44066 (DE-FIRSTC...) (DE-FIRSTCOLO www.first-colo.net)
1 1	31.172.81.172 31.172.81.172	44066 (DE-FIRSTC...) (DE-FIRSTCOLO www.first-colo.net)
1 1	81.222.128.216 81.222.128.216	20597 (ELTEL-AS) (ELTEL-AS)
1	174.137.133.49 174.137.133.49	27257 (WEBAIR-IN...) (WEBAIR-INTERNET)
1	52.51.3.86 52.51.3.86	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
355	40

1 2606:4700:3036::6815:3444 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

cdn-1.reisekostenabrechnung.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

69 2606:4700:3031::ac43:c4ab (United States)

ASN13335 (CLOUDFLARENET, US)

www.reisekostenabrechnung.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

25 142.250.185.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700:e4::ac40:a708 (United States)

ASN13335 (CLOUDFLARENET, US)

go.ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
g.ezodn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.226.158.204 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-158-204.dus51.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:827::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206f:a200:2:cb38:840:93a1 (United States)

ASN16509 (AMAZON-02, US)

go.ezoic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

51 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:827::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 2a00:1450:4001:809::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 3.127.76.126 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-127-76-126.eu-central-1.compute.amazonaws.com

g.ezoic.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

37 142.250.186.34 (United States) 12 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 104.108.145.8 (Berlin, Germany) 6 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-108-145-8.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

65 2a00:1450:4001:813::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f01c:8004:face:b00c:0:8c (United States)

ASN32934 (FACEBOOK, US)

ad.atdmt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.159.104 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-159-104.dus51.r.cloudfront.net

impression.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 142.250.186.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s07-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.74.198 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s02-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:678:cb4:bbbb::11 (United Kingdom) 1 redirects

ASN56396 (TURN, GB)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.228.164.11 (United Kingdom)

ASN56396 (TURN, GB)

r.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.186.193.173 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 173.193.186.35.bc.googleusercontent.com

gcm.ctnsnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.0.66 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)

ads.travelaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 80.64.106.147 (Russian Federation) 1 redirects

ASN20764 (RASCOM-AS CJSC RASCOM ISP, RU)
PTR: s-fr2.rutarget.ru

google-sync.rutarget.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.162.133.149 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: ams-1-sync.go.sonobi.com

sync.go.sonobi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.86.137.121 (France) 1 redirects

ASN201081 (SMARTADSERVER, FR)

ssbsync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.179.156.111 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-179-156-111.ap-northeast-1.compute.amazonaws.com

cc.adingo.jp	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:125e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.120.242.149 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-120-242-149.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.210.53.219 (Brussels, Belgium) 2 redirects

ASN19527 (GOOGLE-2, US)

pool.admedo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.226.159.36 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-226-159-36.dus51.r.cloudfront.net

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.126.56.137 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-126-56-137.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.17.202.120 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

fw.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 185.33.220.244 (Amsterdam, Netherlands) 5 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 37.157.6.245 (Denmark)

ASN198622 (ADFORM, DK)

track.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.255.248.151 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

static.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.173.0.225 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

dt.adsafeprotected.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 37.157.6.234 (Denmark)

ASN198622 (ADFORM, DK)

s1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:f916:5049:f87f:108e (United States)

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.80.199.35 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)

pixel.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.155.156.182 (Sweden)

ASN1299 (TELIANET Telia Carrier, SE)

d5p.de17a.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 217.66.147.170 (St Petersburg, Russian Federation) 2 redirects

ASN29209 (SPBMTS-AS Malaya Monetnaya Street 2-A, RU)

sm.rtb.mts.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 213.87.44.207 (Moscow, Russian Federation) 1 redirects

ASN13174 (MTSNET Moscow, Russia, RU)

tech.rtb.mts.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.193.131.107 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)

match.sharethrough.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 193.0.160.128 (United States) 2 redirects

ASN54312 (ROCKETFUEL, US)

a.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 195.54.48.26 (France) 1 redirects

ASN12516 (WEBORAMA Weborama provides Internet Services, FR)

edf.solution.weborama.fr	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.37.42.216 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a23-37-42-216.deploy.static.akamaitechnologies.com

tracking.m6r.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 31.172.81.160 (Germany) 1 redirects

ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE)

sync3.sniperlog.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 31.172.81.172 (Germany) 1 redirects

ASN44066 (DE-FIRSTCOLO www.first-colo.net, DE)

sync.bumlam.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 81.222.128.216 (Russian Federation) 1 redirects

ASN20597 (ELTEL-AS, RU)

ssp.adriver.ru	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 174.137.133.49 (United States)

ASN27257 (WEBAIR-INTERNET, US)

dsp.adkernel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.51.3.86 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)

ads.yieldmo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
77	doubleclick.net 12 redirects securepubads.g.doubleclick.net googleads.g.doubleclick.net cm.g.doubleclick.net googleads4.g.doubleclick.net ad.doubleclick.net	301 KB
72	googlesyndication.com 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	320 KB
70	reisekostenabrechnung.com 1 redirects cdn-1.reisekostenabrechnung.com www.reisekostenabrechnung.com	603 KB
65	2mdn.net s0.2mdn.net	804 KB
17	adform.net track.adform.net s1.adform.net	106 KB
14	casalemedia.com 6 redirects dsum-sec.casalemedia.com	13 KB
8	adnxs.com 5 redirects ib.adnxs.com	8 KB
8	google.com adservice.google.com www.google.com	1 KB
6	googletagservices.com www.googletagservices.com	206 KB
6	ezoic.net go.ezoic.net g.ezoic.net	2 KB
5	adsafeprotected.com 1 redirects fw.adsafeprotected.com static.adsafeprotected.com dt.adsafeprotected.com	98 KB
5	google.fr adservice.google.fr	2 KB
3	mts.ru 3 redirects sm.rtb.mts.ru tech.rtb.mts.ru	2 KB
3	bidswitch.net 3 redirects x.bidswitch.net	2 KB
3	amazon-adsystem.com c.amazon-adsystem.com	35 KB
3	ezodn.com go.ezodn.com ezodn.com g.ezodn.com	159 KB
2	gstatic.com fonts.gstatic.com	44 KB
2	m6r.eu 2 redirects tracking.m6r.eu	1 KB
2	weborama.fr 1 redirects edf.solution.weborama.fr	1 KB
2	rfihub.com 2 redirects a.rfihub.com	2 KB
2	yahoo.com 2 redirects ups.analytics.yahoo.com	2 KB
2	admedo.com 2 redirects pool.admedo.com	782 B
2	cloudflare.com cdnjs.cloudflare.com	62 KB
2	sonobi.com sync.go.sonobi.com	948 B
2	travelaudience.com 2 redirects ads.travelaudience.com	845 B
2	ctnsnet.com 2 redirects gcm.ctnsnet.com	879 B
2	turn.com 1 redirects ad.turn.com r.turn.com	857 B
2	google-analytics.com www.google-analytics.com	19 KB
1	googleapis.com fonts.googleapis.com	561 B
1	yieldmo.com ads.yieldmo.com	35 B
1	adkernel.com dsp.adkernel.com	233 B
1	adriver.ru 1 redirects ssp.adriver.ru	339 B
1	bumlam.com 1 redirects sync.bumlam.com	680 B
1	sniperlog.ru 1 redirects sync3.sniperlog.ru	369 B
1	sharethrough.com 1 redirects match.sharethrough.com	357 B
1	de17a.com d5p.de17a.com	134 B
1	everesttech.net 1 redirects pixel.everesttech.net	376 B
1	quantserve.com cms.quantserve.com	463 B
1	smaato.net 1 redirects s.ad.smaato.net	429 B
1	adingo.jp cc.adingo.jp	44 B
1	smartadserver.com 1 redirects ssbsync.smartadserver.com	456 B
1	rutarget.ru 1 redirects google-sync.rutarget.ru	578 B
1	impression.link impression.link	548 B
1	atdmt.com ad.atdmt.com
1	googletagmanager.com www.googletagmanager.com	38 KB
0	wbtrk.net Failed um.wbtrk.net Failed
355	46

	Domain	Requested by
69	www.reisekostenabrechnung.com	www.reisekostenabrechnung.com
65	s0.2mdn.net	www.reisekostenabrechnung.com s0.2mdn.net 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
40	pagead2.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com googleads.g.doubleclick.net ad.doubleclick.net www.reisekostenabrechnung.com www.googletagservices.com
37	cm.g.doubleclick.net	12 redirects googleads.g.doubleclick.net 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
26	tpc.googlesyndication.com	securepubads.g.doubleclick.net tpc.googlesyndication.com 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com googleads.g.doubleclick.net www.reisekostenabrechnung.com
19	securepubads.g.doubleclick.net	www.reisekostenabrechnung.com securepubads.g.doubleclick.net
14	dsum-sec.casalemedia.com	6 redirects googleads.g.doubleclick.net
13	s1.adform.net	fw.adsafeprotected.com s1.adform.net www.reisekostenabrechnung.com
10	googleads.g.doubleclick.net	56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com www.reisekostenabrechnung.com
8	ib.adnxs.com	5 redirects googleads.g.doubleclick.net
8	googleads4.g.doubleclick.net	www.reisekostenabrechnung.com
6	www.googletagservices.com	securepubads.g.doubleclick.net 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com www.reisekostenabrechnung.com
6	56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
5	g.ezoic.net	www.reisekostenabrechnung.com
5	adservice.google.com	securepubads.g.doubleclick.net
5	adservice.google.fr	securepubads.g.doubleclick.net
4	track.adform.net	56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com s1.adform.net
3	x.bidswitch.net	3 redirects
3	ad.doubleclick.net	56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
3	www.google.com	56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
3	c.amazon-adsystem.com	www.reisekostenabrechnung.com c.amazon-adsystem.com
2	fonts.gstatic.com	fonts.googleapis.com
2	tracking.m6r.eu	2 redirects
2	edf.solution.weborama.fr	1 redirects 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
2	a.rfihub.com	2 redirects
2	sm.rtb.mts.ru	2 redirects
2	dt.adsafeprotected.com	56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
2	fw.adsafeprotected.com	1 redirects www.reisekostenabrechnung.com
2	ups.analytics.yahoo.com	2 redirects
2	pool.admedo.com	2 redirects
2	cdnjs.cloudflare.com	s0.2mdn.net s1.adform.net
2	sync.go.sonobi.com	56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
2	ads.travelaudience.com	2 redirects
2	gcm.ctnsnet.com	2 redirects
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
1	fonts.googleapis.com	s1.adform.net
1	ads.yieldmo.com	56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
1	dsp.adkernel.com	56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
1	ssp.adriver.ru	1 redirects
1	sync.bumlam.com	1 redirects
1	sync3.sniperlog.ru	1 redirects
1	match.sharethrough.com	1 redirects
1	tech.rtb.mts.ru	1 redirects
1	d5p.de17a.com	56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
1	pixel.everesttech.net	1 redirects
1	cms.quantserve.com	56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
1	static.adsafeprotected.com	56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
1	s.ad.smaato.net	1 redirects
1	cc.adingo.jp	56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
1	ssbsync.smartadserver.com	1 redirects
1	google-sync.rutarget.ru	1 redirects
1	r.turn.com	56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
1	ad.turn.com	1 redirects
1	impression.link	s0.2mdn.net
1	ad.atdmt.com	s0.2mdn.net
1	g.ezodn.com	ezodn.com
1	ezodn.com	www.reisekostenabrechnung.com
1	go.ezoic.net	www.reisekostenabrechnung.com
1	www.googletagmanager.com	www.reisekostenabrechnung.com
1	go.ezodn.com	www.reisekostenabrechnung.com
1	cdn-1.reisekostenabrechnung.com	1 redirects
0	um.wbtrk.net Failed	56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
355	62

This site contains links to these domains. Also see Links.

Domain
www.verpflegungsmehraufwand.de
www.ezoic.com
www.mein-deal.com
www.optimieren.com
www.bodenrichtwert.de
www.vorwahl-online.de
www.erwerbsminderungsrente.de
www.grundstueckspreise.net
g.ezoic.net

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-08-06` - `2021-08-06`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2020-08-04` - `2021-08-02`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.ezoic.net Amazon	`2021-02-15` - `2022-03-16`	a year	crt.sh
*.google.fr GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.google.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.googleusercontent.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
ezoic.net R3	`2021-01-23` - `2021-04-23`	3 months	crt.sh
www.google.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2020-03-02` - `2021-04-01`	a year	crt.sh
*.doubleclick.net GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.atlassolutions.com DigiCert SHA2 High Assurance Server CA	`2021-01-29` - `2021-04-28`	3 months	crt.sh
impression.link Amazon	`2020-06-12` - `2021-07-12`	a year	crt.sh
*.turn.com DigiCert SHA2 Secure Server CA	`2020-03-18` - `2021-04-19`	a year	crt.sh
*.go.sonobi.com Go Daddy Secure Certificate Authority - G2	`2020-12-06` - `2022-01-07`	a year	crt.sh
*.adingo.jp DigiCert SHA2 Secure Server CA	`2020-03-26` - `2021-04-15`	a year	crt.sh
fw.adsafeprotected.com Amazon	`2020-09-09` - `2021-10-09`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
track.adform.net DigiCert SHA2 Secure Server CA	`2019-09-16` - `2021-09-20`	2 years	crt.sh
static.adsafeprotected.com Amazon	`2021-01-06` - `2022-02-04`	a year	crt.sh
dt.adsafeprotected.com Amazon	`2020-05-20` - `2021-06-20`	a year	crt.sh
*.quantserve.com DigiCert SHA2 High Assurance Server CA	`2020-10-02` - `2021-10-07`	a year	crt.sh
*.de17a.com Sectigo ECC Domain Validation Secure Server CA	`2020-11-25` - `2021-12-25`	a year	crt.sh
*.solution.weborama.fr Go Daddy Secure Certificate Authority - G2	`2020-01-11` - `2022-03-11`	2 years	crt.sh
*.adkernel.com Sectigo RSA Domain Validation Secure Server CA	`2020-12-22` - `2022-01-05`	a year	crt.sh
*.yieldmo.com Amazon	`2020-06-23` - `2021-07-23`	a year	crt.sh
upload.video.google.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh
*.gstatic.com GTS CA 1O1	`2021-02-23` - `2021-05-18`	3 months	crt.sh

This page contains 31 frames:

Primary Page: https://www.reisekostenabrechnung.com/
Frame ID: 6D0893C051354B1D57E9B24D8EAAD118
Requests: 119 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html
Frame ID: 6BF0082E10AE80DFC1A6948B36B8C17E
Requests: 2 HTTP requests in this frame

Frame: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 7D460E469819292FB20617CB8E4D7406
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CM-nKBD9yigYrdL3bjAB&v=APEucNXZgYGtvUEM0w_LbVe0mPp0Xk4wuorvtXEKFXLhPCx2TY4OCJQYQ-7XvjvAQeKNx10mVD-c8JMm-NNJapdkFPOSJCsPLasWhatLNOQzEwnLFoPCOvmbKt9mVGuSEY7q5EU_9DyaEtzV3kXdOVgfdl0qWqu9P0ZVnAcbqcmHwJ6EXrowY_XV1q3LRrL9ISdzkx6O7to265rVVnDCfWRKXi4JwBeGv7Hb90KUIlTerzGYL89Srns
Frame ID: 6BF526F3C895186C2282E951D9ED4B0E
Requests: 4 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: FA5493945934C9A8695AB31D698940F8
Requests: 9 HTTP requests in this frame

Frame: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 001E9806CB99123928B0F9C27962F23E
Requests: 17 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 871AE94294EA939D09031CF0983BC025
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/9080429/1589458396737/index.html
Frame ID: DCAEF314290A8956A62A382BF083F7BA
Requests: 11 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNyuyAIQpovKAhjKicqeATAB&v=APEucNW9zJhwGr5lyPXr58mNXy0Ajqxjnn44ZY33gNiuSUks_xxk8uJmdQ4j9Q227puBST0dRcxv1mTlat9ZidtfmrbY9ZOxMJnBlR2HdMrRrbZ-gE-SkxxFNfMjhlsX6S2VbhV13MS_U6wN2BJmCFalE3sIfbMJjj2OnPpNfMRpgl7_qrQOw8yxObA6vNx-qEHjow6XgavJyTxpBpIldAhAdoog41Pxiug8OwOfxxNZrK51rWjtqeE
Frame ID: 54647987BBDCCAE7B9160C95E0888DC3
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 04BD713066BD8165540218865449A50B
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 4DB6CA916AB43331ACF449984183268B
Requests: 8 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: FEA89C914CAE01D38B9348CDCF990030
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
Frame ID: D6AF74AD19262784E9BE14A6AD6D0090
Requests: 15 HTTP requests in this frame

Frame: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 1616E99E6CC17BC097431A0F5A25FF6E
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN_j2ZQCEJbW-a8CGMu_9Z4BMAE&v=APEucNWFQe3opkrn5n3BjBlmWHjvtFpQd-gCs3NnuOLU09ghOXTYhzNhlYx1lo8dfFT17Gv9jpxe4jlJiSzMV2ji8NcLc0MVkjl9iuhH3K8PCqa8fyn-wLpoGKcCIRFTRGG_RnyJ6bBMxbAEAVX47VwVKHLSN1wfZ7YIucA4e3ZodwrmMv-9Falzr_-JXfqcz9H1RjgJdhr35ul9nIvGCDc9w8HRT0kUTnGT68vhbR7M8h1ZuNFzBgk
Frame ID: 4E83FAB4105EF477B7C2B81200CCA78A
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A5X3k5YN9D0yWOLocigHpBYasZjR6hEiir_uIRxfZBaxgyjz5q3lvoOUkThOQGn6dRr-I_iKsaW8aW5rIGr25L4iSUMpXL3YRqnCvHlV4UiY9CtfrAgRcZx6AIAwxlfYJkb1PQ5vIiKmzYLGFF-ajTxQC2Qw&cry=1&dbm_d=AKAmf-BCvHUdnYaSglZ4VBapCkkNx1-bwlPHw4AAzIF_y8wgqXBUDvRObVopy02g2po8I3kYsyw6Xf8nikrQonzrcBNnQZY38k9ZOrCZ5HPpo5g-6xtexvSpbTU-HUY6VPTmQ99w7_cfhxF3LhjZ36m6CLPVCvm70Z_nUM2daDDV-yH-62o0qQOCg8mXYg48sdW5cWTEXYjrVFOAjBsYvxd2knUTb1HdRvBOx5KFN_WWs6kgtiKoartuAQS8I0bPTNiCr1bzN67KY5HZFcTt_NZIQRCmLlULnkie8GIqrVs1KfblvKniXpzamqsswP06jHToJHG6Rl5JbP_1YqJD0_Z6VkxCtmLqJgCRSRtSXhG2b10PajP5gZXJWqi7fXbwvKzCZvRKbk-EqZASqFFvNAqEHtfwWqiWnIdfpSrWzn074x35ch0S5zly1zCI6XZMxxa8QHphu6BKDFF5OxHQAYZn7AcGG2Z4TpfletiAN1wzSy9AkR5_Ty2eAzXYbcHKk-fuI79L8lP3eb2apnr9ngjutulpNg7MMnSTrQrkHSl6DkVWVdZqlJTvoMlHthSY7sWNtfi2tSYfWu-v_fWfzTkSHoXXWbADuejm7Qh6_gfgWy5DC3X7AJOhe7EgQ6tn0GKvP5cwL30mu1Hok9c391PTK5imqpSm3h9oC6TqsFht6ZqYgisJtc6JQJ35Xu3gZJaoOeoMti9gTeb77UZPrsfQL1Mo4UgfLpgD37XBhyhdE2U36ylySUMv8jP7FaxV6xxEF3-poyqadKdvw9EpbbLk4AECSzPhJe1_chlmUWFaZhgGjhdy-sW4TfzLDhslvB2LLYY8yuBW8LrXEyTkXfcS1h4fYmbSa1nc7e6440A7eVyB8zZCjAm_72NSreQ0HD8oi90_vbsEtezuvVxGty9KTnWWhCwR6V4bHrJs2ho5s6MHWIHgIIJp02Rjt7PzAfMZZ0zuL_hLmlZx7qTDtorgYUqG-b2kJfMvRLBuBUGdD51gi1Bs_M_vE02QvNVCcJvBmXOxkMeBSlzEg3V5uHkzUU_QpHk0vKI-sl8t0vUojcmegTZy1uTmVMJEwSAvAUAtWd9X367rqBJpO88XwIi_CDiokMk0SR1OOQvi4K6c3u2qUguEB8DUrKeXOAQwVni6mixSAcmPOtuyY6uqvIWFSzYsyW2jBgt6jhlsjw4MOiBTLYHsYNWRtkFdetTYd_JVv5e7uTLCdbM2oudrKQlH_BBdhbmwPGJg38ZjCYMBBnJFcBRkAj_L1vvgs96kwj8qes2YRqYDKK6DbJHtf-WHacKdiaelocGt1aqIBoJWXWH5uOdTiJaNl5pKszQFKYqJ6P0erAj5tAQTOo40RBo7nhU8aSdghqyPUKJMwEbiDwYpIVktV8_bwm0rv_NOqtNq5F7OtHzqiecgfkxJqXyKfZrTBpPUPBnrje7zjK-vlaOQh8c3KaBtkpKXu-McXmkYcobQ35NfxDhvQI9cPBZwyqOKtAYu8sm_mTD1qeGUJ02xiIgDZb3ziy-Q5weSuGeZwO1_GX4ZHSUx2s_1CbdzuSmFHD9okHwctafVu0mJOTMW_xiPKIjsMBXO9OdS2p0HpeT2IL8wrL3SsoC0a3lraF_P16ZHYsUJ5Pf76wgJKhViL3gLSG3vHecXIGCZpaaKB1MaFc3O7H7nMGZ7pN78YPIII0btRzjLvY2Ij2HZutSfpgi2VRoeeJVX1ZW5SG6D5gYSdBYBnWZ7ExC1pifk5xBAmrazZ4_Kfi3mTLbMnE019CxyR0NPY3exS5hUH2qncNfRZQtpbLhfX4MlZNs715VEGCI7t3jFV0lkCr4vdTwqr3dwNqdeLiu1LDi2VU2YO7ehvUQoWJGFOvoEtcXUMYBsMXs5KJa3b3ehgZ3dGcKlYED8FlAHjVoi1LjdNjRIdAXnX_2mH1g32QJC035yajsxfetj2kCiC8isaW0Xb_EcRza_fIKqM60AryrgUDSvTzMyg9G2lmszOeKlNvjWsxzZO9hCwN1Ru_q3jT7pH6_6Dkmc-GmSipbAQjWYGIW1wCUgnTF533VC-nSLThznRfS_HqQ74CWHCF-MGc8gPcdcfDd0ZIUDE_NEtpFAO47lDhVVVZzQd0MqCrpjoUNNQgj2Dprzc_vxs1lCvEoZ6AFwlJ4OvAbsZjvJDLfx6WxNs0qUuRXYZX05r0r62vOWbp2GOmjPMRWizaGWMRcMm9sFMwRu7I2VezA33wuIyx8BgMRpIWanugTOAe5eGyirQJpfbx3R1TIatUgn3pKuPsayoE248E0xStYAbZFFQE_tu89hRf1Divv-MUEFoPj3W3zYttSnjb-k0tNAgMqy_7Mph6LyyY-vm65QdkrKECYRhMlttFjSLkT2_GRBdgvE23yxOAUuM3BJwMxt_ZmD3uuxXxVzFDE2F2D9OjHxT7LGh5-yVQvU1Mu_rWqhEOUcQgC6jrPBOvtzXXvJyzHDvmuZoe3gGR4xsT2SvNprpvt4IADP1KGRaP9dcateyZQRp5m4ryNiYWM3dHdNpDQr15xeP7gP7X0XJ5ZoqtDTbHfxV1spYbIYEMUPuyqM7O8m8BkrN-naEd86c3Qm7cHm3IY5aUnDJj-IQ8OAyRtwNN0vQE0xvTo2TyXn4LxBaeq9jRZsCpqSKA6bIGR3PNszhUNRHxwstmThkarw4DNBaFGPCTGz9GplrbUf8ZQbt0DptjojViiFrV2tPzwqtv9LbfCqDVRQHYJv1dT_VYV7zHgdb0AEyuDCMMF9BVIExZ4hTmncfKVS-gFSRXJZOMs_JZSkNdHqcn6RUJEaN2By0pMy377Igpc-Nwo75YUTb3CdonYg5VkIUCr6MbwyLvVI15H3Upgx9SmO-iUIUX9wXD3ncw9qFw9WKkjPAry8qfOwyqofX5oaKg0Hh340ogDhoVys_ykbWRnEoRg6rJHzemVkbHtDS0I7Hqgn6ktnH4bUdJd1WqZOY7XWl4FkU1cATMdaOiMpFURQpXz09RjbIMgeDr1BNsJ5LjzLr9bL-NROwxXQeJvATJtDsgILUnEbDoocgD5o_WbDml_af8ywBU4o9i_UqnlO5a69g264UFC0geTQbX9uoHV9JEt3d5K0CTMGfRgYkAfGRpfyZDIwOnev3jKmDUZ8JHYo-dgfxUvsxKY_5QrtBJI_U7a9mOSSOsKLP8xhJe17L6rMFSU5tdrXnvhmHDgdEGgntykEYp4zBXiScMB-O0iDdr9_EZ0AgFfO0Qd-8YGy2gd67N1dzYlF-k8pNTcHZq98NgfekT943237az5DumZ4MqyG8xhojdPY3fPSWK-HQKpFhCAHc6YlABIGLGjw62zz-OrCIcu5bcjJpUeSHweG17qW_mjimkDqUoAHJzPguMpkwwsEFVeXvv7CjXYZ6mOgaRX36Zx1vVyTqTjgi-mD2zkhr58LoyIkvTnVrcW45unxsNPdkWO3kDwoofPt13GwTpfZcyLHDLtQt810aRLo7jq7fTaGFL_r65h5yskwUkt0jUGGxhS8GvfPKQHW&cid=CAASPeRonUriMgQtamsmiUO6vw-iFuVB1r-eFSS1cPqV5UEkRh3R11IpkAN36lRVl4PgSV9r_HyBNz7IzP-EbWw&rfl=2%2Chttps%253A%252F%252Fwww.reisekostenabrechnung.com%252F%240
Frame ID: 9FC710CE638F00507295228D498FF9E0
Requests: 19 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: DFBAA2926CB4BA429B4B6856752BEE6D
Requests: 3 HTTP requests in this frame

Frame: https://static.adsafeprotected.com/sca.17.5.1.js
Frame ID: 5E79AAFAC7F1A9B0CCE97E779CD45FCC
Requests: 1 HTTP requests in this frame

Frame: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: ED7DCEC89212BBB47AC5A7239C911AAD
Requests: 15 HTTP requests in this frame

Frame: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Frame ID: 586AAF24C0734D2D40C4999EE9AE1457
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNyuyAIQpovKAhj9i8qeATAB&v=APEucNWkZsI2GTzkaS48L09y7vkn2IXKufQFgvAJ6WXv6f4lAEl3Q-OcTzoeo7Ckk1ZeyHXnamAEMGIFGhNa4ZRhbmTMZh1YSx3ISvcbnJH9gNUzFBDYz0QEXsW_m0R0veUT19PkDKzeTfDBFUWmjfeoJkYpXsAFtx16-2ugs6aQvhp7xIz_7BpjqIbIjOqBexPd1uDZI2j1aRLXop61rpHAZsni0l6aKI0stSHfO26dhW_UMPFTYwk
Frame ID: 552B30BCFF50006AAB2DF8AFCCDFD274
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNyuyAIQpovKAhjKicqeATAB&v=APEucNV6ZXObWaGf3kWOV4PU0H2tR-V-a2BGu2SNKzjH5y7KfAEEnFpRgjgOPNzIACKjqhoZxfshO50WbJ-z3NykT892vdU4hjVfdBme17DFMfcAJOG0f27b7UN4BRNY68XhjlPAcSvcC0A5CuaGvKjut875eCho7UVj8yKnzmg0IyQRVViIPt78Fkk8XZd10jEnmbW3tl6mBKe5iqIXnSkKTsMQQeFMikdtUkXX1eCLopddkJikNAg
Frame ID: 29ADE2ACFF49C2CDB4426B5AF93346FE
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: A80538248FEC487F22796333101BEC56
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: CD9018783B2032C86036EF4DF041F520
Requests: 3 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: C03110983BB8F62E96EEFEAA674E4758
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 0690E082F3148B12531420865A7BE372
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: E08C4ECB43446379C93AD0C2784DEF09
Requests: 3 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 563E0FAE81B31C99DD138F97D925D3F0
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
Frame ID: 57A2C512AFC7BB43C0182BE750A5D258
Requests: 15 HTTP requests in this frame

Frame: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
Frame ID: 7CBB83B03A33EADB3813D2E1F9A1CF99
Requests: 20 HTTP requests in this frame

Frame: https://s1.adform.net/Banners/Elements/Files/2009362/9059022/9059022.js?ADFassetID=9059022&bv=257
Frame ID: 5EF835B3A01CB9FAD34910EB84AF23C5
Requests: 15 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://cdn-1.reisekostenabrechnung.com/ HTTP 301
https://www.reisekostenabrechnung.com/ Page URL

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

355
Requests

99 %
HTTPS

34 %
IPv6

46
Domains

62
Subdomains

40
IPs

11
Countries

2810 kB
Transfer

6413 kB
Size

19
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://www.verpflegungsmehraufwand.de/
Title: verpflegungsmehraufwand.de

Search URL Search Domain Scan URL

URL: https://www.ezoic.com/what-is-ezoic/

Search URL Search Domain Scan URL

URL: https://www.mein-deal.com/mckinley-trekkingrucksack-make/
Title: McKinley Trekkingrucksack Make 75 + 10 für 68,94€ (statt 85€)

Search URL Search Domain Scan URL

URL: https://www.mein-deal.com/koffer-direkt-halloween/
Title: Koffer Direkt mit 20% extra Rabatt im Sale + 5% bei Vorkasse

Search URL Search Domain Scan URL

URL: https://www.mein-deal.com/gewandhaus-dresden-travelcircus/
Title: Dresden: 2 ÜN im 5* Luxushotel Gewandhaus (Holidaycheck 100%) inkl. Frühstück und Dinner ab 130€ p.P.

Search URL Search Domain Scan URL

URL: https://www.mein-deal.com/taunus-therme-uebernachtung-im-4-sterne-hotel-mit-fruehstueck-ab-59e-p-p/
Title: Taunus Therme + ÜN in Hotel nach Wahl inkl. Frühstück & mehr ab 54€ p.P.

Search URL Search Domain Scan URL

URL: https://www.mein-deal.com/
Title: Die Schnäppchen werden Ihnen präsentiert in Partnerschaft mit mein-deal.com

Search URL Search Domain Scan URL

URL: http://www.optimieren.com/
Title: optimieren.com

Search URL Search Domain Scan URL

URL: https://www.bodenrichtwert.de/
Title: www.bodenrichtwert.de

Search URL Search Domain Scan URL

URL: https://www.vorwahl-online.de/
Title: www.vorwahl-online.de

Search URL Search Domain Scan URL

URL: https://www.erwerbsminderungsrente.de/
Title: www.erwerbsminderungsrente.de

Search URL Search Domain Scan URL

URL: https://www.grundstueckspreise.net/
Title: www.grundstueckspreise.net

Search URL Search Domain Scan URL

URL: http://www.optimieren.com/datenschutz.php?domain=reisekostenabrechnung.com&s=true
Title: Datenschutz

Search URL Search Domain Scan URL

URL: http://www.optimieren.com/impressum.php?domain=reisekostenabrechnung.com&s=true
Title: Impressum

Search URL Search Domain Scan URL

URL: https://g.ezoic.net/privacy/www.reisekostenabrechnung.com
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://cdn-1.reisekostenabrechnung.com/ HTTP 301
https://www.reisekostenabrechnung.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 94

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPsvOQTzRy7T7BcIfZh1CYk&google_cver=1 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPsvOQTzRy7T7BcIfZh1CYk&google_cver=1&C=1

Request Chain 95

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_hm=YFJ1vEBqiX7aifKh3mxp9QAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1

Request Chain 125

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEJq-qV414Dvd6w33wnXM5Z4&google_cver=1&google_push=AQvitUIZTwdrQsX5yTXD5bu7JG7E57kbkHfBz-vyRVZ_m-8qGkzUKH1gdFXeH0oy7d6CzM12eciuvsrM_NJHUFIwxxte4SoDA_Q HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjMzMjExMjc5Njc5Nzg2OTE5Ng== HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEAv6mPmswDnlB6_glYImY0I&google_cver=1

Request Chain 126

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEJcc1zc-gmL4QFhAV4s_tqk&google_cver=1&google_push=AQvitUJnpKed0uFgHE-1OKf-flaAqgNBm2jfDUhJs2euw7befsiuX9I8GdwQPyZ371PfELPCcqUyyIH10HL6uao9cmflapQjWbc HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitUJnpKed0uFgHE-1OKf-flaAqgNBm2jfDUhJs2euw7befsiuX9I8GdwQPyZ371PfELPCcqUyyIH10HL6uao9cmflapQjWbc&google_hm=BElgAYj8RrKxkh-aCmuferw

Request Chain 127

https://ads.travelaudience.com/google_pixel?google_gid=CAESEJEXqM3-moDHohcjMdNqbp4&google_cver=1&google_push=AQvitUKSO5-SDApqyUewqiLegYSoZNIiblYVxShjadN1mMWxd8xyP7XJMPQ2uwYCecP2mafkqP-ag9Vw-khGumGWM3IkrLhItkQ HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=arR9pMK3Qnm-HUfmDcvQkg2&google_push=AQvitUKSO5-SDApqyUewqiLegYSoZNIiblYVxShjadN1mMWxd8xyP7XJMPQ2uwYCecP2mafkqP-ag9Vw-khGumGWM3IkrLhItkQ

Request Chain 128

https://google-sync.rutarget.ru/sync?google_gid=CAESEL0lMSJIoG43aYIQSc4dut0&google_cver=1&google_push=AQvitUJgQ_ltfV44xo54XK4irNVIbsw4jOVjD0-C-qPWs9Sx7snxRS5Yr_WkbSUQ2UNeY4Sds_Loe_xAQL4x_mazSeQgmYg87CQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=segmentoru&google_hm=ZlZ4QjRnRzhVeGVu&google_ula=2046794&google_push=AQvitUJgQ_ltfV44xo54XK4irNVIbsw4jOVjD0-C-qPWs9Sx7snxRS5Yr_WkbSUQ2UNeY4Sds_Loe_xAQL4x_mazSeQgmYg87CQ

Request Chain 130

https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEBthgCKddhUYdZwex43q_Bo&google_cver=1&google_push=AQvitUKGRkbg2sSF-5emLVikJG26Q9YVz6n54adSyHGYv11bJDI8QEGqMUt5IMSvY9s8iwaQSVwzxJqiuhhaV1Ql4-WMOhP5rVI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AQvitUKGRkbg2sSF-5emLVikJG26Q9YVz6n54adSyHGYv11bJDI8QEGqMUt5IMSvY9s8iwaQSVwzxJqiuhhaV1Ql4-WMOhP5rVI&google_hm=MjkwMzAyMzI4MDkxNjM3NjkzNw%3D%3D

Request Chain 156

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEJ_Mj-K1ze_BugAOR9vp93M&google_cver=1&google_push=AQvitUJpQDCD0NrLo8KaPmHlFSQHhKm6WSid6_7fOsBIELtYfplRSBvQJtnB6Xjzm25Jumxhu6LQiDt1S7SGnRJ3COmbFJ4zbEAg HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitUJpQDCD0NrLo8KaPmHlFSQHhKm6WSid6_7fOsBIELtYfplRSBvQJtnB6Xjzm25Jumxhu6LQiDt1S7SGnRJ3COmbFJ4zbEAg&google_hm=BElgAYj8RrKxkh-aCmuferw

Request Chain 157

https://ads.travelaudience.com/google_pixel?google_gid=CAESEGs9z2xJcBAXWrcCsrFr-3c&google_cver=1&google_push=AQvitUJ6iaUtnx_7rwUNtk-EnyPbUQHYWyPdd0jL9LE1GGa_YbFy1Qddll8mafmSZtOrQCDOmaiZJdOmMd_NMK6Jupw5BO_aXyPA HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=arR9pMK3Qnm-HUfmDcvQkg2&google_push=AQvitUJ6iaUtnx_7rwUNtk-EnyPbUQHYWyPdd0jL9LE1GGa_YbFy1Qddll8mafmSZtOrQCDOmaiZJdOmMd_NMK6Jupw5BO_aXyPA

Request Chain 158

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEJEI4GoSmgLf_RM_r0eCqkE&google_cver=1&google_push=AQvitUJ5TB6VcmzO-_tUjScZp3tjtIRTKA439ipAAZLCz-CJNha9mHrm_irVjBDPtLgXSiKSGc7TKK8lctJBDfcJSj_NZmFfyX8 HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEJEI4GoSmgLf_RM_r0eCqkE&google_cver=1&google_push=AQvitUJ5TB6VcmzO-_tUjScZp3tjtIRTKA439ipAAZLCz-CJNha9mHrm_irVjBDPtLgXSiKSGc7TKK8lctJBDfcJSj_NZmFfyX8 HTTP 302
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=google&bsw_custom_parameter=8e0d0586-6ac2-4caa-9fac-f91705e2e8cf HTTP 302
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=google&bsw_custom_parameter=8e0d0586-6ac2-4caa-9fac-f91705e2e8cf HTTP 302
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=e46d74c3-7247-4d25-bb09-0a381c191b93&user_group=1&ssp=google&bsw_param=8e0d0586-6ac2-4caa-9fac-f91705e2e8cf HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AQvitUJ5TB6VcmzO-_tUjScZp3tjtIRTKA439ipAAZLCz-CJNha9mHrm_irVjBDPtLgXSiKSGc7TKK8lctJBDfcJSj_NZmFfyX8&google_hm=jg0FhmrCTKqfrPkXBeLozw==

Request Chain 160

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESENsNd6HI1fwHGKwujMi3PuA&google_cver=1&google_push=AQvitUIqK_G9LU1RHcqv3UXcYpPI69WOAJdKTNIFpMJDcMRFoj2iNW1558W1sL5biS9Fz1E-Vf9WSkM8W43NHAjGgXltByHsvNy6 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AQvitUIqK_G9LU1RHcqv3UXcYpPI69WOAJdKTNIFpMJDcMRFoj2iNW1558W1sL5biS9Fz1E-Vf9WSkM8W43NHAjGgXltByHsvNy6

Request Chain 161

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESECk3VgYNvjEYw63UYKGF9Ho&google_cver=1&google_push=AQvitULPW1164hkvZ04I1H5om_fDTd8UvWoBJDO8GwmySkJag3tT7dbPkERU59j6P1e2u5T0_pSNizy98dAVbGkQzuz42-40aXLr3w HTTP 302
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESECk3VgYNvjEYw63UYKGF9Ho&google_cver=1&google_push=AQvitULPW1164hkvZ04I1H5om_fDTd8UvWoBJDO8GwmySkJag3tT7dbPkERU59j6P1e2u5T0_pSNizy98dAVbGkQzuz42-40aXLr3w&verify=true HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS01cUJFcHp0RTJ1SFNzN2JzZF8uY0VPWWpLWnBIYmNIM35B&google_push=AQvitULPW1164hkvZ04I1H5om_fDTd8UvWoBJDO8GwmySkJag3tT7dbPkERU59j6P1e2u5T0_pSNizy98dAVbGkQzuz42-40aXLr3w

Request Chain 200

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1

Request Chain 201

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_hm=YFJ1vO7rA7INuMC5U4fqkAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1

Request Chain 202

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEGeQgf8VWyg0g1fS5sl7yaU&google_cver=1 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEGeQgf8VWyg0g1fS5sl7yaU%26google_cver%3D1

Request Chain 203

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzcyOTQ2MjExOTAyMTEwOTUwMg%3D%3D

Request Chain 207

https://fw.adsafeprotected.com/rfw/track.adform.net/568657/51893927/adfscript/?bn=42916151;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=ClCDRvHVSYJHIE6z5-ga36peIA-iKsddhu5GSkKUN7aa7j8oiEAEgpczXamD7gYCAiAqgAczrq9AByAEJqQKMAU63JPizPqgDAaoEgAJP0EM6yFRgB_iVyTtq3dgQ21xQc9R6hrzsAaGNYT-EtGSxpGPiY39TfUlrm8Lqgj3IgUB5bNUB2r0YpYKlvEtCpccrIXiHCvtoYR-2dUeUaXFVbnvgtvjWFJmqN_38d2Pzt40UwyRz8f4GK2_N4Szf8wFdcbPqOOiH7-03M_82gwAXs4YgNtod8z5r8U_CLAUgiGg80YdKwneU7iSRw0D1TjZs7psORX8SXmfMI0CxB5j_bv7JKP7G85GS06ADHEmWDsCLVJx3SFLQ_Mdh3RYUy860J2I2Jb20qZKpuoK_RVs5bN-fUYhLAbc4Z8KzgHgkk4DCNbW0a2Yyhe8Wzf0GwASk983nzAPgBAOQBgGgBk2AB5yU1K8CqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RuoB_PRG6gHltgb2AcA0ggJCIDhgFAQARgd8ggbYWR4LXN1YnN5bi00NDM2NzI3MDk2OTY2NTU5gAoDmAsByAsBgAwBsBOqrP0K0BMA2BMD2BQB0BUBgBcB&ae=1&num=1&cid=CAASPeRonUriMgQtamsmiUO6vw-iFuVB1r-eFSS1cPqV5UEkRh3R11IpkAN36lRVl4PgSV9r_HyBNz7IzP-EbWw&sig=AOD64_1B35qtMqeP5ozNU_FsFFBxVYyQkA&client=ca-pub-5902083285302779&dbm_c=AKAmf-CpBbYHKLDdgNf6Gcg7M9fWXPvs5MQS8UniXewdxygsS5t2wmorB3rrcSQ8lW5cvO7EQ4_Rt2AV0MkX8TbqoYpP5lseYImQ8VZ-DmWcf5zNMJ7Ea_AvZ1CK51b3rxMdawWvoehCGj0VFOx_D7oY_T1p50r3dA&cry=1&dbm_d=AKAmf-ByWU-c3SjxbTGxIzkOuj_den8oBwnbjV8EaBZYyAAxhgoP9p3zkPs_NqueTLWKPXJuYf8tOuyJR5Pn9v9P6HoOL1HON0VLeezD6rpWIOUYopXqbdPOQKoWn2WxwLec-x2IH8dae1fFB9G8j8xYJnxk0dv7OBJCeikjZE7NU9MbqwuH62cuZTicgMUZuubi7KNOhPg9LAcuCB7KS7CkaYGkMjBf5p62sKvrYll-grcUcRWt0PePBMLHIdyQ-cz59jc7J7lroJw-im36uqgUWAP0ohDqbsnbDj84-aMyWS3kYBlS7h0W2lX_Ce-5a7xQCHsKx6PcOKMSSRa-vue35_2Xa6-Nf1S5UhROFFmgf_nfkbolYYPcTdyZzo-OYqAYPtXDdQnJHrPqLYhYgIGaBmZzEVkj1TNN2BohRxKemS3jsQuHiflRUc7bWz8MHJG0nXgk6JOWQM3Deov83ePXqysp6BLPbw&adurl=;ord=1616016828320529&adsafe_url=https%3A%2F%2Fwww.reisekostenabrechnung.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&adsafe_type=c&adsafe_url=https%3A%2F%2F56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-37%2Fhtml%2Fcontainer.html&adsafe_type=bd&adsafe_jsinfo=,id:fe9280c0-ee2e-eac2-25d0-db4e47f9d3dc,c:7a2fqE,sl:na,em:true,fr:false,mn:app17ie,pt:1-5-15,br:u,abv:na,an:n,oam:0,scm:qktrf1,nbld:0,fm:srXbVsz+111%7C112%7C113%7C114%7C12%7C131%7C132%7C133%7C134%7C135%7C141*.568657-51893927%7C1411%7C14121,idMap:141*,ex:e2,pl:,rmeas:1,rend:0,renddet:svg.us,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,thd:1,et:26,oid:75f52275-8768-11eb-9df0-0289e6fd96ae,v:19.8.174,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0 HTTP 302
https://track.adform.net/adfscript/?bn=42916151;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=ClCDRvHVSYJHIE6z5-ga36peIA-iKsddhu5GSkKUN7aa7j8oiEAEgpczXamD7gYCAiAqgAczrq9AByAEJqQKMAU63JPizPqgDAaoEgAJP0EM6yFRgB_iVyTtq3dgQ21xQc9R6hrzsAaGNYT-EtGSxpGPiY39TfUlrm8Lqgj3IgUB5bNUB2r0YpYKlvEtCpccrIXiHCvtoYR-2dUeUaXFVbnvgtvjWFJmqN_38d2Pzt40UwyRz8f4GK2_N4Szf8wFdcbPqOOiH7-03M_82gwAXs4YgNtod8z5r8U_CLAUgiGg80YdKwneU7iSRw0D1TjZs7psORX8SXmfMI0CxB5j_bv7JKP7G85GS06ADHEmWDsCLVJx3SFLQ_Mdh3RYUy860J2I2Jb20qZKpuoK_RVs5bN-fUYhLAbc4Z8KzgHgkk4DCNbW0a2Yyhe8Wzf0GwASk983nzAPgBAOQBgGgBk2AB5yU1K8CqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RuoB_PRG6gHltgb2AcA0ggJCIDhgFAQARgd8ggbYWR4LXN1YnN5bi00NDM2NzI3MDk2OTY2NTU5gAoDmAsByAsBgAwBsBOqrP0K0BMA2BMD2BQB0BUBgBcB&ae=1&num=1&cid=CAASPeRonUriMgQtamsmiUO6vw-iFuVB1r-eFSS1cPqV5UEkRh3R11IpkAN36lRVl4PgSV9r_HyBNz7IzP-EbWw&sig=AOD64_1B35qtMqeP5ozNU_FsFFBxVYyQkA&client=ca-pub-5902083285302779&dbm_c=AKAmf-CpBbYHKLDdgNf6Gcg7M9fWXPvs5MQS8UniXewdxygsS5t2wmorB3rrcSQ8lW5cvO7EQ4_Rt2AV0MkX8TbqoYpP5lseYImQ8VZ-DmWcf5zNMJ7Ea_AvZ1CK51b3rxMdawWvoehCGj0VFOx_D7oY_T1p50r3dA&cry=1&dbm_d=AKAmf-ByWU-c3SjxbTGxIzkOuj_den8oBwnbjV8EaBZYyAAxhgoP9p3zkPs_NqueTLWKPXJuYf8tOuyJR5Pn9v9P6HoOL1HON0VLeezD6rpWIOUYopXqbdPOQKoWn2WxwLec-x2IH8dae1fFB9G8j8xYJnxk0dv7OBJCeikjZE7NU9MbqwuH62cuZTicgMUZuubi7KNOhPg9LAcuCB7KS7CkaYGkMjBf5p62sKvrYll-grcUcRWt0PePBMLHIdyQ-cz59jc7J7lroJw-im36uqgUWAP0ohDqbsnbDj84-aMyWS3kYBlS7h0W2lX_Ce-5a7xQCHsKx6PcOKMSSRa-vue35_2Xa6-Nf1S5UhROFFmgf_nfkbolYYPcTdyZzo-OYqAYPtXDdQnJHrPqLYhYgIGaBmZzEVkj1TNN2BohRxKemS3jsQuHiflRUc7bWz8MHJG0nXgk6JOWQM3Deov83ePXqysp6BLPbw&adurl=;ord=1616016828320529

Request Chain 241

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1

Request Chain 242

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_hm=YFJ1vO7rA7INuMC5U4fqkAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1

Request Chain 243

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEGeQgf8VWyg0g1fS5sl7yaU&google_cver=1

Request Chain 244

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzcyOTQ2MjExOTAyMTEwOTUwMg%3D%3D

Request Chain 246

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1

Request Chain 247

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_hm=YFJ1vO7rA7INuMC5U4fqkAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1

Request Chain 248

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEGeQgf8VWyg0g1fS5sl7yaU&google_cver=1

Request Chain 249

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzcyOTQ2MjExOTAyMTEwOTUwMg%3D%3D

Request Chain 274

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAQvitULOVPTcineV_8Cv8nabfDeJGyEh5Kjedez3QUG4FW258QwOvLObB7EvoR7Lyu11FPbR0ANWIRQUW3c7o0FY1wCv5743iDE5&google_gid=CAESEOiPAEC69oKPUaBI93hMGP0&google_cver=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WUZKMXZnQUFCRVFHblJkMQ&google_push=AQvitULOVPTcineV_8Cv8nabfDeJGyEh5Kjedez3QUG4FW258QwOvLObB7EvoR7Lyu11FPbR0ANWIRQUW3c7o0FY1wCv5743iDE5

Request Chain 277

https://sm.rtb.mts.ru/p?ssp=googleban&pm=1&google_gid=CAESEOztffbtPvkYkfGbxV-fJIA&google_cver=1&google_push=AQvitUKe2FgHCecpkikvyls-LwlXCz-0SbmF2Cz30TIvn81IsxVRkBsAfjH-PT5pbWElzBWPQp-lY5AMT4judAZWjxyAXKLW4zYH HTTP 301
https://sm.rtb.mts.ru/match/second?r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dstream_llc%26id%3Dc6dd64a2-4ca1-46a3-a6ee-4d04c770160c%26google_push%3DAQvitUKe2FgHCecpkikvyls-LwlXCz-0SbmF2Cz30TIvn81IsxVRkBsAfjH-PT5pbWElzBWPQp-lY5AMT4judAZWjxyAXKLW4zYH&ssp=googleban&exu=CAESEOztffbtPvkYkfGbxV-fJIA HTTP 301
https://tech.rtb.mts.ru/?dsp_uid=c6dd64a2-4ca1-46a3-a6ee-4d04c770160c&return_url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dstream_llc%26id%3Dc6dd64a2-4ca1-46a3-a6ee-4d04c770160c%26google_push%3DAQvitUKe2FgHCecpkikvyls-LwlXCz-0SbmF2Cz30TIvn81IsxVRkBsAfjH-PT5pbWElzBWPQp-lY5AMT4judAZWjxyAXKLW4zYH HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=stream_llc&id=c6dd64a2-4ca1-46a3-a6ee-4d04c770160c&google_push=AQvitUKe2FgHCecpkikvyls-LwlXCz-0SbmF2Cz30TIvn81IsxVRkBsAfjH-PT5pbWElzBWPQp-lY5AMT4judAZWjxyAXKLW4zYH

Request Chain 278

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESELoVlKEL8UsiyUbP41h9I28&google_cver=1&google_push=AQvitUI97LxmQkbxJpdTYL2eZ0Tx9JPltFeJOSrLVKhiCYzTV3wWQC2fYcJoIAeMjkiZAPO18VHqAftnQtmK7HUt4CDDOjePV6oGVA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MzZiMWM1ZDQtNGJiZS00M2YzLTg0NjItODVkNmMyYjFjNDRh&google_push=AQvitUI97LxmQkbxJpdTYL2eZ0Tx9JPltFeJOSrLVKhiCYzTV3wWQC2fYcJoIAeMjkiZAPO18VHqAftnQtmK7HUt4CDDOjePV6oGVA

Request Chain 279

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEFuq3LH4fqD_N1tfZjcJTL4&google_cver=1&google_push=AQvitULk7b-xzPgZjRZVN0WeXctOs_frxdl1ZE2R3hl7oGGfR4t_OeYN_42sH5hRVUhRfgXRpKRoGy1ag-YR-RH3VbBwic0hTsj9oQ HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AQvitULk7b-xzPgZjRZVN0WeXctOs_frxdl1ZE2R3hl7oGGfR4t_OeYN_42sH5hRVUhRfgXRpKRoGy1ag-YR-RH3VbBwic0hTsj9oQ&google_hm=NDc0NzI3OTg1NzgwMjg5NDMzMw==

Request Chain 281

https://edf.solution.weborama.fr/fcgi-bin/dispatch.fcgi?a.A=im&a.si=4343&a.te=957&a.he=1&a.wi=1&a.hr=p&gdpr=&gdpr_consent=&a.ycp=9148768704996281325&a.ra=78243 HTTP 302
https://edf.solution.weborama.fr/fcgi-bin/dispatch.fcgi?g.bo=OK&g.rn=858099&a.A=im&a.si=4343&a.te=957&a.he=1&a.wi=1&a.hr=p&gdpr=&gdpr_consent=&a.ycp=9148768704996281325&a.ra=78243

Request Chain 284

https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEIgDcOYLkCtkoNdqvCUn0xM&google_cver=1&google_push=AQvitUI2wDgtAhzWY3MNzqkAtWH83ktNfgRmeaM23nrvL6I3ALwERyTdNUBt2rJ_LEd7euau7S68hqAS5pvjahi2UEtGqoyuDw HTTP 302
https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEIgDcOYLkCtkoNdqvCUn0xM&google_cver=1&google_push=AQvitUI2wDgtAhzWY3MNzqkAtWH83ktNfgRmeaM23nrvL6I3ALwERyTdNUBt2rJ_LEd7euau7S68hqAS5pvjahi2UEtGqoyuDw&checkcookies=true HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=ifG28csQQPmTCxEdTshQ9g&google_push=AQvitUI2wDgtAhzWY3MNzqkAtWH83ktNfgRmeaM23nrvL6I3ALwERyTdNUBt2rJ_LEd7euau7S68hqAS5pvjahi2UEtGqoyuDw

Request Chain 285

https://sync3.sniperlog.ru/?src=ggl_nga&google_gid=CAESECMbQlr-4vTjE9nWq0fcnNE&google_cver=1&google_push=AQvitUJ7OnM8yVss6ApVlz3zQvvLTjAIZjWFpuX1GPOr8vg5UFK7Nc8R02ZKeiIfpppsfmV1hAGHp73RW0VV2LGY6hDjj8C-1Js HTTP 301
https://sync.bumlam.com/?src=ggl_nga&google_gid=CAESECMbQlr-4vTjE9nWq0fcnNE&google_cver=1&google_push=AQvitUJ7OnM8yVss6ApVlz3zQvvLTjAIZjWFpuX1GPOr8vg5UFK7Nc8R02ZKeiIfpppsfmV1hAGHp73RW0VV2LGY6hDjj8C-1Js HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_push=AQvitUJ7OnM8yVss6ApVlz3zQvvLTjAIZjWFpuX1GPOr8vg5UFK7Nc8R02ZKeiIfpppsfmV1hAGHp73RW0VV2LGY6hDjj8C-1Js

Request Chain 286

https://ssp.adriver.ru/cgi-bin/sync.cgi?ssp_id=10&external_id=&google_gid=CAESECXpfrF8ypmhhyBy_tAlC3Q&google_cver=1&google_push=AQvitUJ9ZJafMPrujSrlB3T69iHSDpVun-E69KIF6ftgPjoDIe9FuM5Wg8Cety8w246JsmlyYC_uXbyeq7noDBBPNk-HaXkPA_M HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AQvitUJ9ZJafMPrujSrlB3T69iHSDpVun-E69KIF6ftgPjoDIe9FuM5Wg8Cety8w246JsmlyYC_uXbyeq7noDBBPNk-HaXkPA_M&google_hm=QVNVczJWdVFKV1ZPRjRCazdfTXVaTGc=

Request Chain 289

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEFuq3LH4fqD_N1tfZjcJTL4&google_cver=1&google_push=AQvitULPcYLOI3OJU2A5B9PFNbYQMiDzIQ8Gbpb9do5irNA7nbuczvYDSwSvw7W_vLqlHXL_l4hEwLYAUHIhDzt-xgU-owESxc0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AQvitULPcYLOI3OJU2A5B9PFNbYQMiDzIQ8Gbpb9do5irNA7nbuczvYDSwSvw7W_vLqlHXL_l4hEwLYAUHIhDzt-xgU-owESxc0&google_hm=NDc0NzI3OTg1NzgwMjg5NDMzMw==

355 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.reisekostenabrechnung.com/
Redirect Chain

https://cdn-1.reisekostenabrechnung.com/
https://www.reisekostenabrechnung.com/

206 KB
50 KB

406ms
389ms

Document
text/html

2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / PHP/7.2.23
Resource Hash: 880fc31656d53a1510787f75b74b466eb4e1fdee66ae9b74defb381ab5d955f0

Request headers

:method: GET
:authority: www.reisekostenabrechnung.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: __cfduid=d336f91fa9647db1c49d8280de6285f681616016822
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-type: text/html; charset=UTF-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
display: pub_site_sol
expires: Tue, 16 Mar 2021 21:33:43 GMT
hummingbird-cache: Served
pagespeed: off
response: 200
set-cookie: ezoadgid_129856=-1; Path=/; Domain=reisekostenabrechnung.com; Expires=Wed, 17 Mar 2021 22:03:42 UTC ezoref_129856=; Path=/; Domain=reisekostenabrechnung.com; Expires=Wed, 17 Mar 2021 23:33:42 UTC ezoab_129856=mod38; Path=/; Domain=reisekostenabrechnung.com; Expires=Wed, 17 Mar 2021 23:33:42 UTC active_template::129856=pub_site.1616016822; Path=/; Domain=reisekostenabrechnung.com; Expires=Fri, 19 Mar 2021 21:33:42 UTC ezopvc_129856=1; Path=/; Domain=reisekostenabrechnung.com; Expires=Wed, 17 Mar 2021 22:03:43 UTC ezepvv=658; Path=/; Domain=reisekostenabrechnung.com; Expires=Thu, 18 Mar 2021 21:33:43 UTC ezovid_129856=1015559731; Path=/; Domain=reisekostenabrechnung.com; Expires=Wed, 17 Mar 2021 22:03:43 UTC lp_129856=https://www.reisekostenabrechnung.com/; Path=/; Domain=reisekostenabrechnung.com; Expires=Wed, 17 Mar 2021 22:03:43 UTC ezovuuidtime_129856=1616016823; Path=/; Domain=reisekostenabrechnung.com; Expires=Fri, 19 Mar 2021 21:33:43 UTC ezovuuid_129856=96e15438-9cc6-40e6-5f1e-7aeccf3bf1aa; Path=/; Domain=reisekostenabrechnung.com; Expires=Wed, 17 Mar 2021 22:03:43 UTC ezCMPCCS=false; Path=/; Domain=reisekostenabrechnung.com; Expires=Thu, 17 Mar 2022 21:33:43 GMT
vary: Accept-Encoding Accept-Encoding,Cookie
x-middleton-display: pub_site_sol
x-middleton-response: 200
x-powered-by: PHP/7.2.23
x-sol: pub_site
cf-cache-status: DYNAMIC
cf-request-id: 08e3b4e9b2000005f15a3d3000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=9EnKdKKZuEwyaPJY7nwnt9fXqwFBxv7GAWODgH4M%2BqQ224ekpaAfGoYyM5lRL1u5lHNL1mDzteoboQOVo8AjpGX%2FNklgZhgYUD6XxvCp6%2F80A2ZPUWZUB1g2KGGEzAqOljN%2FBTvcOXr2Kw%3D%3D"}],"group":"cf-nel"}
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 63195755e92d05f1-FRA
content-encoding: br
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

Redirect headers

date: Wed, 17 Mar 2021 21:33:42 GMT
content-type: text/plain; charset=utf-8
content-length: 0
set-cookie: __cfduid=d336f91fa9647db1c49d8280de6285f681616016822; expires=Fri, 16-Apr-21 21:33:42 GMT; path=/; domain=.reisekostenabrechnung.com; HttpOnly; SameSite=Lax
cache-control: max-age=300, private
location: https://www.reisekostenabrechnung.com/
vary: Accept-Encoding Accept-Encoding
x-middleton-display: redirect
cf-cache-status: DYNAMIC
cf-request-id: 08e3b4e839000005c4e294e000000001
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ggYSa78VBkM6IFT1FYvk2DNHh7MDvccG9ve%2FMSkCA%2Faxuuolby0HcD7wfGnVGNkAU0DXBoA61rwTqyRkMl%2BhozY5CDy9dKu6VqkVNcIGsfSLbVzVmNjN3%2Bti3FRw3s9eryIPk4LR2y1ReV4i"}]}
nel: {"max_age":604800,"report_to":"cf-nel"}
server: cloudflare
cf-ray: 631957538ab805c4-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 59 KB
20 KB 120ms
41ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

sffe /

Resource Hash

eba385c1782056501cdda10d5706441ab694be71c08db0a758160c6a16373171

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "815 / 706 of 1000 / last-modified: 1616009968"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19955
x-xss-protection: 0
expires: Wed, 17 Mar 2021 21:33:43 GMT

GET
H2 200 dall.js Show response
go.ezodn.com/hb/ 217 KB
64 KB 43ms
28ms Script
application/javascript 2606:4700:e4::ac40:a708
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://go.ezodn.com/hb/dall.js?b=criteo,pulsepoint,rhythmone,spotx&cb=192-2-11
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a708 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10f6e6a4fc6ec19d54cbadf37af57dd9f8770c90889e969fd803a70bd11ffe07

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
age: 52856
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2B53dEvXfNKh8okcPo90l00yYbG6N236LkoDhabwMaGLGHqnaQhajiGnhPZwxZF5US05ZH8jSRslxx9XTUqua0XX6ff%2Bf1SLjSnPQ4Q%2F737yjRt5Ky%2FRoS00%3D"}],"max_age":604800,"group":"cf-nel"}
content-type: application/javascript
cache-control: public, max-age=31536000
cf-ray: 631957587a91dfcf-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb4d0000dfcf4ebf4000000001

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 119 KB
31 KB 153ms
65ms Script
application/javascript 13.226.158.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.158.204 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-158-204.dus51.r.cloudfront.net
Software: Server /
Resource Hash: 86cef609c85d2c2ce6a507af54e77a9c150e2fa408043e1454082614c4b0ce2b

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:29:37 GMT
content-encoding: gzip
server: Server
age: 246
etag: d2bbe61d6c9cfd2f9d26c66417c4fb1e
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 e5dcf90f3787d486ad40e46070021460.cloudfront.net (CloudFront)
cache-control: public, max-age=900
x-amz-cf-pop: DUS51-C1
accept-ranges: bytes
timing-allow-origin: *
x-amz-version-id: qpGbqo5n5ftYm2ZsSSwwmAxZeGfbwfiX
x-amz-cf-id: VxjDbwSc4hsMWOCSotuzaCvFANIe5Qs4LoHIiwAyW-IJzeGuina3qQ==

GET
H2 200 ab9510f7ebc0b73c4303dcda114236c2.css
www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/ 70 KB
13 KB 17ms
16ms Stylesheet
text/css 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/ab9510f7ebc0b73c4303dcda114236c2.css
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d4541768d977bafc2a0a4215e5dbeeee0b39965aeb2fc8b2a3ac6e7b42a25c26

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
cf-cache-status: HIT
x-sol: orig
age: 391637
cf-polished: origSize=71741
x-ezoic-cdn: Hit ds;dd;2c879efce04e78a2b1b333cbdfd13672;2-129856-0;091e4c97-d0e4-495f-4f16-e2d2f7db49dd
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb40000005f14a052000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"1183d-5b3fb68c2f4e6-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"report_to":"cf-nel","max_age":604800}
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=8c9bavvv3cxstt2%2Fd7ETFDDqMNBw4qubXUp7YNFwinPl41McpemKQ74bsOC2FbSLKNmRpQQGykaGbqNZmHq2dzjGBezDAU2QdddWS2I9a9OX6OwDNkVsz7%2F1OVSBWNU8Y5XjSt6VKeZhPA%3D%3D"}],"group":"cf-nel"}
content-type: text/css
cache-control: max-age=691200
cf-ray: 631957586e0305f1-FRA
display: staticcontent_sol, orig_site_sol
cf-bgj: minify

GET
H2 200 0336a730e58c21a73c87a71d152c6ec3.js Show response
www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/ 95 KB
33 KB 15ms
15ms Script
application/javascript 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/0336a730e58c21a73c87a71d152c6ec3.js
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 34ef40de06f89a7924f26fdbafd35352f7fa67a8c5eb8840fdb6eeafb818240e

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 391637
cf-polished: origSize=97571
x-ezoic-cdn: Hit ds;dd;17e0b55b61615e031c31240552f70d48;2-129856-0;65d47d72-5591-4644-73d7-d2bc848adc4e
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb40000005f1f0135000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"17d23-5b3fb68f68819-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=p15GULmLxCk0uKnBQMv8PfL3R0lVTzfzaR1rd9u7K0yVm2Bwzt3oRynOuJ0MX9qH6YU9CJxtY%2FaFEoeKyL91NEYMy4q2ap2LG2XHpGfTleV%2BXUnCMRkkJ83lzJgZ4jJi2yPlse9SYuFFYg%3D%3D"}],"group":"cf-nel"}
content-type: application/javascript
cache-control: max-age=691200
cf-ray: 631957586e0805f1-FRA
display: staticcontent_sol, staticcontent_sol
cf-bgj: minify

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 97 KB
38 KB 29ms
17ms Script
application/javascript 2a00:1450:4001:827::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-2827868-10

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fdad7e0cf0ea2a8c3706cfabedbdaa747b16e701e8df2d5aa9bd6e03fa38d628

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39078
x-xss-protection: 0
last-modified: Wed, 17 Mar 2021 21:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 17 Mar 2021 21:33:43 GMT

GET
H2 200 boise.js Show response
www.reisekostenabrechnung.com/detroitchicago/ 983 B
726 B 22ms
11ms Script
application/javascript 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/boise.js?gcb=192-2&cb=1
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 41eb9054d5d5527274926b32631be8eb22dd6254f15a4d9d14cfe2688ea4f538

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3517435
cf-ray: 63195758ae6e05f1-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb6a000005f10dbf4000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=GkQT2DFeUigymSrs6bjbh5QQviS2cj5f1XB23hF3uAL9TeGz%2F%2B81prN4w9zjnOPmCBUYC8ek2Wqc2KgAn4mQGmG%2Bz%2FougHGnZpIXcZEqxFdsS2dFGuHNG8YzVlge2OaEjM8ac4DApbWlOw%3D%3D"}],"group":"cf-nel"}
content-type: application/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 banger.js Show response
www.reisekostenabrechnung.com/porpoiseant/ 50 KB
11 KB 41ms
31ms Script
application/javascript 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/banger.js?cb=192-2&bv=13&v=46&PageSpeed=off
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85aef15e15535a3497f55f748129fd2744772229e00a72eff6d2b5aaca4f0fb1

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 664560
cf-polished: origSize=51253
cf-ray: 63195758ae7005f1-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb6b000005f12b057000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=b0NKjw7BdKShDb1kME74kvlOoA3ifX%2FHsU6TS3orTrxsGHiQZPaTP6%2B0kE8Ii4We%2BWAMuw0xNMqkjCC1fhQQbEk3uMjNhbgSgV%2BWnJ%2Fz3LIznPzrHHjdUpWRoFAzpR%2BtGY2lcjXDk5pjSg%3D%3D"}],"group":"cf-nel"}
content-type: application/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 memphis.js Show response
www.reisekostenabrechnung.com/detroitchicago/ 5 KB
2 KB 21ms
10ms Script
application/javascript 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b68431bd479f66f60cca8fef9520547c0f28390680174d8b36c5591085e8393

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 492629
cf-ray: 63195758ae7305f1-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb6a000005f1719e5000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=7zIVRiNhmhNRLsy7ltW2p6Ic%2FtgXV5U4%2FmEh8eG%2FGMX7T44eXRjJWFsf%2FMdz3BImPoQsk6bzyPlB4vBDUcNHV2diu1q5ueXnzQ65nhGwMXFw6DTtjRpKepfPSeU83ueoaJe4z6EKrLomWA%3D%3D"}],"group":"cf-nel"}
content-type: application/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 minneapolis.js Show response
www.reisekostenabrechnung.com/detroitchicago/ 864 B
943 B 25ms
15ms Script
application/javascript 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/minneapolis.js?gcb=192-2&cb=3
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5578a62b81f315375d072cfe506fc13813e844f94c910bdb15ce20e1fc3ef50a

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2995444
cf-ray: 63195758ae7405f1-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb6a000005f12f140000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=K6%2BENuEuPLxEe2Iic%2FV5iisdS3sK8nLDylfxug7%2FwByFDjq8vGhf%2FMRmSL190vDwDEb7v%2BGl4mPYMeVrvRn6O6LwRljEMaFP1ZLRzb%2BdYciVcz9VkNpfwmuuuyTtCbAb0VrhSUCwt5ODYA%3D%3D"}],"group":"cf-nel"}
content-type: application/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 raleigh.js Show response
www.reisekostenabrechnung.com/detroitchicago/ 2 KB
1 KB 21ms
11ms Script
application/javascript 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/raleigh.js?gcb=192-2&cb=5
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f69dfe383fe0ef66df2c8de098fda546a826801c150ec22e7e09b8020b221dae

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1793406
cf-ray: 63195758ae7505f1-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb6b000005f1f32d7000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=XueJJScNqivZWmqlw92R4U4WpgkylIf3QjvpVC8daPLNf8OuFHlM6%2FGq1Tr9aPkPmUdf%2BLNqvOMfevVqTGE23YplXFtQvVQo6Lkus2NokXSbmB8RgMxT1gM7HdqQ9W3jlxJdwn0hfKTWoQ%3D%3D"}],"group":"cf-nel"}
content-type: application/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 tampa.js Show response
www.reisekostenabrechnung.com/detroitchicago/ 773 B
731 B 21ms
12ms Script
application/javascript 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/tampa.js?gcb=192-2&cb=3
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c80203c7eae413cecc09a4ed0974e31a8538060cddd5bc1f1a5bfa53db672c9e

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2553941
cf-ray: 63195758ae7605f1-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb6b000005f1fb86b000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=hrejz21BLNG86IEzAdS%2BQ34pLjLHN74OLfxOmD%2BR4ZjmIRm9Guuu8TAjzADey8Emv8VfOmt02u2mHk0LZDAFWoWkyy3zwBlFIKk8GovMiY%2FCuUWXxBVBJ%2Bppy9aUbfYo4BgW5qLOeloM%2Fg%3D%3D"}],"group":"cf-nel"}
content-type: application/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 kilometerpauschale-kilometergeld-150x150.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2013/07/ 6 KB
7 KB 34ms
24ms Image
image/jpeg 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2013/07/kilometerpauschale-kilometergeld-150x150.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bab158f2b326e9f2db0ee25f682afbe01ec4835c26564e68950d4170180cd80b

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 477553
x-ezoic-cdn: Hit ds;dd;2b35c6d762e86e0808c16bc7372ef064;2-129856-0;dcb830f2-49ef-4e78-6baf-a4da912a9fa5
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb6c000005f12b058000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"1998-5852444940df0-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=GJcPidMmlNPEL1m0BEZgvnCKH2UKG5btc2AihQOy5ao4zLsKLbBlckBgQx4wEBLRWyTXyNhbNZS%2F02nxwvgSMkdI%2BLb%2By%2FwTb8g%2BgTiS9wsFBDZZ52fnpfNhAc5v0AH04py3Wjs7BXjY8g%3D%3D"}],"group":"cf-nel"}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 63195758ae7705f1-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 verpflegungsmehraufwand-2020-150x150.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2019/11/ 3 KB
3 KB 22ms
13ms Image
image/jpeg 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2019/11/verpflegungsmehraufwand-2020-150x150.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e9591f064ab3cd667a6d281a2566b45b0636e9da33108e0257c53bd3f5cda455

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 391637
x-ezoic-cdn: Hit ds;dm;5732b09c774bd9042f240d91405f8962;2-129856-0;9b25c575-d94a-4084-7111-d63b440bfadd
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb6b000005f11a3a4000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"be0-5989622b23da7-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=cpYay9Vc3d1J2wlea43HpkK8NEi6kYZE2%2BBbl2yJuOQ6AE%2FMXcIWIILoI4U7vqZ%2FKUW50Z3yY51hOUQDyovUEJEYxfgBF14H1qfYz6qC9%2BuIVFJ7CtK%2FZ8TMOPwhqQx%2B3NIpn4u3N10FfA%3D%3D"}],"group":"cf-nel"}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 63195758ae7805f1-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 reisezeit-arbeitszeit-arbeitsrecht-150x150.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2019/04/ 6 KB
7 KB 29ms
20ms Image
image/jpeg 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2019/04/reisezeit-arbeitszeit-arbeitsrecht-150x150.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 322b1e4ed7c507891b57e9f2de050bbf9e13d3b43a32164f81bd74e1cfe41748

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 477553
x-ezoic-cdn: Hit ds;dm;f72e7e9f24402c64b7981aff2ba56d69;2-129856-0;8a8e3e50-cd77-43dc-5e76-0f275dd71933
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb6b000005f14f2db000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"1893-5861d0e8bc838-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=OFVNxYCJK%2BljV2ojTud1%2BeYOGT8TFOvFoVXi1RWVMWv8nBacOchMTj4Sbxv6EsJw67lWU9lzKN2DCK4mshrLPFL2YCtXXYjE2eYxTz%2F4VeTJHaPXtG5pAtmvrbfVWIri6xLL%2FJM7fCjDyw%3D%3D"}],"group":"cf-nel"}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 63195758ae7905f1-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 verpflegungsmehraufwand-20181.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2017/12/ 23 KB
24 KB 21ms
12ms Image
image/jpeg 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2017/12/verpflegungsmehraufwand-20181.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d17b84f0cbd97c80fcfee28f36b7a4122035195ecbfbaba9ce6d54ba414dbad3

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 306976
x-ezoic-cdn: Miss
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb6b000005f10ab37000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"5cb4-586c9c8cfa68c-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=eveuBpkSwUswZ3NF4bcKtaezFRBUctjWWECx721zVIuxXqnIuZyuGQGj%2FoaS5e%2FT5ETIzmBTt480rrNb0FJ4K99B9FwfFu6YorfpEjKlaOSHbZ1ga4REyfGcArLgLlL9AeL%2FNmz67vj7Ww%3D%3D"}],"group":"cf-nel"}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 63195758ae7a05f1-FRA
display: staticcontent_sol, staticcontent_sol
expires: Mon, 14 Mar 2022 08:17:27 GMT

GET
H2 200 Verpflegungsmehraufwand-2019-150x150.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2018/12/ 7 KB
7 KB 24ms
16ms Image
image/jpeg 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2018/12/Verpflegungsmehraufwand-2019-150x150.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 68984aa0e0192c05e3385c29a8e60cc4a1c37a9273ce62503006a85e09e92246

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 473550
x-ezoic-cdn: Hit ds;mm;28f1616bfbb019102ae26ae1e8d24fff;2-129856-0;a74722ac-7932-4716-5450-4391e04413d5
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb6c000005f1000c9000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"1aa1-584e7848e52f0-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=P7UH2TKsiIInzxDxc5PoAru7Q0Qjovqgob4gYp%2FbRJ%2BTGjusGyhSwutThit7vJfKlXBA5%2FBXXXKRy0%2Bnb399HXmchlvcgkP4WXykPC7pDvyUsGOgF%2BsJrB8XHmglUN8co7M4cAS%2BIJn68w%3D%3D"}],"group":"cf-nel"}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 63195758ae7b05f1-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 verpflegungsmehraufwand-2020.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2019/11/ 22 KB
23 KB 25ms
17ms Image
image/jpeg 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2019/11/verpflegungsmehraufwand-2020.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0f087bb8341880a9a60af996272030bf86504927f2f64b62da3a53389211cbfd

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 215491
x-ezoic-cdn: Hit ds;mm;d837adea95f420caddf69b3709ddad94;2-129856-0;f66950c2-eded-4163-653a-8b17015a7642
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb6e000005f105b44000000001
response: 200
last-modified: Fri, 12 Mar 2021 17:56:24 GMT
server: cloudflare
etag: W/"5839-5989622750d83-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=uSwjF1gF5AweAyDrE8WaMJxLR2OL9yE6RqfF0wbdquJKU9WqXCp%2FEF1oNUg9Jk%2BUGIltZmBgQ%2FW9ut56NtE4xu6sMzEOSTio%2FzR3emN3gb7K9PNmPqjEudEZQNPzEFOd4%2FuCThfsRMkMvQ%3D%3D"}],"group":"cf-nel"}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 63195758ae8005f1-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 wichtige-auslandsvorwahlen.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2019/06/ 21 KB
22 KB 28ms
20ms Image
image/jpeg 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2019/06/wichtige-auslandsvorwahlen.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11ca2b97c357478751eaf975d488b2bb3fe244e18a570e122ee239f27890aec1

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 391637
x-ezoic-cdn: Hit ds;mm;ded5203141a54e589790f0d4e92ac770;2-129856-0;d8183be7-5802-46b0-7275-f52bb2290999
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb6e000005f15cb61000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"5496-58c37ebadc08d-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=eFmOpkLiSXuSqblpdo3vfmVcDiGuElkY1068pxzSaEfDVz7CB5pZrfRc%2BBA7nEcX6PS6ymOfqHOLeDsCK0trE7KzQZsWcuknJwLcAr7kyUmwCY9LJq5xlT0rJOp%2BBz04SVjIpEuvikAZqQ%3D%3D"}],"group":"cf-nel"}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 63195758ae8205f1-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 10-tipps-gegen-flugangst.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2019/04/ 132 KB
132 KB 34ms
26ms Image
image/jpeg 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2019/04/10-tipps-gegen-flugangst.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4b73436f7c44562199d88eacfdaee95d10c34e3cbf03c77756653e4b9447d142

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 391637
x-ezoic-cdn: Hit ds;dd;2b956f56879235c454ef4eaa72b23d1c;2-129856-0;4be72e78-7c22-476d-58f4-c10fe51a9fd8
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb6e000005f1f78ab000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"20e8b-5872ddb7579b9-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Jr2N1%2BqGcvYgZGVk1eP6iwYg23oJ2bvbRu3t4XQ%2FR9zwqpXNZPKzL9hDFtp2fi0%2Fowomn4pb1w85v%2FPd8tj74FJGkVKTDZseM5qHz27Y242jL5%2BA%2F5e3WZ3egS42Tv9OHENgXw4k0KcoSA%3D%3D"}],"group":"cf-nel"}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 63195758ae8305f1-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 gegen-jet-lag.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2019/04/ 47 KB
48 KB 33ms
26ms Image
image/jpeg 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2019/04/gegen-jet-lag.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5c7246a30f947138add9e8a4f08af29a2bbe677690075ec238eb87f02ca9fc2f

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 404775
x-ezoic-cdn: Hit ds;mm;76d601e9cd1e5555d8604299211c68b5;2-129856-0;9710fdbe-cb53-43f8-48f8-e3bb1c763b83
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb6e000005f12d922000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"bcd9-5872d84f9cb14-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Nzf%2B8mkjc3iQ5ha%2Fgd0FIVQj4dqcIyd3cKAVr59p0DwDYFHPttZudLgj8b3lj8pOkG3dCP6aAdWrwmWquzBLXMRblgKhObmQd0driJcZKaqUTFNdCz9O2OFtUzgQuxgm6mdYBeeTfHtFLg%3D%3D"}],"group":"cf-nel"}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 63195758ae8405f1-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 reisezeit-arbeitszeit-arbeitsrecht-600x300.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2019/04/ 31 KB
32 KB 29ms
22ms Image
image/jpeg 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2019/04/reisezeit-arbeitszeit-arbeitsrecht-600x300.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cc470a93cb0f84356b1f95b20e67560edef307fb653294bdf7f050460b8ffabb

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 391637
x-ezoic-cdn: Hit ds;mm;85e1d153aa3302b02ce2ba1dadfa9d88;2-129856-0;7cac4395-1f4e-45e1-798b-0e4b04269e8b
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb6f000005f11e306000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"7d93-5861d7069feba-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=r0%2B%2FkEiKCNTbC8Qzj%2FdfyorEtNuxgdhkwJNBv2YdIDH2EjGmPOtZX4NHfHupJSRIDwe5X2vcuZS2UbqKOjJpcX7aofsbeHobYX2zGcxgsWFT80DoGhVdKyuCJjMrP5oEb0fiShc%2BgVFU%2Bg%3D%3D"}],"group":"cf-nel"}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 63195758ae8505f1-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 parkgebuehr-steuer-150x150.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2020/02/ 5 KB
6 KB 29ms
22ms Image
image/jpeg 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2020/02/parkgebuehr-steuer-150x150.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 22abd45f1c986bcef595abde9c04687cbf9e0aaba50cae7ed74adf43a60e48cd

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 480195
x-ezoic-cdn: Hit ds;mm;3efc99ee46927a30436a2c58b1a3febc;2-129856-0;18f1ca47-6b62-4b2d-721c-6fd6f78b791c
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb6f000005f16b154000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"1529-59ed7db864bbd-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Zv2NqHUXz64ZUiYUY9V0skmhGtPeNP%2FeWv7MwRbXIhdIHGjJ%2FsQdIbwR8J7s6Fm3gYRJOlBWmAD4E8gWqnYvvhju92pWbaUp4vVfbPCo6St%2FpxRg%2FkSn0nVmED9zBatrxSvGKkMG0SYhRw%3D%3D"}],"group":"cf-nel"}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 63195758ae8605f1-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 geschaeftsreise-usa-150x150.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2020/02/ 5 KB
5 KB 31ms
24ms Image
image/jpeg 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2020/02/geschaeftsreise-usa-150x150.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bc4a532d1cc0e0681799df7243d94d96e3949e93d6951765e738c2e455ba5738

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 391637
x-ezoic-cdn: Hit ds;mm;d4ccac5b1c48a209dc3e3160f8fd6f36;2-129856-0;d8700c10-7b0a-4ce3-6bf8-d598d2d37a42
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb6f000005f103276000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"12d9-59dedd0be0dd1-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=11xdI%2FDY1GJXy37UcDJXqWGDCZWbKwO5TmyYTw1bexFi4Vg8EOi7ORVudDcMD%2FYIUq%2FSeXaMXvAm8jDZOokNgC0lHLmkRXWO5Zs1BSCm2HqNgHFw6gm%2BT1llrKGd1mCPMacq3milIo1AeA%3D%3D"}],"group":"cf-nel"}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 63195758ae8705f1-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 schutz-geschaeftsreisen-richtige-versicherung-150x150.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2019/09/ 5 KB
6 KB 32ms
25ms Image
image/jpeg 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2019/09/schutz-geschaeftsreisen-richtige-versicherung-150x150.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 977e2a7ebfdf57c55274f6a1191eefdf637e4055e05d38386de41281209f993a

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 225898
x-ezoic-cdn: Hit ds;mm;0edcaf6e0d47e47629a91311734e6dc0;2-129856-0;662d1f01-39a3-493d-4375-c5999e39064d
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb6f000005f112324000000001
response: 200
last-modified: Fri, 12 Mar 2021 17:56:24 GMT
server: cloudflare
etag: W/"1521-591a3e6d9c2a6-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4m1Mn7U5CXp0hUCQ6TGpbCqrWIQCl%2BLzmiIXz8c1MRNWeQtI77RWQpYrfpesg5MwTaNobt8PbKezNsyIJWRzRG6837bYMzYDuIDy4N7Ko5CimpXmdB6pVzRSJW9LyYpWoMUjDB3ifqul%2Fw%3D%3D"}],"group":"cf-nel"}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 63195758ae8805f1-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 wichtige-auslandsvorwahlen-150x150.jpg
www.reisekostenabrechnung.com/wp-content/uploads/2019/06/ 6 KB
6 KB 32ms
26ms Image
image/jpeg 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/2019/06/wichtige-auslandsvorwahlen-150x150.jpg
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5b598f6b8e6244f2ba676cc0f9fa2749ac3e7b9b04ef153df6770145bd593b66

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 388281
x-ezoic-cdn: Hit ds;mm;ca03750475cf1427e69c7bd43c322f0d;2-129856-0;4150518c-e4b2-42f2-6853-b7c0f6123c0c
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb70000005f1401eb000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: W/"17a7-58c37ebc196b3-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=FisBRmOkJ5l3zwfLHb1l1c3ONztLf%2FZzyoo8H6rgt3Denhv1MQCSP0KQQ8dME8Yzdf1pQkAOp1eb3SAKB10wEpTlPnwnMj29cmtqRr%2FVkC%2FrrrdeFMLDzObdx6RZLjw9wk41qNYG6wiTIQ%3D%3D"}],"group":"cf-nel"}
content-type: image/jpeg
cache-control: max-age=691200
cf-ray: 63195758ae8905f1-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 ezoic.png
go.ezoic.net/utilcave_com/img/ 1 KB
2 KB 38ms
4ms Image
image/png 2600:9000:206f:a200:2:cb38:840:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://go.ezoic.net/utilcave_com/img/ezoic.png
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:a200:2:cb38:840:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.0 /
Resource Hash: e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Sun, 14 Mar 2021 02:36:22 GMT
via: 1.1 b3dc72c60418e8887de31f772538f118.cloudfront.net (CloudFront)
x-sol: middleton
age: 327441
x-cache: Hit from cloudfront
x-middleton-display: staticcontent_sol, staticcontent_sol
content-length: 1181
x-amz-cf-id: MIg2vzZ97cY1rf6CqOPKBx7s6xycNlrALv8oJckU07DvhwJ9CeyWrw==
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: nginx/1.16.0
etag: "49d-5ac9ecc7b5bc0-gzip-gzip"
vary: Accept-Encoding,Accept-Encoding
content-type: image/png
cache-control: max-age=604800
x-amz-cf-pop: FRA56-C1
display: staticcontent_sol, staticcontent_sol
expires: Sun, 21 Mar 2021 02:36:22 GMT

GET
H2 200 b53f34c75ed223f448abdd796c3eb906.css
www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/ 80 KB
15 KB 25ms
15ms Stylesheet
text/css 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/b53f34c75ed223f448abdd796c3eb906.css
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d269f9bebbbe631349351d50b4696ff0d94649dbb03889b769687d0290dd12bf

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
cf-cache-status: HIT
x-sol: orig
age: 220023
cf-polished: origSize=82363
x-ezoic-cdn: Hit ds;dd;3106b3e503c7b9e7fe20130c4341d5ea;2-129856-0;3aef42df-e99e-4bcd-675d-61f9d58a4fad
x-middleton-display: staticcontent_sol, orig_site_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb69000005f14082b000000001
response: 200
last-modified: Fri, 12 Mar 2021 17:56:24 GMT
server: cloudflare
etag: W/"141bb-5b3fb691337e4-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
nel: {"report_to":"cf-nel","max_age":604800}
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Ofy%2BXi1X4Bp4mk880Im6i%2BLZHDbNZ3cFvT9KMoMsUviM7y%2FMdfCupzdD2pKXCGUO7SLvWRkEnW4dSPHft05vpXKIsiNMQ26E9Uoi3wLmrfqDObS9UQEYY3rBI1cjxC0tYZqQE61im454NA%3D%3D"}],"group":"cf-nel"}
content-type: text/css
cache-control: max-age=691200
cf-ray: 63195758ae6705f1-FRA
display: staticcontent_sol, orig_site_sol
cf-bgj: minify

GET
H2 200 33e05ca2d380d27d6dfb8c8dd0e41e01.js Show response
www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/ 64 KB
17 KB 28ms
18ms Script
application/javascript 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/33e05ca2d380d27d6dfb8c8dd0e41e01.js
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3ded49272000064adcec14280964aea6d2253f83ce9ae507f25e24721f3ec8ca

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 118853
cf-polished: origSize=65256
x-ezoic-cdn: Hit ds;dd;748726a908676bfc50b74932841b58d4;2-129856-0;098782b2-4b84-47b7-4158-918226b19655
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb69000005f1378f4000000001
response: 200
last-modified: Fri, 12 Mar 2021 17:56:24 GMT
server: cloudflare
etag: W/"fee8-5b3fb7395d0de-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=NAhgPUq8jseEDzeUZuElOcK5LT0v0O7WlLk1AlaykGoNS6xVJ2I2mXMmbhe6dR53jsG1u3HnvMScPGAYIiY9o3G7cVuYi0G1qFf37JuhNXM30OwBWrTbOgm9fk9%2BeSgZaLxS%2FcZHBC0GYQ%3D%3D"}],"group":"cf-nel"}
content-type: application/javascript
cache-control: max-age=691200
cf-ray: 63195758ae6a05f1-FRA
display: staticcontent_sol, staticcontent_sol
cf-bgj: minify

GET
H2 200 augusta.js Show response
www.reisekostenabrechnung.com/detroitchicago/ 1 KB
997 B 29ms
23ms Script
application/javascript 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/augusta.js?cb=9
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e965b21d6a23293b47f5deb510a49b0675f74ee2eeb6dc86c101c33ff921461c

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 167615
cf-ray: 63195758ae8b05f1-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb70000005f1f0138000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=NAOodKfOPk5xPqKJM1CWuegHuQ%2BwTJU4LsQdOF5duD3tNeZ1DJQArz93H%2BvqReRmgmAcHWTyaTThzlsGROlWMBOFm6qqZZSCyPmrOtn2hpKommfIZazNab9vXm%2B1C1C9P9bC6v23cuS0wg%3D%3D"}],"group":"cf-nel"}
content-type: application/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 altconsent.js Show response
ezodn.com/cmp/ 396 KB
93 KB 60ms
47ms Script
application/javascript 2606:4700:e4::ac40:a708
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ezodn.com/cmp/altconsent.js?v=8
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a708 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f2b92530616ddbefbed0e825e094cd914f17ae899b42152f17028a0073f5eb62

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 02 Dec 2020 23:21:46 GMT
server: cloudflare
age: 595945
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=hPgahENZVo7nW%2FcZfWKasKjBsrW5oMN5AhIOs0ZCj69jeuGWu1QaaAcOxx%2B2%2BjsRebtajKHY6TFDJGNEHJpCwowJp%2FAs2Iuojmy97JX1fLZb%2BaEIZNQ%3D"}],"max_age":604800,"group":"cf-nel"}
content-type: application/javascript
cache-control: public, max-age=604800
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 63195758aacbdfcf-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eb6d0000dfcfbe93a000000001

GET
H2 200 ezcl.webp Show response
www.reisekostenabrechnung.com/utilcave_com/inc/ 1 KB
963 B 31ms
25ms Script
application/javascript 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/utilcave_com/inc/ezcl.webp?cb=4
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1c5ad2fd42dffdf04a0f1d757c1cccb4d840218d7ecada79d6cc9db33ca40319

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 10019
x-middleton-display: staticcontent_sol, staticcontent_sol
x-sol: middleton
cf-request-id: 08e3b4eb70000005f163a35000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,Origin
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=N0gxkQzjChCcaYcjSQgXV5Vw%2F5dMN%2BwVj%2BX03n%2BfS7WzeBr1EAqemuLRwT96i2tanZETgZSvtpLG1wI%2BrDlZx2QGwnicroSNBZ8UHO%2B6xZ6xEESCsneQ%2Fv1oR2zwOQTgvPbZu8%2BQIBJurg%3D%3D"}],"group":"cf-nel"}
content-type: application/javascript
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: max-age=86400
cf-ray: 63195758ae8c05f1-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 default.png
www.reisekostenabrechnung.com/wp-content/plugins/shortcodes-ultimate/includes/images/swiper/ 1 KB
2 KB 9ms
9ms Image
image/png 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.reisekostenabrechnung.com/wp-content/plugins/shortcodes-ultimate/includes/images/swiper/default.png
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/b53f34c75ed223f448abdd796c3eb906.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2597098b7399a8cfcd439b9af387be361db498438b90fb788b1c07177b28b52

Request headers

Referer: https://www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/b53f34c75ed223f448abdd796c3eb906.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 404775
x-ezoic-cdn: Hit ds;mm;5f974ef0f5b09d6e3afd800468abe601;2-129856-0;26ec0a3c-758f-44b5-6fcb-d38be6b26f1a
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 1340
cf-request-id: 08e3b4ec4f000005f163a43000000001
response: 200
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
etag: "53c-5b3fb6766bfc4-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding,User-Agent,Origin
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=48jFTtw6P4%2BhPN9O31BQweafolffR5sjkEHcu%2BL7%2FPgcCmE0z0zrqQCJgalFMsG32r8zbqAEknp5Ry6UQC8eojyxNYZE3%2FgDHhpOcQGTEj9v0A7ddcfD9ptgnyqUrNu6%2FrElrIlDPxcZmg%3D%3D"}],"group":"cf-nel"}
content-type: image/png
cache-control: max-age=691200
accept-ranges: bytes
cf-ray: 6319575a188c05f1-FRA
display: staticcontent_sol, staticcontent_sol

GET
H2 200 forkawesome-webfont.woff2
www.reisekostenabrechnung.com/wp-content/plugins/shortcodes-ultimate/includes/fonts/fork-awesome/ 88 KB
89 KB 78ms
77ms Font
font/woff2 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/wp-content/plugins/shortcodes-ultimate/includes/fonts/fork-awesome/forkawesome-webfont.woff2?v=1.0.11
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/b53f34c75ed223f448abdd796c3eb906.css
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec8604d4eade6552031ca2e8d3af9b3a1393bdc11b39dcb8176c41f4e5fb678c

Request headers

Origin: https://www.reisekostenabrechnung.com
Referer: https://www.reisekostenabrechnung.com/wp-content/uploads/hummingbird-assets/b53f34c75ed223f448abdd796c3eb906.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
vary: Accept-Encoding, Accept-Encoding,Origin
cf-cache-status: EXPIRED
nel: {"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol, staticcontent_sol
x-middleton-display: staticcontent_sol, staticcontent_sol
x-middleton-response: 200
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4ec50000005f126b38000000001
response: 200
last-modified: Fri, 12 Mar 2021 17:56:24 GMT
server: cloudflare
etag: W/"16134-5b3fb67664a94-gzip-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 1728000
access-control-allow-methods: POST, GET, OPTIONS
content-type: font/woff2
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: max-age=0
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=XOF8GZBrXOCshVsC9VJmaMTljV7mEgQmJH9tQk2LpodifEWJYZ%2FOEQ55XQKP5jMU2jucv%2BJD5sjqKERM0Qfelnu6pxYigoaxRR4Cv%2ByYqvWu2Frh2gk8Y9Y6qMlgKfbFgTDbch6d4kQeDA%3D%3D"}],"group":"cf-nel"}
cf-ray: 6319575a188f05f1-FRA
expires: Wed, 17 Mar 2021 21:33:43 GMT

GET
H2 200 rochester.js Show response
www.reisekostenabrechnung.com/detroitchicago/ 3 KB
1 KB 13ms
12ms Script
application/javascript 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/rochester.js?gcb=192-2&cb=4
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: aba387bcb56de1503c6196d03295b70469425af39b649cf05b38b6949e8456c2

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 502716
cf-ray: 6319575a58e905f1-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4ec78000005f1fb87d000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=HrxIdjkRYxbUJnVWHwOIZIEmL5SeNxO9KRNPaYYyO%2BbC9BmGdNTiMfiqrYPih2MuuJ4XWrzJwYLyAfbpVnZTPKiNhLc6GBs678UYqQO7kypX77PB2y0w3Eu4AUI10gj%2Bpaz%2BHkmAIBzNGw%3D%3D"}],"group":"cf-nel"}
content-type: application/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 houston.js Show response
www.reisekostenabrechnung.com/detroitchicago/ 3 KB
1 KB 11ms
10ms Script
application/javascript 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/houston.js?gcb=2&cb=36
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 08375cebca0d36f2fa3ec9e027a974146af7161553e4319a418d4cee6b38bed7

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 1711800
cf-ray: 6319575a996905f1-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4ec9f000005f126b3d000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=pWLSxhjsmC3HDe2zqaSBoLuMtGczZ4IF6h9U14RnBYW7zhOH7broOk1maqq%2BZxLQ8vjUDUzKZ4YQO3GYVKRsm5Fdb1PJMxIYXwotZEQcBB%2FLJv0HAHO3MrZTFN0y5cUNrZyZj7halQp8RQ%3D%3D"}],"group":"cf-nel"}
content-type: application/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 greenoaks.gif Show response
www.reisekostenabrechnung.com/detroitchicago/ 0
425 B 17ms
16ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJkYXRhIjpbeyJuYW1lIjoiZXh0X3VzZXJfaGFzaCIsInZhbCI6InVuZGVmaW5lZCJ9XX1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4eca1000005f1fb881000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=RMc0CcRRnkEyudgFti%2FmYDhYqe07ZXMNL6YT29%2FauyLFV6%2B0Tl%2Bz4aDuYUEZ0lb5bVBfAaxVGc0YwR4U%2FvBX2e6OXPy99lANhxTkdpzk5d87DCNwCH%2BMmPsFv72yG81nbdmpIHFwIvudpQ%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319575a996d05f1-FRA
expires: Tue, 16 Mar 2021 21:33:43 UTC

GET
H2 200 anchorfix.js Show response
www.reisekostenabrechnung.com/ezoic/ 879 B
725 B 11ms
11ms Script
application/javascript 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/ezoic/anchorfix.js?cb=192-2
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 15f0626dd31e3e991a1c21d6304f2e370b92b3c91650de3d7ed8a38f1159a457

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 2553941
cf-ray: 6319575a997105f1-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eca2000005f105b56000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=O1NTPVEgdD8Bd1%2FWFDyISMO%2FOESucH2IIT1wH3OsJf0J9MLAsAU%2FXcBkHOdRL2FF23es%2F0HGx1m0v4o36r5h4m%2Fei%2FoWRelkF9liCQj%2BRuMdP937jqP0sm0srtVylTPGBhP%2F2GCbCyEYCg%3D%3D"}],"group":"cf-nel"}
content-type: application/javascript
cache-control: max-age=31536000
x-robots-tag: noindex, noindex
expires: Wed, 16 Feb 2022 08:08:02 GMT

GET
H2 200 edmonton.webp Show response
www.reisekostenabrechnung.com/detroitchicago/ 13 KB
4 KB 11ms
10ms Script
application/javascript 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/edmonton.webp?a=a&cb=192-2&shcb=34
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d798d8773831f64f1228bc59f6dc361eae9b0811b1cbce20d639a8695b1d118c

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3517433
cf-polished: origSize=13962
cf-ray: 6319575a997405f1-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eca3000005f162108000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2FWIl2Jxd60hY1fQHJaN5COj91ABtgsrj5h%2FOFK2FrBWl%2BU3EdTakCkY6z86neJ4dPIo4VpMco8kg%2BMQO6gCcIe4xZy2LZtwXH%2B1tScD%2FOoYNic8HdTtp0bn3rutKWawLudmxd0k3EwbmBQ%3D%3D"}],"group":"cf-nel"}
content-type: application/javascript
cache-control: max-age=31536000
x-robots-tag: noindex

GET
H2 200 jellyfish.webp Show response
www.reisekostenabrechnung.com/porpoiseant/ 40 KB
9 KB 12ms
12ms Script
application/javascript 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/jellyfish.webp?a=a&cb=192-2&shcb=34
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 37d4ae593a1268d4afce8c38f61ea933982184d2d6055300c2bfdb8ca28c2846

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3517434
cf-polished: origSize=59534
cf-ray: 6319575a997705f1-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eca4000005f1000d9000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=LzyFV3Q2E72rxppXZ4T%2F3vWu5EpvoV4qpE0J0f5GnbnRDbBhSRbAPNzo87JpeYqHzWKN54BUHz%2B%2F5HiGmDoAKceSTDGaTvBIFqMq%2F6XWXATFwZFq%2FO3%2FZtDUibI%2Bja6eh7oj80x92sfXnA%3D%3D"}],"group":"cf-nel"}
content-type: application/javascript
cache-control: max-age=31536000
x-robots-tag: noindex

GET
H2 200 vitals.js Show response
www.reisekostenabrechnung.com/tardisrocinante/ 5 KB
2 KB 15ms
15ms Script
application/javascript 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/tardisrocinante/vitals.js?gcb=2&cb=3
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 26b4485584314aa0850427462143a6a28b66c982db28deb42766214fad7744c7

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 3805398
cf-ray: 6319575aa97805f1-FRA
x-middleton-display: sol-js
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4eca7000005f13a9fa000000001
cf-bgj: minify
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=71aytTAFoHatgdWn2zJwOmowKmUzBAiZV%2BTHd1REj3TNbzy%2BPrwqxahdnMGujLS3UP28uSpdk7VSOaDD5hVNSgvqLMc7j42h6w6RzBT9vn65S7WQgVWdIg%2F85JFWVwAZ7IOBFi5HNG3IEg%3D%3D"}],"group":"cf-nel"}
content-type: application/javascript
cache-control: max-age=31536000, public
x-robots-tag: noindex

GET
H2 200 style.css
g.ezodn.com/cmp/ 13 KB
2 KB 21ms
20ms Stylesheet
text/css 2606:4700:e4::ac40:a708
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezodn.com/cmp/style.css?domainId=129856&version=0&cv=5fa624ffffff000000
Requested by: Host: ezodn.com
URL: https://ezodn.com/cmp/altconsent.js?v=8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:e4::ac40:a708 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 657df3443b334f17bd33ac827932e2395ddc2d5a28b697c91e21fc8fabebf8e7

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Fri, 05 Mar 2021 15:39:56 GMT
server: cloudflare
age: 127721
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4u3n7yKpjFNlaLhkas8%2F2H6UpcRf%2BUELMetwKyu4Di%2FEH%2F9ZDCtsEyzyspdBk9wIpQyFmFGyvA8nw4lP%2BVq4LS15aBiCZrQX6dur7XsrroO0zyy6rzuSvQ%3D%3D"}],"max_age":604800,"group":"cf-nel"}
content-type: text/css; charset=utf-8
cache-control: public, max-age=604800
nel: {"report_to":"cf-nel","max_age":604800}
cf-ray: 6319575adcfbdfcf-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4ecc60000dfcf4b962000000001

GET
H2 200 nmash.js
www.reisekostenabrechnung.com/porpoiseant/ 33 KB
9 KB 12ms
12ms Other
application/javascript 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/nmash.js?v=13
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e03a7aaf1268afc2377a1c4d36959d7213380c40527ac50ccca39b8c16ce610

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 664560
cf-polished: origSize=34155
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id: 08e3b4ecdd000005f13a9fe000000001
x-robots-tag: noindex
last-modified: Wed, 10 Mar 2021 03:20:43 GMT
server: cloudflare
etag: W/"856b-5bd2626f3c490;5bccbe55ccb00-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=1J4buLK6yMtGo4d8zrPRCGY9ZOu3eFWEJwVL9VwK9TKVcsIWBKD8VaOgwDJ3iBD5YpmcRFz3hkt0WRj2yCqhMmf0wAWquc3J4iP1T67jExVrt12uQdrgWahNRUuWZYtMeTJeZCmrcQhtbQ%3D%3D"}],"group":"cf-nel"}
content-type: application/javascript
cache-control: max-age=31536000, public
cf-ray: 6319575af9fd05f1-FRA
cf-bgj: minify

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 46 KB
19 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-2827868-10

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 05 Feb 2021 21:33:27 GMT
server: Golfe2
age: 5468
date: Wed, 17 Mar 2021 20:02:35 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18980
expires: Wed, 17 Mar 2021 22:02:35 GMT

GET
H3-Q050 200 pubads_impl_2021031101.js Show response
securepubads.g.doubleclick.net/gpt/ 284 KB
100 KB 89ms
48ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

sffe /

Resource Hash

801b78af2ab57cfc67d37f8137feac63f1b722b8812dea418b43759e9baddef8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 11 Mar 2021 19:23:32 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, immutable, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 102217
x-xss-protection: 0
expires: Wed, 17 Mar 2021 21:33:43 GMT

GET
H2 200 bid Show response
c.amazon-adsystem.com/e/dtb/ 23 B
381 B 95ms
94ms XHR
text/javascript 13.226.158.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&pid=hW70RJeYAPu9C&cb=0&ws=1600x1200&v=7.60.00&t=2000&slots=%5B%7B%22sd%22%3A%220%22%2C%22s%22%3A%5B%22970x90%22%2C%22728x90%22%5D%2C%22sn%22%3A%22%2F21732118914%2Freisekostenabrechnung_com-medrectangle-2%22%7D%2C%7B%22sd%22%3A%221%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F21732118914%2Freisekostenabrechnung_com-box-2%22%7D%2C%7B%22sd%22%3A%222%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F21732118914%2Freisekostenabrechnung_com-box-2%22%7D%2C%7B%22sd%22%3A%223%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F21732118914%2Freisekostenabrechnung_com-box-2%22%7D%2C%7B%22sd%22%3A%224%22%2C%22s%22%3A%5B%22300x250%22%5D%2C%22sn%22%3A%22%2F21732118914%2Freisekostenabrechnung_com-box-2%22%7D%2C%7B%22sd%22%3A%225%22%2C%22s%22%3A%5B%22336x280%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F21732118914%2Freisekostenabrechnung_com-large-leaderboard-1%22%7D%2C%7B%22sd%22%3A%226%22%2C%22s%22%3A%5B%22970x250%22%2C%22970x90%22%2C%22728x90%22%5D%2C%22sn%22%3A%22%2F21732118914%2Freisekostenabrechnung_com-large-mobile-banner-1%22%7D%2C%7B%22sd%22%3A%227%22%2C%22s%22%3A%5B%22336x280%22%2C%22300x250%22%5D%2C%22sn%22%3A%22%2F21732118914%2Freisekostenabrechnung_com-medrectangle-1%22%7D%5D&cfgv=0&schain=1.0%2C1!ezoic.ai%2C5342729130004cc7c4d61cf871f86247%2C1%2C%2C%2C&pubid=aa05931b-5308-4ea3-95a2-adf84f4ffde4&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.158.204 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-158-204.dus51.r.cloudfront.net
Software: Server /
Resource Hash: 745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
via: 1.1 e5dcf90f3787d486ad40e46070021460.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: DUS51-C1
vary: User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: WQkM9L-xHKqTwalG9PFlop2QN1X0WTZjxgkMuwosavzjtMhdKba2DQ==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 122ms
43ms XHR
application/javascript 13.226.158.204
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.158.204 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-158-204.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id: Z_m26sDjicOoQtCCmuJEtOsMPnFQWWIm
content-encoding: gzip
etag: W/"a4d296427fc806b21335359e398c025c"
age: 69830
x-cache: Hit from cloudfront
access-control-max-age: 3000
access-control-allow-origin: *
last-modified: Sat, 06 Mar 2021 01:32:40 GMT
server: AmazonS3
date: Wed, 17 Mar 2021 02:09:54 GMT
vary: Origin
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 cfe78f21e6a560afb18f3b92eb4e9605.cloudfront.net (CloudFront)
cache-control: public, max-age=86400
x-amz-cf-pop: DUS51-C1
x-amz-cf-id: 3F4dFj4n9-6547bMqSM-NUSvWqD8YaXT4vcMFo9FaRNwZRXaPXXpyQ==

GET
H2 200 imp.gif Show response
www.reisekostenabrechnung.com/detroitchicago/ 43 B
402 B 20ms
20ms XHR
image/gif 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A2%2C%22ad_count_adjustment%22%3A1%2C%22ad_lazyload_version%22%3A5%2C%22ad_location_ids%22%3A%225%2C1%2C1%2C1%2C1%2C35%2C711%2C4%22%2C%22ad_transform_level%22%3A0%2C%22adx_ad_count%22%3A8%2C%22bidder_method%22%3A1%2C%22bidder_version%22%3A1%2C%22city%22%3A%22%22%2C%22country%22%3A%22DE%22%2C%22days_since_last_visit%22%3A-1%2C%22display_ad_count%22%3A4%2C%22domain_id%22%3A129856%2C%22domain_test_group%22%3A20200401%2C%22ds_adsize_opt_id%22%3A-1%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A0%2C%22ezcache_skip_code%22%3A0%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22has_bad_image%22%3A0%2C%22has_bad_words%22%3A0%2C%22iab_category%22%3A%22%22%2C%22iab_category_0%22%3A%22653%22%2C%22is_from_recommended_pages%22%3Afalse%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A0%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22max_ads%22%3A3%2C%22metro_code%22%3A0%2C%22optimization_version%22%3A1%2C%22page_ad_positions%22%3A%221100%2C1103%2C1103%2C1103%2C1103%2C1109%2C1123%2C1124%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%2295c6c84d-396a-459c-4e43-749b3a31ac19%22%2C%22position_selection_id%22%3A39%2C%22postal_code%22%3A%22%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A98867%2C%22response_time_orig%22%3A193%2C%22serverid%22%3A%223.122.114.182%3A8564%22%2C%22state%22%3A%22%22%2C%22sub_page_ad_positions%22%3A%221100%2C1103%2C1103%2C1103%2C1103%2C1109%2C1123%2C1124%22%2C%22t_epoch%22%3A1616016822%2C%22template_id%22%3A134%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Fwww.reisekostenabrechnung.com%2F%22%2C%22user_id%22%3A0%2C%22weather_precipitation%22%3A0%2C%22weather_summary%22%3A%22%22%2C%22weather_temperature%22%3A0%2C%22word_count%22%3A836%2C%22worst_bad_word_level%22%3A0%7D
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=aKMLtRAaD23e8fHsXMDJfUgM%2FhmmMo%2FIanYzbZ34Yo1S2yU%2BaQYv3orBylruwg%2BUxFivlppK4voh%2FW91iTl%2BMzrNw5SA7Llq1VgohHcq77crbhVNDcqr%2BfdXNG9QTRXNlSn6hwqQ0qBvmw%3D%3D"}],"group":"cf-nel"}
content-type: image/gif
x-middleton-display: imp_sol
cache-control: no-cache, no-store, must-revalidate, max-age=0
accept-ranges: bytes
cf-ray: 6319575b7aa905f1-FRA
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
cf-request-id: 08e3b4ed2a000005f171a01000000001

GET
H2 200 greenoaks.gif Show response
www.reisekostenabrechnung.com/detroitchicago/ 0
285 B 33ms
32ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJkYXRhIjpbeyJuYW1lIjoiZGV2aWNlX3dpZHRoIiwidmFsIjoiMTYwMCJ9LHsibmFtZSI6ImRldmljZV9oZWlnaHQiLCJ2YWwiOiIxMjAwIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDMtMTcifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIyMiJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIzIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii02MCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInRfZXBvY2giOjE2MTYwMTY4MjIsImRhdGEiOlt7Im5hbWUiOiJsYW5ndWFnZV90YWciLCJ2YWwiOiJlbi1VUyJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInRfZXBvY2giOjE2MTYwMTY4MjIsImRhdGEiOlt7Im5hbWUiOiJsYW5ndWFnZV9wcmltYXJ5X3N1YnRhZyIsInZhbCI6ImVuIn1dfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4ed37000005f16b16f000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=b6ljJXby1y8OQzY2SmEWLDa0z9msR9LdWCFooaQppv1F%2ByXpauOSbIYS9cKbimRhratbgy%2Fcmkxfh9H2CzxJgqT3yW%2FL%2Fj2FeQ0ppkVeTvNhdaI6nSIIExE2lGQnba2tIdgvLTx0oUNG6A%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319575b8ac905f1-FRA
expires: Tue, 16 Mar 2021 21:33:43 UTC

POST
H3-Q050 200 collect Show response
www.google-analytics.com/j/ 1 B
75 B 13ms
12ms XHR
text/plain 2a00:1450:4001:800::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j88&aip=1&a=414760384&t=pageview&_s=1&dl=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&ul=en-us&de=UTF-8&dt=Reisekostenabrechnung%202020%20%E2%87%92%20Infos%2C%20Vorlagen%2C%20Tipps%20f%C3%BCr%20Arbeitnehmer&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAUABAAAAAC~&jid=1825128560&gjid=102851301&cid=984434283.1616016824&tid=UA-2827868-10&_gid=1109861681.1616016824&_r=1&gtm=2ou3a0&z=2116069502

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:800::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.fr/adsid/ 107 B
799 B 35ms
15ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.fr/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
313 B 15ms
15ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 2 KB
337 B 760ms
760ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3033921947969389&correlator=3535626334303075&output=ldjh&impl=fifs&eid=31060312%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1%2C%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C330x340%7C310x360%2C300x250%7C350x320%7C330x340%7C310x360%2C300x250%7C350x320%7C330x340%7C310x360%2C300x250%7C350x320%7C330x340%7C310x360&prev_scp=a%3D%257C251%257C%26iid14%3D1343379%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1343379%26eb_br%3D588553dcabeb5286f2bd86e6617a0d98%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D44%26br2%3D160%26ezoic%3D1%26nmau%3D4%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%26ax_ssid%3D10082%7Ca%3D%257C254%257C%26iid14%3D1343379%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1343379%26eb_br%3D588553dcabeb5286f2bd86e6617a0d98%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D44%26br2%3D160%26ezoic%3D1%26nmau%3D4%26mau%3D1%26stl%3D34%2C0%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%26ax_ssid%3D10082%7Ca%3D%257C1%257C%26iid14%3D1343379%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1343379%26eb_br%3D588553dcabeb5286f2bd86e6617a0d98%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D44%26br2%3D160%26ezoic%3D1%26nmau%3D4%26mau%3D2%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%26ax_ssid%3D10082%7Ca%3D%257C5%257C%26iid14%3D1343379%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1343379%26eb_br%3D588553dcabeb5286f2bd86e6617a0d98%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D44%26br2%3D160%26ezoic%3D1%26nmau%3D4%26mau%3D3%26stl%3D84%2C152%2C194%2C27%2C94%2C122%2C91%2C20%2C26%2C201%2C187%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%26ax_ssid%3D10082&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1616016823&dt=1616016823760&dlt=1616016823096&idt=605&frm=20&biw=1600&bih=1200&oid=2&adxs=348%2C348%2C348%2C348&adys=140%2C402%2C664%2C926&adks=3475385815%2C3971918858%2C3971918857%2C3971918856&ucis=1%7C2%7C3%7C4&ifi=1&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262%7C300x262%7C300x262%7C300x262&msz=300x262%7C300x262%7C300x262%7C300x262&ga_vid=984434283.1616016824&ga_sid=1616016824&ga_hid=414760384&ga_fc=false&fws=4%2C4%2C4%2C4&ohw=904%2C904%2C904%2C904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

b89903edd56119100b9399dc21d347244373ce36f56c78c399d2672a6fdef78c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:44 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2,-2,-2,-2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 270
x-xss-protection: 0
google-lineitem-id: -2,-2,-2,-2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2,-2,-2,-2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html
56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/ 0
0 28ms
13ms Other
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-37/html/ 0
0 29ms
9ms Other
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-37/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 490 B
754 B 523ms
522ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3033921947969389&correlator=2504146566623105&output=ldjh&impl=fifs&eid=31060312%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90%7C350x320%7C390x330%7C410x330&prev_scp=a%3D%257C2%257C%26iid15%3D1409379%26iit%3D9%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreisekostenabrechnung_com-medrectangle-2-1409379%26eb_br%3D24b380adcc0659544af3c796e2648643%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D400%26br2%3D200%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%26ax_ssid%3D10082&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1616016823&dt=1616016823768&dlt=1616016823096&idt=605&frm=20&biw=1600&bih=1200&oid=2&adxs=315&adys=1103&adks=560436320&ucis=5&ifi=5&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&ga_vid=984434283.1616016824&ga_sid=1616016824&ga_hid=414760384&ga_fc=false&fws=512&ohw=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

aa722b5fb4aa7ac814df29a55b56788dfc54ed17133f0a8c616f3ed1b57706cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:44 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 254
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 greenoaks.gif Show response
www.reisekostenabrechnung.com/detroitchicago/ 0
480 B 25ms
23ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJkYXRhIjpbeyJuYW1lIjoibmF2aWdhdGlvbl90eXBlIiwidmFsIjoiMCJ9LHsibmFtZSI6InJlZGlyZWN0X2NvdW50IiwidmFsIjoiMCJ9XX0seyJ0eXBlIjoicGFnZXZpZXciLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInRfZXBvY2giOjE2MTYwMTY4MjIsImRhdGEiOlt7Im5hbWUiOiJwZXJmX2lzX3RyYWNrZWQiLCJ2YWwiOiIxIn0seyJuYW1lIjoicGVyZl9uYXZfdG9fY29ubmVjdCIsInZhbCI6IjQwMiJ9LHsibmFtZSI6InBlcmZfY29ubmVjdF90b19yZXNwX3N0YXJ0IiwidmFsIjoiNzkwIn0seyJuYW1lIjoicGVyZl9yZXNwX3RpbWUiLCJ2YWwiOiIxMSJ9LHsibmFtZSI6InBlcmZfaW50ZXJhY3RpdmUiLCJ2YWwiOiIzODQifSx7Im5hbWUiOiJwZXJmX2NvbnRlbnRsb2FkZWQiLCJ2YWwiOiI0MTAifSx7Im5hbWUiOiJwZXJmX2NvbXBsZXRlIiwidmFsIjoiNjg0In1dfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4edf1000005f15696f000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=rwtH4t%2BQAm0hu3TPlQJDx1%2Bq4q5UThX3yV72yVKLPkGzZMH6mbpinOA1Ae9sPPfd1AjPEg%2B4RppEIaiNS39FHxdGZghReULqE4jtNDIshHIHuPcu9pObC6V7HLNxybzKQO3LyVTvfZjUIQ%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319575cbc8805f1-FRA
expires: Tue, 16 Mar 2021 21:33:43 UTC

GET
H2 200 greenoaks.gif Show response
www.reisekostenabrechnung.com/detroitchicago/ 0
283 B 21ms
20ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJkYXRhIjpbeyJuYW1lIjoiZmlyc3RfcGFpbnQiLCJ2YWwiOiI5MDgifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJkYXRhIjpbeyJuYW1lIjoiZmlyc3RfY29udGVudGZ1bF9wYWludCIsInZhbCI6IjkwOCJ9XX1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4edf2000005f16aace000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=BOc6Hwh27vRk5%2BU135ePmL3joL3tBN92cXfRoBGM7eWVa6hqeIu%2FFrt5Z0tqn6hZECM0LZ5CLb4jR8Zs3ith8b%2BWrhcIP8dGdWunbVStiqE1usUZtuIaLYsiFVE6EivZGooQPJxP148fZA%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319575cbc8905f1-FRA
expires: Tue, 16 Mar 2021 21:33:43 UTC

GET
H2 200 greenoaks.gif Show response
www.reisekostenabrechnung.com/detroitchicago/ 0
415 B 22ms
21ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9lZmZlY3RpdmVfdHlwZSIsInZhbCI6IjRnIn1dfSx7InR5cGUiOiJwYWdldmlldyIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiZGF0YSI6W3sibmFtZSI6ImNvbm5lY3Rpb25fZG93bmxpbmsiLCJ2YWwiOiI5LjYifV19LHsidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJkYXRhIjpbeyJuYW1lIjoiY29ubmVjdGlvbl9ydHQiLCJ2YWwiOiIwIn1dfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:43 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4edf2000005f112349000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Xat5GNCt2etX1OIcyY8hZuY491yzRLjyEG0kBEAhkevSe8A%2FWivfO9eGWxb8Xq%2BX2Mg55wmr4bXBwUoE8VvlQNZ4xh2Ugd5LUASbTSO5ha0uBQvdavNuRJUIN44wa8KpCISFfcuDIbpJtQ%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319575cbc8a05f1-FRA
expires: Tue, 16 Mar 2021 21:33:43 UTC

GET
H2 200 greenoaks.gif Show response
www.reisekostenabrechnung.com/detroitchicago/ 0
338 B 20ms
20ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfcmVxdWVzdCIsInZhbCI6IjExOTUifV19XQ==
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:44 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4efed000005f14022b000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=b3%2FVaAzLwxaHhTQb9I%2FPzcYDwmPuxfutulIhfGl8pfYFka%2FF85HZflyBdLWQrxiNs6YpDT%2BZfSjZb%2BxZqoA%2FsTOkicQh9O9KFHPOQXVh6Wrgeag0VISuETBpEVH3ZUfhxBrgDUjE%2BSM2Xw%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319575fe91f05f1-FRA
expires: Tue, 16 Mar 2021 21:33:44 UTC

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 8 KB
7 KB 38ms
17ms XHR
application/json 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021031101&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d7576d49fa9e896aa6c50a5a9278ac6c37b1367320292fc34d1a90b50da2e5b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6523
x-xss-protection: 0

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 40ms
39ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d9cebb89ed3e16a74386f743f3fc12fe98cb4fc5c11f03af5febdf1141ca6a39

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1611170586013198"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6403
x-xss-protection: 0
expires: Wed, 17 Mar 2021 21:33:44 GMT

GET
H3-Q050 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/221/ Frame 6BF0 12 KB
5 KB 35ms
20ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

49e1dcef611a905b866974d135554059ecd77a0ae022553178ec359ea0b64504

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/sodar2/221/runner.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.reisekostenabrechnung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.reisekostenabrechnung.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
content-length: 4984
date: Wed, 17 Mar 2021 18:26:59 GMT
expires: Thu, 17 Mar 2022 18:26:59 GMT
last-modified: Tue, 08 Dec 2020 21:41:15 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 11205
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 qcWZRcRw4fq915xPB9DSJSeGn7Tspit4rZWzDhmsliY.js Show response
pagead2.googlesyndication.com/bg/ Frame 6BF0 14 KB
6 KB 34ms
20ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/qcWZRcRw4fq915xPB9DSJSeGn7Tspit4rZWzDhmsliY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/221/runner.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9c59945c470e1fabdd79c4f07d0d22527869fb4eca62b78ad95b30e19ac9626

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 16:22:53 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 13:45:00 GMT
server: sffe
age: 105051
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5666
x-xss-protection: 0
expires: Wed, 16 Mar 2022 16:22:53 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
224 B 39ms
39ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=221&t=2&li=gpt_2021031101&jk=3033921947969389&bg=!3t2l3ZnNAAbUo7L91KM7ACkAdvg8Wpv8Wmgg5S1wM_A7N7YBd6JiKOb9Qc4-ysWQDnMCWgXGprjwVAIAAAB7UgAAAAxoAQcKAKjlPxOQDGjmPYBL0edS_k3XFGo3oNmOb7OJcl-EQQOmolxjQisY57arlOmVPQ_aFzk40m5CMoeFb2wJN7Yx8jnxoqcDszb6SlL4zV5eWWokZi8TXp2irWnM6X5oSdZLD3TpDQeKSbKgXrd8wfZ33RIyEfRst2Z0gtbwjFs8tdGPjmTZGEEXeQVhJJaJcDIP5ugQIi1ryffrqAjdbAqcnJwj4THv-Gpx8uuZAeX7VwnFFdfYlxTu1Qcoi5vJPk0mUodZ2-gOpK6ehlz-mxeqnGZnMUZNEcyXk7lyCKXtfdG-LyF54uTn0TJENojkfkp2x_XA0W5HjFfChmR6FYFQULndJg5IVozkbLA86fRTDzw2c5ovYIK9oG28hKpv6IOmhtNasr23MQYIvm22YDWQLCVl52dZpHkJfaID6XoFQnEccAr6jnoPeS9wZzA1RW0YISvivCYrqwwzDlmxS-7XAPD1HpYrAa8aQ8iLBUelnQ09jDywSoXuGy5SVEugs6-9p4qgD1oZt4kFQMEpOsud8UWleyG7q6wWS2d54tYVOG_sxbPfxLE8Rmx5PfJzasF6UTZUrcQbmBukXMo5VVLvrXsF7SF29Ha4BoIi2dJHU7UbBHYWapWzCAmGMztCXktCkvtLnRyLl-OVxp0rRdKRlig1HNnkG9AubZnCIwcU3r6YGZFjd0O0nvCIA52tLNiCGIbH7EqNsJGrO-IzRSJW807uFIqjUXP-se5SvET5b8GGxIB1GTgHbrVHPkioWhUF5Gh1Nlr1lFBbIOQjNzz4ozv6xFTS9NRrgP0KQks8toI3lZ931FJBkoWsSFdHxKqvHH7hjgsO-ozEqWIdEh5XjEslv3moHDMNQzpspPUU5vhLSA

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 integrator.js Show response
adservice.google.fr/adsid/ 107 B
165 B 15ms
15ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.fr/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 14ms
14ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 482 B
424 B 343ms
343ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3033921947969389&correlator=320002035347960&output=ldjh&impl=fifs&eid=31060312%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C330x340%7C310x360&ris=3&rcs=1&prev_scp=a%3D%257C5%257C%26iid14%3D1343379%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1343379%26eb_br%3Deeb512de4b40f938fd78cdef344a7ebd%2C1e913e99b80640fd5b86a539e5b97c94%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D22%26br2%3D160%26ezoic%3D1%26nmau%3D4%26mau%3D3%26stl%3D84%2C152%2C194%2C27%2C94%2C122%2C91%2C20%2C26%2C201%2C187%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C18%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D44%26reqt%3D1616016827136&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1616016827&dt=1616016827174&dlt=1616016823096&idt=605&frm=20&biw=1600&bih=1200&oid=2&adxs=348&adys=926&adks=3971918856&ucis=6&ifi=6&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=984434283.1616016824&ga_sid=1616016824&ga_hid=414760384&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

43fe272ec1281bdced0ec26c62061faf66ed5615aae765a89eef6ed28ab1959c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:47 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 250
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 482 B
428 B 449ms
448ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3033921947969389&correlator=4066835807503344&output=ldjh&impl=fifs&eid=31060312%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C330x340%7C310x360&ris=3&rcs=1&prev_scp=a%3D%257C1%257C%26iid14%3D1343379%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1343379%26eb_br%3Deeb512de4b40f938fd78cdef344a7ebd%2C1e913e99b80640fd5b86a539e5b97c94%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D22%26br2%3D160%26ezoic%3D1%26nmau%3D4%26mau%3D2%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C18%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D44%26reqt%3D1616016827176&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1616016827&dt=1616016827178&dlt=1616016823096&idt=605&frm=20&biw=1600&bih=1200&oid=2&adxs=348&adys=664&adks=3971918857&ucis=7&ifi=7&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=984434283.1616016824&ga_sid=1616016824&ga_hid=414760384&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

6649958b1a60f4c559d05df4699238b3824338f5f24aacd94d7cb9c8aa53256a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:47 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 251
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 482 B
800 B 297ms
297ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3033921947969389&correlator=4400107985027718&output=ldjh&impl=fifs&eid=31060312%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C330x340%7C310x360&ris=3&rcs=1&prev_scp=a%3D%257C254%257C%26iid14%3D1343379%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1343379%26eb_br%3Deeb512de4b40f938fd78cdef344a7ebd%2C1e913e99b80640fd5b86a539e5b97c94%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D22%26br2%3D160%26ezoic%3D1%26nmau%3D4%26mau%3D1%26stl%3D34%2C0%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C18%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D44%26reqt%3D1616016827185&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1616016827&dt=1616016827186&dlt=1616016823096&idt=605&frm=20&biw=1600&bih=1200&oid=2&adxs=348&adys=402&adks=3971918858&ucis=8&ifi=8&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=984434283.1616016824&ga_sid=1616016824&ga_hid=414760384&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

32a6991dfe05f1f9f4cfd4a424dfeb221761d70fb219ee42150fe90de41a3c9f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:47 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 250
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 482 B
427 B 365ms
364ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3033921947969389&correlator=343163367044263&output=ldjh&impl=fifs&eid=31060312%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C330x340%7C310x360&ris=3&rcs=1&prev_scp=a%3D%257C251%257C%26iid14%3D1343379%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1343379%26eb_br%3Deeb512de4b40f938fd78cdef344a7ebd%2C1e913e99b80640fd5b86a539e5b97c94%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D22%26br2%3D160%26ezoic%3D1%26nmau%3D4%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C18%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D44%26reqt%3D1616016827189&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1616016827&dt=1616016827191&dlt=1616016823096&idt=605&frm=20&biw=1600&bih=1200&oid=2&adxs=348&adys=140&adks=3475385815&ucis=9&ifi=9&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=984434283.1616016824&ga_sid=1616016824&ga_hid=414760384&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

8969b7273c752efcffdbaa9fa9eef8cefcab328ede0bd72302693d6e9bdf319c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:47 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 249
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 490 B
429 B 402ms
402ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3033921947969389&correlator=2489980596504&output=ldjh&impl=fifs&eid=31060312%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90%7C350x320%7C390x330%7C410x330&ris=3&rcs=1&prev_scp=a%3D%257C2%257C%26iid15%3D1409379%26iit%3D9%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreisekostenabrechnung_com-medrectangle-2-1409379%26eb_br%3Dbb779436aa3533ea7e00abe462374b80%2C86802a923a1f32517e4c5d3b6d550271%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D200%26br2%3D200%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D400%26reqt%3D1616016827192&eri=1&cookie_enabled=1&bc=31&abxe=1&lmt=1616016827&dt=1616016827194&dlt=1616016823096&idt=605&frm=20&biw=1600&bih=1200&oid=2&adxs=315&adys=1103&adks=560436320&ucis=a&ifi=10&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=984434283.1616016824&ga_sid=1616016824&ga_hid=414760384&ga_fc=false&fws=512&ohw=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

7b16a81c8d220bd11bde8d34c34cbe5be38612e2b4fc1f58a82d7b8f23114611

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:47 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 252
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 integrator.js Show response
adservice.google.fr/adsid/ 107 B
777 B 43ms
28ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.fr/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
531 B 44ms
28ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 465 B
410 B 433ms
433ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3033921947969389&correlator=2203655238746776&output=ldjh&impl=fifs&eid=31060312%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C330x340%7C310x360&ris=1&rcs=2&prev_scp=a%3D%257C5%257C%26iid14%3D1343379%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1343379%26eb_br%3D5123967dad9631f0d2a57fa9c3237b87%2Ce29f69dd468d31a5514dc9b5587ce757%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D16%26br2%3D160%26ezoic%3D1%26nmau%3D4%26mau%3D3%26stl%3D84%2C152%2C194%2C27%2C94%2C122%2C91%2C20%2C26%2C201%2C187%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C18%2C19%2C20%2C17%2C18%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D22%26reqt%3D1616016827677&eri=1&cookie=ID%3D3378e19534576578-22b936b4d3ba00b1%3AT%3D1616016827%3AS%3DALNI_MYZ1v2KGm8bbG3YhMjyjIZzLWzYSw&bc=31&abxe=1&lmt=1616016827&dt=1616016827680&dlt=1616016823096&idt=605&frm=20&biw=1600&bih=1200&oid=2&adxs=348&adys=926&adks=3971918856&ucis=b&ifi=11&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=984434283.1616016824&ga_sid=1616016824&ga_hid=414760384&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

f10ee421996d2a7f3d0d160a3f1b1c2dc78e9d81a1fe0e319d494737fbe5dfea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 238
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 465 B
409 B 459ms
459ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3033921947969389&correlator=3880006180758957&output=ldjh&impl=fifs&eid=31060312%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C330x340%7C310x360&ris=1&rcs=2&prev_scp=a%3D%257C1%257C%26iid14%3D1343379%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1343379%26eb_br%3D5123967dad9631f0d2a57fa9c3237b87%2Ce29f69dd468d31a5514dc9b5587ce757%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D16%26br2%3D160%26ezoic%3D1%26nmau%3D4%26mau%3D2%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C18%2C19%2C20%2C17%2C18%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D22%26reqt%3D1616016827683&eri=1&cookie=ID%3D3378e19534576578-22b936b4d3ba00b1%3AT%3D1616016827%3AS%3DALNI_MYZ1v2KGm8bbG3YhMjyjIZzLWzYSw&bc=31&abxe=1&lmt=1616016827&dt=1616016827688&dlt=1616016823096&idt=605&frm=20&biw=1600&bih=1200&oid=2&adxs=348&adys=664&adks=3971918857&ucis=c&ifi=12&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=984434283.1616016824&ga_sid=1616016824&ga_hid=414760384&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

77690e448be45a574fb4a397faf4934ddd1fbcc36f3f76cb94416ee526e035df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 235
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 16 KB
9 KB 360ms
360ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3033921947969389&correlator=613908238923497&output=ldjh&impl=fifs&eid=31060312%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C330x340%7C310x360&ris=1&rcs=2&prev_scp=a%3D%257C254%257C%26iid14%3D1343379%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1343379%26eb_br%3D5123967dad9631f0d2a57fa9c3237b87%2Ce29f69dd468d31a5514dc9b5587ce757%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D16%26br2%3D160%26ezoic%3D1%26nmau%3D4%26mau%3D1%26stl%3D34%2C0%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C18%2C19%2C20%2C17%2C18%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D22%26reqt%3D1616016827696&eri=1&cookie=ID%3D3378e19534576578-22b936b4d3ba00b1%3AT%3D1616016827%3AS%3DALNI_MYZ1v2KGm8bbG3YhMjyjIZzLWzYSw&bc=31&abxe=1&lmt=1616016827&dt=1616016827699&dlt=1616016823096&idt=605&frm=20&biw=1600&bih=1200&oid=2&adxs=348&adys=402&adks=3971918858&ucis=d&ifi=13&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=984434283.1616016824&ga_sid=1616016824&ga_hid=414760384&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

9e12c1c950a6746bfde4cced285da0418086d6295dd388d7e471205b2c78e2e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9082
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
10 KB 486ms
486ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3033921947969389&correlator=2521935236508217&output=ldjh&impl=fifs&eid=31060312%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C330x340%7C310x360&ris=1&rcs=2&prev_scp=a%3D%257C251%257C%26iid14%3D1343379%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1343379%26eb_br%3D5123967dad9631f0d2a57fa9c3237b87%2Ce29f69dd468d31a5514dc9b5587ce757%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D16%26br2%3D160%26ezoic%3D1%26nmau%3D4%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C122%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C18%2C19%2C20%2C17%2C18%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D22%26reqt%3D1616016827703&eri=1&cookie=ID%3D3378e19534576578-22b936b4d3ba00b1%3AT%3D1616016827%3AS%3DALNI_MYZ1v2KGm8bbG3YhMjyjIZzLWzYSw&bc=31&abxe=1&lmt=1616016827&dt=1616016827705&dlt=1616016823096&idt=605&frm=20&biw=1600&bih=1200&oid=2&adxs=348&adys=140&adks=3475385815&ucis=e&ifi=14&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=984434283.1616016824&ga_sid=1616016824&ga_hid=414760384&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

ec9a3b5dc41c4ebdb43bbdcad3675562898fe4cbdfc55708f680586c8cee361f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9660
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 473 B
412 B 442ms
442ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3033921947969389&correlator=2895924832809821&output=ldjh&impl=fifs&eid=31060312%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90%7C350x320%7C390x330%7C410x330&ris=1&rcs=2&prev_scp=a%3D%257C2%257C%26iid15%3D1409379%26iit%3D9%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D3%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreisekostenabrechnung_com-medrectangle-2-1409379%26eb_br%3Dea7c242a89c8cb1608366a3d063fa70d%2C527e52c10635ac8136a4c84094ee49a8%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D70%26br2%3D200%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%2C17%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D200%26reqt%3D1616016827712&eri=1&cookie=ID%3D3378e19534576578-22b936b4d3ba00b1%3AT%3D1616016827%3AS%3DALNI_MYZ1v2KGm8bbG3YhMjyjIZzLWzYSw&bc=31&abxe=1&lmt=1616016827&dt=1616016827715&dlt=1616016823096&idt=605&frm=20&biw=1600&bih=1200&oid=2&adxs=315&adys=1103&adks=560436320&ucis=f&ifi=15&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=984434283.1616016824&ga_sid=1616016824&ga_hid=414760384&ga_fc=false&fws=512&ohw=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

29f413e714f523cdf2b9c97b6a27474779682b6da0abbbaf89972140f13eb741

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 241
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 7D46 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e86479d6e54449d1085c2149e190a615c6bead407b20bacbcf5852b5d65f1fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.reisekostenabrechnung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.reisekostenabrechnung.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2973
date: Wed, 17 Mar 2021 21:33:43 GMT
expires: Thu, 17 Mar 2022 21:33:43 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 5
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 73 KB
28 KB 38ms
18ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ca625f204331905abf3b4d86a89dfb9799c63771723b9b15c5b54c1f9fb2b83c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1615980824644616"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28204
x-xss-protection: 0
expires: Wed, 17 Mar 2021 21:33:48 GMT

GET
H2 200 greenoaks.gif Show response
www.reisekostenabrechnung.com/detroitchicago/ 0
292 B 23ms
22ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJkYXRhIjpbeyJuYW1lIjoidGltZXJfZmlyc3RfYWRfbG9hZCIsInZhbCI6IjQ5ODMifV19XQ==
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4feb8000005f10a867000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=VUu5Uc7C3Ii%2Fpz5DNRt69HG99grF%2BfAb7lM11Lv3WZxeL759Cpag%2FPmgQIq7dXUXkxhehJFot5MEBc1tXYH2cl6%2FR28UFMefW%2B2HbnPHDsnMrv7tMWbnBsvB6E%2FM27JIewQbw%2BLMs%2FWB3A%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957778d1205f1-FRA
expires: Tue, 16 Mar 2021 21:33:48 UTC

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
285 B 21ms
20ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8xIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiIzIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQzMzc5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wXzEiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiNTEyMzk2N2RhZDk2MzFmMGQyYTU3ZmE5YzMyMzdiODcsZTI5ZjY5ZGQ0NjhkMzFhNTUxNGRjOWI1NTg3Y2U3NTcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDMzNzkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTBfMSIsInRfZXBvY2giOjE2MTYwMTY4MjIsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDE2LCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAuMDAwMTYsImJpZF9mbG9vcl9wcmV2IjowLjAwMDIyLCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8xIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImNyZWF0aXZlX2lkIiwidmFsIjoiMTM4MjQxMTIzNTE3In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQzMzc5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wXzEiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiI0OTc0OTAyODMyIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4feba000005f12b188000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=2tTqKZIrYlbkTIZtaI6IIQMcu9D%2B3qNDTo1kaESE4VT%2BO8wwTOEuY2SWX55sUHdIU2q8NzoLXWIPuV2J3A7fBJAGXmvo4iLowal5w2ODbEM414lbikuIlttF4NLh0QeZx7bN1VXd6n6Ulw%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957778d1905f1-FRA
expires: Tue, 16 Mar 2021 21:33:48 UTC

GET
H2 200 4974902832 Show response
g.ezoic.net/dac/ 0
93 B 128ms
42ms XHR
text/plain 3.127.76.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/4974902832
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/porpoiseant/banger.js?cb=192-2&bv=13&v=46&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.127.76.126 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-76-126.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 17 Mar 2021 21:33:48 GMT
cache-control: max-age=3600, public
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
450 B 18ms
17ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8xIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDMtMTcifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIyMiJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIzIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii02MCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4feba000005f167a1b000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=M411OrClosMQ0%2BdxHAW6zgHf%2BTXedEpxVrRwwfKHY1nMXf8qtJPlD9VWX7qePhtjvbvNiUNy57WbLKwV5YyXZJ99V%2BQD75HagE%2FqAqj8VwS1xSktrgnjwkBB7zvw8mtBxI0hDojCv7PCqw%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957779d1b05f1-FRA
expires: Tue, 16 Mar 2021 21:33:48 UTC

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
285 B 20ms
19ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8xIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYXVjdGlvbl9lcG9jaCI6MTYxNjAxNjgyOCwiYWRfcG9zaXRpb24iOjExMDMsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJiaWRfZmxvb3JfaW5pdGlhbCI6NDQsImJpZF9mbG9vcl9wcmV2IjoyMiwiYmlkX2Zsb29yX2ZpbGxlZCI6MTYsImF1Y3Rpb25fY291bnQiOjMsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjM3NiwibXVsdGlfYWRfdW5pdCI6MSwibXVsdGlfYWRfY291bnQiOjQsIm5ldHdvcmtfY29kZSI6MjE3MzIxMTg5MTQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMn1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4febd000005f137a22000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=9zazxNyy0yJuUotzOJ1j1dxiK5PFmrbB2ywkPUx2waSU8erjBp6zG9dpxxElUzMuJHGjk7a6l1NH9fkjzsWWZ%2FcCwqmj5HzMntCki96vx4Mhua4JbXYUUTtGI95N%2FEOeWt6e1XygK8zhLQ%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957779d2005f1-FRA
expires: Tue, 16 Mar 2021 21:33:48 UTC

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 6BF5 510 B
329 B 17ms
16ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CM-nKBD9yigYrdL3bjAB&v=APEucNXZgYGtvUEM0w_LbVe0mPp0Xk4wuorvtXEKFXLhPCx2TY4OCJQYQ-7XvjvAQeKNx10mVD-c8JMm-NNJapdkFPOSJCsPLasWhatLNOQzEwnLFoPCOvmbKt9mVGuSEY7q5EU_9DyaEtzV3kXdOVgfdl0qWqu9P0ZVnAcbqcmHwJ6EXrowY_XV1q3LRrL9ISdzkx6O7to265rVVnDCfWRKXi4JwBeGv7Hb90KUIlTerzGYL89Srns

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ec204561656bab028c2fb1d77312a95e26333f39b4a2a274049423f023acf5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CM-nKBD9yigYrdL3bjAB&v=APEucNXZgYGtvUEM0w_LbVe0mPp0Xk4wuorvtXEKFXLhPCx2TY4OCJQYQ-7XvjvAQeKNx10mVD-c8JMm-NNJapdkFPOSJCsPLasWhatLNOQzEwnLFoPCOvmbKt9mVGuSEY7q5EU_9DyaEtzV3kXdOVgfdl0qWqu9P0ZVnAcbqcmHwJ6EXrowY_XV1q3LRrL9ISdzkx6O7to265rVVnDCfWRKXi4JwBeGv7Hb90KUIlTerzGYL89Srns
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnNqxZz_IrsBkubxAGVQYTuHtEaspCtEOP7PfnUUT5dzaXfjngOWHBYrDDEC5M
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 17 Mar 2021 21:33:48 GMT
server: cafe
cache-control: private
content-length: 236
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 7D46 55 KB
22 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BDu3ez1isAKOmRXWGcYHTsFAShJSiEz4lDenEE0edTktinyQU1i19PC-Ha3HIkHjB9DAgu2rk458j_nseP81S13mq3JxLoVLjy5bmKd-jwRZ_K8leGks_xqLhUjbfkbpwp4m44Wq2yBtwz9xDjf4vSqwF_jA&dbm_d=AKAmf-C7Vo7Upb9Lck38NZl9Y_ZK108jZICz4llIu-sjmKqJ3zydsAu9ggn7PDfuXO7k0l5tRZuGgdrrot1DenqzHyczlX6rGyt9BPkbZEuLSdMG-QUjogzh3oATn-2BhSHOM0ylgsRA3O1bI9g5wLVNPjE_T_W7I2IEvBO6PzJCpNQVOZU13dfydjE4NZR-dE5D8Xymaw2nmkAtv1t-vx4Ro5Ywjm4eY6N6n5afa9ZYndIMyNKLyWm2LYrIOd_XkIS8-sS6LCB0uy6PyXKIordQ30wQNHvr_7rQjwXQIbqyXQIeJJcR_2ezqFdug7t3wP8-u946xnKXNufSrT61RAaXJL-Empg24R1ZZoROx5xI_P9x8LGb35e5beFMWVP9sdE1OujnxkWq_kQFXG8orcssHpj_vd_6If3hoRiqMRe0miZCmA_4RwXpv1bQK1HvrjyWzsEupQTCRoJ6jn6ww9sPipJFVAUUVykNPYnvctVapnBbAG8aAc8641XxxYzMJGhJoowUaxltUcUNePBz64AN5sAfDfnfbTKL6G9ErknITMmi_wBffEpBqv51R2QSsU7mDlGuLyRiGKI_wY-KGKH8Zdhjs_hxbCbkRTJZoak1BRKOcWF9G5L0yYbXu3I8iQnraFaRIFXIm-JX8i9kIg8n4HTDcQP8vHb67pLq3anK0DH2urScLPNCek5k8TYBBtwNvLpqyptnmfjbpoMKsMZs0gY_1NAq4M42uzWL0E4WCW1fHq4xU9WmHBgIoRDPyKFdW6pJPI4fo7B9RZezG7hUyt_1lU2J0JFJKwJd_rzx_CikJgGUrlimhYU2YLjAvGoLqZ4bsJYBnqkGzKmN3bSXY4MN40iDw11o1p5DSd9ddgnX0DADEtFZrUdeBiD8j6oAx8UA2JDKr-cGCve_lEeEkx9AO7UlvCSab3I2KEJeSHdhVZByHVkPvf-TpM8d_4A_N250t3KeKC3Rp-Ai_DT1f4nexBsyDdlIicC_P97xB8ov9FkAFysR5-tQHk-h8dDDcTKEZC0uXOdt-pj5cAogpCsoRmgR97PIyj8ghWeRN9sPwRkSHpmvZ0aDfJ6763pR_Is759WBV1KFjheBfOlMShdFX_f9glKMGgAvwAZsxfHjH6Rejx6MbrDuyUzFqvaePFK8ei1ra4-wLOKnJ5d3Sgmm_PssF5r_LUzCA5SD6D4BkwVKOc3Sb4oIhD7CaddNHHOdzfMwuMpPTobVQGiduHInCVX98zXdyL4jsYhcrAm2jo0FpyldGq9rZW7EZJ5Kw1hYMXgeKDSV0M4OHO9sWvNEdEU0fsCD1ffLgYQO5COx_WgLiay-ZNoh5e0zIsqwlClVE8qs3RMkMDv0-atU30rHZ7cUz0eej0ooYSPF15TyGYXq5ZNAQjhzk0hWtrhCVlk--Yt59jX5XAC0CJsxQ_jixgBAS0id830767vVTiWlVYcNL5aL7i7KPP9ZTwwgI58HA49sgbRYF8GB6WTLi6Tk_eOrqOM7cLnukIaV022W6BkSWW16-utouVFiLofzrPZZOKYUYWXyUjgntCfqSzGPnWjRv_AxetMf8hBRIZjHWlq0GsYZpf7U9NBtTECm3OUPcCwSxmFjhEMixc1WgE0iqKCtQIGuJjnMsDGHb0JTOSs1LhIOi9mM5Esl6BXHYYmHI7fgxnKrI44XymmBkfEe4WGpz1WoV0FRlYQYUngJQ1HCjxAOGw6q0et7k2d761_eLrZ_SGfcbPAZn2tc__m-LGTqPXRCE8yATjydVxq7BPuuZZMY_nW-DiyUV6CsHc8BmpfKiY4D_ermt7ywc2HkhpFNSaKBfE119lC0Uxjl5zQO8pHjGVY5WHE2rTQmTQhfipuJUkrzFj2naLlS0lSxrOI6divtS2kGV5Vpeb3jH4iFi3eKk92gTDCK6TTq8xaPprXXLlJjMISJ8f7EGDYfcgKtIxnN48rYQsj42SID75Xjmh4yPqES36XilZPCIIuhneJaNeQDAw6VBoX2QT70NmmCt-5Wx1bn6NFL7jer31iIxFHHzXE4Z-HXtzabiWDaxZjZ3dwgTVxIY0VIbR_VwWh8ES3gFZ51xRy4K8ncaGyAAesalejPlB25f2I6nTbxiL_H-mXDX8i1SbuarP9aTglCkItEj5vhmwaDJd_6nQizjF3whidA9RHg9bkTqGMDFfhHUPjZWtYNGjgWJd845HDmuB_d0ZGPUbS1Ryax7DQVNklberiykSYUNna5EvisHBjOnsJevGcYMblbUkfJkS7PgICWi9AWjZs0PYyXEPukLM3rMBmIKlzjoImPcSe8Ltv2gLGj1a31g5PYU9jf-mgcqct0N185IM4TxtRvlOWcjWFBjyoDYNR-mgbEzCZHiGiQQYEHlTkmanMz-smAcXywttV1ZL5C486OD85-q4WHgd0VaxU355HQovj4ybeFFs7wcJfHyOk7yEe8wyeIFnykZj3kftD-wXOjOzg9vmHQr_52F8Zf4vda7WT-E9YieE8AO41ttaPWaIEWq84JbHCRA1Hu8tujP_2J7TVVTWUigm6BMKRb-hKd1D6el-FM6awqDKoHE1F0m-6IEGJ_cccXvRNg2eM8LJgBHJoqrhwGuHqMOb9UsIqUtaLP0gsPeW94XsD-rCZaDsAOViEk4lwhiZWrK-NbNpMM7JHm5ejWWRblXcQ40fNYjNMc1QwCYqozRwiqHIDpPomd5oEJUdz1yTGh6npMqsQgsLVVadm57TAPCFAmovA0ocsZ9pEVL1LDzLT7EGKtbi5z1F89WJRGB08DXzDfVnWKlz3hCHjMVSHS5yipAU-bka13M_X24lXMyMCPhmGzIcK099sTUvzAlOnzFQM6llppr5pCl1jqXeGwZhgzAo0-KZu0EnZBis-ndjERM4jJ_MpJDHOAczsUUFmB0TV9EDBM6wHPnYyXZ4gE0oKhSRw0Vfl3DIPXg4DR2iIZSjqljcPjj8VQ0VuvX75MSgP9LhgMBNRn6bG5_XPhxxamjPYCiFyFoCT7ukiGwy5QpYevypgqRU7WNRHQBJ6nKtReu6-yzdAjds_tfnHaixfdmzL7Aa58GBB-UK0wIuGNJq4Wt4eStQ-q7V3UgjAC3MMN9UcqTRViiiW52di1GfOQ0hVhQKxrzdhpniHFLAacmtz4sU4bvhc2j14YZSL37WLZG5--nkb9ZEK9ktJ8DFaBxvQtpMp-idMf0M1MsO2r0oMeHnAhiBUnlNGAtPDyl36VDFKinB34yOlQfeY&cid=CAASEuRoktasdZxFNjquPf4dG6ohDg&rfl=1%2Chttps%253A%252F%252Fwww.reisekostenabrechnung.com%252F%240

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

29d07745f18e4749b2e736b113cc6445c904080eff34da9080fa054fd742c030

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22719
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7D46 42 B
317 B 39ms
38ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-BhAtvS_zYpihOziHSOOSx6LjGutL1krFLxRiJT8pz_GaU9IJj281ReTbBAOKor4j3Atp95qsjJpPwBl48mQeLj9L4bDoykyw1BdmBNtid1q2r4z_w

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:48 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/ Frame 7D46 2 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/window_focus_fy2019.js

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:31:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 162
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:31:06 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 7D46 117 KB
36 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

941c260356b6aa75782a27384179a63581c9e41b42155774982f36b0d84cde9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1615980836519751"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36389
x-xss-protection: 0
expires: Wed, 17 Mar 2021 21:33:48 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/ Frame 7D46 13 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

570c04b30a5c8fa6ceaff96ea6d3a0dfabd85dee3edae40e38b0344a7278f254

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:30:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 191
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5991
x-xss-protection: 0
server: cafe
etag: 8832118191516519848
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:30:37 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 7D46 0
0 14ms
14ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQW7v80RmUi6tnMjPNIo0h8m195YvO-wcsDG1XNxNyBQpCHdV7FXKmTs79qDAtY3uP6HbgbCGuADec-YGM9XOU2DHJeIg
Requested by: Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 pixel
cm.g.doubleclick.net/ Frame 6BF5 170 B
506 B 123ms
43ms Image
image/png 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adscale&google_cm&google_sc&google_dbm

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CM-nKBD9yigYrdL3bjAB&v=APEucNXZgYGtvUEM0w_LbVe0mPp0Xk4wuorvtXEKFXLhPCx2TY4OCJQYQ-7XvjvAQeKNx10mVD-c8JMm-NNJapdkFPOSJCsPLasWhatLNOQzEwnLFoPCOvmbKt9mVGuSEY7q5EU_9DyaEtzV3kXdOVgfdl0qWqu9P0ZVnAcbqcmHwJ6EXrowY_XV1q3LRrL9ISdzkx6O7to265rVVnDCfWRKXi4JwBeGv7Hb90KUIlTerzGYL89Srns

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6BF5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPsvOQTzRy7T7BcIfZh1CYk&google_cver=1
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPsvOQTzRy7T7BcIfZh1CYk&google_cver=1&C=1

43 B
1014 B

75ms
75ms

Image
image/gif

104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPsvOQTzRy7T7BcIfZh1CYk&google_cver=1&C=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CM-nKBD9yigYrdL3bjAB&v=APEucNXZgYGtvUEM0w_LbVe0mPp0Xk4wuorvtXEKFXLhPCx2TY4OCJQYQ-7XvjvAQeKNx10mVD-c8JMm-NNJapdkFPOSJCsPLasWhatLNOQzEwnLFoPCOvmbKt9mVGuSEY7q5EU_9DyaEtzV3kXdOVgfdl0qWqu9P0ZVnAcbqcmHwJ6EXrowY_XV1q3LRrL9ISdzkx6O7to265rVVnDCfWRKXi4JwBeGv7Hb90KUIlTerzGYL89Srns
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.145.8 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:48 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 17 Mar 2021 21:33:48 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:48 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEPsvOQTzRy7T7BcIfZh1CYk&google_cver=1&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 308
Expires: Wed, 17 Mar 2021 21:33:48 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 6BF5
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_hm=YFJ1vEBqiX7aifKh3mxp9QAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1

43 B
894 B

59ms
58ms

Image
image/gif

104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CM-nKBD9yigYrdL3bjAB&v=APEucNXZgYGtvUEM0w_LbVe0mPp0Xk4wuorvtXEKFXLhPCx2TY4OCJQYQ-7XvjvAQeKNx10mVD-c8JMm-NNJapdkFPOSJCsPLasWhatLNOQzEwnLFoPCOvmbKt9mVGuSEY7q5EU_9DyaEtzV3kXdOVgfdl0qWqu9P0ZVnAcbqcmHwJ6EXrowY_XV1q3LRrL9ISdzkx6O7to265rVVnDCfWRKXi4JwBeGv7Hb90KUIlTerzGYL89Srns
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.145.8 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:48 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 17 Mar 2021 21:33:48 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame 7D46 111 KB
39 KB 27ms
6ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 13:10:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30215
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:10:13 GMT

GET
H3-Q050 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/elements/html/ Frame 7D46 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BDu3ez1isAKOmRXWGcYHTsFAShJSiEz4lDenEE0edTktinyQU1i19PC-Ha3HIkHjB9DAgu2rk458j_nseP81S13mq3JxLoVLjy5bmKd-jwRZ_K8leGks_xqLhUjbfkbpwp4m44Wq2yBtwz9xDjf4vSqwF_jA&dbm_d=AKAmf-C7Vo7Upb9Lck38NZl9Y_ZK108jZICz4llIu-sjmKqJ3zydsAu9ggn7PDfuXO7k0l5tRZuGgdrrot1DenqzHyczlX6rGyt9BPkbZEuLSdMG-QUjogzh3oATn-2BhSHOM0ylgsRA3O1bI9g5wLVNPjE_T_W7I2IEvBO6PzJCpNQVOZU13dfydjE4NZR-dE5D8Xymaw2nmkAtv1t-vx4Ro5Ywjm4eY6N6n5afa9ZYndIMyNKLyWm2LYrIOd_XkIS8-sS6LCB0uy6PyXKIordQ30wQNHvr_7rQjwXQIbqyXQIeJJcR_2ezqFdug7t3wP8-u946xnKXNufSrT61RAaXJL-Empg24R1ZZoROx5xI_P9x8LGb35e5beFMWVP9sdE1OujnxkWq_kQFXG8orcssHpj_vd_6If3hoRiqMRe0miZCmA_4RwXpv1bQK1HvrjyWzsEupQTCRoJ6jn6ww9sPipJFVAUUVykNPYnvctVapnBbAG8aAc8641XxxYzMJGhJoowUaxltUcUNePBz64AN5sAfDfnfbTKL6G9ErknITMmi_wBffEpBqv51R2QSsU7mDlGuLyRiGKI_wY-KGKH8Zdhjs_hxbCbkRTJZoak1BRKOcWF9G5L0yYbXu3I8iQnraFaRIFXIm-JX8i9kIg8n4HTDcQP8vHb67pLq3anK0DH2urScLPNCek5k8TYBBtwNvLpqyptnmfjbpoMKsMZs0gY_1NAq4M42uzWL0E4WCW1fHq4xU9WmHBgIoRDPyKFdW6pJPI4fo7B9RZezG7hUyt_1lU2J0JFJKwJd_rzx_CikJgGUrlimhYU2YLjAvGoLqZ4bsJYBnqkGzKmN3bSXY4MN40iDw11o1p5DSd9ddgnX0DADEtFZrUdeBiD8j6oAx8UA2JDKr-cGCve_lEeEkx9AO7UlvCSab3I2KEJeSHdhVZByHVkPvf-TpM8d_4A_N250t3KeKC3Rp-Ai_DT1f4nexBsyDdlIicC_P97xB8ov9FkAFysR5-tQHk-h8dDDcTKEZC0uXOdt-pj5cAogpCsoRmgR97PIyj8ghWeRN9sPwRkSHpmvZ0aDfJ6763pR_Is759WBV1KFjheBfOlMShdFX_f9glKMGgAvwAZsxfHjH6Rejx6MbrDuyUzFqvaePFK8ei1ra4-wLOKnJ5d3Sgmm_PssF5r_LUzCA5SD6D4BkwVKOc3Sb4oIhD7CaddNHHOdzfMwuMpPTobVQGiduHInCVX98zXdyL4jsYhcrAm2jo0FpyldGq9rZW7EZJ5Kw1hYMXgeKDSV0M4OHO9sWvNEdEU0fsCD1ffLgYQO5COx_WgLiay-ZNoh5e0zIsqwlClVE8qs3RMkMDv0-atU30rHZ7cUz0eej0ooYSPF15TyGYXq5ZNAQjhzk0hWtrhCVlk--Yt59jX5XAC0CJsxQ_jixgBAS0id830767vVTiWlVYcNL5aL7i7KPP9ZTwwgI58HA49sgbRYF8GB6WTLi6Tk_eOrqOM7cLnukIaV022W6BkSWW16-utouVFiLofzrPZZOKYUYWXyUjgntCfqSzGPnWjRv_AxetMf8hBRIZjHWlq0GsYZpf7U9NBtTECm3OUPcCwSxmFjhEMixc1WgE0iqKCtQIGuJjnMsDGHb0JTOSs1LhIOi9mM5Esl6BXHYYmHI7fgxnKrI44XymmBkfEe4WGpz1WoV0FRlYQYUngJQ1HCjxAOGw6q0et7k2d761_eLrZ_SGfcbPAZn2tc__m-LGTqPXRCE8yATjydVxq7BPuuZZMY_nW-DiyUV6CsHc8BmpfKiY4D_ermt7ywc2HkhpFNSaKBfE119lC0Uxjl5zQO8pHjGVY5WHE2rTQmTQhfipuJUkrzFj2naLlS0lSxrOI6divtS2kGV5Vpeb3jH4iFi3eKk92gTDCK6TTq8xaPprXXLlJjMISJ8f7EGDYfcgKtIxnN48rYQsj42SID75Xjmh4yPqES36XilZPCIIuhneJaNeQDAw6VBoX2QT70NmmCt-5Wx1bn6NFL7jer31iIxFHHzXE4Z-HXtzabiWDaxZjZ3dwgTVxIY0VIbR_VwWh8ES3gFZ51xRy4K8ncaGyAAesalejPlB25f2I6nTbxiL_H-mXDX8i1SbuarP9aTglCkItEj5vhmwaDJd_6nQizjF3whidA9RHg9bkTqGMDFfhHUPjZWtYNGjgWJd845HDmuB_d0ZGPUbS1Ryax7DQVNklberiykSYUNna5EvisHBjOnsJevGcYMblbUkfJkS7PgICWi9AWjZs0PYyXEPukLM3rMBmIKlzjoImPcSe8Ltv2gLGj1a31g5PYU9jf-mgcqct0N185IM4TxtRvlOWcjWFBjyoDYNR-mgbEzCZHiGiQQYEHlTkmanMz-smAcXywttV1ZL5C486OD85-q4WHgd0VaxU355HQovj4ybeFFs7wcJfHyOk7yEe8wyeIFnykZj3kftD-wXOjOzg9vmHQr_52F8Zf4vda7WT-E9YieE8AO41ttaPWaIEWq84JbHCRA1Hu8tujP_2J7TVVTWUigm6BMKRb-hKd1D6el-FM6awqDKoHE1F0m-6IEGJ_cccXvRNg2eM8LJgBHJoqrhwGuHqMOb9UsIqUtaLP0gsPeW94XsD-rCZaDsAOViEk4lwhiZWrK-NbNpMM7JHm5ejWWRblXcQ40fNYjNMc1QwCYqozRwiqHIDpPomd5oEJUdz1yTGh6npMqsQgsLVVadm57TAPCFAmovA0ocsZ9pEVL1LDzLT7EGKtbi5z1F89WJRGB08DXzDfVnWKlz3hCHjMVSHS5yipAU-bka13M_X24lXMyMCPhmGzIcK099sTUvzAlOnzFQM6llppr5pCl1jqXeGwZhgzAo0-KZu0EnZBis-ndjERM4jJ_MpJDHOAczsUUFmB0TV9EDBM6wHPnYyXZ4gE0oKhSRw0Vfl3DIPXg4DR2iIZSjqljcPjj8VQ0VuvX75MSgP9LhgMBNRn6bG5_XPhxxamjPYCiFyFoCT7ukiGwy5QpYevypgqRU7WNRHQBJ6nKtReu6-yzdAjds_tfnHaixfdmzL7Aa58GBB-UK0wIuGNJq4Wt4eStQ-q7V3UgjAC3MMN9UcqTRViiiW52di1GfOQ0hVhQKxrzdhpniHFLAacmtz4sU4bvhc2j14YZSL37WLZG5--nkb9ZEK9ktJ8DFaBxvQtpMp-idMf0M1MsO2r0oMeHnAhiBUnlNGAtPDyl36VDFKinB34yOlQfeY&cid=CAASEuRoktasdZxFNjquPf4dG6ohDg&rfl=1%2Chttps%253A%252F%252Fwww.reisekostenabrechnung.com%252F%240

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:28:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 327
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:28:21 GMT

GET
H3-Q050 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/ Frame 7D46 21 KB
8 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/abg_lite.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

70d82c6075989e0082b4917c6685f5f6bec1e673d0a80160eac61b3f1cdcb1a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8471
x-xss-protection: 0
server: cafe
etag: 753583566593306265
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:32:49 GMT

GET
H3-Q050 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 7D46 41 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 17:30:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 187374
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 15 Mar 2022 17:30:54 GMT

GET
H3-Q050 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame FA54 1 KB
854 B 6ms
6ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 17 Mar 2021 03:14:09 GMT
expires: Thu, 18 Mar 2021 03:14:09 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 65979
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 7D46 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a677ebd50879d5c89a66566e301e98cee34f985664cbbc13f887feca7a1e6c2f

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 container.html Show response
56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 001E 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e86479d6e54449d1085c2149e190a615c6bead407b20bacbcf5852b5d65f1fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.reisekostenabrechnung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.reisekostenabrechnung.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2973
date: Wed, 17 Mar 2021 21:33:43 GMT
expires: Thu, 17 Mar 2022 21:33:43 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 5
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 integrator.js Show response
adservice.google.fr/adsid/ 107 B
165 B 16ms
15ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.fr/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 16ms
15ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 482 B
425 B 304ms
304ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3033921947969389&correlator=3875299485864439&output=ldjh&impl=fifs&eid=31060312%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C330x340%7C310x360&ris=1&rcs=3&prev_scp=a%3D%257C5%257C%26iid14%3D1343379%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1343379%26eb_br%3D295bc01864bf3dbd0117e0a3f7f6bc96%2C291d27313eb66c50243129b23df8a579%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D10%26br2%3D160%26ezoic%3D1%26nmau%3D4%26mau%3D3%26stl%3D84%2C152%2C194%2C27%2C94%2C122%2C91%2C20%2C26%2C201%2C187%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C18%2C19%2C20%2C17%2C18%2C19%2C20%2C17%2C18%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D16%26reqt%3D1616016828266&eri=1&cookie=ID%3D3378e19534576578%3AT%3D1616016827%3AS%3DALNI_MYF21kzcSbfFNROo7ctDFt27QJeIw&bc=31&abxe=1&lmt=1616016828&dt=1616016828270&dlt=1616016823096&idt=605&frm=20&biw=1600&bih=1200&oid=2&adxs=348&adys=950&adks=3971918856&ucis=g&ifi=16&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=984434283.1616016824&ga_sid=1616016824&ga_hid=414760384&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

77757c2654e4525cd61d7a3fe8f29fb352aad3c4f7cbe47178abf3b1429a29fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 251
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 482 B
426 B 386ms
386ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3033921947969389&correlator=386573027456063&output=ldjh&impl=fifs&eid=31060312%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C330x340%7C310x360&ris=1&rcs=3&prev_scp=a%3D%257C1%257C%26iid14%3D1343379%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1343379%26eb_br%3D295bc01864bf3dbd0117e0a3f7f6bc96%2C291d27313eb66c50243129b23df8a579%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D10%26br2%3D160%26ezoic%3D1%26nmau%3D4%26mau%3D2%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C18%2C19%2C20%2C17%2C18%2C19%2C20%2C17%2C18%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D16%26reqt%3D1616016828272&eri=1&cookie=ID%3D3378e19534576578%3AT%3D1616016827%3AS%3DALNI_MYF21kzcSbfFNROo7ctDFt27QJeIw&bc=31&abxe=1&lmt=1616016828&dt=1616016828274&dlt=1616016823096&idt=605&frm=20&biw=1600&bih=1200&oid=2&adxs=348&adys=688&adks=3971918857&ucis=h&ifi=17&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=984434283.1616016824&ga_sid=1616016824&ga_hid=414760384&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

fba0c3fbaa10ce71ff6ebe9307af1dba9f9d063a52afee72a0d0707f2ac9cadc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 248
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 20 KB
9 KB 417ms
417ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3033921947969389&correlator=1761416297788854&output=ldjh&impl=fifs&eid=31060312%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=970x90%7C350x320%7C390x330%7C410x330&ris=1&rcs=3&prev_scp=a%3D%257C2%257C%26iid15%3D1409379%26iit%3D9%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1100%26sap%3D1100%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D4%26at%3Dmbf%26adr%3D399%26ezosn%3D0%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dreisekostenabrechnung_com-medrectangle-2-1409379%26eb_br%3Df09d4fef38161a27d028cff6eebf43aa%2C33dd523f8e4dda158f0aa99686dda7f2%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D13%26bvm%3D0%26bvr%3D3%26shp%3D1%26ftsn%3D3%26br1%3D6%26br2%3D200%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D34%2C0%2C28%2C67%2C45%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C20%2C17%2C19%2C20%2C17%2C18%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D70%26reqt%3D1616016828276&eri=1&cookie=ID%3D3378e19534576578%3AT%3D1616016827%3AS%3DALNI_MYF21kzcSbfFNROo7ctDFt27QJeIw&bc=31&abxe=1&lmt=1616016828&dt=1616016828277&dlt=1616016823096&idt=605&frm=20&biw=1600&bih=1200&oid=2&adxs=315&adys=1103&adks=560436320&ucis=i&ifi=18&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=970x-1&msz=970x-1&psts=AGkb-H9awlplzm3R5rYar7qljqzk%2CAGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=984434283.1616016824&ga_sid=1616016824&ga_hid=414760384&ga_fc=false&fws=512&ohw=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

924d230035283500771737b8dd94ac0dce42946fa339bf2d1d0445bdfcba8189

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8984
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
504 B 22ms
19ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMCIsInRfZXBvY2giOjE2MTYwMTY4MjIsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiIzIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQzMzc5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiNTEyMzk2N2RhZDk2MzFmMGQyYTU3ZmE5YzMyMzdiODcsZTI5ZjY5ZGQ0NjhkMzFhNTUxNGRjOWI1NTg3Y2U3NTcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDMzNzkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MC4wMDAxNiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDE2LCJiaWRfZmxvb3JfcHJldiI6MC4wMDAyMiwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMCIsInRfZXBvY2giOjE2MTYwMTY4MjIsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImNyZWF0aXZlX2lkIiwidmFsIjoiMTM4MjQxMTIzNTE3In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQzMzc5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiI0OTc0OTAyODMyIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4ff7f000005f13ab1b000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ryqAYenJCO9VLqG3UzRzGnZL2z8AhFcbgy7ijYozJbQ82%2B5VbA1hS1nZYj3NY%2BF4ooNoM0Uvi0ZfS4YD83jjZ6CCu%2F89KbjPTnykzJnpiPyR4tWUgAmn83icARW%2BwkcIvuLoffSsUeoYkw%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 63195778cf0705f1-FRA
expires: Tue, 16 Mar 2021 21:33:47 UTC

GET
H2 200 4974902832 Show response
g.ezoic.net/dac/ 0
17 B 45ms
42ms XHR
text/plain 3.127.76.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/4974902832
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/porpoiseant/banger.js?cb=192-2&bv=13&v=46&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.127.76.126 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-76-126.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 17 Mar 2021 21:33:48 GMT
cache-control: max-age=3600, public
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
284 B 38ms
36ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMCIsInRfZXBvY2giOjE2MTYwMTY4MjIsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDMtMTcifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIyMiJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIzIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii02MCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4ff80000005f14b1b5000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=soVAjG89Y53aMg1WQb1BZRKOa7h6hOSn3b9CWLr%2FU6uDczRnWBi9bh5u%2BE5Ux5x8uhM6hOermJsOjWaoINI8L8THoeIKtiMOXWk3GalW422K7h7uP1xRRFbKdoRQtxYbCktgFgxmD%2BLoEA%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 63195778cf0905f1-FRA
expires: Tue, 16 Mar 2021 21:33:48 UTC

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
410 B 20ms
19ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMCIsInRfZXBvY2giOjE2MTYwMTY4MjIsImF1Y3Rpb25fZXBvY2giOjE2MTYwMTY4MjgsImFkX3Bvc2l0aW9uIjoxMTAzLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiYmlkX2Zsb29yX2luaXRpYWwiOjQ0LCJiaWRfZmxvb3JfcHJldiI6MjIsImJpZF9mbG9vcl9maWxsZWQiOjE2LCJhdWN0aW9uX2NvdW50IjozLCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo1NDEsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50Ijo0LCJuZXR3b3JrX2NvZGUiOjIxNzMyMTE4OTE0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzJ9XQ==
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b4ff80000005f10a873000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=7r3umO0YGsbS%2BC5oHBYfDKdfbN41DQJ%2FIcwwutHHxfgU47zKN2PiSfxBmB78pfhwhIzBELO2c6O%2FZlelap7K%2B3KZOiGHxsvRIGKqOEI5gntgbUGOcT%2FL8d52VMKoy2ivv7EBHO2freDw6A%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 63195778cf0b05f1-FRA
expires: Tue, 16 Mar 2021 21:33:46 UTC

GET
H2 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 871A 22 KB
8 KB 6ms
5ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 15 Mar 2021 17:55:06 GMT
expires: Tue, 15 Mar 2022 17:55:06 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 185922
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 t.js;adv=11297208284209;ec=11297212736296;adv.a=9080429;c.a=24153710;s.a=2103608;p.a=273624679;a.a=468022857;cache=381710845;%22async Show response
ad.atdmt.com/i/ Frame 7D46 0
0 141ms
127ms Script
text/html 2a03:2880:f01c:8004:face:b00c:0:8c
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.atdmt.com/i/t.js;adv=11297208284209;ec=11297212736296;adv.a=9080429;c.a=24153710;s.a=2103608;p.a=273624679;a.a=468022857;cache=381710845;%22async
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f01c:8004:face:b00c:0:8c , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 impression Show response
impression.link/ Frame 7D46 68 B
548 B 271ms
195ms Script
image/png 13.226.159.104
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://impression.link/impression?branch_key=key_live_ljOlMvJZ565wI6bVcOuPYagjwsoHp4MX&%243p=a_doubleclick&%24android_deepview=&%24android_url=https%3A%2F%2Fwww.worldremit.com%2F&%24ios_deepview=&%24ios_url=https%3A%2F%2Fwww.worldremit.com%2F&cat={cat}&src={src}&t_url={unescapedlpurl}&type={type}&~branch_ad_format=Cross-Platform%20Display&~campaign=Display%20Web%20Activity&~channel=DoubleClick&~feature=paid%20advertising
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.159.104 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-159-104.dus51.r.cloudfront.net
Software: openresty/1.13.6.2 /
Resource Hash: 13f86bd1a6d578ee82ca0c54a9a634e03d8d7db09380d72590b158f173f53790

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
via: 1.1 4ecd74dda94d7576e134fcdf16df8129.cloudfront.net (CloudFront)
last-modified: Thu, 29 Oct 2020 21:20:06 GMT
server: openresty/1.13.6.2
x-amz-cf-pop: DUS51-C1
etag: "5f9b3206-44"
x-cache: Miss from cloudfront
content-type: text/plain
access-control-allow-origin: *
cache-control: no-cache
accept-ranges: bytes
content-length: 68
x-amz-cf-id: 8TaO8soXWA_3VHDttYmis8Cn0iMOltOTctce5WOGV3rkK1l5L5ELWg==
expires: Wed, 17 Mar 2021 21:33:47 GMT

GET
H2 200 index.html Show response
s0.2mdn.net/9080429/1589458396737/ Frame DCAE 74 KB
23 KB 24ms
7ms Document
text/html 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9080429/1589458396737/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

18876aa194dc231d0c3bc858cd881885107d8bedbab226c369018fb83488eae4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /9080429/1589458396737/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 23498
date: Wed, 17 Mar 2021 03:43:13 GMT
expires: Thu, 18 Mar 2021 03:43:13 GMT
last-modified: Thu, 14 May 2020 12:13:16 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=86400
age: 64235
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7D46 0
575 B 150ms
75ms Other
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsukiqYmBvfvy1RqePgt6pYWxT7RGw13vVRMP2VH4EiLkMlcyp9rbtvqvF2csvbGXwS075-qxVB041W5URemrVDyWBv6sQeDpYGWOC9534kmF_7srEAcuGV7Xy21jK_zUZcLdwlHHqyQpUC9ckpE1r8a_jh_CCTxxvPcTHfT6T3Jc4ds_Mrje71zzhJMDofWUlw4zSz06LM8Uqko_9Zn-ceWfsaQlYIPVY1x73H8qkgqWkL0f6ZEfeNxjqwMDrqhI9Artj52Jge3kRKmU2HveBDcnDYmRPlpLzMz092qdC-j3AVW12hEj5xMQIpNWupXdSJY5Dvl1IDA2BKgnIeNRzKW955S3Vp00wX6trB_hsBF0eYenmZCHiMso_5zXIU2ZELa88GnatD0vC0_TZda-YedayKkGfPiC-nK7FaL5WScRLAig8m7pB56jtQNl5Eb66mFMr0mlrn_8KGVGpHRa1jGLw9O4XGtujlBlJOUXoCt81pRm3xrhXXyFvuk2CrlJY7_KGZg0aKW-No5J3jQ8KbC9AfPXEQI-6casgh7r1i2_BP21REqYfxM_yKhsjiCWZcLFml-je6RBInJE-2JPEN-My7YFWqLcZmLm0n0JEVppDd0-Zyt2zQdlDAtq6jkFVoITFTQ1fWopJGbGasC7L36hLRJ6k69AjUyM8WiT5Dfc0OwbFYaveAYdeIy8Y-_cwJOXM3rHP_H4oCAqHYYuSPQPC4bxRg1ZHYvZ-pEPC2IHvWe19_o3-GofnYVurhkRsshLldoNm0A9TxxKBGQnld6GP9uk3VWkkjoAbxfLP0kXgnWQ1byELrDwOvJ4Kc_gIIgaN72JcksNiYSCyeYuX3VdjC4px0TptxuI2YbcLGE6KyaHV4aStOZmZyImYgOw-arRT38ofa-u1mguwZOBEtfKCTT1bPKbzTweoW_IB1puq3s9eYe6OpZ7hD3HdG351elrTlDEXbsQSWq367OVEOWzUTFNJT3PbOcPLK0qt5ygNluP9AIH9egsdcdAqbQddu-CF0fo5VXzkPyPqqiZbRJcSExOrNTgURaEXb_ue3Un21pGn-s5LKclP3O9A1E0v1Je_myJ5Qu0hORC7aKMUPXT-n6vuab5EAtD1r2mXWTfz1aeJ7J2alhDj4vNLZalfNImfNQlhA5CqUYBS3HtOczTV0NGod1rGCqEp6278WDUxPauFM2G7iqNhzA2Na54vRtXZR1H3iE-pEJXnFM347MPKihVMGMC6tJplbwh0VoUC93xGYpcsR-tSr8_d9HOqwEFAMmgu4wWXMXJuzn0dMV5WVG7iBsDmSFfC_KbtAoymo1HEmWU9L9i-4NP2QIK9jCOAL4fNa9rTLW5_0ortq7lE6tVg24nzFkz0YAvNY0hBFodKZKPA&sai=AMfl-YRRgCblnPW9xDilRC24oot7Lq0FxOcfAxgmPhKMHEN911g_qCry0OpA2fSJptuyO_KTh4-kHy4RS-dThrxz7rC5HzU4YSoWaQzGhIMkiA-YLRjUNXGdg-lH6DfuNlRYE9jBC26xkP9A1owdA9Yor9T10pjPrM0qq2gHVd7kqpslvRKsxJsw&sig=Cg0ArKJSzG4NhpqOONfVEAE&urlfix=1&omid=0&rm=1&ctpt=155&cbvp=1&cstd=152&cisv=r20210316.85923&adurl=

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Wed, 17 Mar 2021 21:33:48 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 5464 0
174 B 15ms
14ms Document
text/html 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNyuyAIQpovKAhjKicqeATAB&v=APEucNW9zJhwGr5lyPXr58mNXy0Ajqxjnn44ZY33gNiuSUks_xxk8uJmdQ4j9Q227puBST0dRcxv1mTlat9ZidtfmrbY9ZOxMJnBlR2HdMrRrbZ-gE-SkxxFNfMjhlsX6S2VbhV13MS_U6wN2BJmCFalE3sIfbMJjj2OnPpNfMRpgl7_qrQOw8yxObA6vNx-qEHjow6XgavJyTxpBpIldAhAdoog41Pxiug8OwOfxxNZrK51rWjtqeE

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CNyuyAIQpovKAhjKicqeATAB&v=APEucNW9zJhwGr5lyPXr58mNXy0Ajqxjnn44ZY33gNiuSUks_xxk8uJmdQ4j9Q227puBST0dRcxv1mTlat9ZidtfmrbY9ZOxMJnBlR2HdMrRrbZ-gE-SkxxFNfMjhlsX6S2VbhV13MS_U6wN2BJmCFalE3sIfbMJjj2OnPpNfMRpgl7_qrQOw8yxObA6vNx-qEHjow6XgavJyTxpBpIldAhAdoog41Pxiug8OwOfxxNZrK51rWjtqeE
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Wed, 17 Mar 2021 21:33:48 GMT
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Wed, 17-Mar-2021 21:48:48 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 17 Mar 2021 21:33:48 GMT
cache-control: private

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 001E 23 KB
11 KB 30ms
30ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Acr2T5cAQDoHST5d7_QdEa4fJwX84VmRF3QcQaCl6mO9pa9iOWNYllw2U384U0CHIEUflPNmVfEHUixbHrPXgbAeAfCt11to6MjgeR4I7izekZe0aT2OAwUNKqEmT2ItMw-WP2TP7urg21_t4JtNcTUg8owQ&dbm_d=AKAmf-C6kqyAvxc1MOxkfShXA-cA2Wi8tlKVY-xPfS-aHwN-OCEBh24npBrOs8rOgBwXe_21uVSDtHtf0AGl3t_9jv31YJa_PsOor1i1TIXf3emCnMZAfN2lFbj352aio0EhhVdnwKOh6IgCakKe9o0napOKdu7Tg0rmTFIbcEWu_SeOM-Cv_rrXNjpnv0IBNH9msRF45TbJpooCmJMEpVcu6PYeRjqeL2DmKAPoWSAkoSj1SsLFZ9V_eq8PWhz8YZy5ZMUVhZQx4Wz4gLGan5YIHA0oa0qYsvv-dW4esdHaSj3aMvSLHNqXuh316QjepjLQHOwIZE4zmoC4dsTWKMFtM00KW4CrXd9rb65FiFRbbfluvihzmed0FsjIYef_YEZUgaqAqZNbFmqiDD5BWmjwSvX_s6LkrhiZCCNJOh0s8CmAJkgUbeJROozxUkoMDkq7sjoeuuMJFyC-I0MFHbAqJW2Q0x7_hbXdmvQ31V28RnoR4jVcLRZZ_izk8FGlFYV0nVxATQaH5s0J2Yjot2TVzL0VOnIPKiOkJm8flF4U_BiQ0w0YbsjGwURssywGSVt7Cth-Nt8dmNezsG-YDTpCPMnE5QItne72t8hRLaxqdRKHJI1T5My20BbQ_ajdneeHRWr83pZ5Kw_s0Ov1g20n1oJoUEf2is6WIZmld0FghuBspiMArF2qTfM4WTlw99wPDwU6byUqDVmtMQ6BugPovQVCdKT7QtzHXbCIxU-Gqtl6bje26lzh4gKICKwpT8AtPCV028-d5sOgUEuQX4LrQYmdP0CjT1TY_ODrRe1YkqwxB0paQg4Hl-QPxKSZ2GFRxCOWKJkWO4i3MIfAjMR6DkOoSvW1_5GlWbksKstxy7rz2jhWHM_cfX0XZXnstYuYZneK5iCO2qztSe17gG26MmG94V1eguIi0IwmEn7scNAK6nwoepnepcXmYbhG3ugCg3L7yZcutmgJ8XXHU8pbVWyw8vXexTNk-He5VSLkx-B7D4QNZI8kNyBkGuAGO6x-LHzdsTCUpOQdoX8j6Nm2wHLlf_PXk-eEnQuOE8R7AoY818v9Nx4hZ5H_vGc06AzqQBNZUAnla1Gn1Ro47zKAdNtRgEyhGPL6I86_SvcDNvJN1Rp6-1EaK2oRoIC2VK6SENcm0HdwbCszf0TiUqXwvQdtHeviXmLfe0QayEsCDtrcx47DtdYfimaLt7e0aLPIuW_cDoza0_vJaokmMe8lYIaNfTqrEfiZEDKmrkXvPD72N53VPbAP1ztTQ83AoQTFLRHrgqbpvGCw6wQcz648jjXSYH9Kbqeqx_mIYFexWHbnqNa1en5Crl8sRi3M13tf96kOwQst11TxCD9FWj2UMRdI2cURgi64xn4ORGMG5CihK5-uea6vm0tlhNLY1oyc0oAGU6-QCCWD0k1ZN33XEiGLZcVLc0egd0DMSpvCxvSvXUGU3Lhc7Py3cqT9_K95aWvmHprHmEZ9VEkkYkue0QvbOZX5mCRag_JSiLL6m7mtZESP868hN1BsbcoVzHCwC3mspyk9cfqbaf2_oTPC4yL0fUpVXXtPoenUAm0bv2hsXEd7RC3HGLi3A4dsO2AkgCGbtIVPRDvO6U0BFzgP0LMUUzIsGlALIZuKNAAkTy_rhwv6P3lcKh68x4w9khplNPhVW9NT9fsfL5h-__Bso2YJZtHnC62GXk5_VgCIPumGC9zwo2dbI1XxsDgPKgZlL8J-01WHGBuvQ2IrShfp7WdP-r5MPfXfq6QfC85kUJFIG6E4SF96_Z_f2NEzWZH2f1IfEixaUE0OE3fIkV5gbBgS3GVX6ernutRTMvKZHSzm0gLHf8l33Q0faoCOWOBNz2HXyYW9QbI-g8Faab5KuOp88gJ_V-vUlAvJM2NZtp7SJDyJXUj7UlGCAXoz8YAR_0T-VAhXZeLgC4eGdFMTKdtzIuN25k_hy-uldU9ztE06fecwq-XMw8IY6dEwOlX1ZI_DZjQE2LJI60h31MPk8Yi-zyBiWdrAI84offPriAJ3ZDn6hH2qhVn7pw4Q-llYh9HStLlMyq7WiYWrpK3ICqzPL4ewvXRW2H6ppkR2p3gYoPZGywAcFDXbnkRpbazorrLTbCs_JJYnAGmlaVB73gWI_sEuuz-6eW3epzX74nbWuRHLP6nOIBpNSJ2LtoG-FLB24pjHwOX0Zab7JzlWFPsQlaO1e1UaEfB9lscpAnkWED0TlJ94IL9W4mXDOfbxzIjO_BPLVD-hLaYaBAPeILyLn6JRpv6fyTuMSzm5bd2CjMlJeU-kjgf_ZSXad9bJd8V2hw2_lpLvtht_V6MNGufMwmX1o5St2HvR4LQqguMEV4ipG4Pc9kPlgq0yFG2fViUK_L_4HPmKmjG1cUXGTcLP2nwxfFJjVoUkpeKRMH0_a_KSmCTNV-dg4t1wypVdj80QwKXBa2nm9ca_HSpQ17xI-gK_Zh26KIcSeImm7fYepQcecYu3sq2FebaYr2t3KcwW_RklmOLXQ7FPSMg51EfbhJyv4YBeOhgm07erZNqAB1hfW6i4ZEthbwK9SoEuwVj9LnUr0FnwAEman72puvc89DBWVYxrWf6KZvCAERDzHqQka05KQNz-6Xq52fdrYH7KdUTFnbyiOxuSpfuG5kST_YcE34N8jfiuZbh8dllGusa1VHu5sYjkORUAqlmIVyYR72z2x7w-7ajOugYzw45MhDMBqaBgM9LeM9_se8uUBZpIl2U-VGOMNQzjqP6pHo0aG6NOKKb_kNptTV1mQPfFCsxTmnAy_kAk2c24yLYzqw-HiCcZS5x_O0Esw9krS74fkOzWKECRX42vzPNpWIf-LUoPEYDYMFt0TMpmpk67yW06UQBGkimTrQ4S7qqG3vDlR-jTXrFOdU7Fuju2-KRgMASGpgVAZH1BrHRBn4BLj9iFFbvyoro1tB2Ggvci3NJe425QPlQKWLqbEhbVoWA7OjAYVSkEHpmJXy_IiYK0hXYQqHgFEbNZnaGjEoawc-Y10-dbX1Nqcxr52PiuwbmtBhTz9ZmaVqqfSA6APKvqBQmLNmAiKP3h0D7BZytP_DbbNur4bNuLT4ccw1CzhGu75h28orbIJBz6tdu36OON4zVEkVDShnF2dGremh-aAAaNrdcyalbnGzAXTXzsp0I5ZWqstZm3IrHq9dCdwf91be3pt9SCHE8TbMKBGCqzsiKUAPm3Q7k6MckOhWsXrJ2lhvB-iG0AzRow-VuyNY4ZhCL4GVk&cid=CAASEuRo4ZsM8num09ttMomZ0tRuMA&rfl=1%2Chttps%253A%252F%252Fwww.reisekostenabrechnung.com%252F%240

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3514bda8c0485fc4f389308759afffa01a67af483112a31a9569c906acfeeb3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11452
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 001E 42 B
107 B 38ms
38ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AKvmf3LumXtJTfyRN6m5TIaXfZJZdxBb0ZeaswAVPWOovJ8EFNe7q7r2cmxb63HV-WIBu8wCUgzNUBTOcsx4OCiE8z7TcTAqxefu22YXTmMXYWsAc

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:48 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 clk Show response
ad.doubleclick.net/ddm/adj/N1246177.3716415IGNITIONONE/B25408918.296831033;gdpr=;gdpr_consent=;sz=300x250;click=https://googleads.g.doubleclick.net/dbm/ Frame 001E 39 KB
18 KB 137ms
61ms Script
text/javascript 142.250.74.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N1246177.3716415IGNITIONONE/B25408918.296831033;gdpr=;gdpr_consent=;sz=300x250;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CZACQu3VSYJHkLYnI7gOE9rLYB_OLv9Rhj_mu5LoN2tkeEAEgpczXamD7gYCAiAqgAeLd28sCyAEJqQKMAU63JPizPqgDAaoEhQJP0JJ7pH18KU8DGN6pJusuJmNSVxUxr9KdnBM8aSmPWxQZIMHK1XwDy5ll3WpKXk16q76Z9CGIAmyZyk5wB5WmMrGWvoeiNuQqAtZPwd_7aS5FCFOedHyxtQzO8TJSiRZyUCkLbowb1LYu3cq_FqTdxm-LgETBpxLn-xaFYBw3mG6gZTMqVnI8AZLP22qcnMoG4CgzhhPimJoFJZfUgROhRNjJyrtsuevlgSQparW2J5dmCgMO1cZU_4O-QxmqD-X68ir_maPcMSfM0GYfXQarcnX3-aon4XX2KTny8XvTDF2hyWgm-nxL7HPr9xDGUnHMwzQ4VsIYw6PtlkZHYlGvkBy8SnLABNLOsOG0A-AEA5AGAaAGTYAHhqKktAGoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTQ0MzY3MjcwOTY5NjY1NTmACgOYCwHICwGADAGwE_rb8grQEwDYEwPYFAE&ae=1&num=1&cid=CAASEuRo4ZsM8num09ttMomZ0tRuMA&sig=AOD64_3kKowAhpL2jcIoUKz3sUJSfz7rHg&client=ca-pub-5902083285302779&dbm_c=AKAmf-AhUTy8ph3IIxkav2qWdnpXHYcWqGFyMxVFYC6y0PNJDh5RHtSlIqkvN-r7v5SUiaZf3EuiJZMa47Fc25qKt7PWXkq8c548b5ntU7xOqLnn2UoTVyCaNcDq1TlXunuNR_q1UX3IcwdFGu9I7G8kkEOzN-PVog&dbm_d=AKAmf-D0IdAeBpC3MDyISRyf4boeAYHW-OM3zRI15mjQORHuipxQ2PKu2TZK44s9asx5UeQ7MdomugXjEFOht8bgZhfv_blkWmUaC5RUyyX53dS5_h4pCTRolz9OVkrEzQ6FxU7Z14KlPKUe6c1UsWpfQWZKgmFpnGgDLI5aKY5XbpofDFGKIi6BLRodyP7TPacx32NH7ntuhD1Fxmemwnq6ZtBJhpjkYCAQ-TlDiWrnqcKlx4RKMDA3luYsw_iygeFvgA9hFFQCARXPhYi4_30LvTxObKwEGRebAhgPygmvHcrdhO73rvtKzQOZZF5SQa6I7nSj1bHDowHsPulDX6x4vpEEqA0vVdsKi3IsvJl7vac0BzO2-b6C2e697s5SJ-vCEL__BKX0LOmxVP3k4ONe1QrXp6AaBJM2wSkNcGSQu2M4y2BfAhC7gw9aXYFwWZj9an_eFSPr-6k3ipnB8GI1ttRetfSfOQ&adurl=;ord=1616016827750097;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.74.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f6.1e100.net

Software

cafe /

Resource Hash

ee160714b80f6172a2bd888f2cc8a96d09e3be220730d5a5f99530bbce0a3366

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17369
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/ Frame 001E 2 KB
1 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/window_focus_fy2019.js

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:31:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 162
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:31:06 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 001E 117 KB
36 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

941c260356b6aa75782a27384179a63581c9e41b42155774982f36b0d84cde9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1615980836519751"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36389
x-xss-protection: 0
expires: Wed, 17 Mar 2021 21:33:48 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/ Frame 001E 13 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

570c04b30a5c8fa6ceaff96ea6d3a0dfabd85dee3edae40e38b0344a7278f254

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:32:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5991
x-xss-protection: 0
server: cafe
etag: 8832118191516519848
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:32:45 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 001E 0
0 14ms
14ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTWsVunXciju1y0u1xNF9Vfs6FNwhvb8rWv_-pJ81pSufOBlgKqlqgQItHiskSgf3Qmi--EzCyWV6VpM3u7DscBPUik4Q
Requested by: Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame FA54
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEJq-qV414Dvd6w33wnXM5Z4&google_cver=1&google_push=AQvitUIZTwdrQsX5yTXD5bu7JG7E57kbkHfBz-vyRVZ_m-8qGkzUKH1gdFXeH0oy7d6CzM12eciuvsrM_NJHUFIwxxte4SoDA_Q
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjMzMjExMjc5Njc5Nzg2OTE5Ng==
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEAv6mPmswDnlB6_glYImY0I&google_cver=1

43 B
407 B

111ms
38ms

Image
image/gif

46.228.164.11
TURN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEAv6mPmswDnlB6_glYImY0I&google_cver=1
Requested by: Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 46.228.164.11 , United Kingdom, ASN56396 (TURN, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:48 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-type: image/gif
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:48 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?google_gid=CAESEAv6mPmswDnlB6_glYImY0I&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 301
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame FA54
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEJcc1zc-gmL4QFhAV4s_tqk&google_cver=1&google_push=AQvitUJnpKed0uFgHE-1OKf-flaAqgNBm2jfDUhJs2euw7befsiuX9I8GdwQPyZ371PfELPCcqUyyIH10HL...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitUJnpKed0uFgHE-1OKf-flaAqgNBm2jfDUhJs2euw7befsiuX9I8GdwQPyZ371PfELPCcqUyyIH10HL6uao9cmflapQjWbc&google_hm=BElgAYj8RrKxkh-aCmuferw

170 B
201 B

43ms
43ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitUJnpKed0uFgHE-1OKf-flaAqgNBm2jfDUhJs2euw7befsiuX9I8GdwQPyZ371PfELPCcqUyyIH10HL6uao9cmflapQjWbc&google_hm=BElgAYj8RrKxkh-aCmuferw

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:47 GMT
via: 1.1 google
server: Apache-Coyote/1.1
status: 302
p3p: CP="NOI DSP COR NID CUR OUR NOR"
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitUJnpKed0uFgHE-1OKf-flaAqgNBm2jfDUhJs2euw7befsiuX9I8GdwQPyZ371PfELPCcqUyyIH10HL6uao9cmflapQjWbc&google_hm=BElgAYj8RrKxkh-aCmuferw
cache-control: no-cache, must-revalidate
content-type: text/html;charset=UTF-8
alt-svc: clear
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame FA54
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEJEXqM3-moDHohcjMdNqbp4&google_cver=1&google_push=AQvitUKSO5-SDApqyUewqiLegYSoZNIiblYVxShjadN1mMWxd8xyP7XJMPQ2uwYCecP2mafkqP-ag9Vw-khGumGW...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=arR9pMK3Qnm-HUfmDcvQkg2&google_push=AQvitUKSO5-SDApqyUewqiLegYSoZNIiblYVxShjadN1mMWxd8xyP7XJMPQ2uwYCecP2mafkqP-ag9Vw-khGumGWM3IkrLhItkQ

170 B
190 B

43ms
42ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=arR9pMK3Qnm-HUfmDcvQkg2&google_push=AQvitUKSO5-SDApqyUewqiLegYSoZNIiblYVxShjadN1mMWxd8xyP7XJMPQ2uwYCecP2mafkqP-ag9Vw-khGumGWM3IkrLhItkQ

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 17 Mar 2021 21:33:48 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.15.12
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=arR9pMK3Qnm-HUfmDcvQkg2&google_push=AQvitUKSO5-SDApqyUewqiLegYSoZNIiblYVxShjadN1mMWxd8xyP7XJMPQ2uwYCecP2mafkqP-ag9Vw-khGumGWM3IkrLhItkQ
x-host: tde-deliveryengine-production-565b569db7-nrb6h
alt-svc: clear
content-length: 0

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame FA54
Redirect Chain

https://google-sync.rutarget.ru/sync?google_gid=CAESEL0lMSJIoG43aYIQSc4dut0&google_cver=1&google_push=AQvitUJgQ_ltfV44xo54XK4irNVIbsw4jOVjD0-C-qPWs9Sx7snxRS5Yr_WkbSUQ2UNeY4Sds_Loe_xAQL4x_mazSeQgmYg...
https://cm.g.doubleclick.net/pixel?google_nid=segmentoru&google_hm=ZlZ4QjRnRzhVeGVu&google_ula=2046794&google_push=AQvitUJgQ_ltfV44xo54XK4irNVIbsw4jOVjD0-C-qPWs9Sx7snxRS5Yr_WkbSUQ2UNeY4Sds_Loe_xAQL...

170 B
190 B

137ms
136ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=segmentoru&google_hm=ZlZ4QjRnRzhVeGVu&google_ula=2046794&google_push=AQvitUJgQ_ltfV44xo54XK4irNVIbsw4jOVjD0-C-qPWs9Sx7snxRS5Yr_WkbSUQ2UNeY4Sds_Loe_xAQL4x_mazSeQgmYg87CQ

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=segmentoru&google_hm=ZlZ4QjRnRzhVeGVu&google_ula=2046794&google_push=AQvitUJgQ_ltfV44xo54XK4irNVIbsw4jOVjD0-C-qPWs9Sx7snxRS5Yr_WkbSUQ2UNeY4Sds_Loe_xAQL4x_mazSeQgmYg87CQ
Date: Wed, 17 Mar 2021 21:33:48 GMT
Server: nginx
Connection: keep-alive
Content-Length: 0
P3P: CP="This is not a P3P policy. Please visit http://rutarget.ru/p3p/ to get more information."

GET
H/1.1 200
OK us
sync.go.sonobi.com/ Frame FA54 0
474 B 153ms
36ms Image
text/plain 178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsonobi%26google_push%3DAQvitUIYCm5q8Qs3R4oASRPcuZtMbDRhlpnNb0RQt9jN5_h7Tes3iWPWCb9wL4WrNgGx3Vc7jWfjmIVUiuvgqWRoJdYu_F4LkYY%26google_hm%3D%5BUID%5D&google_gid=CAESEOcFpF8VkgJFdPGjpJ8viF8&google_cver=1

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-sync.go.sonobi.com

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:48 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-9
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame FA54
Redirect Chain

https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESEBthgCKddhUYdZwex43q_Bo&google_cver=1&google_push=AQvitUKGRkbg2sSF-5emLVikJG26Q9YVz6n54adSyHGYv11bJDI8QEGqMUt5IMSvY9s8iwaQSVwzxJ...
https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AQvitUKGRkbg2sSF-5emLVikJG26Q9YVz6n54adSyHGYv11bJDI8QEGqMUt5IMSvY9s8iwaQSVwzxJqiuhhaV1Ql4-WMOhP5rVI&google_hm=MjkwMzAyMzI...

170 B
190 B

43ms
43ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AQvitUKGRkbg2sSF-5emLVikJG26Q9YVz6n54adSyHGYv11bJDI8QEGqMUt5IMSvY9s8iwaQSVwzxJqiuhhaV1Ql4-WMOhP5rVI&google_hm=MjkwMzAyMzI4MDkxNjM3NjkzNw%3D%3D

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=smart_adserver_eb&google_push=AQvitUKGRkbg2sSF-5emLVikJG26Q9YVz6n54adSyHGYv11bJDI8QEGqMUt5IMSvY9s8iwaQSVwzxJqiuhhaV1Ql4-WMOhP5rVI&google_hm=MjkwMzAyMzI4MDkxNjM3NjkzNw%3D%3D
date: Wed, 17 Mar 2021 21:33:47 GMT
content-length: 0

GET
H2 204 /
cc.adingo.jp/adx/push/ Frame FA54 0
44 B 855ms
278ms Image
text/plain 18.179.156.111
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cc.adingo.jp/adx/push/?google_gid=CAESEEMQKeCOuaXZVIcP4e76HeQ&google_cver=1&google_push=AQvitUIOUolrwfl9UNX8oMo-poViAagA_t8mclSa7damuSlgiZb-T8_BmZvMnRGSS2ovJ2Nr3z98Z62twAWXicGC7WdJX6p4m7k
Requested by: Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.179.156.111 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-179-156-111.ap-northeast-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
server: awselb/2.0

GET
H3-Q050 204 attr
cm.g.doubleclick.net/pixel/ Frame FA54 0
223 B 94ms
48ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JjCWVkP_9x7_xYdxt1NFrzA9ASmA3dpdJGM53W1N4FPFQWiwT8rmR2UXNUhBbcRzpOtAkz

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 qcWZRcRw4fq915xPB9DSJSeGn7Tspit4rZWzDhmsliY.js Show response
pagead2.googlesyndication.com/bg/ Frame 871A 14 KB
6 KB 10ms
6ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/qcWZRcRw4fq915xPB9DSJSeGn7Tspit4rZWzDhmsliY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9c59945c470e1fabdd79c4f07d0d22527869fb4eca62b78ad95b30e19ac9626

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 16:22:53 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 13:45:00 GMT
server: sffe
age: 105055
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5666
x-xss-protection: 0
expires: Wed, 16 Mar 2022 16:22:53 GMT

GET
H3-Q050 200 DcmEnabler_01_242.js Show response
s0.2mdn.net/879366/ Frame DCAE 29 KB
11 KB 35ms
21ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/DcmEnabler_01_242.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9080429/1589458396737/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

77a6e7584722f285dd6b3039728b6f1aab3948e60b4c26298600f1a5ee155bbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9080429/1589458396737/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:23:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 593
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10603
x-xss-protection: 0
last-modified: Thu, 06 Feb 2020 15:49:49 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 21:23:55 GMT

GET
H3-Q050 200 gsap_3.0.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame DCAE 54 KB
22 KB 42ms
28ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.0.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9080429/1589458396737/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8154aa9057e3367d9d3e4bb1f85db9645c01fc0690091aadc57dbae849ba3499

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9080429/1589458396737/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22005
x-xss-protection: 0
last-modified: Mon, 11 Nov 2019 18:08:13 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Mar 2021 21:33:48 GMT

GET
H2 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/ Frame DCAE 86 KB
27 KB 11ms
11ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9080429/1589458396737/index.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 522385
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 27748
cf-request-id: 08e3b4ffcb00004aa97f314000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:11:48 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec4-15851"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=zN0IPz852spfhs8Cdf9oYdQZKjTkJiVmJO222SWziuYg7jxYCCZo8lWsZbuRJT%2B8EcZQUcC8c3hzvNUeG%2Fv%2BwD2F3Hr1MTURA6rODMRGe4vEAC2suBkSecf3hl7p1ff5dg%3D%3D"}],"max_age":604800,"group":"cf-nel"}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6319577948b84aa9-FRA
expires: Mon, 07 Mar 2022 21:33:48 GMT

GET
H3-Q050 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/ Frame 001E 21 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Acr2T5cAQDoHST5d7_QdEa4fJwX84VmRF3QcQaCl6mO9pa9iOWNYllw2U384U0CHIEUflPNmVfEHUixbHrPXgbAeAfCt11to6MjgeR4I7izekZe0aT2OAwUNKqEmT2ItMw-WP2TP7urg21_t4JtNcTUg8owQ&dbm_d=AKAmf-C6kqyAvxc1MOxkfShXA-cA2Wi8tlKVY-xPfS-aHwN-OCEBh24npBrOs8rOgBwXe_21uVSDtHtf0AGl3t_9jv31YJa_PsOor1i1TIXf3emCnMZAfN2lFbj352aio0EhhVdnwKOh6IgCakKe9o0napOKdu7Tg0rmTFIbcEWu_SeOM-Cv_rrXNjpnv0IBNH9msRF45TbJpooCmJMEpVcu6PYeRjqeL2DmKAPoWSAkoSj1SsLFZ9V_eq8PWhz8YZy5ZMUVhZQx4Wz4gLGan5YIHA0oa0qYsvv-dW4esdHaSj3aMvSLHNqXuh316QjepjLQHOwIZE4zmoC4dsTWKMFtM00KW4CrXd9rb65FiFRbbfluvihzmed0FsjIYef_YEZUgaqAqZNbFmqiDD5BWmjwSvX_s6LkrhiZCCNJOh0s8CmAJkgUbeJROozxUkoMDkq7sjoeuuMJFyC-I0MFHbAqJW2Q0x7_hbXdmvQ31V28RnoR4jVcLRZZ_izk8FGlFYV0nVxATQaH5s0J2Yjot2TVzL0VOnIPKiOkJm8flF4U_BiQ0w0YbsjGwURssywGSVt7Cth-Nt8dmNezsG-YDTpCPMnE5QItne72t8hRLaxqdRKHJI1T5My20BbQ_ajdneeHRWr83pZ5Kw_s0Ov1g20n1oJoUEf2is6WIZmld0FghuBspiMArF2qTfM4WTlw99wPDwU6byUqDVmtMQ6BugPovQVCdKT7QtzHXbCIxU-Gqtl6bje26lzh4gKICKwpT8AtPCV028-d5sOgUEuQX4LrQYmdP0CjT1TY_ODrRe1YkqwxB0paQg4Hl-QPxKSZ2GFRxCOWKJkWO4i3MIfAjMR6DkOoSvW1_5GlWbksKstxy7rz2jhWHM_cfX0XZXnstYuYZneK5iCO2qztSe17gG26MmG94V1eguIi0IwmEn7scNAK6nwoepnepcXmYbhG3ugCg3L7yZcutmgJ8XXHU8pbVWyw8vXexTNk-He5VSLkx-B7D4QNZI8kNyBkGuAGO6x-LHzdsTCUpOQdoX8j6Nm2wHLlf_PXk-eEnQuOE8R7AoY818v9Nx4hZ5H_vGc06AzqQBNZUAnla1Gn1Ro47zKAdNtRgEyhGPL6I86_SvcDNvJN1Rp6-1EaK2oRoIC2VK6SENcm0HdwbCszf0TiUqXwvQdtHeviXmLfe0QayEsCDtrcx47DtdYfimaLt7e0aLPIuW_cDoza0_vJaokmMe8lYIaNfTqrEfiZEDKmrkXvPD72N53VPbAP1ztTQ83AoQTFLRHrgqbpvGCw6wQcz648jjXSYH9Kbqeqx_mIYFexWHbnqNa1en5Crl8sRi3M13tf96kOwQst11TxCD9FWj2UMRdI2cURgi64xn4ORGMG5CihK5-uea6vm0tlhNLY1oyc0oAGU6-QCCWD0k1ZN33XEiGLZcVLc0egd0DMSpvCxvSvXUGU3Lhc7Py3cqT9_K95aWvmHprHmEZ9VEkkYkue0QvbOZX5mCRag_JSiLL6m7mtZESP868hN1BsbcoVzHCwC3mspyk9cfqbaf2_oTPC4yL0fUpVXXtPoenUAm0bv2hsXEd7RC3HGLi3A4dsO2AkgCGbtIVPRDvO6U0BFzgP0LMUUzIsGlALIZuKNAAkTy_rhwv6P3lcKh68x4w9khplNPhVW9NT9fsfL5h-__Bso2YJZtHnC62GXk5_VgCIPumGC9zwo2dbI1XxsDgPKgZlL8J-01WHGBuvQ2IrShfp7WdP-r5MPfXfq6QfC85kUJFIG6E4SF96_Z_f2NEzWZH2f1IfEixaUE0OE3fIkV5gbBgS3GVX6ernutRTMvKZHSzm0gLHf8l33Q0faoCOWOBNz2HXyYW9QbI-g8Faab5KuOp88gJ_V-vUlAvJM2NZtp7SJDyJXUj7UlGCAXoz8YAR_0T-VAhXZeLgC4eGdFMTKdtzIuN25k_hy-uldU9ztE06fecwq-XMw8IY6dEwOlX1ZI_DZjQE2LJI60h31MPk8Yi-zyBiWdrAI84offPriAJ3ZDn6hH2qhVn7pw4Q-llYh9HStLlMyq7WiYWrpK3ICqzPL4ewvXRW2H6ppkR2p3gYoPZGywAcFDXbnkRpbazorrLTbCs_JJYnAGmlaVB73gWI_sEuuz-6eW3epzX74nbWuRHLP6nOIBpNSJ2LtoG-FLB24pjHwOX0Zab7JzlWFPsQlaO1e1UaEfB9lscpAnkWED0TlJ94IL9W4mXDOfbxzIjO_BPLVD-hLaYaBAPeILyLn6JRpv6fyTuMSzm5bd2CjMlJeU-kjgf_ZSXad9bJd8V2hw2_lpLvtht_V6MNGufMwmX1o5St2HvR4LQqguMEV4ipG4Pc9kPlgq0yFG2fViUK_L_4HPmKmjG1cUXGTcLP2nwxfFJjVoUkpeKRMH0_a_KSmCTNV-dg4t1wypVdj80QwKXBa2nm9ca_HSpQ17xI-gK_Zh26KIcSeImm7fYepQcecYu3sq2FebaYr2t3KcwW_RklmOLXQ7FPSMg51EfbhJyv4YBeOhgm07erZNqAB1hfW6i4ZEthbwK9SoEuwVj9LnUr0FnwAEman72puvc89DBWVYxrWf6KZvCAERDzHqQka05KQNz-6Xq52fdrYH7KdUTFnbyiOxuSpfuG5kST_YcE34N8jfiuZbh8dllGusa1VHu5sYjkORUAqlmIVyYR72z2x7w-7ajOugYzw45MhDMBqaBgM9LeM9_se8uUBZpIl2U-VGOMNQzjqP6pHo0aG6NOKKb_kNptTV1mQPfFCsxTmnAy_kAk2c24yLYzqw-HiCcZS5x_O0Esw9krS74fkOzWKECRX42vzPNpWIf-LUoPEYDYMFt0TMpmpk67yW06UQBGkimTrQ4S7qqG3vDlR-jTXrFOdU7Fuju2-KRgMASGpgVAZH1BrHRBn4BLj9iFFbvyoro1tB2Ggvci3NJe425QPlQKWLqbEhbVoWA7OjAYVSkEHpmJXy_IiYK0hXYQqHgFEbNZnaGjEoawc-Y10-dbX1Nqcxr52PiuwbmtBhTz9ZmaVqqfSA6APKvqBQmLNmAiKP3h0D7BZytP_DbbNur4bNuLT4ccw1CzhGu75h28orbIJBz6tdu36OON4zVEkVDShnF2dGremh-aAAaNrdcyalbnGzAXTXzsp0I5ZWqstZm3IrHq9dCdwf91be3pt9SCHE8TbMKBGCqzsiKUAPm3Q7k6MckOhWsXrJ2lhvB-iG0AzRow-VuyNY4ZhCL4GVk&cid=CAASEuRo4ZsM8num09ttMomZ0tRuMA&rfl=1%2Chttps%253A%252F%252Fwww.reisekostenabrechnung.com%252F%240

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

70d82c6075989e0082b4917c6685f5f6bec1e673d0a80160eac61b3f1cdcb1a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8471
x-xss-protection: 0
server: cafe
etag: 753583566593306265
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:32:49 GMT

GET
H3-Q050 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 001E 41 KB
15 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 17:30:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 187374
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 15 Mar 2022 17:30:54 GMT

GET
H3-Q050 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 04BD 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 15 Mar 2021 17:55:06 GMT
expires: Tue, 15 Mar 2022 17:55:06 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 185922
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 Gilroy-SemiBold.ttf
s0.2mdn.net/9080429/1589458396737/ Frame DCAE 79 KB
36 KB 8ms
7ms Font
font/ttf 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9080429/1589458396737/Gilroy-SemiBold.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9080429/1589458396737/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d14179c52c8976762b2a18c43bf2bf151281ea48aaa8b2fd4433ea046cebba64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/9080429/1589458396737/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 20:21:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4326
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36779
x-xss-protection: 0
last-modified: Thu, 14 May 2020 12:13:16 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Thu, 18 Mar 2021 20:21:42 GMT

GET
H3-Q050 200 Gilroy-Medium.ttf
s0.2mdn.net/9080429/1589458396737/ Frame DCAE 79 KB
36 KB 9ms
8ms Font
font/ttf 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9080429/1589458396737/Gilroy-Medium.ttf

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9080429/1589458396737/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ea218661f49e28158ba378bd053b70c878adb09953e5ae48cab3768651a4abe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://s0.2mdn.net
Referer: https://s0.2mdn.net/9080429/1589458396737/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 07:03:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 52204
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36988
x-xss-protection: 0
last-modified: Thu, 14 May 2020 12:13:17 GMT
server: sffe
vary: Accept-Encoding
content-type: font/ttf
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Thu, 18 Mar 2021 07:03:44 GMT

POST
H3-Q050 200 view
googleads4.g.doubleclick.net/pcs/ Frame 7D46 0
515 B 167ms
69ms Other
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-Q050 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame 001E 111 KB
39 KB 33ms
20ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 13:10:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30215
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:10:13 GMT

GET
H3-Q050 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/elements/html/ Frame 001E 8 KB
3 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1246177.3716415IGNITIONONE/B25408918.296831033;gdpr=;gdpr_consent=;sz=300x250;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CZACQu3VSYJHkLYnI7gOE9rLYB_OLv9Rhj_mu5LoN2tkeEAEgpczXamD7gYCAiAqgAeLd28sCyAEJqQKMAU63JPizPqgDAaoEhQJP0JJ7pH18KU8DGN6pJusuJmNSVxUxr9KdnBM8aSmPWxQZIMHK1XwDy5ll3WpKXk16q76Z9CGIAmyZyk5wB5WmMrGWvoeiNuQqAtZPwd_7aS5FCFOedHyxtQzO8TJSiRZyUCkLbowb1LYu3cq_FqTdxm-LgETBpxLn-xaFYBw3mG6gZTMqVnI8AZLP22qcnMoG4CgzhhPimJoFJZfUgROhRNjJyrtsuevlgSQparW2J5dmCgMO1cZU_4O-QxmqD-X68ir_maPcMSfM0GYfXQarcnX3-aon4XX2KTny8XvTDF2hyWgm-nxL7HPr9xDGUnHMwzQ4VsIYw6PtlkZHYlGvkBy8SnLABNLOsOG0A-AEA5AGAaAGTYAHhqKktAGoB9XJG6gH8NkbqAfy2RuoB47OG6gHk9gbqAe6BqgH7NUbqAfulrECqAemvhuoB-zVG6gH89EbqAeW2BvYBwDSCAkIgOGAEBABGB3yCBthZHgtc3Vic3luLTQ0MzY3MjcwOTY5NjY1NTmACgOYCwHICwGADAGwE_rb8grQEwDYEwPYFAE&ae=1&num=1&cid=CAASEuRo4ZsM8num09ttMomZ0tRuMA&sig=AOD64_3kKowAhpL2jcIoUKz3sUJSfz7rHg&client=ca-pub-5902083285302779&dbm_c=AKAmf-AhUTy8ph3IIxkav2qWdnpXHYcWqGFyMxVFYC6y0PNJDh5RHtSlIqkvN-r7v5SUiaZf3EuiJZMa47Fc25qKt7PWXkq8c548b5ntU7xOqLnn2UoTVyCaNcDq1TlXunuNR_q1UX3IcwdFGu9I7G8kkEOzN-PVog&dbm_d=AKAmf-D0IdAeBpC3MDyISRyf4boeAYHW-OM3zRI15mjQORHuipxQ2PKu2TZK44s9asx5UeQ7MdomugXjEFOht8bgZhfv_blkWmUaC5RUyyX53dS5_h4pCTRolz9OVkrEzQ6FxU7Z14KlPKUe6c1UsWpfQWZKgmFpnGgDLI5aKY5XbpofDFGKIi6BLRodyP7TPacx32NH7ntuhD1Fxmemwnq6ZtBJhpjkYCAQ-TlDiWrnqcKlx4RKMDA3luYsw_iygeFvgA9hFFQCARXPhYi4_30LvTxObKwEGRebAhgPygmvHcrdhO73rvtKzQOZZF5SQa6I7nSj1bHDowHsPulDX6x4vpEEqA0vVdsKi3IsvJl7vac0BzO2-b6C2e697s5SJ-vCEL__BKX0LOmxVP3k4ONe1QrXp6AaBJM2wSkNcGSQu2M4y2BfAhC7gw9aXYFwWZj9an_eFSPr-6k3ipnB8GI1ttRetfSfOQ&adurl=;ord=1616016827750097;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:28:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 327
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:28:21 GMT

GET
H3-Q050 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 4DB6 1 KB
750 B 6ms
5ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 17 Mar 2021 03:14:09 GMT
expires: Thu, 18 Mar 2021 03:14:09 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 65979
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 001E 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eaaf0cf994d2fc2ccdd1cdca4a02d1df904b65b586b3ba4135764d7c631ed416

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame FEA8 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 15 Mar 2021 17:55:06 GMT
expires: Tue, 15 Mar 2022 17:55:06 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 185922
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 logo_White.png
s0.2mdn.net/9080429/1589458396737/ Frame DCAE 4 KB
4 KB 19ms
9ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9080429/1589458396737/logo_White.png

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

28161d419de84b0fb3c3bb264e0b244f907bb1bf505da450c833c34edf95d3a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9080429/1589458396737/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 19:43:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 14 May 2020 12:13:17 GMT
server: sffe
age: 6628
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3892
x-xss-protection: 0
expires: Thu, 18 Mar 2021 19:43:20 GMT

GET
H3-Q050 200 trust_Logo_White.png
s0.2mdn.net/9080429/1589458396737/ Frame DCAE 4 KB
4 KB 19ms
9ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9080429/1589458396737/trust_Logo_White.png

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b7dabd76ad06582c66fd0838e1e831a74a425bc01f73870eadd2ecc67af87b38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9080429/1589458396737/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 04:10:49 GMT
x-content-type-options: nosniff
last-modified: Thu, 14 May 2020 12:13:17 GMT
server: sffe
age: 62579
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4308
x-xss-protection: 0
expires: Thu, 18 Mar 2021 04:10:49 GMT

GET
H3-Q050 200 Ease.png
s0.2mdn.net/9080429/1589458396737/ Frame DCAE 36 KB
36 KB 17ms
8ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9080429/1589458396737/Ease.png

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7ab0362198bfacd73852b08292ca2765dbf4c1fba9acb4772f4fafabdd9f8025

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9080429/1589458396737/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 19:43:20 GMT
x-content-type-options: nosniff
last-modified: Thu, 14 May 2020 12:13:17 GMT
server: sffe
age: 6628
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36692
x-xss-protection: 0
expires: Thu, 18 Mar 2021 19:43:20 GMT

GET
H3-Q050 200 cta_Yellow.png
s0.2mdn.net/9080429/1589458396737/ Frame DCAE 3 KB
3 KB 16ms
7ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9080429/1589458396737/cta_Yellow.png

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3bde76c6950203c0ab0a0a7316bb04503e0d8aa5dfae95e4d7509256ca208186

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9080429/1589458396737/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 01:16:58 GMT
x-content-type-options: nosniff
last-modified: Thu, 14 May 2020 12:13:17 GMT
server: sffe
age: 73010
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2988
x-xss-protection: 0
expires: Thu, 18 Mar 2021 01:16:58 GMT

GET
H3-Q050 200 bg_DarkPurple.png
s0.2mdn.net/9080429/1589458396737/ Frame DCAE 1 KB
1 KB 11ms
9ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9080429/1589458396737/bg_DarkPurple.png

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8024f896824781eb08e614b5ffe0cbfd2020fe08cc833062010d7573714ecd4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9080429/1589458396737/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 14:36:35 GMT
x-content-type-options: nosniff
last-modified: Thu, 14 May 2020 12:13:17 GMT
server: sffe
age: 25033
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1449
x-xss-protection: 0
expires: Thu, 18 Mar 2021 14:36:35 GMT

GET
H3-Q050 200 qcWZRcRw4fq915xPB9DSJSeGn7Tspit4rZWzDhmsliY.js Show response
pagead2.googlesyndication.com/bg/ Frame 04BD 14 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/qcWZRcRw4fq915xPB9DSJSeGn7Tspit4rZWzDhmsliY.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a9c59945c470e1fabdd79c4f07d0d22527869fb4eca62b78ad95b30e19ac9626

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 16:22:53 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 13:45:00 GMT
server: sffe
age: 105055
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5666
x-xss-protection: 0
expires: Wed, 16 Mar 2022 16:22:53 GMT

GET
H3-Q050 200 index.html Show response
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame D6AF 4 KB
2 KB 7ms
6ms Document
text/html 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f37e108a103ae6d6ed4ca9047d415434b8a1edefa81ddb7d4314ecb21587010

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 1491
date: Wed, 17 Mar 2021 16:35:33 GMT
expires: Thu, 18 Mar 2021 16:35:33 GMT
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 17895
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-Q050 200 view
googleads4.g.doubleclick.net/pcs/ Frame 001E 0
27 B 69ms
68ms Other
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsumONnnLGAb16RHnwHaRDILSyCLBNxCJQ41eKOSeYm23rR6GJyQduno-0qs3oUHzUm__d9BA0mx7ueflpnmEVCz6A6IVGbNZqaNHBBpCXt72n4ZZHqxVgy89H5j8peayYAxCBnv3dVHLjZaguHnnqMFFC-1pBPKERgOrfaERhCB5g_3Ls2ZB3le2ieOGFM&sig=Cg0ArKJSzKeJzC5tq49-EAE&urlfix=1&omid=0&rm=1&ctpt=111&cbvp=1&cstd=109&cisv=r20210316.75174&adurl=

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 4DB6
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEJ_Mj-K1ze_BugAOR9vp93M&google_cver=1&google_push=AQvitUJpQDCD0NrLo8KaPmHlFSQHhKm6WSid6_7fOsBIELtYfplRSBvQJtnB6Xjzm25Jumxhu6LQiDt1S7S...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitUJpQDCD0NrLo8KaPmHlFSQHhKm6WSid6_7fOsBIELtYfplRSBvQJtnB6Xjzm25Jumxhu6LQiDt1S7SGnRJ3COmbFJ4zbEAg&google_hm=BElgAYj8RrKxkh-aCmuferw

170 B
190 B

44ms
43ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitUJpQDCD0NrLo8KaPmHlFSQHhKm6WSid6_7fOsBIELtYfplRSBvQJtnB6Xjzm25Jumxhu6LQiDt1S7SGnRJ3COmbFJ4zbEAg&google_hm=BElgAYj8RrKxkh-aCmuferw

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:47 GMT
via: 1.1 google
server: Apache-Coyote/1.1
status: 302
p3p: CP="NOI DSP COR NID CUR OUR NOR"
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AQvitUJpQDCD0NrLo8KaPmHlFSQHhKm6WSid6_7fOsBIELtYfplRSBvQJtnB6Xjzm25Jumxhu6LQiDt1S7SGnRJ3COmbFJ4zbEAg&google_hm=BElgAYj8RrKxkh-aCmuferw
cache-control: no-cache, must-revalidate
content-type: text/html;charset=UTF-8
alt-svc: clear
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 4DB6
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEGs9z2xJcBAXWrcCsrFr-3c&google_cver=1&google_push=AQvitUJ6iaUtnx_7rwUNtk-EnyPbUQHYWyPdd0jL9LE1GGa_YbFy1Qddll8mafmSZtOrQCDOmaiZJdOmMd_NMK6J...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=arR9pMK3Qnm-HUfmDcvQkg2&google_push=AQvitUJ6iaUtnx_7rwUNtk-EnyPbUQHYWyPdd0jL9LE1GGa_YbFy1Qddll8mafmSZtOrQCDOmaiZJdOmMd_NMK6Jupw5BO_aXyPA

170 B
190 B

46ms
46ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=arR9pMK3Qnm-HUfmDcvQkg2&google_push=AQvitUJ6iaUtnx_7rwUNtk-EnyPbUQHYWyPdd0jL9LE1GGa_YbFy1Qddll8mafmSZtOrQCDOmaiZJdOmMd_NMK6Jupw5BO_aXyPA

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 17 Mar 2021 21:33:48 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.15.12
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=arR9pMK3Qnm-HUfmDcvQkg2&google_push=AQvitUJ6iaUtnx_7rwUNtk-EnyPbUQHYWyPdd0jL9LE1GGa_YbFy1Qddll8mafmSZtOrQCDOmaiZJdOmMd_NMK6Jupw5BO_aXyPA
x-host: tde-deliveryengine-production-565b569db7-txt8m
alt-svc: clear
content-length: 0

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 4DB6
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEJEI4GoSmgLf_RM_r0eCqkE&google_cver=1&google_push=AQvitUJ5TB6VcmzO-_tUjScZp3tjtIRTKA439ipAAZLCz-CJNha9mHrm_irVjBDPtLgXSiKSGc7TKK8lctJBDfcJSj_N...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEJEI4GoSmgLf_RM_r0eCqkE&google_cver=1&google_push=AQvitUJ5TB6VcmzO-_tUjScZp3tjtIRTKA439ipAAZLCz-CJNha9mHrm_irVjBDPtLgXSiKSGc7TKK8lctJBDf...
https://pool.admedo.com/sync?ssp=bidswitch&bidswitch_ssp_id=google&bsw_custom_parameter=8e0d0586-6ac2-4caa-9fac-f91705e2e8cf
https://pool.admedo.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=google&bsw_custom_parameter=8e0d0586-6ac2-4caa-9fac-f91705e2e8cf
https://x.bidswitch.net/sync?dsp_id=23&expires=14&user_id=e46d74c3-7247-4d25-bb09-0a381c191b93&user_group=1&ssp=google&bsw_param=8e0d0586-6ac2-4caa-9fac-f91705e2e8cf
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AQvitUJ5TB6VcmzO-_tUjScZp3tjtIRTKA439ipAAZLCz-CJNha9mHrm_irVjBDPtLgXSiKSGc7TKK8lctJBDfcJSj_NZmFfyX8&google_hm=jg0FhmrCTKqfrPkXBeLozw==

170 B
190 B

44ms
43ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AQvitUJ5TB6VcmzO-_tUjScZp3tjtIRTKA439ipAAZLCz-CJNha9mHrm_irVjBDPtLgXSiKSGc7TKK8lctJBDfcJSj_NZmFfyX8&google_hm=jg0FhmrCTKqfrPkXBeLozw==

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AQvitUJ5TB6VcmzO-_tUjScZp3tjtIRTKA439ipAAZLCz-CJNha9mHrm_irVjBDPtLgXSiKSGc7TKK8lctJBDfcJSj_NZmFfyX8&google_hm=jg0FhmrCTKqfrPkXBeLozw==
date: Wed, 17 Mar 2021 21:33:49 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H/1.1 200
OK us
sync.go.sonobi.com/ Frame 4DB6 0
474 B 38ms
37ms Image
text/plain 178.162.133.149
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sync.go.sonobi.com/us?loc=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dsonobi%26google_push%3DAQvitUIN-t4JJeGvSw3K3ppA4-C4it_wGNBSe-N6pPVGuBmq9A15HBQABLdNxdSH6VuL6HGjhiDvm-MsPBqnELaGrlMBQTK3JPhW%26google_hm%3D%5BUID%5D&google_gid=CAESEIDctYO7hc1tzJiJdUKwl9k&google_cver=1

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.149 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-sync.go.sonobi.com

Software

sonobi-go /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:48 GMT
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: xcp-ams-1-7-9
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache, no-store, private
Tcn: Choice
Content-Type: text/plain; charset=utf8
Content-Length: 0
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 4DB6
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESENsNd6HI1fwHGKwujMi3PuA&google_cver=1&google_push=AQvitUIqK_G9LU1RHcqv3UXcYpPI69WOAJdKTNIFpMJDcMRFoj2iNW1558W1sL5biS9Fz1E-Vf9WSkM8W43NHAjG...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AQvitUIqK_G9LU1RHcqv3UXcYpPI69WOAJdKTNIFpMJDcMRFoj2iNW1558W1sL5biS9Fz1E-Vf9WSkM8W43NHAjGgXltByHsvNy6

170 B
190 B

43ms
43ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AQvitUIqK_G9LU1RHcqv3UXcYpPI69WOAJdKTNIFpMJDcMRFoj2iNW1558W1sL5biS9Fz1E-Vf9WSkM8W43NHAjGgXltByHsvNy6

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 17 Mar 2021 21:33:48 GMT
via: 1.1 dfeaf865724e57eaac72220929416926.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: DUS51-C1
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=AQvitUIqK_G9LU1RHcqv3UXcYpPI69WOAJdKTNIFpMJDcMRFoj2iNW1558W1sL5biS9Fz1E-Vf9WSkM8W43NHAjGgXltByHsvNy6
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: 6CY2CB16ffhyhSvy4nf1KyzmyFrbJ1OvOd68dAtkyRBabQR_euuzeA==

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 4DB6
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESECk3VgYNvjEYw63UYKGF9Ho&google_cver=1&google_push=AQvitULPW1164hkvZ04I1H5om_fDTd8UvWoBJDO8GwmySkJag3tT7dbPkERU59j6P1e2u5T0_p...
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESECk3VgYNvjEYw63UYKGF9Ho&google_cver=1&google_push=AQvitULPW1164hkvZ04I1H5om_fDTd8UvWoBJDO8GwmySkJag3tT7dbPkERU59j6P1e2u5T0_p...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS01cUJFcHp0RTJ1SFNzN2JzZF8uY0VPWWpLWnBIYmNIM35B&google_push=AQvitULPW1164hkvZ04I1H5om_fDTd8UvWoBJDO8GwmySkJag3tT7dbPk...

170 B
190 B

44ms
44ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS01cUJFcHp0RTJ1SFNzN2JzZF8uY0VPWWpLWnBIYmNIM35B&google_push=AQvitULPW1164hkvZ04I1H5om_fDTd8UvWoBJDO8GwmySkJag3tT7dbPkERU59j6P1e2u5T0_pSNizy98dAVbGkQzuz42-40aXLr3w

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:48 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 17 Mar 2021 21:33:48 GMT
Server: ATS/7.1.2.128
Age: 0
Strict-Transport-Security: max-age=31536000
P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
Location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS01cUJFcHp0RTJ1SFNzN2JzZF8uY0VPWWpLWnBIYmNIM35B&google_push=AQvitULPW1164hkvZ04I1H5om_fDTd8UvWoBJDO8GwmySkJag3tT7dbPkERU59j6P1e2u5T0_pSNizy98dAVbGkQzuz42-40aXLr3w
Connection: keep-alive
Content-Length: 0

GET
H3-Q050 204 attr
cm.g.doubleclick.net/pixel/ Frame 4DB6 0
16 B 43ms
41ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Jr7-Bletf2xilMspFffEmC9v8eFOnLAG4Aco9VYhe7jB-Ecz1x7RLeVtSuke1WWhA

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-Q050 200 container.html Show response
56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 1616 6 KB
3 KB 35ms
20ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e86479d6e54449d1085c2149e190a615c6bead407b20bacbcf5852b5d65f1fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.reisekostenabrechnung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.reisekostenabrechnung.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2973
date: Wed, 17 Mar 2021 21:33:43 GMT
expires: Thu, 17 Mar 2022 21:33:43 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 5
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 style.css
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame D6AF 1 KB
547 B 7ms
6ms Stylesheet
text/css 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84c65cf6dccd23cbcc0603f73e434c41a4086431756078e8bd2c7a1ff182066f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 17895
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 511
x-xss-protection: 0
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 main.js Show response
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame D6AF 1 KB
644 B 8ms
7ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4e3441f0da47965d475c902c09d9c269054457d568226269c23335e0d43d766

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 08:41:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46336
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 563
x-xss-protection: 0
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Thu, 18 Mar 2021 08:41:32 GMT

GET
H3-Q050 200 tweenmax_1.19.1_92cf05aba6ca4ea5cbc62b5a7cb924e3_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame D6AF 110 KB
37 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_1.19.1_92cf05aba6ca4ea5cbc62b5a7cb924e3_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62b1cff44a5e34b9587ad49f7ca951160f1559c5c545bcf99e13574ccaa5425a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37930
x-xss-protection: 0
last-modified: Tue, 20 Jun 2017 21:14:35 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Mar 2021 21:33:48 GMT

GET
H3-Q050 200 back3.jpg
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame D6AF 32 KB
32 KB 7ms
6ms Image
image/jpeg 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/back3.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

24fafa96014bb69b2d14236c4982326ae80293f8d04891dd080dd094084f8320

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17895
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33176
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 text4.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame D6AF 1 KB
1 KB 6ms
6ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/text4.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

498e1816875171bad3e7bee172b561231eb2f8aa004e9b872fd5b651f5f84062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17895
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1050
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 text4b.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame D6AF 3 KB
3 KB 12ms
10ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/text4b.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

01b91c27c2dd8d42bf4832466bfb4d3f0ab2eff59e855e4ad8446dc626637cc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17895
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3216
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 cta.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame D6AF 1 KB
1 KB 11ms
9ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e25fa1dc383dab10261f885d1c39a604525d2cd2ea6ca908e2c2375c07e3884d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 22:45:59 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 82069
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1239
x-xss-protection: 0
expires: Wed, 17 Mar 2021 22:45:59 GMT

GET
H3-Q050 200 nissan_black.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame D6AF 1 KB
1 KB 10ms
9ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/nissan_black.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

39e4c6e25be371a3026dc5ea8ae0e23e953d6916518811fcc5c1a1769767ab16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17895
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1420
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 back2.jpg
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame D6AF 33 KB
33 KB 9ms
7ms Image
image/jpeg 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/back2.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91b4244ebe9f1ca90ed84b8b5c9fe2f340e35d55df94c668b89f824d57e9010c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 08:19:39 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 47649
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33890
x-xss-protection: 0
expires: Thu, 18 Mar 2021 08:19:39 GMT

GET
H3-Q050 200 text2.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame D6AF 1 KB
1 KB 10ms
8ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/text2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4139b3e7ead7268f5e730fb9b32300273ce262da28ed4bdff16508d8d6d7314

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 19:35:11 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 7117
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1354
x-xss-protection: 0
expires: Thu, 18 Mar 2021 19:35:11 GMT

GET
H3-Q050 200 text2b.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame D6AF 3 KB
3 KB 9ms
8ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/text2b.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd8cc56d4953209cb0bd10a1198b3726b03857abfe648c987b6dbd4e0f63513a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17895
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2791
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 back1.jpg
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame D6AF 34 KB
34 KB 12ms
10ms Image
image/jpeg 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/back1.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a25f4e403cd3009578cf6ca056afac33ed6aae8f47d1ab575756804b52be203a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17895
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35261
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 text1.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame D6AF 1 KB
1 KB 12ms
11ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/text1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9d9f49fc378d4322355f7fdf35e213afc7f835ab2542b772a4e25802a5ac5cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17895
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1337
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 logo.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame D6AF 5 KB
5 KB 11ms
10ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/logo.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd5a91913a74d6a43b060f616dd109816717a7cfafa30f62e08890e3986758a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:07 GMT
server: sffe
age: 17895
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4973
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js Show response
pagead2.googlesyndication.com/bg/ Frame FEA8 14 KB
6 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25c788c3d6b5a5f5931ef45abc5640af29b16f379c2e1634dc32c6c225327f38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 16:25:17 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 13:45:00 GMT
server: sffe
age: 104911
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5657
x-xss-protection: 0
expires: Wed, 16 Mar 2022 16:25:17 GMT

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
310 B 18ms
17ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTQwOTM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MTYwMTY4MjIsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwNTI3MSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiI0In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxNDA5Mzc5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTA1MjcxLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiZjA5ZDRmZWYzODE2MWEyN2QwMjhjZmY2ZWViZjQzYWEsMzNkZDUyM2Y4ZTRkZGExNThmMGFhOTk2ODZkZGE3ZjIifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjE0MDkzNzkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MC4wMDAwNiwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDA2LCJiaWRfZmxvb3JfcHJldiI6MC4wMDA3LCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDUyNzEsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxNDA5Mzc5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTA1MjcxLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgyNDExMjM1MTcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjE0MDkzNzkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDUyNzEsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjQ5NzQ5MDUyNzEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b5014f000005f112080000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ftNymIFQWlK9a5ivy4JO%2FkqNdCBHWzdEfY8V3Jp4a4Qbm7ISdxEYpYHwqaJzg2PO7mpbvnrpWwIcQEaZOssK8kIiQ8dUmBRx71TjA8Rr1d%2B0vu%2BxtYpT%2FQc7yxhmPuZyfX5XKIVAjiJtpw%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319577bbba205f1-FRA
expires: Tue, 16 Mar 2021 21:33:47 UTC

GET
H2 200 4974905271 Show response
g.ezoic.net/dac/ 0
17 B 43ms
43ms XHR
text/plain 3.127.76.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/4974905271
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/porpoiseant/banger.js?cb=192-2&bv=13&v=46&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.127.76.126 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-76-126.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 17 Mar 2021 21:33:48 GMT
cache-control: max-age=3600, public
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
313 B 22ms
21ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTQwOTM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MTYwMTY4MjIsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwNTI3MSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjEtMDMtMTcifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIyMiJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiIzIn0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6Ii02MCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b5014f000005f10f84a000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=HGpeDU2CPcgp77w9OdC7wffJQ%2BWGmB%2BMrGotBDIfMcDJ2h0crP%2B2tsi6oCzN3KcH%2FxUMHYyuEwYmYQogi2grpY3qUXGrmnBm%2FtuUJXDV8QnxTwWwNHYgJsPulBLrObe%2BMV%2FrwAqaoU2nOQ%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319577bbba505f1-FRA
expires: Tue, 16 Mar 2021 21:33:48 UTC

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
285 B 23ms
22ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTQwOTM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MTYwMTY4MjIsImF1Y3Rpb25fZXBvY2giOjE2MTYwMTY4MjksImFkX3Bvc2l0aW9uIjoxMTAwLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiYmlkX2Zsb29yX2luaXRpYWwiOjQwMCwiYmlkX2Zsb29yX3ByZXYiOjcwLCJiaWRfZmxvb3JfZmlsbGVkIjo2LCJhdWN0aW9uX2NvdW50Ijo0LCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo0MzksIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjIxNzMyMTE4OTE0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDUyNzF9XQ==
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b5014f000005f108374000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ffDDOKfdJrfLjlh9U8bLfP%2Be7HMbwZzMajQS%2BRF9qYO7Hrfg1ckQdeT6owCpAPhqX63Ei8TjiI0GmHGlnQLhxSUOwhnRdYtLevmwU3m%2Fs2JUKzhF2wMkBGw6y4iGiIzCEiqQfB32WIS2hg%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319577bbba605f1-FRA
expires: Tue, 16 Mar 2021 21:33:48 UTC

GET
H3-Q050 200 integrator.js Show response
adservice.google.fr/adsid/ 107 B
146 B 15ms
15ms Script
application/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.fr/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
146 B 16ms
15ms Script
application/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.reisekostenabrechnung.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
10 KB 325ms
325ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3033921947969389&correlator=3010413803431458&output=ldjh&impl=fifs&eid=31060312%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C330x340%7C310x360&ris=1&rcs=4&prev_scp=a%3D%257C5%257C%26iid14%3D1343379%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1343379%26eb_br%3Df09d4fef38161a27d028cff6eebf43aa%2C33dd523f8e4dda158f0aa99686dda7f2%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D6%26br2%3D160%26ezoic%3D1%26nmau%3D4%26mau%3D3%26stl%3D84%2C152%2C194%2C27%2C94%2C122%2C91%2C20%2C26%2C201%2C187%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C18%2C19%2C20%2C17%2C18%2C19%2C20%2C17%2C18%2C19%2C20%2C17%2C18%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D10%26reqt%3D1616016828807&eri=1&cookie=ID%3D3378e19534576578-22418ba2d3ba00e2%3AT%3D1616016828%3AS%3DALNI_Mbw7QmSFj7WTp23nAbyy0gPdeyKIA&bc=31&abxe=1&lmt=1616016828&dt=1616016828810&dlt=1616016823096&idt=605&frm=20&biw=1600&bih=1200&oid=2&adxs=348&adys=950&adks=3971918856&ucis=j&ifi=19&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=984434283.1616016824&ga_sid=1616016824&ga_hid=414760384&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

83bc9c7d0ba363ee8e4f48002596290e8c08cd64b3e510a00ad5a0af0cfbef3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9789
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
10 KB 367ms
367ms XHR
text/plain 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=3033921947969389&correlator=3013070789610009&output=ldjh&impl=fifs&eid=31060312%2C31060367%2C44739387&vrg=2021031101&ptt=17&us_privacy=1---&sc=1&sfv=1-0-37&ecs=20210317&iu_parts=21732118914%2Creisekostenabrechnung_com-box-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C350x320%7C330x340%7C310x360&ris=1&rcs=4&prev_scp=a%3D%257C1%257C%26iid14%3D1343379%26iit%3D1%26t%3D134%26d%3D129856%26t1%3D134%26pvc%3D0%26ap%3D1103%26sap%3D1103%26as%3Drevenue%26plat%3D1%26bra%3Dmod38%26ic%3D5%26at%3Dmbf%26adr%3D399%26ezosn%3D3%26reft%3Dtf%26refs%3D30%26ga%3D5302779%26rid%3D99998%26pt%3D1%26al%3D1001%26compid%3D0%26tap%3Dreisekostenabrechnung_com-box-2-1343379%26eb_br%3Df09d4fef38161a27d028cff6eebf43aa%2C33dd523f8e4dda158f0aa99686dda7f2%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C11304%26bv%3D3%26bvm%3D0%26bvr%3D8%26shp%3D1%26ftsn%3D3%26acptad%3D1%26br1%3D6%26br2%3D160%26ezoic%3D1%26nmau%3D4%26mau%3D2%26stl%3D83%2C13%2C120%2C67%2C51%2C0%2C66%2C20%2C71%2C30%2C0%2C31%26deal1%3D21%2C22%2C23%2C24%2C25%2C26%2C17%2C18%2C19%2C20%2C17%2C18%2C19%2C20%2C17%2C18%2C19%2C20%2C17%2C18%2C19%2C20%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D10%26reqt%3D1616016828811&eri=1&cookie=ID%3D3378e19534576578-22418ba2d3ba00e2%3AT%3D1616016828%3AS%3DALNI_Mbw7QmSFj7WTp23nAbyy0gPdeyKIA&bc=31&abxe=1&lmt=1616016828&dt=1616016828814&dlt=1616016823096&idt=605&frm=20&biw=1600&bih=1200&oid=2&adxs=348&adys=688&adks=3971918857&ucis=k&ifi=20&u_tz=60&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x262&msz=300x262&psts=AGkb-H9awlplzm3R5rYar7qljqzk&ga_vid=984434283.1616016824&ga_sid=1616016824&ga_hid=414760384&ga_fc=false&fws=4&ohw=904

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

9ba3dcc29141bf41b69a403d7fa22bc24ff9850377c50586c621737138623d6c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9775
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.reisekostenabrechnung.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
283 B 27ms
27ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMCIsInRfZXBvY2giOjE2MTYwMTY4MjIsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjEyOSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8xIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMTYzIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQzMzc5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wXzIiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJ3b3Jkc19iZWZvcmUiLCJ2YWwiOiIyMjkifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDMzNzkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTBfMyIsInRfZXBvY2giOjE2MTYwMTY4MjIsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjI2OCJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTQwOTM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MTYwMTY4MjIsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwNTI3MSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjI5MSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b501b8000005f11e853000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=UxD38RyMC9aPlsni1o9sALr5fU3PiD%2BtzuP16hisk4lG0gpmMK7Q%2FHdpcaa0EA9ELLvY4A5pQB0DXWeYWnQ4AHBaS20DoRRnbl4StEoRMlHC58sKgfB%2FLBGaCoALzvx5gpFFnFDSxmpWvA%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319577c5c8a05f1-FRA
expires: Tue, 16 Mar 2021 21:33:48 UTC

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
288 B 26ms
26ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMCIsInRfZXBvY2giOjE2MTYwMTY4MjIsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMzQ4In0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiIxNDAifSx7Im5hbWUiOiJpc19mbG9hdGluZyIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQzMzc5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wXzEiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjM0OCJ9LHsibmFtZSI6InBvc195IiwidmFsIjoiNDE0In0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8yIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIzNDgifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjY4OCJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDMzNzkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTBfMyIsInRfZXBvY2giOjE2MTYwMTY4MjIsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InBvc194IiwidmFsIjoiMzQ4In0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiI5NTAifSx7Im5hbWUiOiJpc19mbG9hdGluZyIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxNDA5Mzc5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDAsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTA1MjcxLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIwIn0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiIxMDY2In0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJ0cnVlIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b501b8000005f1f302e000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=aYUY7wCQu%2F3XXd0vVPR%2Fn%2FfBwfiKZ6jj3r65WXI5wQflUAudpMhZDD4klhTcT%2BcUmQcQ15eYgRn6mZ5Vps7LiLozHb%2FJ9ko9OYthtCpNANWpBU20XpOCaDvVHiQ3uvrijXGmBs1t6pL1Yw%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319577c5c8b05f1-FRA
expires: Tue, 16 Mar 2021 21:33:48 UTC

GET
H3-Q050 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 4E83 656 B
443 B 45ms
43ms Document
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN_j2ZQCEJbW-a8CGMu_9Z4BMAE&v=APEucNWFQe3opkrn5n3BjBlmWHjvtFpQd-gCs3NnuOLU09ghOXTYhzNhlYx1lo8dfFT17Gv9jpxe4jlJiSzMV2ji8NcLc0MVkjl9iuhH3K8PCqa8fyn-wLpoGKcCIRFTRGG_RnyJ6bBMxbAEAVX47VwVKHLSN1wfZ7YIucA4e3ZodwrmMv-9Falzr_-JXfqcz9H1RjgJdhr35ul9nIvGCDc9w8HRT0kUTnGT68vhbR7M8h1ZuNFzBgk

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

1170a116f6521465e0d4f0df36d070b1502f257e88dbeb459d31d3e2c3fb861b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CN_j2ZQCEJbW-a8CGMu_9Z4BMAE&v=APEucNWFQe3opkrn5n3BjBlmWHjvtFpQd-gCs3NnuOLU09ghOXTYhzNhlYx1lo8dfFT17Gv9jpxe4jlJiSzMV2ji8NcLc0MVkjl9iuhH3K8PCqa8fyn-wLpoGKcCIRFTRGG_RnyJ6bBMxbAEAVX47VwVKHLSN1wfZ7YIucA4e3ZodwrmMv-9Falzr_-JXfqcz9H1RjgJdhr35ul9nIvGCDc9w8HRT0kUTnGT68vhbR7M8h1ZuNFzBgk
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmz7gXw1XfKVul9v1C9aFcoMkKC-S8nU6CYsVWxeLJohLENMnpGHv3XLtBAxFs; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 17 Mar 2021 21:33:48 GMT
server: cafe
cache-control: private
content-length: 284
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Wed, 17 Mar 2021 21:33:48 GMT

GET
H3-Q050 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9FC7 23 KB
12 KB 67ms
65ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A5X3k5YN9D0yWOLocigHpBYasZjR6hEiir_uIRxfZBaxgyjz5q3lvoOUkThOQGn6dRr-I_iKsaW8aW5rIGr25L4iSUMpXL3YRqnCvHlV4UiY9CtfrAgRcZx6AIAwxlfYJkb1PQ5vIiKmzYLGFF-ajTxQC2Qw&cry=1&dbm_d=AKAmf-BCvHUdnYaSglZ4VBapCkkNx1-bwlPHw4AAzIF_y8wgqXBUDvRObVopy02g2po8I3kYsyw6Xf8nikrQonzrcBNnQZY38k9ZOrCZ5HPpo5g-6xtexvSpbTU-HUY6VPTmQ99w7_cfhxF3LhjZ36m6CLPVCvm70Z_nUM2daDDV-yH-62o0qQOCg8mXYg48sdW5cWTEXYjrVFOAjBsYvxd2knUTb1HdRvBOx5KFN_WWs6kgtiKoartuAQS8I0bPTNiCr1bzN67KY5HZFcTt_NZIQRCmLlULnkie8GIqrVs1KfblvKniXpzamqsswP06jHToJHG6Rl5JbP_1YqJD0_Z6VkxCtmLqJgCRSRtSXhG2b10PajP5gZXJWqi7fXbwvKzCZvRKbk-EqZASqFFvNAqEHtfwWqiWnIdfpSrWzn074x35ch0S5zly1zCI6XZMxxa8QHphu6BKDFF5OxHQAYZn7AcGG2Z4TpfletiAN1wzSy9AkR5_Ty2eAzXYbcHKk-fuI79L8lP3eb2apnr9ngjutulpNg7MMnSTrQrkHSl6DkVWVdZqlJTvoMlHthSY7sWNtfi2tSYfWu-v_fWfzTkSHoXXWbADuejm7Qh6_gfgWy5DC3X7AJOhe7EgQ6tn0GKvP5cwL30mu1Hok9c391PTK5imqpSm3h9oC6TqsFht6ZqYgisJtc6JQJ35Xu3gZJaoOeoMti9gTeb77UZPrsfQL1Mo4UgfLpgD37XBhyhdE2U36ylySUMv8jP7FaxV6xxEF3-poyqadKdvw9EpbbLk4AECSzPhJe1_chlmUWFaZhgGjhdy-sW4TfzLDhslvB2LLYY8yuBW8LrXEyTkXfcS1h4fYmbSa1nc7e6440A7eVyB8zZCjAm_72NSreQ0HD8oi90_vbsEtezuvVxGty9KTnWWhCwR6V4bHrJs2ho5s6MHWIHgIIJp02Rjt7PzAfMZZ0zuL_hLmlZx7qTDtorgYUqG-b2kJfMvRLBuBUGdD51gi1Bs_M_vE02QvNVCcJvBmXOxkMeBSlzEg3V5uHkzUU_QpHk0vKI-sl8t0vUojcmegTZy1uTmVMJEwSAvAUAtWd9X367rqBJpO88XwIi_CDiokMk0SR1OOQvi4K6c3u2qUguEB8DUrKeXOAQwVni6mixSAcmPOtuyY6uqvIWFSzYsyW2jBgt6jhlsjw4MOiBTLYHsYNWRtkFdetTYd_JVv5e7uTLCdbM2oudrKQlH_BBdhbmwPGJg38ZjCYMBBnJFcBRkAj_L1vvgs96kwj8qes2YRqYDKK6DbJHtf-WHacKdiaelocGt1aqIBoJWXWH5uOdTiJaNl5pKszQFKYqJ6P0erAj5tAQTOo40RBo7nhU8aSdghqyPUKJMwEbiDwYpIVktV8_bwm0rv_NOqtNq5F7OtHzqiecgfkxJqXyKfZrTBpPUPBnrje7zjK-vlaOQh8c3KaBtkpKXu-McXmkYcobQ35NfxDhvQI9cPBZwyqOKtAYu8sm_mTD1qeGUJ02xiIgDZb3ziy-Q5weSuGeZwO1_GX4ZHSUx2s_1CbdzuSmFHD9okHwctafVu0mJOTMW_xiPKIjsMBXO9OdS2p0HpeT2IL8wrL3SsoC0a3lraF_P16ZHYsUJ5Pf76wgJKhViL3gLSG3vHecXIGCZpaaKB1MaFc3O7H7nMGZ7pN78YPIII0btRzjLvY2Ij2HZutSfpgi2VRoeeJVX1ZW5SG6D5gYSdBYBnWZ7ExC1pifk5xBAmrazZ4_Kfi3mTLbMnE019CxyR0NPY3exS5hUH2qncNfRZQtpbLhfX4MlZNs715VEGCI7t3jFV0lkCr4vdTwqr3dwNqdeLiu1LDi2VU2YO7ehvUQoWJGFOvoEtcXUMYBsMXs5KJa3b3ehgZ3dGcKlYED8FlAHjVoi1LjdNjRIdAXnX_2mH1g32QJC035yajsxfetj2kCiC8isaW0Xb_EcRza_fIKqM60AryrgUDSvTzMyg9G2lmszOeKlNvjWsxzZO9hCwN1Ru_q3jT7pH6_6Dkmc-GmSipbAQjWYGIW1wCUgnTF533VC-nSLThznRfS_HqQ74CWHCF-MGc8gPcdcfDd0ZIUDE_NEtpFAO47lDhVVVZzQd0MqCrpjoUNNQgj2Dprzc_vxs1lCvEoZ6AFwlJ4OvAbsZjvJDLfx6WxNs0qUuRXYZX05r0r62vOWbp2GOmjPMRWizaGWMRcMm9sFMwRu7I2VezA33wuIyx8BgMRpIWanugTOAe5eGyirQJpfbx3R1TIatUgn3pKuPsayoE248E0xStYAbZFFQE_tu89hRf1Divv-MUEFoPj3W3zYttSnjb-k0tNAgMqy_7Mph6LyyY-vm65QdkrKECYRhMlttFjSLkT2_GRBdgvE23yxOAUuM3BJwMxt_ZmD3uuxXxVzFDE2F2D9OjHxT7LGh5-yVQvU1Mu_rWqhEOUcQgC6jrPBOvtzXXvJyzHDvmuZoe3gGR4xsT2SvNprpvt4IADP1KGRaP9dcateyZQRp5m4ryNiYWM3dHdNpDQr15xeP7gP7X0XJ5ZoqtDTbHfxV1spYbIYEMUPuyqM7O8m8BkrN-naEd86c3Qm7cHm3IY5aUnDJj-IQ8OAyRtwNN0vQE0xvTo2TyXn4LxBaeq9jRZsCpqSKA6bIGR3PNszhUNRHxwstmThkarw4DNBaFGPCTGz9GplrbUf8ZQbt0DptjojViiFrV2tPzwqtv9LbfCqDVRQHYJv1dT_VYV7zHgdb0AEyuDCMMF9BVIExZ4hTmncfKVS-gFSRXJZOMs_JZSkNdHqcn6RUJEaN2By0pMy377Igpc-Nwo75YUTb3CdonYg5VkIUCr6MbwyLvVI15H3Upgx9SmO-iUIUX9wXD3ncw9qFw9WKkjPAry8qfOwyqofX5oaKg0Hh340ogDhoVys_ykbWRnEoRg6rJHzemVkbHtDS0I7Hqgn6ktnH4bUdJd1WqZOY7XWl4FkU1cATMdaOiMpFURQpXz09RjbIMgeDr1BNsJ5LjzLr9bL-NROwxXQeJvATJtDsgILUnEbDoocgD5o_WbDml_af8ywBU4o9i_UqnlO5a69g264UFC0geTQbX9uoHV9JEt3d5K0CTMGfRgYkAfGRpfyZDIwOnev3jKmDUZ8JHYo-dgfxUvsxKY_5QrtBJI_U7a9mOSSOsKLP8xhJe17L6rMFSU5tdrXnvhmHDgdEGgntykEYp4zBXiScMB-O0iDdr9_EZ0AgFfO0Qd-8YGy2gd67N1dzYlF-k8pNTcHZq98NgfekT943237az5DumZ4MqyG8xhojdPY3fPSWK-HQKpFhCAHc6YlABIGLGjw62zz-OrCIcu5bcjJpUeSHweG17qW_mjimkDqUoAHJzPguMpkwwsEFVeXvv7CjXYZ6mOgaRX36Zx1vVyTqTjgi-mD2zkhr58LoyIkvTnVrcW45unxsNPdkWO3kDwoofPt13GwTpfZcyLHDLtQt810aRLo7jq7fTaGFL_r65h5yskwUkt0jUGGxhS8GvfPKQHW&cid=CAASPeRonUriMgQtamsmiUO6vw-iFuVB1r-eFSS1cPqV5UEkRh3R11IpkAN36lRVl4PgSV9r_HyBNz7IzP-EbWw&rfl=2%2Chttps%253A%252F%252Fwww.reisekostenabrechnung.com%252F%240

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

0d4072b36aa1a5fdc3d7f63f495c0217d7fae137a403588b4a312deabebdcdb7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11774
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
fw.adsafeprotected.com/rjss/track.adform.net/568657/51893927/adfscript/ Frame 9FC7 226 KB
75 KB 167ms
80ms Script
application/javascript 52.17.202.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/track.adform.net/568657/51893927/adfscript/?bn=42916151;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=ClCDRvHVSYJHIE6z5-ga36peIA-iKsddhu5GSkKUN7aa7j8oiEAEgpczXamD7gYCAiAqgAczrq9AByAEJqQKMAU63JPizPqgDAaoEgAJP0EM6yFRgB_iVyTtq3dgQ21xQc9R6hrzsAaGNYT-EtGSxpGPiY39TfUlrm8Lqgj3IgUB5bNUB2r0YpYKlvEtCpccrIXiHCvtoYR-2dUeUaXFVbnvgtvjWFJmqN_38d2Pzt40UwyRz8f4GK2_N4Szf8wFdcbPqOOiH7-03M_82gwAXs4YgNtod8z5r8U_CLAUgiGg80YdKwneU7iSRw0D1TjZs7psORX8SXmfMI0CxB5j_bv7JKP7G85GS06ADHEmWDsCLVJx3SFLQ_Mdh3RYUy860J2I2Jb20qZKpuoK_RVs5bN-fUYhLAbc4Z8KzgHgkk4DCNbW0a2Yyhe8Wzf0GwASk983nzAPgBAOQBgGgBk2AB5yU1K8CqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RuoB_PRG6gHltgb2AcA0ggJCIDhgFAQARgd8ggbYWR4LXN1YnN5bi00NDM2NzI3MDk2OTY2NTU5gAoDmAsByAsBgAwBsBOqrP0K0BMA2BMD2BQB0BUBgBcB&ae=1&num=1&cid=CAASPeRonUriMgQtamsmiUO6vw-iFuVB1r-eFSS1cPqV5UEkRh3R11IpkAN36lRVl4PgSV9r_HyBNz7IzP-EbWw&sig=AOD64_1B35qtMqeP5ozNU_FsFFBxVYyQkA&client=ca-pub-5902083285302779&dbm_c=AKAmf-CpBbYHKLDdgNf6Gcg7M9fWXPvs5MQS8UniXewdxygsS5t2wmorB3rrcSQ8lW5cvO7EQ4_Rt2AV0MkX8TbqoYpP5lseYImQ8VZ-DmWcf5zNMJ7Ea_AvZ1CK51b3rxMdawWvoehCGj0VFOx_D7oY_T1p50r3dA&cry=1&dbm_d=AKAmf-ByWU-c3SjxbTGxIzkOuj_den8oBwnbjV8EaBZYyAAxhgoP9p3zkPs_NqueTLWKPXJuYf8tOuyJR5Pn9v9P6HoOL1HON0VLeezD6rpWIOUYopXqbdPOQKoWn2WxwLec-x2IH8dae1fFB9G8j8xYJnxk0dv7OBJCeikjZE7NU9MbqwuH62cuZTicgMUZuubi7KNOhPg9LAcuCB7KS7CkaYGkMjBf5p62sKvrYll-grcUcRWt0PePBMLHIdyQ-cz59jc7J7lroJw-im36uqgUWAP0ohDqbsnbDj84-aMyWS3kYBlS7h0W2lX_Ce-5a7xQCHsKx6PcOKMSSRa-vue35_2Xa6-Nf1S5UhROFFmgf_nfkbolYYPcTdyZzo-OYqAYPtXDdQnJHrPqLYhYgIGaBmZzEVkj1TNN2BohRxKemS3jsQuHiflRUc7bWz8MHJG0nXgk6JOWQM3Deov83ePXqysp6BLPbw&adurl=;ord=1616016828320529
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.17.202.120 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: 771401f92c9927cc3149966b99f476dfde0f392077a06790559647781669d11e

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
content-encoding: gzip
x-server-name: app17.ie.303net.net
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/ Frame 9FC7 2 KB
1 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/window_focus_fy2019.js

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:31:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 162
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:31:06 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9FC7 117 KB
36 KB 16ms
14ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

941c260356b6aa75782a27384179a63581c9e41b42155774982f36b0d84cde9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1615980836519751"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36389
x-xss-protection: 0
expires: Wed, 17 Mar 2021 21:33:48 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/ Frame 9FC7 13 KB
6 KB 8ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

570c04b30a5c8fa6ceaff96ea6d3a0dfabd85dee3edae40e38b0344a7278f254

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:32:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 63
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5991
x-xss-protection: 0
server: cafe
etag: 8832118191516519848
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:32:45 GMT

GET
H3-Q050 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9FC7 42 B
68 B 40ms
38ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Aq46s4gPafdwZ8gepVGFUV3CcdxA-yXBqv1kZX6W8d0IaBYkCcUX5FJv6juwuVM7QWH46FlDek-PxvsEeB_xW-fbaBNrm0D7nfVa59ov0k-OLpOq8

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:48 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3-Q050 200 view
googleads4.g.doubleclick.net/pcs/ Frame 001E 0
27 B 68ms
67ms Other
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:48 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 871A 0
46 B 45ms
44ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BgVXyvHVSYKfuBsny-gaF1YKQBQAAAAA4AeAEAg&bg=!cXKlcjbNAAbUo7L91KM7ACkAdvg8WhVNbtI1GBrcpKDRyQ8zOUFaUmj0_8zitacfXFpOwkZfr5K_PQIAAAHrUgAAADloAQcKAP6i-mr5bwywX5eY0_zzt7Scg6-t-uGAc1uy30ol4U-7yg-2HuS1KMXEIZXfhFrIs3BCO_70dLNxbgoUnzPuAsLukUt5V-zqwzfpZYNqtPvNiT6BZV4uKMCbxu6GtiHtJhtfuzVDLU4zvYZqB38jdli56wd1oBdLwuvDXEt8vRNmpedyYR2w1iLgFAT0EVU4GBpv_GoYYV_ugBIH8tGclHPbc5A79PBffn67jEVjxx7RPcw_fuOBrF5HkKBpPXGwG7uJqn9fc96MqD53r6jXQop1gAxexxoy_PqLgChpmlByPKPFyHcJfel1gvmcXL2mBgOe3r89ZXinKnShQZ18dZkChhVeqnGl9ro-o06GCQbY3lYy8gCQRhXUv9meOI1hWQS8Sp6tINjWTNpPtHdwgkYdiI36g84Oi5BAPHC8LdW_hHmoecanVJWll9IqBUmOWo8uJcdQOGzGbbNTmXE3f1DDnluPDKkPvUlFXEfy5tI3A8loOMHQsD1vxPYJ5hhI6q1FtHRPbTvWbWHQfqPKynzywtiNXLU_1Rhoa84tW9Mi3mh1nW7JOfpFPPb0_aW74VcwEl4GsVZqQfNcuMni1mF-3NnQ9s9ginB7CT5wOolMG68mUPbiVeZ0ZRp2byeigzCptFCX9NCAmsM0gQZmfq34gq3556_o7LifWZSpIVo8AaxpKmjvLO50OxhXHFrlFJN9PYjl-KBtECEztEJ47WgxSXoxzGwtf35OhH74yNKo1Ss6bxR8THS7FXVnuGwGcFQPLhdWeo7RTWglxCKxaQnYc20Ncb9iBEcnaALktvDo4txf3WVIWZq7wFKYoyUG1yxtUHfhLspawjiAcgDkdSYKYAFG9OWLutssGbVHnYwS1bWCCeSmutzetwbant1xw52WxtgF-eBNRBJprqqV1KHsPXKllz-Mjlaa73BQLxSc0QB6hVfBbIMcyrasdSvZQvKitNGJSeK0SvpbfFjtOvLa3tUyuFmnlK7qd2SYdmnGD7gUMFDSc4RvX7ZgZtAT4z3QGSztK4HFCdEakEQ76uhHNyWE_x75DfbNjdwGj-E5Q9ejI7A3yKuVTkDINRa-lPyU6uPFACd1zjIUX6_FkGSk0Dc5Ka1E00XjUBwaJZxmn3JcNaRG3qsBhz1QhuBJLp7uJaPwrN9wxUC5q7yGMX4rnTaT8m1axBMvA8rlUqymMILkJHRb8us

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/ Frame 9FC7 21 KB
8 KB 16ms
15ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A5X3k5YN9D0yWOLocigHpBYasZjR6hEiir_uIRxfZBaxgyjz5q3lvoOUkThOQGn6dRr-I_iKsaW8aW5rIGr25L4iSUMpXL3YRqnCvHlV4UiY9CtfrAgRcZx6AIAwxlfYJkb1PQ5vIiKmzYLGFF-ajTxQC2Qw&cry=1&dbm_d=AKAmf-BCvHUdnYaSglZ4VBapCkkNx1-bwlPHw4AAzIF_y8wgqXBUDvRObVopy02g2po8I3kYsyw6Xf8nikrQonzrcBNnQZY38k9ZOrCZ5HPpo5g-6xtexvSpbTU-HUY6VPTmQ99w7_cfhxF3LhjZ36m6CLPVCvm70Z_nUM2daDDV-yH-62o0qQOCg8mXYg48sdW5cWTEXYjrVFOAjBsYvxd2knUTb1HdRvBOx5KFN_WWs6kgtiKoartuAQS8I0bPTNiCr1bzN67KY5HZFcTt_NZIQRCmLlULnkie8GIqrVs1KfblvKniXpzamqsswP06jHToJHG6Rl5JbP_1YqJD0_Z6VkxCtmLqJgCRSRtSXhG2b10PajP5gZXJWqi7fXbwvKzCZvRKbk-EqZASqFFvNAqEHtfwWqiWnIdfpSrWzn074x35ch0S5zly1zCI6XZMxxa8QHphu6BKDFF5OxHQAYZn7AcGG2Z4TpfletiAN1wzSy9AkR5_Ty2eAzXYbcHKk-fuI79L8lP3eb2apnr9ngjutulpNg7MMnSTrQrkHSl6DkVWVdZqlJTvoMlHthSY7sWNtfi2tSYfWu-v_fWfzTkSHoXXWbADuejm7Qh6_gfgWy5DC3X7AJOhe7EgQ6tn0GKvP5cwL30mu1Hok9c391PTK5imqpSm3h9oC6TqsFht6ZqYgisJtc6JQJ35Xu3gZJaoOeoMti9gTeb77UZPrsfQL1Mo4UgfLpgD37XBhyhdE2U36ylySUMv8jP7FaxV6xxEF3-poyqadKdvw9EpbbLk4AECSzPhJe1_chlmUWFaZhgGjhdy-sW4TfzLDhslvB2LLYY8yuBW8LrXEyTkXfcS1h4fYmbSa1nc7e6440A7eVyB8zZCjAm_72NSreQ0HD8oi90_vbsEtezuvVxGty9KTnWWhCwR6V4bHrJs2ho5s6MHWIHgIIJp02Rjt7PzAfMZZ0zuL_hLmlZx7qTDtorgYUqG-b2kJfMvRLBuBUGdD51gi1Bs_M_vE02QvNVCcJvBmXOxkMeBSlzEg3V5uHkzUU_QpHk0vKI-sl8t0vUojcmegTZy1uTmVMJEwSAvAUAtWd9X367rqBJpO88XwIi_CDiokMk0SR1OOQvi4K6c3u2qUguEB8DUrKeXOAQwVni6mixSAcmPOtuyY6uqvIWFSzYsyW2jBgt6jhlsjw4MOiBTLYHsYNWRtkFdetTYd_JVv5e7uTLCdbM2oudrKQlH_BBdhbmwPGJg38ZjCYMBBnJFcBRkAj_L1vvgs96kwj8qes2YRqYDKK6DbJHtf-WHacKdiaelocGt1aqIBoJWXWH5uOdTiJaNl5pKszQFKYqJ6P0erAj5tAQTOo40RBo7nhU8aSdghqyPUKJMwEbiDwYpIVktV8_bwm0rv_NOqtNq5F7OtHzqiecgfkxJqXyKfZrTBpPUPBnrje7zjK-vlaOQh8c3KaBtkpKXu-McXmkYcobQ35NfxDhvQI9cPBZwyqOKtAYu8sm_mTD1qeGUJ02xiIgDZb3ziy-Q5weSuGeZwO1_GX4ZHSUx2s_1CbdzuSmFHD9okHwctafVu0mJOTMW_xiPKIjsMBXO9OdS2p0HpeT2IL8wrL3SsoC0a3lraF_P16ZHYsUJ5Pf76wgJKhViL3gLSG3vHecXIGCZpaaKB1MaFc3O7H7nMGZ7pN78YPIII0btRzjLvY2Ij2HZutSfpgi2VRoeeJVX1ZW5SG6D5gYSdBYBnWZ7ExC1pifk5xBAmrazZ4_Kfi3mTLbMnE019CxyR0NPY3exS5hUH2qncNfRZQtpbLhfX4MlZNs715VEGCI7t3jFV0lkCr4vdTwqr3dwNqdeLiu1LDi2VU2YO7ehvUQoWJGFOvoEtcXUMYBsMXs5KJa3b3ehgZ3dGcKlYED8FlAHjVoi1LjdNjRIdAXnX_2mH1g32QJC035yajsxfetj2kCiC8isaW0Xb_EcRza_fIKqM60AryrgUDSvTzMyg9G2lmszOeKlNvjWsxzZO9hCwN1Ru_q3jT7pH6_6Dkmc-GmSipbAQjWYGIW1wCUgnTF533VC-nSLThznRfS_HqQ74CWHCF-MGc8gPcdcfDd0ZIUDE_NEtpFAO47lDhVVVZzQd0MqCrpjoUNNQgj2Dprzc_vxs1lCvEoZ6AFwlJ4OvAbsZjvJDLfx6WxNs0qUuRXYZX05r0r62vOWbp2GOmjPMRWizaGWMRcMm9sFMwRu7I2VezA33wuIyx8BgMRpIWanugTOAe5eGyirQJpfbx3R1TIatUgn3pKuPsayoE248E0xStYAbZFFQE_tu89hRf1Divv-MUEFoPj3W3zYttSnjb-k0tNAgMqy_7Mph6LyyY-vm65QdkrKECYRhMlttFjSLkT2_GRBdgvE23yxOAUuM3BJwMxt_ZmD3uuxXxVzFDE2F2D9OjHxT7LGh5-yVQvU1Mu_rWqhEOUcQgC6jrPBOvtzXXvJyzHDvmuZoe3gGR4xsT2SvNprpvt4IADP1KGRaP9dcateyZQRp5m4ryNiYWM3dHdNpDQr15xeP7gP7X0XJ5ZoqtDTbHfxV1spYbIYEMUPuyqM7O8m8BkrN-naEd86c3Qm7cHm3IY5aUnDJj-IQ8OAyRtwNN0vQE0xvTo2TyXn4LxBaeq9jRZsCpqSKA6bIGR3PNszhUNRHxwstmThkarw4DNBaFGPCTGz9GplrbUf8ZQbt0DptjojViiFrV2tPzwqtv9LbfCqDVRQHYJv1dT_VYV7zHgdb0AEyuDCMMF9BVIExZ4hTmncfKVS-gFSRXJZOMs_JZSkNdHqcn6RUJEaN2By0pMy377Igpc-Nwo75YUTb3CdonYg5VkIUCr6MbwyLvVI15H3Upgx9SmO-iUIUX9wXD3ncw9qFw9WKkjPAry8qfOwyqofX5oaKg0Hh340ogDhoVys_ykbWRnEoRg6rJHzemVkbHtDS0I7Hqgn6ktnH4bUdJd1WqZOY7XWl4FkU1cATMdaOiMpFURQpXz09RjbIMgeDr1BNsJ5LjzLr9bL-NROwxXQeJvATJtDsgILUnEbDoocgD5o_WbDml_af8ywBU4o9i_UqnlO5a69g264UFC0geTQbX9uoHV9JEt3d5K0CTMGfRgYkAfGRpfyZDIwOnev3jKmDUZ8JHYo-dgfxUvsxKY_5QrtBJI_U7a9mOSSOsKLP8xhJe17L6rMFSU5tdrXnvhmHDgdEGgntykEYp4zBXiScMB-O0iDdr9_EZ0AgFfO0Qd-8YGy2gd67N1dzYlF-k8pNTcHZq98NgfekT943237az5DumZ4MqyG8xhojdPY3fPSWK-HQKpFhCAHc6YlABIGLGjw62zz-OrCIcu5bcjJpUeSHweG17qW_mjimkDqUoAHJzPguMpkwwsEFVeXvv7CjXYZ6mOgaRX36Zx1vVyTqTjgi-mD2zkhr58LoyIkvTnVrcW45unxsNPdkWO3kDwoofPt13GwTpfZcyLHDLtQt810aRLo7jq7fTaGFL_r65h5yskwUkt0jUGGxhS8GvfPKQHW&cid=CAASPeRonUriMgQtamsmiUO6vw-iFuVB1r-eFSS1cPqV5UEkRh3R11IpkAN36lRVl4PgSV9r_HyBNz7IzP-EbWw&rfl=2%2Chttps%253A%252F%252Fwww.reisekostenabrechnung.com%252F%240

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

70d82c6075989e0082b4917c6685f5f6bec1e673d0a80160eac61b3f1cdcb1a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 60
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8471
x-xss-protection: 0
server: cafe
etag: 753583566593306265
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:32:49 GMT

GET
H3-Q050 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 9FC7 41 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 17:30:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 187374
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 15 Mar 2022 17:30:54 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4E83
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1

43 B
1014 B

59ms
58ms

Image
image/gif

104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN_j2ZQCEJbW-a8CGMu_9Z4BMAE&v=APEucNWFQe3opkrn5n3BjBlmWHjvtFpQd-gCs3NnuOLU09ghOXTYhzNhlYx1lo8dfFT17Gv9jpxe4jlJiSzMV2ji8NcLc0MVkjl9iuhH3K8PCqa8fyn-wLpoGKcCIRFTRGG_RnyJ6bBMxbAEAVX47VwVKHLSN1wfZ7YIucA4e3ZodwrmMv-9Falzr_-JXfqcz9H1RjgJdhr35ul9nIvGCDc9w8HRT0kUTnGT68vhbR7M8h1ZuNFzBgk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.145.8 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:49 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 17 Mar 2021 21:33:49 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 4E83
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_hm=YFJ1vO7rA7INuMC5U4fqkAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1

43 B
894 B

287ms
286ms

Image
image/gif

104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN_j2ZQCEJbW-a8CGMu_9Z4BMAE&v=APEucNWFQe3opkrn5n3BjBlmWHjvtFpQd-gCs3NnuOLU09ghOXTYhzNhlYx1lo8dfFT17Gv9jpxe4jlJiSzMV2ji8NcLc0MVkjl9iuhH3K8PCqa8fyn-wLpoGKcCIRFTRGG_RnyJ6bBMxbAEAVX47VwVKHLSN1wfZ7YIucA4e3ZodwrmMv-9Falzr_-JXfqcz9H1RjgJdhr35ul9nIvGCDc9w8HRT0kUTnGT68vhbR7M8h1ZuNFzBgk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.145.8 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:49 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 17 Mar 2021 21:33:49 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame 4E83
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEGeQgf8VWyg0g1fS5sl7yaU&google_cver=1
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEGeQgf8VWyg0g1fS5sl7yaU%26google_cver%3D1

43 B
1 KB

52ms
52ms

Image
image/gif

185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEGeQgf8VWyg0g1fS5sl7yaU%26google_cver%3D1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN_j2ZQCEJbW-a8CGMu_9Z4BMAE&v=APEucNWFQe3opkrn5n3BjBlmWHjvtFpQd-gCs3NnuOLU09ghOXTYhzNhlYx1lo8dfFT17Gv9jpxe4jlJiSzMV2ji8NcLc0MVkjl9iuhH3K8PCqa8fyn-wLpoGKcCIRFTRGG_RnyJ6bBMxbAEAVX47VwVKHLSN1wfZ7YIucA4e3ZodwrmMv-9Falzr_-JXfqcz9H1RjgJdhr35ul9nIvGCDc9w8HRT0kUTnGT68vhbR7M8h1ZuNFzBgk

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:49 GMT
X-Proxy-Origin: 217.138.207.188; 217.138.207.188; 731.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.84:80
AN-X-Request-Uuid: 26514bdc-09b6-4aa6-be73-9f529aed3cb2
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:49 GMT
X-Proxy-Origin: 217.138.207.188; 217.138.207.188; 731.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.228:80
AN-X-Request-Uuid: bfe58068-0a23-4999-90fd-85c1ca01c21f
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D101%26code%3DCAESEGeQgf8VWyg0g1fS5sl7yaU%26google_cver%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 4E83
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzcyOTQ2MjExOTAyMTEwOTUwMg%3D%3D

170 B
190 B

44ms
44ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzcyOTQ2MjExOTAyMTEwOTUwMg%3D%3D

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:49 GMT
X-Proxy-Origin: 217.138.207.188; 217.138.207.188; 731.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.177:80
AN-X-Request-Uuid: e7113406-b4bb-4b06-adf8-34c036179749
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzcyOTQ2MjExOTAyMTEwOTUwMg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-Q050 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame DFBA 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 15 Mar 2021 17:55:06 GMT
expires: Tue, 15 Mar 2022 17:55:06 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 185923
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js Show response
pagead2.googlesyndication.com/bg/ Frame DFBA 14 KB
6 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25c788c3d6b5a5f5931ef45abc5640af29b16f379c2e1634dc32c6c225327f38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 16:25:17 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 13:45:00 GMT
server: sffe
age: 104912
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5657
x-xss-protection: 0
expires: Wed, 16 Mar 2022 16:25:17 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 04BD 0
23 B 39ms
39ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B_s3AvHVSYJ-9FPHC7_UP4KaZ-AEAAAAAOAHgBAI&bg=!-_il-LzNAAbUo7L91KM7ACkAdvg8WiIXeqRUsCLkWhsUxakBSc0mm2Dvf1wjk2HLhMQcfADVZjnurgIAAAFpUgAAACloAQeZAnlVXjnHfXfK_d10QhfT2YJ_hDBKOQ1k29NMdt5aIosHJO3qtaUCTn2nlfQXie1GbRCih5fnpCaT8ig_dBMMdPZrHfB8MMpBmjsIL57Gf-eFkiS1-eOrEROFQ99GkdNpY0VQeHHZrEwUtaYgiHZ9UO312by-8elP1HmJFRlqV6Gx_xAsuDaiLGU-6fOT3vbcztkXXaKVT-ahVUvLU7uvAFCbzKdf6r9xmE7pKoSZiORDFuS8caM4M2BNFCI9oOUvMpxe8-o-rjQKKpYz-3nKItuh3qz-ie68Feilm6oakLGlw2qMwCLFhvX5E0Y5i10V2VAZB4J7Zz5tQTfRXsozuoi6M5dXH60Z4GjdI7dXWVjSvHYr11dsLXRGYVp9YlYkPjSyux6mGB7HCwaxZuILJ5CqXpfMvEfNy8kVuRFPuSQR1vpb_TpfiVB0t0dNIgkqeOhdeb7ATBx3gCRFM0hSEehmYPKHVD0P8PG2l-CR_PSP0tKx7ti1zHVxXh6tVvDSUflWtZapF8EcuuqgjGM4Rm3o9RSz2gpIvw8y9AFF_0YTv91iOv_gjVv_Kg6rZk65xNP-fv1i2fQ2T2_OoP6rYU-NHABDxuCpHpW7GgKyMhCxzvRKcl-1IeknIl6a2ssvAf0Um55yF-boUEqvUvMJjxj-eV-UKlzewa_Mu4q3wmRkfsLIB4bKxE10vmM85i7qcuSNlb7K7_6Cy_mEcK4z5Mz6_abCNIbksun6JF9wqmZrs7309m4v49GYJf3jn4V_rHDFrvIXCyIQ3iOirHFtJhS3B1BRMEf1corivbcoRrFEWpY-FQ7GdQCSUO4uhBsflEB0Xvfzo0_p0yI

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/ Show response
track.adform.net/adfscript/ Frame 9FC7
Redirect Chain

https://fw.adsafeprotected.com/rfw/track.adform.net/568657/51893927/adfscript/?bn=42916151;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=ClCDRvHVSYJHIE6z5-ga36peIA-iKsddhu5GSkKUN7aa7j8o...
https://track.adform.net/adfscript/?bn=42916151;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=ClCDRvHVSYJHIE6z5-ga36peIA-iKsddhu5GSkKUN7aa7j8oiEAEgpczXamD7gYCAiAqgAczrq9AByAEJqQKMAU63JP...

2 KB
3 KB

155ms
51ms

Script
text/javascript

37.157.6.245
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfscript/?bn=42916151;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=ClCDRvHVSYJHIE6z5-ga36peIA-iKsddhu5GSkKUN7aa7j8oiEAEgpczXamD7gYCAiAqgAczrq9AByAEJqQKMAU63JPizPqgDAaoEgAJP0EM6yFRgB_iVyTtq3dgQ21xQc9R6hrzsAaGNYT-EtGSxpGPiY39TfUlrm8Lqgj3IgUB5bNUB2r0YpYKlvEtCpccrIXiHCvtoYR-2dUeUaXFVbnvgtvjWFJmqN_38d2Pzt40UwyRz8f4GK2_N4Szf8wFdcbPqOOiH7-03M_82gwAXs4YgNtod8z5r8U_CLAUgiGg80YdKwneU7iSRw0D1TjZs7psORX8SXmfMI0CxB5j_bv7JKP7G85GS06ADHEmWDsCLVJx3SFLQ_Mdh3RYUy860J2I2Jb20qZKpuoK_RVs5bN-fUYhLAbc4Z8KzgHgkk4DCNbW0a2Yyhe8Wzf0GwASk983nzAPgBAOQBgGgBk2AB5yU1K8CqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RuoB_PRG6gHltgb2AcA0ggJCIDhgFAQARgd8ggbYWR4LXN1YnN5bi00NDM2NzI3MDk2OTY2NTU5gAoDmAsByAsBgAwBsBOqrP0K0BMA2BMD2BQB0BUBgBcB&ae=1&num=1&cid=CAASPeRonUriMgQtamsmiUO6vw-iFuVB1r-eFSS1cPqV5UEkRh3R11IpkAN36lRVl4PgSV9r_HyBNz7IzP-EbWw&sig=AOD64_1B35qtMqeP5ozNU_FsFFBxVYyQkA&client=ca-pub-5902083285302779&dbm_c=AKAmf-CpBbYHKLDdgNf6Gcg7M9fWXPvs5MQS8UniXewdxygsS5t2wmorB3rrcSQ8lW5cvO7EQ4_Rt2AV0MkX8TbqoYpP5lseYImQ8VZ-DmWcf5zNMJ7Ea_AvZ1CK51b3rxMdawWvoehCGj0VFOx_D7oY_T1p50r3dA&cry=1&dbm_d=AKAmf-ByWU-c3SjxbTGxIzkOuj_den8oBwnbjV8EaBZYyAAxhgoP9p3zkPs_NqueTLWKPXJuYf8tOuyJR5Pn9v9P6HoOL1HON0VLeezD6rpWIOUYopXqbdPOQKoWn2WxwLec-x2IH8dae1fFB9G8j8xYJnxk0dv7OBJCeikjZE7NU9MbqwuH62cuZTicgMUZuubi7KNOhPg9LAcuCB7KS7CkaYGkMjBf5p62sKvrYll-grcUcRWt0PePBMLHIdyQ-cz59jc7J7lroJw-im36uqgUWAP0ohDqbsnbDj84-aMyWS3kYBlS7h0W2lX_Ce-5a7xQCHsKx6PcOKMSSRa-vue35_2Xa6-Nf1S5UhROFFmgf_nfkbolYYPcTdyZzo-OYqAYPtXDdQnJHrPqLYhYgIGaBmZzEVkj1TNN2BohRxKemS3jsQuHiflRUc7bWz8MHJG0nXgk6JOWQM3Deov83ePXqysp6BLPbw&adurl=;ord=1616016828320529

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.245 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

408d8516f6a084ae826e070be2167a5f7fef39dac5eb848d6094ce57fcfe4944

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 2229
expires: -1

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
x-server-name: app09.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://track.adform.net/adfscript/?bn=42916151;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=ClCDRvHVSYJHIE6z5-ga36peIA-iKsddhu5GSkKUN7aa7j8oiEAEgpczXamD7gYCAiAqgAczrq9AByAEJqQKMAU63JPizPqgDAaoEgAJP0EM6yFRgB_iVyTtq3dgQ21xQc9R6hrzsAaGNYT-EtGSxpGPiY39TfUlrm8Lqgj3IgUB5bNUB2r0YpYKlvEtCpccrIXiHCvtoYR-2dUeUaXFVbnvgtvjWFJmqN_38d2Pzt40UwyRz8f4GK2_N4Szf8wFdcbPqOOiH7-03M_82gwAXs4YgNtod8z5r8U_CLAUgiGg80YdKwneU7iSRw0D1TjZs7psORX8SXmfMI0CxB5j_bv7JKP7G85GS06ADHEmWDsCLVJx3SFLQ_Mdh3RYUy860J2I2Jb20qZKpuoK_RVs5bN-fUYhLAbc4Z8KzgHgkk4DCNbW0a2Yyhe8Wzf0GwASk983nzAPgBAOQBgGgBk2AB5yU1K8CqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RuoB_PRG6gHltgb2AcA0ggJCIDhgFAQARgd8ggbYWR4LXN1YnN5bi00NDM2NzI3MDk2OTY2NTU5gAoDmAsByAsBgAwBsBOqrP0K0BMA2BMD2BQB0BUBgBcB&ae=1&num=1&cid=CAASPeRonUriMgQtamsmiUO6vw-iFuVB1r-eFSS1cPqV5UEkRh3R11IpkAN36lRVl4PgSV9r_HyBNz7IzP-EbWw&sig=AOD64_1B35qtMqeP5ozNU_FsFFBxVYyQkA&client=ca-pub-5902083285302779&dbm_c=AKAmf-CpBbYHKLDdgNf6Gcg7M9fWXPvs5MQS8UniXewdxygsS5t2wmorB3rrcSQ8lW5cvO7EQ4_Rt2AV0MkX8TbqoYpP5lseYImQ8VZ-DmWcf5zNMJ7Ea_AvZ1CK51b3rxMdawWvoehCGj0VFOx_D7oY_T1p50r3dA&cry=1&dbm_d=AKAmf-ByWU-c3SjxbTGxIzkOuj_den8oBwnbjV8EaBZYyAAxhgoP9p3zkPs_NqueTLWKPXJuYf8tOuyJR5Pn9v9P6HoOL1HON0VLeezD6rpWIOUYopXqbdPOQKoWn2WxwLec-x2IH8dae1fFB9G8j8xYJnxk0dv7OBJCeikjZE7NU9MbqwuH62cuZTicgMUZuubi7KNOhPg9LAcuCB7KS7CkaYGkMjBf5p62sKvrYll-grcUcRWt0PePBMLHIdyQ-cz59jc7J7lroJw-im36uqgUWAP0ohDqbsnbDj84-aMyWS3kYBlS7h0W2lX_Ce-5a7xQCHsKx6PcOKMSSRa-vue35_2Xa6-Nf1S5UhROFFmgf_nfkbolYYPcTdyZzo-OYqAYPtXDdQnJHrPqLYhYgIGaBmZzEVkj1TNN2BohRxKemS3jsQuHiflRUc7bWz8MHJG0nXgk6JOWQM3Deov83ePXqysp6BLPbw&adurl=;ord=1616016828320529
cache-control: no-cache
content-length: 0
server: nginx

GET
H2 200 sca.17.5.1.js Show response
static.adsafeprotected.com/ Frame 5E79 82 KB
22 KB 135ms
44ms Script
application/javascript 34.255.248.151
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.5.1.js
Requested by: Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.255.248.151 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: 134bdfef6b19c84bcb7dfc55f32065853ffdf1b05a8661caf172e56edacd427f

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
content-encoding: gzip
last-modified: Thu, 04 Mar 2021 17:39:07 GMT
server: nginx/1.16.1
age: 14
etag: W/"793767aa29c23c195c863f01f1e83e06"
x-cache-status: HIT
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000

GET
H3-Q050 200 container.html Show response
56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame ED7D 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e86479d6e54449d1085c2149e190a615c6bead407b20bacbcf5852b5d65f1fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.reisekostenabrechnung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.reisekostenabrechnung.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2973
date: Wed, 17 Mar 2021 21:33:43 GMT
expires: Thu, 17 Mar 2022 21:33:43 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 6
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 container.html Show response
56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/ Frame 586A 6 KB
3 KB 6ms
6ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021031101.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e86479d6e54449d1085c2149e190a615c6bead407b20bacbcf5852b5d65f1fee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
:scheme: https
:path: /safeframe/1-0-37/html/container.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://www.reisekostenabrechnung.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://www.reisekostenabrechnung.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 2973
date: Wed, 17 Mar 2021 21:33:43 GMT
expires: Thu, 17 Mar 2022 21:33:43 GMT
last-modified: Thu, 21 Nov 2019 16:01:11 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, immutable, max-age=31536000
age: 6
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
480 B 26ms
24ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8zIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjUifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDMzNzkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTBfMyIsInRfZXBvY2giOjE2MTYwMTY4MjIsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6ImYwOWQ0ZmVmMzgxNjFhMjdkMDI4Y2ZmNmVlYmY0M2FhLDMzZGQ1MjNmOGU0ZGRhMTU4ZjBhYTk5Njg2ZGRhN2YyIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQzMzc5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wXzMiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MC4wMDAwNiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDA2LCJiaWRfZmxvb3JfcHJldiI6MC4wMDAxLCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQzMzc5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wXzMiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODI0MTEyMzUxNyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8zIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiI0OTc0OTAyODMyIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b5032c000005f15a16b000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=h9FzjVLq45BF2BeTOrDD74EOOpnmxXhKMQmfhhCYycthmR8BWmg6xuOOtcD97Xrqh5Ofua8uYzMXoFtZw9QrqZcONEgmkuAldByqLkfKTK1tfqML%2B74JTpAo2%2BZjL2sZdgA30f%2F%2FQozfiQ%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319577ea83d05f1-FRA
expires: Tue, 16 Mar 2021 21:33:49 UTC

GET
H2 200 4974902832 Show response
g.ezoic.net/dac/ 0
40 B 44ms
43ms XHR
text/plain 3.127.76.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/4974902832
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/porpoiseant/banger.js?cb=192-2&bv=13&v=46&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.127.76.126 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-76-126.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 17 Mar 2021 21:33:49 GMT
cache-control: max-age=3600, public
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
286 B 26ms
25ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8zIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wMy0xNyJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjIyIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjMifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTYwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b5032c000005f13ab4f000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=cYEvxalSYas5EdS9tfGiprEheLSO7EXVnAfXKf9ZahEfAZfKeGTrhECLRvQzRuTtpj4Ut1Gxm7VOMeo2%2Fw0fURjgtZVcn4MKf7YYfOk6gnIq6r68snO%2FV%2BeN5nA%2F7INGLHpQZOF0QdSx6A%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319577ea83e05f1-FRA
expires: Tue, 16 Mar 2021 21:33:48 UTC

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
430 B 20ms
19ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8zIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYXVjdGlvbl9lcG9jaCI6MTYxNjAxNjgyOSwiYWRfcG9zaXRpb24iOjExMDMsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJiaWRfZmxvb3JfaW5pdGlhbCI6NDQsImJpZF9mbG9vcl9wcmV2IjoxMCwiYmlkX2Zsb29yX2ZpbGxlZCI6NiwiYXVjdGlvbl9jb3VudCI6NSwicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6Mzc2LCJtdWx0aV9hZF91bml0IjozLCJtdWx0aV9hZF9jb3VudCI6NCwibmV0d29ya19jb2RlIjoyMTczMjExODkxNCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b5032c000005f11b84f000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=HADB7udzLVXM5bDRVTP169xr1nSQD7E14Gb9QqFUwHtLJC3W2pr8q%2BnfBn3wL3M6s4GyCwwiKPPH11YPbREgVsO67Vj%2B7pBi17MA2Uhdj64nNk3Mjd2MZa9Ew7JuP%2F0pXi53Gbvy1EWl1w%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319577ea84005f1-FRA
expires: Tue, 16 Mar 2021 21:33:49 UTC

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9FC7 43 B
216 B 322ms
103ms Image
image/gif 35.173.0.225
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=568657&asId=fe9280c0-ee2e-eac2-25d0-db4e47f9d3dc&tv=%7Bc:7a2fs8,pingTime:-2,time:117,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:224,beZ:225,mfA:227,cmA:229,inA:229,inZ:234,prA:234,prZ:241,si:250,poA:251,poZ:268,cmZ:268,mfZ:268,loA:300,loZ:304,ltA:341,ltZ:341%7D%7D,sca:%7Bdfp:%7Bdf:4,sz:100.100,dom:div%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:-1,vs:n,r:r,w:728,h:90,t:25%7D%5D,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:0,n:118,pp:0,pm:0%7D,slEvents:%5B%7Bsl:n,t:24,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:-1,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B111~1%5D,as:%5B111~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:srXbVsz+111%7C112%7C113%7C114%7C12%7C131%7C132%7C133%7C134%7C135%7C141*.568657-51893927%7C1411%7C14121,idMap:141*,rmeas:1,rend:0,renddet:svg.us,sinceFw:90,readyFired:false%7D&br=u
Requested by: Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.0.225 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
x-server-name: dt54.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
285 B 18ms
17ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8yIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjUifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDMzNzkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MTYwMTY4MjIsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6ImYwOWQ0ZmVmMzgxNjFhMjdkMDI4Y2ZmNmVlYmY0M2FhLDMzZGQ1MjNmOGU0ZGRhMTU4ZjBhYTk5Njg2ZGRhN2YyIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQzMzc5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wXzIiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MC4wMDAwNiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLjAwMDA2LCJiaWRfZmxvb3JfcHJldiI6MC4wMDAxLCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQzMzc5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wXzIiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJjcmVhdGl2ZV9pZCIsInZhbCI6IjEzODI0MTEyMzUxNyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8yIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoibGluZWl0ZW1faWQiLCJ2YWwiOiI0OTc0OTAyODMyIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b5034a000005f1409a1000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=vtMozfgTs23%2BBvm7YskV3GTDXf5LApDTAMv7aoYQuZWqfRtHHft21uGUXAQOGlqAhq1zKyVv1u5aZWaJjOpqQH2MSSViuGTdRlvUCQSL4bNj%2By0YiFkeKg6koNdsDW7HuS%2FghLoPqXiw8g%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319577ed88e05f1-FRA
expires: Tue, 16 Mar 2021 21:33:49 UTC

GET
H2 200 4974902832 Show response
g.ezoic.net/dac/ 0
17 B 42ms
41ms XHR
text/plain 3.127.76.126
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://g.ezoic.net/dac/4974902832
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/porpoiseant/banger.js?cb=192-2&bv=13&v=46&PageSpeed=off
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 3.127.76.126 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-127-76-126.eu-central-1.compute.amazonaws.com
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 17 Mar 2021 21:33:49 GMT
cache-control: max-age=3600, public
server: nginx/1.16.0
content-length: 0
vary: Accept-Encoding
content-type: text/plain

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
292 B 22ms
21ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8yIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMS0wMy0xNyJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjIyIn0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjMifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiLTYwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b5034a000005f137a69000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=w5zpRlUZRgj%2BecPHFdpPLOT1ziEqJf%2BZYO09gEx8KPuA%2FlDegT9f8e9dLqjaWZRY%2F3UPfQfAUf%2FNXt81zYYFuRzaveut88VwBLep6RgUZP%2FEvO9INhoIu%2F5FWXbQtXqOUKzK6Ve8usz6zg%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319577ed88f05f1-FRA
expires: Tue, 16 Mar 2021 21:33:49 UTC

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
286 B 20ms
19ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8yIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYXVjdGlvbl9lcG9jaCI6MTYxNjAxNjgyOSwiYWRfcG9zaXRpb24iOjExMDMsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJiaWRfZmxvb3JfaW5pdGlhbCI6NDQsImJpZF9mbG9vcl9wcmV2IjoxMCwiYmlkX2Zsb29yX2ZpbGxlZCI6NiwiYXVjdGlvbl9jb3VudCI6NSwicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6NDA2LCJtdWx0aV9hZF91bml0IjoyLCJtdWx0aV9hZF9jb3VudCI6NCwibmV0d29ya19jb2RlIjoyMTczMjExODkxNCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b5034f000005f15a16d000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=jiZx6Xqu0ySxW4BVlxoKqUBmIxWgB2O1mbaTwXCPXL4nt1UXpY2fVAqxwYlr%2B86P87At88tGZIRfNHzQcujg%2Bj5mxT0Q9I86ksdjihX4PX0y49d5M5D%2BhM94rdefpTtqXiidnAQCb%2FxiCg%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319577ee89705f1-FRA
expires: Tue, 16 Mar 2021 21:33:49 UTC

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame FEA8 0
23 B 41ms
40ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B_W4AvHVSYNvkGeKN7_UP2ZyP-AEAAAAAOAHgBAI&bg=!TU6lTgrNAAbUo7L91KM7ACkAdvg8WsFQvhzAjxgTAJnjRs5zbSVkkN-lJp7LQTRPxGqITTsKibVR4wIAAAD9UgAAAF1oAQcKAIOYUeyZymIDTa3uITNyupl-6JmyMosnF1GSQ_QpsCV27bRZzr0n4wn46NPlBR830uqwGfnUVO5M-Spb3JTKnAMFRC20NGhaIiim5zkmLvYpg2uTlE3vR3a2uUYWHuNl1lg3L4FuvdSI3CNJ3D4v01ACVoVQ7eGCzAzoQ-pVyzV8-RHOEpkCequ-gOMrmYBB9oNlyETmobaMXbkzeh22WHB1eNo7MBLCkoPQS3ut3xBkiLhCztXqGyefGQgE9qtSmMXAA2Z2T4UGlNUxnAxHx7u8XxcVN6uOtnX9SMApwzKMJrlC9sI5zyWHOX5iocCSqq7DLw1l_ZxJ1U2wPxSP91zU3toSt4SLMGKpAN3vFaK8KzTrBr8YTy-sBO2WAdRYEaIG745yfNqQX24Fxrvl1fc1jt8Bjy-_nQbfrwYCSE0sTm0SikTBQ9O0G0stFicw0YMZ0fskLF4PyDJegEebWXrNDexRR8Opzn6Tgx0M8QUPvyWsTwTCCahBZfyTQwcSP8s6GFbcE4n8tuvWxU_BVrDQCpHh-W183bhF5vrSpIHmWMj2VPrrQR5eQMMpQP0B-x8Hca0n37k_y76384BGvT4PsPMgTV_RBeO-B1dkjPOriKO7rBLdSXTpGzpoD-WH8E1JGgjr30NYiOB_cvRQJobRGbeD5xeVH4LU6d7Um-lvLAe16wYrJ5h-ZSp4qRkJF8oMahbWNrGFiCQ4WAaIb8hNH7aCGQ43If9_Rrw9JAcmqWCGv3gu3g1lUD8v4e3a21ud4Nv8Yhoj-ZKVi4hhcZ-fBhsXzi7YN5uTLZ4ghFPwBgBKk_99J6bUZRUuCR-zllaoHcYIhipkJ30f3G_LV-FMfsBzbVM00p9Ei2dj3YzDBAasObfzkLS7O4ghgb5pcWpTYEkVkxQZI0zqoC1cEAkfXr-FVhl2tb7tkEB-mRf7zcfsTdk4b_6ZLYusXBn3pXkWVOSIdFqXSrAnDR50gZwjZ3UhyBwCVLlINoWNhpT5NyGEM7PifpEH0gdd8kHLOUU

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 552B 656 B
306 B 48ms
47ms Document
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNyuyAIQpovKAhj9i8qeATAB&v=APEucNWkZsI2GTzkaS48L09y7vkn2IXKufQFgvAJ6WXv6f4lAEl3Q-OcTzoeo7Ckk1ZeyHXnamAEMGIFGhNa4ZRhbmTMZh1YSx3ISvcbnJH9gNUzFBDYz0QEXsW_m0R0veUT19PkDKzeTfDBFUWmjfeoJkYpXsAFtx16-2ugs6aQvhp7xIz_7BpjqIbIjOqBexPd1uDZI2j1aRLXop61rpHAZsni0l6aKI0stSHfO26dhW_UMPFTYwk

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

1170a116f6521465e0d4f0df36d070b1502f257e88dbeb459d31d3e2c3fb861b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CNyuyAIQpovKAhj9i8qeATAB&v=APEucNWkZsI2GTzkaS48L09y7vkn2IXKufQFgvAJ6WXv6f4lAEl3Q-OcTzoeo7Ckk1ZeyHXnamAEMGIFGhNa4ZRhbmTMZh1YSx3ISvcbnJH9gNUzFBDYz0QEXsW_m0R0veUT19PkDKzeTfDBFUWmjfeoJkYpXsAFtx16-2ugs6aQvhp7xIz_7BpjqIbIjOqBexPd1uDZI2j1aRLXop61rpHAZsni0l6aKI0stSHfO26dhW_UMPFTYwk
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmz7gXw1XfKVul9v1C9aFcoMkKC-S8nU6CYsVWxeLJohLENMnpGHv3XLtBAxFs
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 17 Mar 2021 21:33:49 GMT
server: cafe
cache-control: private
content-length: 284
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame ED7D 23 KB
11 KB 70ms
68ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bl6pDWqEUmfbSxb4Jhuq6A0G0EO7Fx-PcxRx9Pkbaxv3qeOzby-gcQDdr41cPw8VWgKvaLdNd_34QGpLoDb8ZsczbEHxER8Y4M700DVx0dWQoLKC2lOdoHoyyt-IuaIVsqrcUDGn03RlBXRsxIP295EVl-uQ&dbm_d=AKAmf-CoG56cDdl59pi_vZfVM-SY9XwtsMNyty2m5ahXNxvR225snOxJah_WI63deE6ahO2DHwYlfENS1Y_CyGC4-bWWU0sx-j4fY4FpZ02LRugl2m01pKGx8Qd1_TkXN-4M98vn-6D06rhMVXEBYBR2PeW396oOcC_3l89ZZZECsuQ-s5KvemQYHW7hv70SnEExBW9QF-u2DWZrHrOIJdE1zs2dCiKwchP9VESOlV5Yx26tLwNMa0WVxBnr8t1M7Th0g-J5hM8Ju_Uo5M57kgoMSh_gsGFBv3ZkaPs894XPmnLh4knHeixqmu2KcMNjh2ShCibY7lXjTDcLHXGJqlKTYPL7Dexn4tmQ0r9zqLjWCFJmUUPdRhdRADVCjEvF5Zl5diJ5C4IDtgR-nxED410dbSnE7T9813CQz5eUhepPBWtJ1enLpnBQCFEwLPCpDtgPdWYxR9TjyOwFeghYbMenTaGys27p_39lkbJQvPG9OWYncKfJGLH6DUnxr8pJo-H57BlNIeFYMl5dvWSCqzVOJRzA7uJ53pbI_n51W3r9RY82A0Nm6j7tM60pegvW2GNxCMcZmuR0CeDx3lRaqFeZU6w6HTSUwE-2chtuCja69GQUevJ91RFF8-PwB5S6oPbEEdE_kjV6RMUubuxELU0UZ4zHaVdXHyub83aXHeqBYNnum9EO7Yakd6HydFCUZZlSYsfOtjU1-Aq4bkuh48NtZ88Rp64iDFpTHCIiz13j4XYjHUC3XTfAWgLYEATp9QfesahvWl0pDeZnReCmL1CMvBtzQwcpZzDB3NMDcsHEqOtuSM8XqmYj4-mNct06fjA1kfWn9vABmEq2Pd-o3TpaoFlvrNqbOilGC0SQjRk7jfSrfV7Vzaij-1vgCH-2Wfy56YdqxeBnxJ4Hde_KOKuqsSzu7BqN9AFamgo7HR5CBsBtY1SrRPReIKG7zpsmpTzWwo5sBLkoA2TaNMUImt3gwOgnQ5Clzn5DKnM1uxN0qdlZE686ULUHGtSqn9P-spv8qNU-PW9RlGRnjR0vTnGsu84Dr5So5sd9RJBZ8rlIS_bZ7NGXNcu-DkAhTQro2kd_jWNFtQdmQFcrenJRVHwPBjs_2jD9ZuF8HV6t9zkvgqSIwEVEyLlaqM39LQEsbPl7GBc4oKFF87vnYBKXDcsPsGgryF03L04SGJnXcPblWg6WC6fipyUIBG39auHX4nQhv06x2rF5OSJ0zHtQP9S-_JYArEId0PYXCKIY62bK788Pt8BoCSm3uusMG-45lFmhhGRv0E6qHsiUmIef8s3MepAfC_eeoO9WB2ZBBpj9_dBKwVjVwOMa1uplstDEa-8Mge9BPonAPlem-bAJHOXDtzKfuAgt7uqi5kOa_sR_jKKQFeLFxs4MFq1L9tUGbwtMgxUvsT8IKsAW_cuoZr8FOfJn8Q8TWMKQEIzIyQJk6mmyWH9zU4axuBHzzhuDhXXatAtasrVo03Gkd6W4uONooog37w1hSN2MqrzUdfiii16FpmlUb5YEIWC9gnTSqnU2JkvrlZy8td9g88p800I43LLG3zZIn8e8DdlaPwUwftRYTMK3IhO8twp0_kp6kZaVh4mZh_w1mlGj3fvqMw-6EWpPBwvOqLMSOqjqmnQAOXaPddst2-RpyJcaOc_Zlas7Hcxqmatth9Ivrd7MAKQKFtlhEf1k33ftjhQkXE7p6LdviAcCFgBvwEhj-UpNQbwg0XjjApXlVdCsjWEs2yKKV1YIUpFH58bhrIe4UhdW97P-jY3L64F_5UR_X8S62TAwMy9tgBm-GB-Qz-Ac8QKRScWNofUlB_A5Ph3ZFuuGNdgP22bOAZgnQhoyhfLBUNldL09qyjRd7bFy7zlp5dE9gpaU7J27F7ziVcdc4m1m6QiWUu_nQG-2cPNkXWsVwqVj35UyRzdFc6eD4bUgwF3WdslYXkVDbsQuSHEuSFZkqZjWNOo3Nr7FQpp_W5Sa_DTyv9_RKrb3Ib7CMGGr3M1NhE2o813VneUP2EARIe9eJ6CVJfvKPUFqZv-_NuGregJBUScTnidHT1h1RWSf39Ptfwuws13DGeGZ8LkYULfW9j7BILn16o6hatQqIPL5aPnM1TE9rnxuZufxADcj1Am5HPjRo9lWx8h6bF_lKBmBJa6Z9qF65Ph11noc9vt2NM5Or1F89ivOdYnZPoUBT5x6JIrBWahIVo90_iWAm8iB9QOBWKlvdDygNJGB861oY4ZCk3-EmWFFpflUP17pFql_GMnUwPprDLjcmkFvwc2JKpimImR1DA2uqZzQI5iSiJcV1bxxHhf15LLR8enbaqBll91wjEI31xSYg4dhc-ctF4sD02OS9_NtG7EYprVvLBJHtUCoJLD5gHg1QSujhOEpd11hEKVmCfG1X-kC_h_Y1yJXtZF3Bv-kXeOlT1FbNpI3JyipCWkm0cGnUCJJ0MhGjClwkZsdN6GSWtf9dK8BKiUcqHn366hWXQ4GwyD5CYJW48UaFzS8bOC3ba2xCdLZVzFpk2fHu9sqiUYETad2M7tSx8flzoY74E-SMrcG_PdBfCXWvN_8roAqTdbkwuw8b-7uMhGlhQXYTcht-lTiTwRKumh2fY6RKgr8gdmfkOPNItwaSU4A4HvhU1Zlefulw6ajT_sQTdAMG1W19HNb-BEbN-m3CEmBHGOSoz5w_5wGVvN0ytEg_XCPd8Z4yV02Oua9F1_saYE9hsRMBbgB_KUqLxVcZ8JN5nFjutG3d5x5JJ0seE0w1VO46bFsi9HajI6Z7iTlR6cAEkRwtXqO7oJo2W30KKUBCyMJSbp_81iBQEAvDZ42YLOHX9OCSUaXz45CUg_bnqdBWsYQdu1fu5GRwiUs9QVQZs_Qfbvj2nDIoz_OoBW9fRgcQDJdy6O2c5QzG-YDWaX6uSsjxu84aXTx4Un9xD9cVEVqAhmnn-bSRe8wEybz3hv5FSrablwcZeu0oEU5baiPOQ7f9QvxYLlVQMtDGBCtbhpmEDHVu8uPkQse5CI-IGGe4kL4MApl7tfjDPyVs3fNcFa26Asmx82GUTkMY5bawpmA5XAuvdXjw1zTMtTOkSQT3JfcbOGgv61PeWHfrbWV6MXSfC0XGscmxhdwv3jAgeL5SuLH49hGVXbAlH8488lKqFYo8W3zlSTl-X0NKnOm_h_DXTBU287sBR1Ym0dOxZ4b4zJuwEL055r2ODznlaCYikBGtPsKnwxItLo19AwpAzYPKDpPk9-GMPPi2VI&cid=CAASEuRo8QhJXOsL6wY-mxlNGfqTkA&rfl=1%2Chttps%253A%252F%252Fwww.reisekostenabrechnung.com%252F%240

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

3153a3db000c87f17b7e96eb5346655401baf25ec6fde84fcd05475b5a686260

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11595
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame ED7D 42 B
65 B 41ms
38ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-D4mbZpdeOa1SY3y0o2-9AhZdVdaf3gnqpAbAUf73zxGbHrkGRTvEF2Wm9v-ZXEVhwW6eSFun-ICwMAnD__RJkJIQNi1TWoSJWtMg4fNr0N-vKOddA

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 clk Show response
ad.doubleclick.net/ddm/adj/N1246177.3716415IGNITIONONE/B25408918.296831030;gdpr=;gdpr_consent=;sz=300x250;click=https://googleads.g.doubleclick.net/dbm/ Frame ED7D 39 KB
17 KB 116ms
73ms Script
text/javascript 142.250.74.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N1246177.3716415IGNITIONONE/B25408918.296831030;gdpr=;gdpr_consent=;sz=300x250;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CLk69vHVSYNqDNJeVgQejqZPICpGMv9Rh8eH1m_0M2tkeEAEgpczXamD7gYCAiAqgAeLd28sCyAEJqQKMAU63JPizPqgDAaoEhAJP0H_B-e38qfioBxnHa6H-rkHbmqUSeBRZZqN7-griXfoxRVF-2hKAG5djamhl6NKaOg2MzL3xKQ2DQZJ7ZlZb57X2YWQI1otodURz9F0ImHB6SEaGqugRNbx75earzKNTku75S_ETAE-WMuFKdF6KMwZRVzdYSx0p3X3GFBFtr9o1VdvSPMOMPUn7Vx945_FOFxIUGR3wgDkQ1wJHhFwwVESYbLjsvOwqiuaeqdA7lr_K8pi-jOMudtTx2XueIccmlcnBacoVwiNRUuKy_Te7dfm21BKpdSeG6_AjBLBRMfVlFo53ssavmxz_Bz3WByMSSsfRiMKXbwJUPTic8Cn0m90ZhsAE-saBibYD4AQDkAYBoAZNgAeGoqS0AagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNDQzNjcyNzA5Njk2NjU1OYAKA5gLAcgLAYAMAbAT-tvyCtATANgTA9gUAQ&ae=1&num=1&cid=CAASEuRo8QhJXOsL6wY-mxlNGfqTkA&sig=AOD64_00UgE6PZ-ZjCM4nt4x3h9aWqTO9A&client=ca-pub-5902083285302779&dbm_c=AKAmf-A-zfNnZQUyYlsxuGtvsXyLmKR51xkLUNOEeaTBZwYQeeebaPc7CTojE3eeOP6HstQI_oEUgjzN89565cdhAyYsTkXilPe-SUCV4Rt_Pg_fVp6RgbToQepqof4_anIpfHzuzSEBvWcJYHZe5Qi69Qn-qGQUhA&dbm_d=AKAmf-BViaV7gv0ABSCF6HPMzcwE0EY3GClEUKcCTXIkEmIFe4q-LpRKGIOuXK6OQcB2-jIMMp4XiEmxPDxS1QeUu_bLNj7mWnTOTzEEsyPuM8nppCjxIUe5tJYGwhpJ1FoKxAZlsbYu6psQ12uM56aj-9HLTfEDJRwiCHaA-WysQvC9iJgOIDKODsN1sQC-GejBE1bToVLulEwiP6jiQTe-LleivBCmkSVz94dFeL-JMuMeRHvTpatIb2ZGMTXkVcjWa25bQgC8_mZHeqpam-o0SrbxS5otdGixmMZeTa3x-anaCblzniRFElX4tlWIanAg_pCmlsptivrcy6wyzkVDxlh6rSuALXWOB1694tcStQFvRmhDVNBcoYU9jFFwmSEEM0nExWfy93lH6GCoeGAzC262rslCPnwJECz02U10z946vc3Ei75JFm2nHaHI-ToivuG70rOUnXbDRkY1UuBZ7ty2EI6Yog&adurl=;ord=1616016828852442;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.74.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f6.1e100.net

Software

cafe /

Resource Hash

b9ac4313aac22318378364aad6fc6a2620a882b4373d705ddf6a4b4b778ea0de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17252
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/ Frame ED7D 2 KB
1 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/window_focus_fy2019.js

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:31:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 163
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:31:06 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame ED7D 117 KB
36 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

941c260356b6aa75782a27384179a63581c9e41b42155774982f36b0d84cde9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1615980836519751"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36389
x-xss-protection: 0
expires: Wed, 17 Mar 2021 21:33:49 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/ Frame ED7D 13 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

570c04b30a5c8fa6ceaff96ea6d3a0dfabd85dee3edae40e38b0344a7278f254

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:32:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 64
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5991
x-xss-protection: 0
server: cafe
etag: 8832118191516519848
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:32:45 GMT

GET
H3-Q050 204 l
www.google.com/ads/measurement/ Frame ED7D 0
0 46ms
29ms Image
text/html 2a00:1450:4001:810::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTSTpzAqlZuQZgeFr8pD6va3wBfeIMlfU6O5EmI2dVYeLdvo7tkUukAG_mNb1UaJJk9vFdpcJmmT16-Jq2zyHh1j_RKGA
Requested by: Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: H3-Q050
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H3-Q050 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 29AD 656 B
306 B 46ms
45ms Document
text/html 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CNyuyAIQpovKAhjKicqeATAB&v=APEucNV6ZXObWaGf3kWOV4PU0H2tR-V-a2BGu2SNKzjH5y7KfAEEnFpRgjgOPNzIACKjqhoZxfshO50WbJ-z3NykT892vdU4hjVfdBme17DFMfcAJOG0f27b7UN4BRNY68XhjlPAcSvcC0A5CuaGvKjut875eCho7UVj8yKnzmg0IyQRVViIPt78Fkk8XZd10jEnmbW3tl6mBKe5iqIXnSkKTsMQQeFMikdtUkXX1eCLopddkJikNAg

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

1170a116f6521465e0d4f0df36d070b1502f257e88dbeb459d31d3e2c3fb861b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: googleads.g.doubleclick.net
:scheme: https
:path: /xbbe/pixel?d=CNyuyAIQpovKAhjKicqeATAB&v=APEucNV6ZXObWaGf3kWOV4PU0H2tR-V-a2BGu2SNKzjH5y7KfAEEnFpRgjgOPNzIACKjqhoZxfshO50WbJ-z3NykT892vdU4hjVfdBme17DFMfcAJOG0f27b7UN4BRNY68XhjlPAcSvcC0A5CuaGvKjut875eCho7UVj8yKnzmg0IyQRVViIPt78Fkk8XZd10jEnmbW3tl6mBKe5iqIXnSkKTsMQQeFMikdtUkXX1eCLopddkJikNAg
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmz7gXw1XfKVul9v1C9aFcoMkKC-S8nU6CYsVWxeLJohLENMnpGHv3XLtBAxFs
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Wed, 17 Mar 2021 21:33:49 GMT
server: cafe
cache-control: private
content-length: 284
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 586A 23 KB
11 KB 63ms
62ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BCoOFV86eb5ZHlMrqLvldQsfpNW51eRm8mAYPvyOeSzKjuUEo8S1VzSj57W8aOqr0_CYHIqDOTh8PfxqLIJ3pnwuJlFNVvjUMqo303Ktusuoa7XA3q1vmTHsC3qx5VrV0FapY8f1cjXxYxOc748SEW9Xb4CQ&dbm_d=AKAmf-CHpA-OvDB447mffHSyMhqkGgVhERR_7jLd0k55qt5bsLcBadjhbNF-3BjtGz5-Xy5Yiej2YmUgQxOvHPfwsZy2VKGwn0AqaxFDZEzMOIV4tuPSIBocB5IKtACrhiSIVC3o16oTPiUufOyuHRN8BGjp8ofsE1oRGHLFWOYlG7oMwOu7DMCm2FsCH-kUYuMrn9Fss6Yxrp9R70wrxXhufEmt5YT3s5iYpZyVneTVnq-_tpgFZIjZSV2YWnNmbjp6eRAMlPPU-bp0_9nGyKjWlguf6kw4ey1uDxKiilEzg7KmXPWHysgiqBnOflyQeNwoknX7hhw0JTzMlOCvWVffArd2r3MYDrk-HsDkv14UbBCMqwsfKWwsh9-6n51_-m1-dS_nENxl1i1b_bZMVX7ZYu2j2wsTehobmTIWukNpAVx2fpSheVF47kOCmguoLDejHNXtQHG62NBYWdP3qEf9h8F2uQG5iX1ZtdJNKxgGN4NgC8cc3vOqic0g1GABp5g3deoBl4HU9Md6CHWldiW8NgYd1Aywnxlu5Up6AIVs6DhV2BObPpC1yC-ZQOQ20_zA5npEVUdvM3hgl1JscAGLtIuMVWWkT0ptpQYTvJ_xyb7S6EvcZ6qmZ07mZnpbfwxshKmFro5xv2etheDiEHzhEKaoJ6bxLMnCFX4w3XFLAaJTBkN8ItkvISxiuWNRduerBArgRMyOqPZiKSfYf9ybuQrOHMn-pgVcLZKwGjYWt8w9_tajVqTGDmCp_XLSszcPTbEa8ilMXYFsYBU7IegCoYkurEGOoTt1QcVgjhLGgbFnpmgEPA64xZ-25tYvP16QlPQGf1VPKeKodAs0VN5blfpkGUtcV42SmvGBlNRheb002emes8qJ8u2czbdAtUheH8UDblPFglztnkdJGpuAdqCrgUUUqAiqdqc-4nc4t4sKM7CYV-WkAlpLzTj621v9LwEc39BxWFdKG6UKtIh89MhK7tH1Ajz6qmKEUv4l7h5dvqCWr1NkK622OB0uWTV9DCqQHDjt4hr_Q4ZOjTLIZVAYyBsboaKy9GiQ7NzYb72yqWZCNxGnTNyqgOfZMk6LhQiAgOirrJBUzjtdQSo77IeWVnJVXNbwyBUJV_IM_4TE0UdksnOLB8T4vCg_1gCVlQ1wfCCUwTLKaWV7_Un-JwhOoPMhaA6QG2oscGM9LIfRgZcoyHwVbSx8QOrV3bBfFSdKoEjS9bwcyP6FOyzJ9naNtlEwshtKP0HEVHuj1luI0VjcYyxTvo7xNXevnijV0YipUcu_4JPEsCviTbeohkP7Q3J_-hGPPQw3QPFji9TmQI5CoFaqf0nv0eLHL4Nt283YS3PPMHxxJF2fcucfZkeyFd0ubhcvLfRmbd5R7pI8VOa-kIu7lhgcjZ3-OA9kbOKmpupK40F7IzpU8PYLrXoR1Q_vzBcM2q78sMtRPCBAIDv8a8__nXg4vvHXVXzxOzSCODsLFpOXBErg7yGQSbEEPFu7XH6rTJDGt7CLs5xSAF10fwV9jWp4ACGEawSIR_1Y6gKZ1qpR_cdX7fhr-SJ0GOj7xRtSb_9HnPpzgL6V6HudxRryVwKm2W29kpdqA9jJPfU2gWXny_7SNzkeUSFwCQyqishN8vpIDFMQHSqKqlnc6htvWFhYQ3yva7UpCLm4AjqF8PMvvG0InreYcB3ALKBJb7QIK-M0wGhnI1nIAzvjW5lcggQf1cNzREnAZDcafPGn2t4RpLEKscT5hMccpsb_7vQ-VkZZ9Yp5ZuFlkuEICYQXH9UX9DR1ddiD2TmemanD4Z2LA-Qjb2n65_a6g29JAYLYyIeRnafldb6EN436f8CCNvgOEnwkKSX5_AZqROufF8P1go7EcdcV-yxhFBJdddn3JKdhkuOoVRdGyja-IJSVR3UAaplz_ohN00W8O4SM5PKYSlsKrtj8H267tRA8Rkghr00LgmdKZCqLNObC9HhVedeHbXQcM14XKceR38ev2gsH7HqB_B4pzTmK-VK3e3fsVrs6cDu6haMZiSvN-Xp3PrxOmkQsvDCsKOGVVzK29yJ4P2TNpLaNB85R1SxcNFuo0pt_UQRntq8ma5SvsakeOagM_chULMJ6MsN72n-S8uDHQUMONQDtvzzlOxXhVDsScG_IKhzKK7xELsTkiZ_TkNWhQ4EqjqdA1teC3aTJzMmCyYZaWxmg2d2AQnP63QHncJZugr_Hg7pl9n5Edzv0jH0Ox376C74PZBgk7t-1txBN-jy0zV621IYHJFF7Bb57RXDnOyC-jodMCx0z8JM_ON8xOXeBrXC1YUIApwfasX1WtiS-J1APMGL9WP8y-Qb-V3vPBR9gXaaTdvS2pNACyeOnI8hHSAbhXrVI2WaruHFwi-pWunEeLkzLii-73yLtnTIj--Z_Ug6rwEMPIXFpFQM9b6ZgUGQadK_TzTQ4Arxzlktnnii3uNevDqIMIN-mKGLenSRq054RoJki79wVSx-1arFLRiaGc137Z_ThrAqZnAnP9IRxWu6eLYd_hwcyl7H57tWMLpoj8Td63zFuiZLDsUO2Bf79YHqmoZtO8cFjjaDdJpJD1lnqMVIrZaV_8NZWX855PgH-vZujzpiPkmUhocVEMeAFzrjeDgVXbjq5xdPkWCBuMmT5f_wHRBaiyvJYaIh336HQaTu5-vX-HcA9YDih2slJZQq3DfYtozDQDJ7QCAc-VVb5lTb8G5vncsN74zZtOGdObVPfS9mG1HwB1X4SUJZCisqVLVllP9Zax7o2PsWTQsBvAMfdE1ncMqhp7xrn7QZrxxY_evz2jjyUapfJjuElVthPvJAGSJdFNorSdTiYx4Ubc8aP8upgYjizuTg3VU2vOYKWOtdRfa5e_SYPLLQll8n1JFKLKGaY_DuX6hqYV6VoP6hg0mbnLcFRptVW_N43QimfGQPaa-PM6k3GnvUT5S8YBCvEM7nY_fqm4v_9CfsOEczMKhAJSeYvwex1wx8RXcMmPetu3kjy8ijPj4H6DgmqpC1LCjHzv3ZfDI18FvfV7_SbCsnEy_ZFQfwXl7unMEg9TFxSqoQC9HIR9GFH7OQzwwCeWtWT2Xu3CZYDCNgkpqeBRMyvknTeyiX2QMh29339MSg2Jj2wpK2RH5ZPyZQOVflzggKLXirIiFFoBlRvgEt-SvZY3liwZa0YZuzljOt3DC35CkXBPrxavDCSu_3d4B4YaFxGq_bUa561TE4vkS1hjKTW0ynePBLQDfIn8k0IrAY&cid=CAASEuRo4v7__XJ5ijouPMDqRI2pSA&rfl=1%2Chttps%253A%252F%252Fwww.reisekostenabrechnung.com%252F%240

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

d0da92b77812f9be5a18d54d33e9a212381f690048fcce8486424e0c761dfa88

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 11414
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 586A 42 B
65 B 40ms
38ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DxhxweJZQ4IjHMsdhtVZ88btK7SuIow6zYE2OTtFhtM4QHb51gtnq_poUPm-x_A2ozPmd9EhwmHEdxpKNgGWeas5Heq0iE8ypRSKXIBp40rgaLvB4

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 clk Show response
ad.doubleclick.net/ddm/adj/N1246177.3716415IGNITIONONE/B25408918.296831033;gdpr=;gdpr_consent=;sz=300x250;click=https://googleads.g.doubleclick.net/dbm/ Frame 586A 39 KB
17 KB 116ms
77ms Script
text/javascript 142.250.74.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ad.doubleclick.net/ddm/adj/N1246177.3716415IGNITIONONE/B25408918.296831033;gdpr=;gdpr_consent=;sz=300x250;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CqGq8vHVSYJK4NMvugAfrlruAApGMv9RhyeH1m_0M2tkeEAEgpczXamD7gYCAiAqgAeLd28sCyAEJqQKMAU63JPizPqgDAaoEhAJP0N8gJV-G_j2C5pfrThNxEBTj8bhgEURfaA5qZmjQI_zIRwfJfaooAb69cwQonZSywSeyzytjv2iXyvut6NY46Kurk8avztTtkOHQKdSEwTAaHv3gdYM8DZzrgEyMDT6wZT2jcsxDtzNf8hRTiMrdPAVYrXQCh2RQXSxjermIlfnRSI-5U_EoLC1Y6slbKUCjZ0V9VwRCzBmcHl6SVsrnLRkm4DupcKtelA3WVeCBO9Jwwfwkr5WUuEyTrnYNLJ2ctrLz_lk4AqiLZmmVXoxpuKS0Itzybkb4vUpJQ9lQs1npjHVHlf_l1migsGkYY57DL4vq3PbLeXx1C1D27b96fG6ZKsAE-saBibYD4AQDkAYBoAZNgAeGoqS0AagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNDQzNjcyNzA5Njk2NjU1OYAKA5gLAcgLAYAMAbAT-tvyCtATANgTA9gUAQ&ae=1&num=1&cid=CAASEuRo4v7__XJ5ijouPMDqRI2pSA&sig=AOD64_3gQQTy60LraXmiO4s9i8L2iYMU7g&client=ca-pub-5902083285302779&dbm_c=AKAmf-DTkA7hn2A5tmE1qRXYLMTw89t3W9FRJQN1ZB410CtLIkv-Z6Y3cpnBtoxGcOCXncCD3RnWBz-HJeGVLZIU39TVQIRq7q4k8ki92zuu2UigRLJ6s0V5W3c7lZHHJIJ07QYmyBUHRq1uwLffmCI-K0ISYcFjJg&dbm_d=AKAmf-AMxouubioa7gvp0ERqvbkwu6K8_u83pqS-cGP6ruSrgSmjWGq_XyQsRY3CI74WzOTqq5xckn0Wo5OC-LIJfj5R7TexUr_GvmXCQ9IyWRV66sdBEekiD3uL_-IgCju-sXsaSycwLnwDxz63UBnfwCn-yEhloFSuJkNUG5anmvwJmEgNpNLIlF3kGq0qPuKMbuFho5AzDFo6-JFRTvv3cQaS8wD0PzGs0W5OQUqIbN25YXZqtlJu7FM6gZ9ndEzFUEp8gTtM0JT9lN46y0HuekpKY7zA_jpM98hqUS1CjurCn5DDTmgudZ4nN4PRwkdkzEmNoVYpdpL2Zq4Wo07WQ0BjQRSek1vJY73AV-f3TUDB3Z7PbOAxH4tja0JFhqG7IHbSIsKpNwf-McqHhG7u98PGPP-Jkt4FDxi3oaalNI2jrMaHGbFauTDarSJ99n2z7jLO8y0M5MLPV1TWUl2kJc2xkuJo5g&adurl=;ord=1616016828859154;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.74.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s02-in-f6.1e100.net

Software

cafe /

Resource Hash

0074b127a29ae376437ff1b01ed01c6f60b0ab72b5aaf81e50cc7939e626d620

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17237
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/ Frame 586A 2 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/window_focus_fy2019.js

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:31:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 163
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1303
x-xss-protection: 0
server: cafe
etag: 14729628269804859526
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:31:06 GMT

GET
H3-Q050 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 586A 117 KB
36 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

941c260356b6aa75782a27384179a63581c9e41b42155774982f36b0d84cde9c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1615980836519751"
vary: Accept-Encoding
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36389
x-xss-protection: 0
expires: Wed, 17 Mar 2021 21:33:49 GMT

GET
H3-Q050 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/ Frame 586A 13 KB
6 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20210316/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

570c04b30a5c8fa6ceaff96ea6d3a0dfabd85dee3edae40e38b0344a7278f254

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:32:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 64
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5991
x-xss-protection: 0
server: cafe
etag: 8832118191516519848
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:32:45 GMT

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
289 B 25ms
25ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMCIsInRfZXBvY2giOjE2MTYwMTY4MjIsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InZpZXdlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b50395000005f10839c000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=nBArgVtQB2cBxhnUEm6Q%2FNM%2B6y4FtAU7Lrr6tHscz3wPVwrqtAhjZO2C4RwVN1dDo%2Brg9%2BhRcehfG64e1rLGvprIUYva2xAV5zy%2FmNm5ZxKv2Nm9Yb9%2B4mkw%2F5mc9RnwDMO0Fy9Ag1xuRg%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319577f596605f1-FRA
expires: Tue, 16 Mar 2021 21:33:49 UTC

GET
H3-Q050 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/ Frame 586A 21 KB
8 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BCoOFV86eb5ZHlMrqLvldQsfpNW51eRm8mAYPvyOeSzKjuUEo8S1VzSj57W8aOqr0_CYHIqDOTh8PfxqLIJ3pnwuJlFNVvjUMqo303Ktusuoa7XA3q1vmTHsC3qx5VrV0FapY8f1cjXxYxOc748SEW9Xb4CQ&dbm_d=AKAmf-CHpA-OvDB447mffHSyMhqkGgVhERR_7jLd0k55qt5bsLcBadjhbNF-3BjtGz5-Xy5Yiej2YmUgQxOvHPfwsZy2VKGwn0AqaxFDZEzMOIV4tuPSIBocB5IKtACrhiSIVC3o16oTPiUufOyuHRN8BGjp8ofsE1oRGHLFWOYlG7oMwOu7DMCm2FsCH-kUYuMrn9Fss6Yxrp9R70wrxXhufEmt5YT3s5iYpZyVneTVnq-_tpgFZIjZSV2YWnNmbjp6eRAMlPPU-bp0_9nGyKjWlguf6kw4ey1uDxKiilEzg7KmXPWHysgiqBnOflyQeNwoknX7hhw0JTzMlOCvWVffArd2r3MYDrk-HsDkv14UbBCMqwsfKWwsh9-6n51_-m1-dS_nENxl1i1b_bZMVX7ZYu2j2wsTehobmTIWukNpAVx2fpSheVF47kOCmguoLDejHNXtQHG62NBYWdP3qEf9h8F2uQG5iX1ZtdJNKxgGN4NgC8cc3vOqic0g1GABp5g3deoBl4HU9Md6CHWldiW8NgYd1Aywnxlu5Up6AIVs6DhV2BObPpC1yC-ZQOQ20_zA5npEVUdvM3hgl1JscAGLtIuMVWWkT0ptpQYTvJ_xyb7S6EvcZ6qmZ07mZnpbfwxshKmFro5xv2etheDiEHzhEKaoJ6bxLMnCFX4w3XFLAaJTBkN8ItkvISxiuWNRduerBArgRMyOqPZiKSfYf9ybuQrOHMn-pgVcLZKwGjYWt8w9_tajVqTGDmCp_XLSszcPTbEa8ilMXYFsYBU7IegCoYkurEGOoTt1QcVgjhLGgbFnpmgEPA64xZ-25tYvP16QlPQGf1VPKeKodAs0VN5blfpkGUtcV42SmvGBlNRheb002emes8qJ8u2czbdAtUheH8UDblPFglztnkdJGpuAdqCrgUUUqAiqdqc-4nc4t4sKM7CYV-WkAlpLzTj621v9LwEc39BxWFdKG6UKtIh89MhK7tH1Ajz6qmKEUv4l7h5dvqCWr1NkK622OB0uWTV9DCqQHDjt4hr_Q4ZOjTLIZVAYyBsboaKy9GiQ7NzYb72yqWZCNxGnTNyqgOfZMk6LhQiAgOirrJBUzjtdQSo77IeWVnJVXNbwyBUJV_IM_4TE0UdksnOLB8T4vCg_1gCVlQ1wfCCUwTLKaWV7_Un-JwhOoPMhaA6QG2oscGM9LIfRgZcoyHwVbSx8QOrV3bBfFSdKoEjS9bwcyP6FOyzJ9naNtlEwshtKP0HEVHuj1luI0VjcYyxTvo7xNXevnijV0YipUcu_4JPEsCviTbeohkP7Q3J_-hGPPQw3QPFji9TmQI5CoFaqf0nv0eLHL4Nt283YS3PPMHxxJF2fcucfZkeyFd0ubhcvLfRmbd5R7pI8VOa-kIu7lhgcjZ3-OA9kbOKmpupK40F7IzpU8PYLrXoR1Q_vzBcM2q78sMtRPCBAIDv8a8__nXg4vvHXVXzxOzSCODsLFpOXBErg7yGQSbEEPFu7XH6rTJDGt7CLs5xSAF10fwV9jWp4ACGEawSIR_1Y6gKZ1qpR_cdX7fhr-SJ0GOj7xRtSb_9HnPpzgL6V6HudxRryVwKm2W29kpdqA9jJPfU2gWXny_7SNzkeUSFwCQyqishN8vpIDFMQHSqKqlnc6htvWFhYQ3yva7UpCLm4AjqF8PMvvG0InreYcB3ALKBJb7QIK-M0wGhnI1nIAzvjW5lcggQf1cNzREnAZDcafPGn2t4RpLEKscT5hMccpsb_7vQ-VkZZ9Yp5ZuFlkuEICYQXH9UX9DR1ddiD2TmemanD4Z2LA-Qjb2n65_a6g29JAYLYyIeRnafldb6EN436f8CCNvgOEnwkKSX5_AZqROufF8P1go7EcdcV-yxhFBJdddn3JKdhkuOoVRdGyja-IJSVR3UAaplz_ohN00W8O4SM5PKYSlsKrtj8H267tRA8Rkghr00LgmdKZCqLNObC9HhVedeHbXQcM14XKceR38ev2gsH7HqB_B4pzTmK-VK3e3fsVrs6cDu6haMZiSvN-Xp3PrxOmkQsvDCsKOGVVzK29yJ4P2TNpLaNB85R1SxcNFuo0pt_UQRntq8ma5SvsakeOagM_chULMJ6MsN72n-S8uDHQUMONQDtvzzlOxXhVDsScG_IKhzKK7xELsTkiZ_TkNWhQ4EqjqdA1teC3aTJzMmCyYZaWxmg2d2AQnP63QHncJZugr_Hg7pl9n5Edzv0jH0Ox376C74PZBgk7t-1txBN-jy0zV621IYHJFF7Bb57RXDnOyC-jodMCx0z8JM_ON8xOXeBrXC1YUIApwfasX1WtiS-J1APMGL9WP8y-Qb-V3vPBR9gXaaTdvS2pNACyeOnI8hHSAbhXrVI2WaruHFwi-pWunEeLkzLii-73yLtnTIj--Z_Ug6rwEMPIXFpFQM9b6ZgUGQadK_TzTQ4Arxzlktnnii3uNevDqIMIN-mKGLenSRq054RoJki79wVSx-1arFLRiaGc137Z_ThrAqZnAnP9IRxWu6eLYd_hwcyl7H57tWMLpoj8Td63zFuiZLDsUO2Bf79YHqmoZtO8cFjjaDdJpJD1lnqMVIrZaV_8NZWX855PgH-vZujzpiPkmUhocVEMeAFzrjeDgVXbjq5xdPkWCBuMmT5f_wHRBaiyvJYaIh336HQaTu5-vX-HcA9YDih2slJZQq3DfYtozDQDJ7QCAc-VVb5lTb8G5vncsN74zZtOGdObVPfS9mG1HwB1X4SUJZCisqVLVllP9Zax7o2PsWTQsBvAMfdE1ncMqhp7xrn7QZrxxY_evz2jjyUapfJjuElVthPvJAGSJdFNorSdTiYx4Ubc8aP8upgYjizuTg3VU2vOYKWOtdRfa5e_SYPLLQll8n1JFKLKGaY_DuX6hqYV6VoP6hg0mbnLcFRptVW_N43QimfGQPaa-PM6k3GnvUT5S8YBCvEM7nY_fqm4v_9CfsOEczMKhAJSeYvwex1wx8RXcMmPetu3kjy8ijPj4H6DgmqpC1LCjHzv3ZfDI18FvfV7_SbCsnEy_ZFQfwXl7unMEg9TFxSqoQC9HIR9GFH7OQzwwCeWtWT2Xu3CZYDCNgkpqeBRMyvknTeyiX2QMh29339MSg2Jj2wpK2RH5ZPyZQOVflzggKLXirIiFFoBlRvgEt-SvZY3liwZa0YZuzljOt3DC35CkXBPrxavDCSu_3d4B4YaFxGq_bUa561TE4vkS1hjKTW0ynePBLQDfIn8k0IrAY&cid=CAASEuRo4v7__XJ5ijouPMDqRI2pSA&rfl=1%2Chttps%253A%252F%252Fwww.reisekostenabrechnung.com%252F%240

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

70d82c6075989e0082b4917c6685f5f6bec1e673d0a80160eac61b3f1cdcb1a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 60
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8471
x-xss-protection: 0
server: cafe
etag: 753583566593306265
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:32:49 GMT

GET
H3-Q050 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 586A 41 KB
15 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 17:30:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 187375
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 15 Mar 2022 17:30:54 GMT

GET
H3-Q050 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/ Frame ED7D 21 KB
8 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bl6pDWqEUmfbSxb4Jhuq6A0G0EO7Fx-PcxRx9Pkbaxv3qeOzby-gcQDdr41cPw8VWgKvaLdNd_34QGpLoDb8ZsczbEHxER8Y4M700DVx0dWQoLKC2lOdoHoyyt-IuaIVsqrcUDGn03RlBXRsxIP295EVl-uQ&dbm_d=AKAmf-CoG56cDdl59pi_vZfVM-SY9XwtsMNyty2m5ahXNxvR225snOxJah_WI63deE6ahO2DHwYlfENS1Y_CyGC4-bWWU0sx-j4fY4FpZ02LRugl2m01pKGx8Qd1_TkXN-4M98vn-6D06rhMVXEBYBR2PeW396oOcC_3l89ZZZECsuQ-s5KvemQYHW7hv70SnEExBW9QF-u2DWZrHrOIJdE1zs2dCiKwchP9VESOlV5Yx26tLwNMa0WVxBnr8t1M7Th0g-J5hM8Ju_Uo5M57kgoMSh_gsGFBv3ZkaPs894XPmnLh4knHeixqmu2KcMNjh2ShCibY7lXjTDcLHXGJqlKTYPL7Dexn4tmQ0r9zqLjWCFJmUUPdRhdRADVCjEvF5Zl5diJ5C4IDtgR-nxED410dbSnE7T9813CQz5eUhepPBWtJ1enLpnBQCFEwLPCpDtgPdWYxR9TjyOwFeghYbMenTaGys27p_39lkbJQvPG9OWYncKfJGLH6DUnxr8pJo-H57BlNIeFYMl5dvWSCqzVOJRzA7uJ53pbI_n51W3r9RY82A0Nm6j7tM60pegvW2GNxCMcZmuR0CeDx3lRaqFeZU6w6HTSUwE-2chtuCja69GQUevJ91RFF8-PwB5S6oPbEEdE_kjV6RMUubuxELU0UZ4zHaVdXHyub83aXHeqBYNnum9EO7Yakd6HydFCUZZlSYsfOtjU1-Aq4bkuh48NtZ88Rp64iDFpTHCIiz13j4XYjHUC3XTfAWgLYEATp9QfesahvWl0pDeZnReCmL1CMvBtzQwcpZzDB3NMDcsHEqOtuSM8XqmYj4-mNct06fjA1kfWn9vABmEq2Pd-o3TpaoFlvrNqbOilGC0SQjRk7jfSrfV7Vzaij-1vgCH-2Wfy56YdqxeBnxJ4Hde_KOKuqsSzu7BqN9AFamgo7HR5CBsBtY1SrRPReIKG7zpsmpTzWwo5sBLkoA2TaNMUImt3gwOgnQ5Clzn5DKnM1uxN0qdlZE686ULUHGtSqn9P-spv8qNU-PW9RlGRnjR0vTnGsu84Dr5So5sd9RJBZ8rlIS_bZ7NGXNcu-DkAhTQro2kd_jWNFtQdmQFcrenJRVHwPBjs_2jD9ZuF8HV6t9zkvgqSIwEVEyLlaqM39LQEsbPl7GBc4oKFF87vnYBKXDcsPsGgryF03L04SGJnXcPblWg6WC6fipyUIBG39auHX4nQhv06x2rF5OSJ0zHtQP9S-_JYArEId0PYXCKIY62bK788Pt8BoCSm3uusMG-45lFmhhGRv0E6qHsiUmIef8s3MepAfC_eeoO9WB2ZBBpj9_dBKwVjVwOMa1uplstDEa-8Mge9BPonAPlem-bAJHOXDtzKfuAgt7uqi5kOa_sR_jKKQFeLFxs4MFq1L9tUGbwtMgxUvsT8IKsAW_cuoZr8FOfJn8Q8TWMKQEIzIyQJk6mmyWH9zU4axuBHzzhuDhXXatAtasrVo03Gkd6W4uONooog37w1hSN2MqrzUdfiii16FpmlUb5YEIWC9gnTSqnU2JkvrlZy8td9g88p800I43LLG3zZIn8e8DdlaPwUwftRYTMK3IhO8twp0_kp6kZaVh4mZh_w1mlGj3fvqMw-6EWpPBwvOqLMSOqjqmnQAOXaPddst2-RpyJcaOc_Zlas7Hcxqmatth9Ivrd7MAKQKFtlhEf1k33ftjhQkXE7p6LdviAcCFgBvwEhj-UpNQbwg0XjjApXlVdCsjWEs2yKKV1YIUpFH58bhrIe4UhdW97P-jY3L64F_5UR_X8S62TAwMy9tgBm-GB-Qz-Ac8QKRScWNofUlB_A5Ph3ZFuuGNdgP22bOAZgnQhoyhfLBUNldL09qyjRd7bFy7zlp5dE9gpaU7J27F7ziVcdc4m1m6QiWUu_nQG-2cPNkXWsVwqVj35UyRzdFc6eD4bUgwF3WdslYXkVDbsQuSHEuSFZkqZjWNOo3Nr7FQpp_W5Sa_DTyv9_RKrb3Ib7CMGGr3M1NhE2o813VneUP2EARIe9eJ6CVJfvKPUFqZv-_NuGregJBUScTnidHT1h1RWSf39Ptfwuws13DGeGZ8LkYULfW9j7BILn16o6hatQqIPL5aPnM1TE9rnxuZufxADcj1Am5HPjRo9lWx8h6bF_lKBmBJa6Z9qF65Ph11noc9vt2NM5Or1F89ivOdYnZPoUBT5x6JIrBWahIVo90_iWAm8iB9QOBWKlvdDygNJGB861oY4ZCk3-EmWFFpflUP17pFql_GMnUwPprDLjcmkFvwc2JKpimImR1DA2uqZzQI5iSiJcV1bxxHhf15LLR8enbaqBll91wjEI31xSYg4dhc-ctF4sD02OS9_NtG7EYprVvLBJHtUCoJLD5gHg1QSujhOEpd11hEKVmCfG1X-kC_h_Y1yJXtZF3Bv-kXeOlT1FbNpI3JyipCWkm0cGnUCJJ0MhGjClwkZsdN6GSWtf9dK8BKiUcqHn366hWXQ4GwyD5CYJW48UaFzS8bOC3ba2xCdLZVzFpk2fHu9sqiUYETad2M7tSx8flzoY74E-SMrcG_PdBfCXWvN_8roAqTdbkwuw8b-7uMhGlhQXYTcht-lTiTwRKumh2fY6RKgr8gdmfkOPNItwaSU4A4HvhU1Zlefulw6ajT_sQTdAMG1W19HNb-BEbN-m3CEmBHGOSoz5w_5wGVvN0ytEg_XCPd8Z4yV02Oua9F1_saYE9hsRMBbgB_KUqLxVcZ8JN5nFjutG3d5x5JJ0seE0w1VO46bFsi9HajI6Z7iTlR6cAEkRwtXqO7oJo2W30KKUBCyMJSbp_81iBQEAvDZ42YLOHX9OCSUaXz45CUg_bnqdBWsYQdu1fu5GRwiUs9QVQZs_Qfbvj2nDIoz_OoBW9fRgcQDJdy6O2c5QzG-YDWaX6uSsjxu84aXTx4Un9xD9cVEVqAhmnn-bSRe8wEybz3hv5FSrablwcZeu0oEU5baiPOQ7f9QvxYLlVQMtDGBCtbhpmEDHVu8uPkQse5CI-IGGe4kL4MApl7tfjDPyVs3fNcFa26Asmx82GUTkMY5bawpmA5XAuvdXjw1zTMtTOkSQT3JfcbOGgv61PeWHfrbWV6MXSfC0XGscmxhdwv3jAgeL5SuLH49hGVXbAlH8488lKqFYo8W3zlSTl-X0NKnOm_h_DXTBU287sBR1Ym0dOxZ4b4zJuwEL055r2ODznlaCYikBGtPsKnwxItLo19AwpAzYPKDpPk9-GMPPi2VI&cid=CAASEuRo8QhJXOsL6wY-mxlNGfqTkA&rfl=1%2Chttps%253A%252F%252Fwww.reisekostenabrechnung.com%252F%240

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

70d82c6075989e0082b4917c6685f5f6bec1e673d0a80160eac61b3f1cdcb1a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:32:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 60
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8471
x-xss-protection: 0
server: cafe
etag: 753583566593306265
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:32:49 GMT

GET
H3-Q050 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame ED7D 41 KB
15 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Mon, 15 Mar 2021 17:30:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 187375
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 15 Mar 2022 17:30:54 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 552B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1

43 B
894 B

71ms
70ms

Image
image/gif

104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNyuyAIQpovKAhj9i8qeATAB&v=APEucNWkZsI2GTzkaS48L09y7vkn2IXKufQFgvAJ6WXv6f4lAEl3Q-OcTzoeo7Ckk1ZeyHXnamAEMGIFGhNa4ZRhbmTMZh1YSx3ISvcbnJH9gNUzFBDYz0QEXsW_m0R0veUT19PkDKzeTfDBFUWmjfeoJkYpXsAFtx16-2ugs6aQvhp7xIz_7BpjqIbIjOqBexPd1uDZI2j1aRLXop61rpHAZsni0l6aKI0stSHfO26dhW_UMPFTYwk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.145.8 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:49 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 17 Mar 2021 21:33:49 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 552B
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_hm=YFJ1vO7rA7INuMC5U4fqkAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1

43 B
894 B

57ms
57ms

Image
image/gif

104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNyuyAIQpovKAhj9i8qeATAB&v=APEucNWkZsI2GTzkaS48L09y7vkn2IXKufQFgvAJ6WXv6f4lAEl3Q-OcTzoeo7Ckk1ZeyHXnamAEMGIFGhNa4ZRhbmTMZh1YSx3ISvcbnJH9gNUzFBDYz0QEXsW_m0R0veUT19PkDKzeTfDBFUWmjfeoJkYpXsAFtx16-2ugs6aQvhp7xIz_7BpjqIbIjOqBexPd1uDZI2j1aRLXop61rpHAZsni0l6aKI0stSHfO26dhW_UMPFTYwk
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.145.8 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:49 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 17 Mar 2021 21:33:49 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 552B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEGeQgf8VWyg0g1fS5sl7yaU&google_cver=1

43 B
1 KB

37ms
36ms

Image
image/gif

185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEGeQgf8VWyg0g1fS5sl7yaU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNyuyAIQpovKAhj9i8qeATAB&v=APEucNWkZsI2GTzkaS48L09y7vkn2IXKufQFgvAJ6WXv6f4lAEl3Q-OcTzoeo7Ckk1ZeyHXnamAEMGIFGhNa4ZRhbmTMZh1YSx3ISvcbnJH9gNUzFBDYz0QEXsW_m0R0veUT19PkDKzeTfDBFUWmjfeoJkYpXsAFtx16-2ugs6aQvhp7xIz_7BpjqIbIjOqBexPd1uDZI2j1aRLXop61rpHAZsni0l6aKI0stSHfO26dhW_UMPFTYwk

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:49 GMT
X-Proxy-Origin: 217.138.207.188; 217.138.207.188; 731.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.183:80
AN-X-Request-Uuid: c83ea638-3b67-4854-99d9-1c9336cc6909
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEGeQgf8VWyg0g1fS5sl7yaU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 552B
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzcyOTQ2MjExOTAyMTEwOTUwMg%3D%3D

170 B
190 B

43ms
43ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzcyOTQ2MjExOTAyMTEwOTUwMg%3D%3D

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:49 GMT
X-Proxy-Origin: 217.138.207.188; 217.138.207.188; 731.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.59:80
AN-X-Request-Uuid: 81e6b8ff-ac09-41ce-a783-16c75e403cb4
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzcyOTQ2MjExOTAyMTEwOTUwMg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 bootstrap.js Show response
s1.adform.net/stoat/620/s1.adform.net/ Frame 9FC7 35 KB
16 KB 158ms
52ms Script
text/javascript 37.157.6.234
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js
Requested by: Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/track.adform.net/568657/51893927/adfscript/?bn=42916151;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=ClCDRvHVSYJHIE6z5-ga36peIA-iKsddhu5GSkKUN7aa7j8oiEAEgpczXamD7gYCAiAqgAczrq9AByAEJqQKMAU63JPizPqgDAaoEgAJP0EM6yFRgB_iVyTtq3dgQ21xQc9R6hrzsAaGNYT-EtGSxpGPiY39TfUlrm8Lqgj3IgUB5bNUB2r0YpYKlvEtCpccrIXiHCvtoYR-2dUeUaXFVbnvgtvjWFJmqN_38d2Pzt40UwyRz8f4GK2_N4Szf8wFdcbPqOOiH7-03M_82gwAXs4YgNtod8z5r8U_CLAUgiGg80YdKwneU7iSRw0D1TjZs7psORX8SXmfMI0CxB5j_bv7JKP7G85GS06ADHEmWDsCLVJx3SFLQ_Mdh3RYUy860J2I2Jb20qZKpuoK_RVs5bN-fUYhLAbc4Z8KzgHgkk4DCNbW0a2Yyhe8Wzf0GwASk983nzAPgBAOQBgGgBk2AB5yU1K8CqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RuoB_PRG6gHltgb2AcA0ggJCIDhgFAQARgd8ggbYWR4LXN1YnN5bi00NDM2NzI3MDk2OTY2NTU5gAoDmAsByAsBgAwBsBOqrP0K0BMA2BMD2BQB0BUBgBcB&ae=1&num=1&cid=CAASPeRonUriMgQtamsmiUO6vw-iFuVB1r-eFSS1cPqV5UEkRh3R11IpkAN36lRVl4PgSV9r_HyBNz7IzP-EbWw&sig=AOD64_1B35qtMqeP5ozNU_FsFFBxVYyQkA&client=ca-pub-5902083285302779&dbm_c=AKAmf-CpBbYHKLDdgNf6Gcg7M9fWXPvs5MQS8UniXewdxygsS5t2wmorB3rrcSQ8lW5cvO7EQ4_Rt2AV0MkX8TbqoYpP5lseYImQ8VZ-DmWcf5zNMJ7Ea_AvZ1CK51b3rxMdawWvoehCGj0VFOx_D7oY_T1p50r3dA&cry=1&dbm_d=AKAmf-ByWU-c3SjxbTGxIzkOuj_den8oBwnbjV8EaBZYyAAxhgoP9p3zkPs_NqueTLWKPXJuYf8tOuyJR5Pn9v9P6HoOL1HON0VLeezD6rpWIOUYopXqbdPOQKoWn2WxwLec-x2IH8dae1fFB9G8j8xYJnxk0dv7OBJCeikjZE7NU9MbqwuH62cuZTicgMUZuubi7KNOhPg9LAcuCB7KS7CkaYGkMjBf5p62sKvrYll-grcUcRWt0PePBMLHIdyQ-cz59jc7J7lroJw-im36uqgUWAP0ohDqbsnbDj84-aMyWS3kYBlS7h0W2lX_Ce-5a7xQCHsKx6PcOKMSSRa-vue35_2Xa6-Nf1S5UhROFFmgf_nfkbolYYPcTdyZzo-OYqAYPtXDdQnJHrPqLYhYgIGaBmZzEVkj1TNN2BohRxKemS3jsQuHiflRUc7bWz8MHJG0nXgk6JOWQM3Deov83ePXqysp6BLPbw&adurl=;ord=1616016828320529&adsafe_url=https%3A%2F%2Fwww.reisekostenabrechnung.com&adsafe_type=g&adsafe_url=https%3A%2F%2Fwww.reisekostenabrechnung.com%2F&adsafe_type=c&adsafe_url=https%3A%2F%2F56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-37%2Fhtml%2Fcontainer.html&adsafe_type=bd&adsafe_jsinfo=,id:fe9280c0-ee2e-eac2-25d0-db4e47f9d3dc,c:7a2fqE,sl:na,em:true,fr:false,mn:app17ie,pt:1-5-15,br:u,abv:na,an:n,oam:0,scm:qktrf1,nbld:0,fm:srXbVsz+111%7C112%7C113%7C114%7C12%7C131%7C132%7C133%7C134%7C135%7C141*.568657-51893927%7C1411%7C14121,idMap:141*,ex:e2,pl:,rmeas:1,rend:0,renddet:svg.us,es:0,sc:1,ha:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,thd:1,et:26,oid:75f52275-8768-11eb-9df0-0289e6fd96ae,v:19.8.174,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.234 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 686df60545fbf0a0d59457fc410d3f997b5c904afdedb6d1b67a48984d6a2cda

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
content-encoding: gzip
last-modified: Mon, 08 Mar 2021 15:51:47 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Fri, 19 Mar 2021 00:24:35 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 29AD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1

43 B
894 B

66ms
64ms

Image
image/gif

104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNyuyAIQpovKAhjKicqeATAB&v=APEucNV6ZXObWaGf3kWOV4PU0H2tR-V-a2BGu2SNKzjH5y7KfAEEnFpRgjgOPNzIACKjqhoZxfshO50WbJ-z3NykT892vdU4hjVfdBme17DFMfcAJOG0f27b7UN4BRNY68XhjlPAcSvcC0A5CuaGvKjut875eCho7UVj8yKnzmg0IyQRVViIPt78Fkk8XZd10jEnmbW3tl6mBKe5iqIXnSkKTsMQQeFMikdtUkXX1eCLopddkJikNAg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.145.8 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:49 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 17 Mar 2021 21:33:49 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 29AD
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_sc%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_sc&google_hm=YFJ1vO7rA7INuMC5U4fqkAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1

43 B
894 B

58ms
57ms

Image
image/gif

104.108.145.8
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNyuyAIQpovKAhjKicqeATAB&v=APEucNV6ZXObWaGf3kWOV4PU0H2tR-V-a2BGu2SNKzjH5y7KfAEEnFpRgjgOPNzIACKjqhoZxfshO50WbJ-z3NykT892vdU4hjVfdBme17DFMfcAJOG0f27b7UN4BRNY68XhjlPAcSvcC0A5CuaGvKjut875eCho7UVj8yKnzmg0IyQRVViIPt78Fkk8XZd10jEnmbW3tl6mBKe5iqIXnSkKTsMQQeFMikdtUkXX1eCLopddkJikNAg
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.145.8 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-145-8.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:49 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 17 Mar 2021 21:33:49 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEBhP3YcMgug2vSLDudjqMEA&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 29AD
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEGeQgf8VWyg0g1fS5sl7yaU&google_cver=1

43 B
1 KB

39ms
38ms

Image
image/gif

185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEGeQgf8VWyg0g1fS5sl7yaU&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CNyuyAIQpovKAhjKicqeATAB&v=APEucNV6ZXObWaGf3kWOV4PU0H2tR-V-a2BGu2SNKzjH5y7KfAEEnFpRgjgOPNzIACKjqhoZxfshO50WbJ-z3NykT892vdU4hjVfdBme17DFMfcAJOG0f27b7UN4BRNY68XhjlPAcSvcC0A5CuaGvKjut875eCho7UVj8yKnzmg0IyQRVViIPt78Fkk8XZd10jEnmbW3tl6mBKe5iqIXnSkKTsMQQeFMikdtUkXX1eCLopddkJikNAg

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:49 GMT
X-Proxy-Origin: 217.138.207.188; 217.138.207.188; 731.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.234:80
AN-X-Request-Uuid: 6579bcd3-c6eb-45e3-bcbe-61a1ecaafa13
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEGeQgf8VWyg0g1fS5sl7yaU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 29AD
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzcyOTQ2MjExOTAyMTEwOTUwMg%3D%3D

170 B
190 B

43ms
43ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzcyOTQ2MjExOTAyMTEwOTUwMg%3D%3D

Requested by

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:49 GMT
X-Proxy-Origin: 217.138.207.188; 217.138.207.188; 731.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.119:80
AN-X-Request-Uuid: cfc4fc24-2c94-47e0-8b98-c2ef6b20417f
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=NzcyOTQ2MjExOTAyMTEwOTUwMg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3-Q050 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame A805 22 KB
8 KB 7ms
7ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 15 Mar 2021 17:55:06 GMT
expires: Tue, 15 Mar 2022 17:55:06 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 185923
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame CD90 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 15 Mar 2021 17:55:06 GMT
expires: Tue, 15 Mar 2022 17:55:06 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 185923
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame 586A 111 KB
38 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 13:10:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30216
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:10:13 GMT

GET
H3-Q050 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/elements/html/ Frame 586A 8 KB
3 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1246177.3716415IGNITIONONE/B25408918.296831033;gdpr=;gdpr_consent=;sz=300x250;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CqGq8vHVSYJK4NMvugAfrlruAApGMv9RhyeH1m_0M2tkeEAEgpczXamD7gYCAiAqgAeLd28sCyAEJqQKMAU63JPizPqgDAaoEhAJP0N8gJV-G_j2C5pfrThNxEBTj8bhgEURfaA5qZmjQI_zIRwfJfaooAb69cwQonZSywSeyzytjv2iXyvut6NY46Kurk8avztTtkOHQKdSEwTAaHv3gdYM8DZzrgEyMDT6wZT2jcsxDtzNf8hRTiMrdPAVYrXQCh2RQXSxjermIlfnRSI-5U_EoLC1Y6slbKUCjZ0V9VwRCzBmcHl6SVsrnLRkm4DupcKtelA3WVeCBO9Jwwfwkr5WUuEyTrnYNLJ2ctrLz_lk4AqiLZmmVXoxpuKS0Itzybkb4vUpJQ9lQs1npjHVHlf_l1migsGkYY57DL4vq3PbLeXx1C1D27b96fG6ZKsAE-saBibYD4AQDkAYBoAZNgAeGoqS0AagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNDQzNjcyNzA5Njk2NjU1OYAKA5gLAcgLAYAMAbAT-tvyCtATANgTA9gUAQ&ae=1&num=1&cid=CAASEuRo4v7__XJ5ijouPMDqRI2pSA&sig=AOD64_3gQQTy60LraXmiO4s9i8L2iYMU7g&client=ca-pub-5902083285302779&dbm_c=AKAmf-DTkA7hn2A5tmE1qRXYLMTw89t3W9FRJQN1ZB410CtLIkv-Z6Y3cpnBtoxGcOCXncCD3RnWBz-HJeGVLZIU39TVQIRq7q4k8ki92zuu2UigRLJ6s0V5W3c7lZHHJIJ07QYmyBUHRq1uwLffmCI-K0ISYcFjJg&dbm_d=AKAmf-AMxouubioa7gvp0ERqvbkwu6K8_u83pqS-cGP6ruSrgSmjWGq_XyQsRY3CI74WzOTqq5xckn0Wo5OC-LIJfj5R7TexUr_GvmXCQ9IyWRV66sdBEekiD3uL_-IgCju-sXsaSycwLnwDxz63UBnfwCn-yEhloFSuJkNUG5anmvwJmEgNpNLIlF3kGq0qPuKMbuFho5AzDFo6-JFRTvv3cQaS8wD0PzGs0W5OQUqIbN25YXZqtlJu7FM6gZ9ndEzFUEp8gTtM0JT9lN46y0HuekpKY7zA_jpM98hqUS1CjurCn5DDTmgudZ4nN4PRwkdkzEmNoVYpdpL2Zq4Wo07WQ0BjQRSek1vJY73AV-f3TUDB3Z7PbOAxH4tja0JFhqG7IHbSIsKpNwf-McqHhG7u98PGPP-Jkt4FDxi3oaalNI2jrMaHGbFauTDarSJ99n2z7jLO8y0M5MLPV1TWUl2kJc2xkuJo5g&adurl=;ord=1616016828859154;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:28:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 328
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:28:21 GMT

GET
H3-Q050 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C031 1 KB
755 B 7ms
7ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 17 Mar 2021 03:14:09 GMT
expires: Thu, 18 Mar 2021 03:14:09 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 65980
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame 586A 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 389ec2c26664b880f0c6561ed43a0458a86e2a9d18192740f125843fa643842b

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 express_html_inpage_rendering_lib_200_271.js Show response
s0.2mdn.net/879366/ Frame ED7D 111 KB
38 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 13:10:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30216
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39287
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 18:02:50 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 18 Mar 2021 13:10:13 GMT

GET
H3-Q050 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/elements/html/ Frame ED7D 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20210316/r20110914/elements/html/omrhp.js

Requested by

Host: ad.doubleclick.net
URL: https://ad.doubleclick.net/ddm/adj/N1246177.3716415IGNITIONONE/B25408918.296831030;gdpr=;gdpr_consent=;sz=300x250;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CLk69vHVSYNqDNJeVgQejqZPICpGMv9Rh8eH1m_0M2tkeEAEgpczXamD7gYCAiAqgAeLd28sCyAEJqQKMAU63JPizPqgDAaoEhAJP0H_B-e38qfioBxnHa6H-rkHbmqUSeBRZZqN7-griXfoxRVF-2hKAG5djamhl6NKaOg2MzL3xKQ2DQZJ7ZlZb57X2YWQI1otodURz9F0ImHB6SEaGqugRNbx75earzKNTku75S_ETAE-WMuFKdF6KMwZRVzdYSx0p3X3GFBFtr9o1VdvSPMOMPUn7Vx945_FOFxIUGR3wgDkQ1wJHhFwwVESYbLjsvOwqiuaeqdA7lr_K8pi-jOMudtTx2XueIccmlcnBacoVwiNRUuKy_Te7dfm21BKpdSeG6_AjBLBRMfVlFo53ssavmxz_Bz3WByMSSsfRiMKXbwJUPTic8Cn0m90ZhsAE-saBibYD4AQDkAYBoAZNgAeGoqS0AagH1ckbqAfw2RuoB_LZG6gHjs4bqAeT2BuoB7oGqAfs1RuoB-6WsQKoB6a-G6gH7NUbqAfz0RuoB5bYG9gHANIICQiA4YAQEAEYHfIIG2FkeC1zdWJzeW4tNDQzNjcyNzA5Njk2NjU1OYAKA5gLAcgLAYAMAbAT-tvyCtATANgTA9gUAQ&ae=1&num=1&cid=CAASEuRo8QhJXOsL6wY-mxlNGfqTkA&sig=AOD64_00UgE6PZ-ZjCM4nt4x3h9aWqTO9A&client=ca-pub-5902083285302779&dbm_c=AKAmf-A-zfNnZQUyYlsxuGtvsXyLmKR51xkLUNOEeaTBZwYQeeebaPc7CTojE3eeOP6HstQI_oEUgjzN89565cdhAyYsTkXilPe-SUCV4Rt_Pg_fVp6RgbToQepqof4_anIpfHzuzSEBvWcJYHZe5Qi69Qn-qGQUhA&dbm_d=AKAmf-BViaV7gv0ABSCF6HPMzcwE0EY3GClEUKcCTXIkEmIFe4q-LpRKGIOuXK6OQcB2-jIMMp4XiEmxPDxS1QeUu_bLNj7mWnTOTzEEsyPuM8nppCjxIUe5tJYGwhpJ1FoKxAZlsbYu6psQ12uM56aj-9HLTfEDJRwiCHaA-WysQvC9iJgOIDKODsN1sQC-GejBE1bToVLulEwiP6jiQTe-LleivBCmkSVz94dFeL-JMuMeRHvTpatIb2ZGMTXkVcjWa25bQgC8_mZHeqpam-o0SrbxS5otdGixmMZeTa3x-anaCblzniRFElX4tlWIanAg_pCmlsptivrcy6wyzkVDxlh6rSuALXWOB1694tcStQFvRmhDVNBcoYU9jFFwmSEEM0nExWfy93lH6GCoeGAzC262rslCPnwJECz02U10z946vc3Ei75JFm2nHaHI-ToivuG70rOUnXbDRkY1UuBZ7ty2EI6Yog&adurl=;ord=1616016828852442;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=?

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:28:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 328
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3124
x-xss-protection: 0
server: cafe
etag: 4537136162986801320
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 31 Mar 2021 21:28:21 GMT

GET
H3-Q050 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0690 1 KB
750 B 7ms
6ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: pagead2.googlesyndication.com
:scheme: https
:path: /pagead/s/cookie_push_onload.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
date: Wed, 17 Mar 2021 03:14:09 GMT
expires: Thu, 18 Mar 2021 03:14:09 GMT
content-type: text/html; charset=UTF-8
etag: 48472445140208031
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
age: 65980
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame ED7D 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b61b5702e02282165f2916dcf5e71a0beb332b4966d0432c13f34f1f045827d8

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET
H3-Q050 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame E08C 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 15 Mar 2021 17:55:06 GMT
expires: Tue, 15 Mar 2022 17:55:06 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 185923
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 563E 22 KB
8 KB 6ms
6ms Document
text/html 2a00:1450:4001:809::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: tpc.googlesyndication.com
:scheme: https
:path: /sodar/Enqz_20U.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 8395
date: Mon, 15 Mar 2021 17:55:06 GMT
expires: Tue, 15 Mar 2022 17:55:06 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
cache-control: public, max-age=31536000
age: 185923
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
284 B 20ms
19ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8xIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDMzNzkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTBfMSIsInRfZXBvY2giOjE2MTYwMTY4MjIsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQzMzc5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wXzEiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMzQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b504ce000005f171b7a000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=F8iEqO07FYSUtZ4k95OyHddv51wQq%2BNHQPeBjzxFLnpZ0JnFEcHGqzdYNedVh90kfFNO8zuXJo5RVaA496Q9ezdr9vZjhabWZVY1nEOdtI2nvPaMpj44dlSuTVWn281FjjTBMO8L%2FmAjUw%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957814c6405f1-FRA
expires: Tue, 16 Mar 2021 21:33:49 UTC

GET
H3-Q050 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 001E 42 B
479 B 72ms
58ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvZ3LCivX7WXeFTlI-JK8j12sD3pHANlNdz3DBrPJJKOprGxiSVocZ8bdu_sLwCO6CSGkl661Lhv8XqrjGYBwRtWvvqhKSRHee1rrxrPl1nrL8O95Ss3-W4sevnIA&sai=AMfl-YTKXcRXMIiRLJE9bRK7j3S0GqfhJxnEuOsrZ1HKuCySMna7L4kAGx6liMtjnSv-UmT11bb2VuMr8N90r_6WkKrlwODDhkOyOtaj3WpvlhACq9iOt8IWnvOaEv4&sig=Cg0ArKJSzFCvDSHtCSVSEAE&cid=CAASEuRo4ZsM8num09ttMomZ0tRuMA&id=osdim&mcvt=1086&p=140,348,390,648&mtos=1086,1086,1086,1086,1086&tos=1086,0,0,0,0&v=20210317&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=3475385815&rs=4&met=ce&la=0&cr=0&osd=1&vs=4&rst=1616016828248&dlt=40&rpt=2&isd=0&msd=0&r=v&uup=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9FC7 43 B
215 B 104ms
103ms Image
image/gif 35.173.0.225
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=568657&asId=fe9280c0-ee2e-eac2-25d0-db4e47f9d3dc&tv=%7Bc:7a2fzx,pingTime:-10,time:576,type:s,mvn:ZnNjPTEyLHNkPTMsbm89Nyxhc3A9MQ--,fsc:17.5.1v220002022000220000022002222000022220200000222220222220002222022002222202002220222022222022222000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000002220002220000022200222202220022200200222022202220022202220020222222000220000222202222202222000002002002222222222220022202200022002220222202,sd:MTcuNS4xdjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNS4xdk1vemlsbGF8fE5ldHNjYXBlfHxufHwxNnx8bnx8MHx8bnx8TGludXggeDg2XzY0fHxHZWNrb3x8MjAwMzAxMDd8fC02MHx8TW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzg5LjAuNDM4OS43MiBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,asp:1616016829702%7C%7Cbd47250c1e8f0f4c7792f9afe4d0c32d%7C%7Cf34e96995ddf3ff5eb1bfde138cfe29c%7C%7Cc4a49c6bd2e0c31f3d10d755c2d39bf7%7C%7Cff296e9f3d242d66c39181e357365735%7C%7Cc0f688086673be4edc558c4d08c1a6e1%7C%7Ca209ff36552d5e79895e348e1126cb58%7C%7Cda18f30a78adb0212075a709660f261c%7C%7C1614879537%7D
Requested by: Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.173.0.225 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
x-server-name: dt17.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
cache-control: no-cache
content-type: image/gif
content-length: 43
server: nginx

GET
H3-Q050 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 001E 42 B
66 B 39ms
39ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstHhDtXCpFAPAZenWECAKVTgsQ_lyXYc4lemNWhqZMSXfj9SzFi-aPXl8Nx3cKi5bPDo47B1kqWSQ&sig=Cg0ArKJSzFRzW6qm255DEAE&id=lidar2&mcvt=1090&p=0,0,250,300&mtos=1090,1090,1090,1090,1090&tos=1090,0,0,0,0&v=20210317&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=34&adk=0&rs=6&met=mue&la=0&cr=0&vs=4&r=v&uup=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 index.html Show response
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 57A2 4 KB
2 KB 7ms
7ms Document
text/html 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f37e108a103ae6d6ed4ca9047d415434b8a1edefa81ddb7d4314ecb21587010

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 1491
date: Wed, 17 Mar 2021 16:35:33 GMT
expires: Thu, 18 Mar 2021 16:35:33 GMT
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 17896
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-Q050 200 view
googleads4.g.doubleclick.net/pcs/ Frame 586A 0
50 B 69ms
69ms Other
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsscY5IKbwELY82yx_x_ceBnn0ltSOAkV71dGGoTpKJWzDYKdcdyJ0plCEVJCl1DfnaDi6SnIN_axBTTYEyf58ixRX9njkv6QRDwQKM98SzfLwXwXsQK4abSYvgAoe7NNwjqfTJQq0Unsd2Wvd9FalmZgbwh4LSKST1qWYlbAt4gHSwCoeCZcLMKOCUhcoxiWLHbT1zEZLcI9UcGDA&sig=Cg0ArKJSzFo51ifgValIEAE&urlfix=1&omid=0&rm=1&ctpt=267&cbvp=1&cstd=265&cisv=r20210316.66813&adurl=

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3-Q050 200 index.html Show response
s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/ Frame 7CBB 5 KB
2 KB 7ms
7ms Document
text/html 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_271.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

741628e3cc4a52bff09cf26c22429b26f3d55618a9d63e9bd1a97e2e79de83d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: s0.2mdn.net
:scheme: https
:path: /9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
content-length: 1519
date: Wed, 17 Mar 2021 20:30:12 GMT
expires: Thu, 18 Mar 2021 20:30:12 GMT
last-modified: Fri, 18 Dec 2020 09:53:02 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 3817
cache-control: public, max-age=86400
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3-Q050 200 view
googleads4.g.doubleclick.net/pcs/ Frame ED7D 0
27 B 71ms
71ms Other
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstOu9_Bqdl9TscFq-Rmbk-dacg_qeQhENbYz5l2mFsI-hfpUVpj_MaNbqgxtpM2PoNz7jxx2LmC_HGI97y9B9sSAgY8AfLJ_ROKBswuzOlzcyIa52xl9k6TgeHogyzEh_jHsTAgWNV122nK45cs70GWQcHaGKNiAV8ULG1xs9VU5lVFV-EU36R-_maeKtuQQO_MD-iCp80m3vUD0g&sig=Cg0ArKJSzIQBSiwJ2_pWEAE&urlfix=1&omid=0&rm=1&ctpt=221&cbvp=1&cstd=219&cisv=r20210316.43586&adurl=

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:49 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 / Show response
track.adform.net/adfserve/ Frame 9FC7 8 KB
4 KB 53ms
52ms Script
text/javascript 37.157.6.245
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/adfserve/?CC=1&bn=42916151;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=ClCDRvHVSYJHIE6z5-ga36peIA-iKsddhu5GSkKUN7aa7j8oiEAEgpczXamD7gYCAiAqgAczrq9AByAEJqQKMAU63JPizPqgDAaoEgAJP0EM6yFRgB_iVyTtq3dgQ21xQc9R6hrzsAaGNYT-EtGSxpGPiY39TfUlrm8Lqgj3IgUB5bNUB2r0YpYKlvEtCpccrIXiHCvtoYR-2dUeUaXFVbnvgtvjWFJmqN_38d2Pzt40UwyRz8f4GK2_N4Szf8wFdcbPqOOiH7-03M_82gwAXs4YgNtod8z5r8U_CLAUgiGg80YdKwneU7iSRw0D1TjZs7psORX8SXmfMI0CxB5j_bv7JKP7G85GS06ADHEmWDsCLVJx3SFLQ_Mdh3RYUy860J2I2Jb20qZKpuoK_RVs5bN-fUYhLAbc4Z8KzgHgkk4DCNbW0a2Yyhe8Wzf0GwASk983nzAPgBAOQBgGgBk2AB5yU1K8CqAfVyRuoB_DZG6gH8tkbqAeOzhuoB5PYG6gHugaoB-zVG6gH7paxAqgHpr4bqAfs1RuoB_PRG6gHltgb2AcA0ggJCIDhgFAQARgd8ggbYWR4LXN1YnN5bi00NDM2NzI3MDk2OTY2NTU5gAoDmAsByAsBgAwBsBOqrP0K0BMA2BMD2BQB0BUBgBcB&ae=1&num=1&cid=CAASPeRonUriMgQtamsmiUO6vw-iFuVB1r-eFSS1cPqV5UEkRh3R11IpkAN36lRVl4PgSV9r_HyBNz7IzP-EbWw&sig=AOD64_1B35qtMqeP5ozNU_FsFFBxVYyQkA&client=ca-pub-5902083285302779&dbm_c=AKAmf-CpBbYHKLDdgNf6Gcg7M9fWXPvs5MQS8UniXewdxygsS5t2wmorB3rrcSQ8lW5cvO7EQ4_Rt2AV0MkX8TbqoYpP5lseYImQ8VZ-DmWcf5zNMJ7Ea_AvZ1CK51b3rxMdawWvoehCGj0VFOx_D7oY_T1p50r3dA&cry=1&dbm_d=AKAmf-ByWU-c3SjxbTGxIzkOuj_den8oBwnbjV8EaBZYyAAxhgoP9p3zkPs_NqueTLWKPXJuYf8tOuyJR5Pn9v9P6HoOL1HON0VLeezD6rpWIOUYopXqbdPOQKoWn2WxwLec-x2IH8dae1fFB9G8j8xYJnxk0dv7OBJCeikjZE7NU9MbqwuH62cuZTicgMUZuubi7KNOhPg9LAcuCB7KS7CkaYGkMjBf5p62sKvrYll-grcUcRWt0PePBMLHIdyQ-cz59jc7J7lroJw-im36uqgUWAP0ohDqbsnbDj84-aMyWS3kYBlS7h0W2lX_Ce-5a7xQCHsKx6PcOKMSSRa-vue35_2Xa6-Nf1S5UhROFFmgf_nfkbolYYPcTdyZzo-OYqAYPtXDdQnJHrPqLYhYgIGaBmZzEVkj1TNN2BohRxKemS3jsQuHiflRUc7bWz8MHJG0nXgk6JOWQM3Deov83ePXqysp6BLPbw&adurl=;ord=1616016828320529;js=1;adfxid=1x;7753;set=en-US|en-US|1600X1200|0|750|100|24|8|3|7|1|;cmpgdpr=;cmpgdprconsent=;fd=0|0&CREFURL=https%3A%2F%2Fwww.reisekostenabrechnung.com

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.245 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

0c7aa75647150fce78a2daf807b9a7ddd1501f45a4dc141aab369283179c3665

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 3874
expires: -1

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
439 B 18ms
18ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMCIsInRfZXBvY2giOjE2MTYwMTY4MjIsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9zaXplIiwidmFsIjoiWzMwMCwyNTBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQzMzc5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDMzNzkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMzQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b50566000005f11e09b000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=28IC4WnjX2khq%2BxId%2BMv5iqtz%2Bat%2FV%2FRh4C7bI2CRTd6dIOCB7RKcfUvcKksyHrmJs1q9SxguN1%2BFLyzZvEYGG%2BzeHG637Q5o5kghf6oBT%2BphaHWREz31R%2BcFTkJTGYRxu8GKlYQvmAmeQ%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957823dbc05f1-FRA
expires: Tue, 16 Mar 2021 21:33:49 UTC

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DFBA 0
23 B 39ms
39ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B0o8DvHVSYMf9OJKD3wPyn6GQAQAAAAA4AeAEAg&bg=!Dg2lDUnNAAbUo7L91KM7ACkAdvg8Wti--5dwKkEbTA_V_wGJ-k3ia0wEMvzJ4uY8CFyb03z-1jP0OwIAAAFtUgAAAI1oAQeZArZuslEnNi4J8R9GDOnrT27O0YvdeBH1i0fLhbFN2VHHJrQix-h8Poyk-eacXeDzVeZmAHegR7XUemHpKzw8Yzp1jMYD5U2EiNnhhElur13nI88kOI4mVapL65IMQ6OOKctJO2E8tPWG1ywQQlK_j5VwuFkW1_O79YQImgC7_ghpOOp9bYPyPLCb5FNas7Dcq5f5xWYemqfdalUwdCe9IPWvjcslirRzYGWEBkQSNF48ycFMPDl4jhyjM33WiMmIYgCG_iVllv6KoGmcp1kDuW50KeP7rNAvAfxyxy8KlvYvq2_wPtcu-VKWnWn-02W8iXzLYuRSn2iV3aZPs0omY5xk-B5vPypFJyI174cmHHkwLEUQ7LOKdJj8ocj-r-k8LsRg2IBMsNmUQkhlzi7JYMDjxgmzh_vD1yQ8jZIBxmljdg4y_hpmj2vDDX9lxBl7aLpRN8kCMxUXJUQRPMDi1YpQeJHSU7XwYHbhXA1JUSdWX4olXz1JNwlAmXkdwl8JXx-oQflBmQ4QrfaOApS6g6FDPoWcEstY2o22DjXtusHf8rOCgSyU83lbhzoB2EU3IJYmzhB1tIRyxbRzfA58Z0gNRVcqOENvaEjr0hKWfm7U4t6pDVZSHq6TY-JFoUXvrS5KEoywb-EmiT8AzLM2i-zuoV0LOmc_zAqzQD6lpbB7ls16kNtDnPd3xhk-WiD_Gn7SirVG4kbW_6sPEUEEfPoWsLt1C9Yq_qtl_HKFk7M-4B1nJ9m2de3uypBWDxqqibL2-t3ucvqyP2vVwexPXg1pAignLjkjyueapRidErkxv3vx_CD5ohn40lRETUvGxt6Fe0DfLVwmgHCmglsn8UGeBzbHKt-5ICS_oN-N_U6bbU-vBQvbshIQwsxxYuQIznMvOZqHJl7XMqap4bblmDpfDZ3fWP98

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dpixel
cms.quantserve.com/ Frame C031 35 B
463 B 25ms
7ms Image
image/gif 2620:116:800d:21:f916:5049:f87f:108e
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEJ0LAH1A6D-313Yr3PiC-s0&google_cver=1&google_push=AQvitULYfl9fZFXFDMY6Ic279g8GawunQNUxTgnFNKufcMh-Yef1xTbgciJpgd-QT8g4Zy5NoFbyLFBq_qaZuRwjGlW7E189RbPM

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:f916:5049:f87f:108e , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:49 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame C031
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAQvitULOVPTcineV_8Cv8nabfDeJGyEh5Kjedez3QUG...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WUZKMXZnQUFCRVFHblJkMQ&google_push=AQvitULOVPTcineV_8Cv8nabfDeJGyEh5Kjedez3QUG4FW258QwOvLObB7EvoR7Lyu11FPbR0ANWIRQUW3c7o0FY1wCv5743iDE5

170 B
190 B

48ms
47ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WUZKMXZnQUFCRVFHblJkMQ&google_push=AQvitULOVPTcineV_8Cv8nabfDeJGyEh5Kjedez3QUG4FW258QwOvLObB7EvoR7Lyu11FPbR0ANWIRQUW3c7o0FY1wCv5743iDE5

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WUZKMXZnQUFCRVFHblJkMQ&google_push=AQvitULOVPTcineV_8Cv8nabfDeJGyEh5Kjedez3QUG4FW258QwOvLObB7EvoR7Lyu11FPbR0ANWIRQUW3c7o0FY1wCv5743iDE5
Date: Wed, 17 Mar 2021 21:33:50 GMT
Server: Apache
Connection: keep-alive
Content-Length: 391
Content-Type: text/html; charset=iso-8859-1

GET
H3-Q050 200 dot.gif
s0.2mdn.net/ Frame C031 43 B
146 B 15ms
13ms Image
image/gif 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dot.gif?google_gid=CAESEBNdgyWVy5bPAZcFTS-OZoE&google_cver=1&google_push=AQvitUITsbV6WI6MxtuZTBcR17bf-PK6mdrVWuv3Ux-fhShUPNBFsVoYQtnxeo7rpeUJFXi22PQprI6ZTRxWYKEYJ9XrGus-Vm69

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
x-content-type-options: nosniff
last-modified: Sun, 01 Feb 2009 08:00:00 GMT
server: sffe
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 43
x-xss-protection: 0
expires: Thu, 18 Mar 2021 21:33:49 GMT

GET
H2 200 google
d5p.de17a.com/cookies/ Frame C031 35 B
134 B 181ms
56ms Image
image/gif 213.155.156.182
TELIANET Telia Ca...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d5p.de17a.com/cookies/google?google_gid=CAESEDsXllr1OnGCo4cIRfRf3PA&google_cver=1&google_push=AQvitUKVTtcBy2h39yxuYGm16R1fsqme9K5Zwcj7ohTW-K-VhLnRUUEmbiiJsb7dqNsNAgmpUbolPfxYE8ehfDp9Y-SlMD-PjqcX
Requested by: Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 213.155.156.182 , Sweden, ASN1299 (TELIANET Telia Carrier, SE),
Reverse DNS
Software: /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-type: image/gif
content-length: 35
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame C031
Redirect Chain

https://sm.rtb.mts.ru/p?ssp=googleban&pm=1&google_gid=CAESEOztffbtPvkYkfGbxV-fJIA&google_cver=1&google_push=AQvitUKe2FgHCecpkikvyls-LwlXCz-0SbmF2Cz30TIvn81IsxVRkBsAfjH-PT5pbWElzBWPQp-lY5AMT4judAZWj...
https://sm.rtb.mts.ru/match/second?r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dstream_llc%26id%3Dc6dd64a2-4ca1-46a3-a6ee-4d04c770160c%26google_push%3DAQvitUKe2FgHCecpkikvyls-LwlXCz-...
https://tech.rtb.mts.ru/?dsp_uid=c6dd64a2-4ca1-46a3-a6ee-4d04c770160c&return_url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dstream_llc%26id%3Dc6dd64a2-4ca1-46a3-a6ee-4d04c770160c%26g...
https://cm.g.doubleclick.net/pixel?google_nid=stream_llc&id=c6dd64a2-4ca1-46a3-a6ee-4d04c770160c&google_push=AQvitUKe2FgHCecpkikvyls-LwlXCz-0SbmF2Cz30TIvn81IsxVRkBsAfjH-PT5pbWElzBWPQp-lY5AMT4judAZW...

170 B
190 B

43ms
43ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=stream_llc&id=c6dd64a2-4ca1-46a3-a6ee-4d04c770160c&google_push=AQvitUKe2FgHCecpkikvyls-LwlXCz-0SbmF2Cz30TIvn81IsxVRkBsAfjH-PT5pbWElzBWPQp-lY5AMT4judAZWjxyAXKLW4zYH

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 17 Mar 2021 21:33:50 GMT
Server: nginx/1.13.12
Transfer-Encoding: chunked
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Content-Type: text/html; charset=utf-8
Location: https://cm.g.doubleclick.net/pixel?google_nid=stream_llc&id=c6dd64a2-4ca1-46a3-a6ee-4d04c770160c&google_push=AQvitUKe2FgHCecpkikvyls-LwlXCz-0SbmF2Cz30TIvn81IsxVRkBsAfjH-PT5pbWElzBWPQp-lY5AMT4judAZWjxyAXKLW4zYH
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept,Authorization,Cache-Control,Content-Type,DNT,If-Modified-Since,Keep-Alive,Origin,User-Agent,X-Requested-With

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame C031
Redirect Chain

https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESELoVlKEL8UsiyUbP41h9I28&google_cver=1&google_push=AQvitUI97LxmQkbxJpdTYL2eZ0Tx9JPltFeJOSrLVKhiCYzTV3wWQC2fYcJoIAeMjkiZAPO18VHqAftnQtmK7HUt4...
https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MzZiMWM1ZDQtNGJiZS00M2YzLTg0NjItODVkNmMyYjFjNDRh&google_push=AQvitUI97LxmQkbxJpdTYL2eZ0Tx9JPltFeJOSrLVKhiCYzTV3wWQC2fYcJoIAeM...

170 B
213 B

50ms
49ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MzZiMWM1ZDQtNGJiZS00M2YzLTg0NjItODVkNmMyYjFjNDRh&google_push=AQvitUI97LxmQkbxJpdTYL2eZ0Tx9JPltFeJOSrLVKhiCYzTV3wWQC2fYcJoIAeMjkiZAPO18VHqAftnQtmK7HUt4CDDOjePV6oGVA

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=sharethrough_ob&google_hm=MzZiMWM1ZDQtNGJiZS00M2YzLTg0NjItODVkNmMyYjFjNDRh&google_push=AQvitUI97LxmQkbxJpdTYL2eZ0Tx9JPltFeJOSrLVKhiCYzTV3wWQC2fYcJoIAeMjkiZAPO18VHqAftnQtmK7HUt4CDDOjePV6oGVA
date: Wed, 17 Mar 2021 21:33:49 GMT
content-length: 0

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame C031
Redirect Chain

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEFuq3LH4fqD_N1tfZjcJTL4&google_cver=1&google_push=AQvitULk7b-xzPgZjRZVN0WeXctOs_frxdl1ZE2R3hl7oGGfR4t_OeYN_42sH5hRVUhRfgXRpKRoGy1ag-YR-RH3VbBwic0...
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AQvitULk7b-xzPgZjRZVN0WeXctOs_frxdl1ZE2R3hl7oGGfR4t_OeYN_42sH5hRVUhRfgXRpKRoGy1ag-YR-RH3VbBwic0hTsj9oQ&google_hm=NDc0NzI3O...

170 B
190 B

48ms
42ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AQvitULk7b-xzPgZjRZVN0WeXctOs_frxdl1ZE2R3hl7oGGfR4t_OeYN_42sH5hRVUhRfgXRpKRoGy1ag-YR-RH3VbBwic0hTsj9oQ&google_hm=NDc0NzI3OTg1NzgwMjg5NDMzMw==

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AQvitULk7b-xzPgZjRZVN0WeXctOs_frxdl1ZE2R3hl7oGGfR4t_OeYN_42sH5hRVUhRfgXRpKRoGy1ag-YR-RH3VbBwic0hTsj9oQ&google_hm=NDc0NzI3OTg1NzgwMjg5NDMzMw==
Date: Wed, 17 Mar 2021 21:33:50 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3-Q050 204 attr
cm.g.doubleclick.net/pixel/ Frame C031 0
16 B 42ms
41ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13L_JSKGkyvoA6z5yXI9iZgu57oMu_WT5-m8FTXo_ok0idnKS62XNNPh6rAPiaXPsqOkIsvf6A-0

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H/1.1

200
OK

dispatch.fcgi
edf.solution.weborama.fr/fcgi-bin/ Frame 9FC7
Redirect Chain

https://edf.solution.weborama.fr/fcgi-bin/dispatch.fcgi?a.A=im&a.si=4343&a.te=957&a.he=1&a.wi=1&a.hr=p&gdpr=&gdpr_consent=&a.ycp=9148768704996281325&a.ra=78243
https://edf.solution.weborama.fr/fcgi-bin/dispatch.fcgi?g.bo=OK&g.rn=858099&a.A=im&a.si=4343&a.te=957&a.he=1&a.wi=1&a.hr=p&gdpr=&gdpr_consent=&a.ycp=9148768704996281325&a.ra=78243

67 B
483 B

46ms
41ms

Image
image/gif

195.54.48.26
WEBORAMA Weborama...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://edf.solution.weborama.fr/fcgi-bin/dispatch.fcgi?g.bo=OK&g.rn=858099&a.A=im&a.si=4343&a.te=957&a.he=1&a.wi=1&a.hr=p&gdpr=&gdpr_consent=&a.ycp=9148768704996281325&a.ra=78243
Requested by: Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 195.54.48.26 , France, ASN12516 (WEBORAMA Weborama provides Internet Services, FR),
Reverse DNS
Software: Apache /
Resource Hash: e1ef44bacf5da572d77131f447646f8c3da2fc7765e90c73a664c69121c71e87

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:50 GMT
last-modified: Wed, 17 Mar 2021 21:33:50 GMT
server: Apache
transfer-encoding: chunked
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
access-control-allow-origin: *
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
content-type: image/gif
expires: Tue, 03 Jul 2001 06:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:50 GMT
last-modified: Wed, 17 Mar 2021 21:33:50 GMT
server: Apache
access-control-allow-origin: *
transfer-encoding: chunked
p3p: CP="NOI DSP COR CURa DEVa PSAa OUR STP UNI DEM"
location: https://edf.solution.weborama.fr/fcgi-bin/dispatch.fcgi?g.bo=OK&g.rn=858099&a.A=im&a.si=4343&a.te=957&a.he=1&a.wi=1&a.hr=p&gdpr=&gdpr_consent=&a.ycp=9148768704996281325&a.ra=78243
cache-control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
expires: Tue, 03 Jul 2001 06:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 9FC7 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a68f554f71963880eee6d2c65b585a9a5469dcbec019738b4a2ee3eda70815aa

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type: image/png

GET match
um.wbtrk.net/doubleclick/user/ Frame 0690 0
0

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 0690
Redirect Chain

https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEIgDcOYLkCtkoNdqvCUn0xM&google_cver=1&google_push=AQvitUI2wDgtAhzWY3MNzqkAtWH83ktNfgRmeaM23nrvL6I3ALwERyTdNUBt2...
https://tracking.m6r.eu/sync/adxRedirect?gdprFallback=true&google_gid=&google_gid=CAESEIgDcOYLkCtkoNdqvCUn0xM&google_cver=1&google_push=AQvitUI2wDgtAhzWY3MNzqkAtWH83ktNfgRmeaM23nrvL6I3ALwERyTdNUBt2...
https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=ifG28csQQPmTCxEdTshQ9g&google_push=AQvitUI2wDgtAhzWY3MNzqkAtWH83ktNfgRmeaM23nrvL6I3ALwERyTdNUBt2rJ_LEd7euau7S68hqAS5...

170 B
190 B

44ms
43ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=ifG28csQQPmTCxEdTshQ9g&google_push=AQvitUI2wDgtAhzWY3MNzqkAtWH83ktNfgRmeaM23nrvL6I3ALwERyTdNUBt2rJ_LEd7euau7S68hqAS5pvjahi2UEtGqoyuDw

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=m6r&google_ula=158217889&google_hm=ifG28csQQPmTCxEdTshQ9g&google_push=AQvitUI2wDgtAhzWY3MNzqkAtWH83ktNfgRmeaM23nrvL6I3ALwERyTdNUBt2rJ_LEd7euau7S68hqAS5pvjahi2UEtGqoyuDw
Date: Wed, 17 Mar 2021 21:33:50 GMT
Server: nginx
Connection: keep-alive
Content-Type: text/plain; charset=utf-8
Content-Length: 236
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 0690
Redirect Chain

https://sync3.sniperlog.ru/?src=ggl_nga&google_gid=CAESECMbQlr-4vTjE9nWq0fcnNE&google_cver=1&google_push=AQvitUJ7OnM8yVss6ApVlz3zQvvLTjAIZjWFpuX1GPOr8vg5UFK7Nc8R02ZKeiIfpppsfmV1hAGHp73RW0VV2LGY6hDj...
https://sync.bumlam.com/?src=ggl_nga&google_gid=CAESECMbQlr-4vTjE9nWq0fcnNE&google_cver=1&google_push=AQvitUJ7OnM8yVss6ApVlz3zQvvLTjAIZjWFpuX1GPOr8vg5UFK7Nc8R02ZKeiIfpppsfmV1hAGHp73RW0VV2LGY6hDjj8C...
https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_push=AQvitUJ7OnM8yVss6ApVlz3zQvvLTjAIZjWFpuX1GPOr8vg5UFK7Nc8R02ZKeiIfpppsfmV1hAGHp73RW0VV2LGY6hDjj8C-1Js

170 B
190 B

43ms
43ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_push=AQvitUJ7OnM8yVss6ApVlz3zQvvLTjAIZjWFpuX1GPOr8vg5UFK7Nc8R02ZKeiIfpppsfmV1hAGHp73RW0VV2LGY6hDjj8C-1Js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Wed, 17 Mar 2021 21:33:50 GMT
Server: nginx
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=adsniperru&google_push=AQvitUJ7OnM8yVss6ApVlz3zQvvLTjAIZjWFpuX1GPOr8vg5UFK7Nc8R02ZKeiIfpppsfmV1hAGHp73RW0VV2LGY6hDjj8C-1Js
Cache-Control: no-cache, must-revalidate, post-check=0, pre-check=0, no-cache=Set-Cookie, max-age=0, proxy-revalidate, s-maxage=0
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 0690
Redirect Chain

https://ssp.adriver.ru/cgi-bin/sync.cgi?ssp_id=10&external_id=&google_gid=CAESECXpfrF8ypmhhyBy_tAlC3Q&google_cver=1&google_push=AQvitUJ9ZJafMPrujSrlB3T69iHSDpVun-E69KIF6ftgPjoDIe9FuM5Wg8Cety8w246Js...
https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AQvitUJ9ZJafMPrujSrlB3T69iHSDpVun-E69KIF6ftgPjoDIe9FuM5Wg8Cety8w246JsmlyYC_uXbyeq7noDBBPNk-HaXkPA_M&google_hm=QVNVczJWdVFKV1ZPRjRCazdfT...

170 B
190 B

43ms
43ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AQvitUJ9ZJafMPrujSrlB3T69iHSDpVun-E69KIF6ftgPjoDIe9FuM5Wg8Cety8w246JsmlyYC_uXbyeq7noDBBPNk-HaXkPA_M&google_hm=QVNVczJWdVFKV1ZPRjRCazdfTXVaTGc=

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=ADR&google_push=AQvitUJ9ZJafMPrujSrlB3T69iHSDpVun-E69KIF6ftgPjoDIe9FuM5Wg8Cety8w246JsmlyYC_uXbyeq7noDBBPNk-HaXkPA_M&google_hm=QVNVczJWdVFKV1ZPRjRCazdfTXVaTGc=
Date: Wed, 17 Mar 2021 21:33:50 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked

GET
H/1.1 200
OK sync
dsp.adkernel.com/ Frame 0690 42 B
233 B 336ms
103ms Image
image/gif 174.137.133.49
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsp.adkernel.com/sync?exchange=11&google_gid=CAESEPFcgUjULCN1GqZHhsPar6Q&google_cver=1&google_push=AQvitUI-cgzO5OF6Y88iFJJhl-8X5_PyLzhhtv8ZXPIt--6JfEUuv_nnMHC3v5ukBVpgB7uqYPTBK0JzzJzFcWX6b-1twu9xfZ0
Requested by: Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.49 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 17 Mar 2021 21:33:50 GMT
Server: nginx
Age: 0
Content-Type: image/gif
Cache-Control: no-store
Connection: keep-alive
Content-Length: 42

GET
H2 204 exptsync
ads.yieldmo.com/ Frame 0690 0
35 B 134ms
42ms Image
text/plain 52.51.3.86
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/exptsync?google_gid=CAESEFr5xkoH8V2BzhMaYjpeuzk&google_cver=1&google_push=AQvitULo0-r15h_Btcxm5OTzr4KpVomQQGQ4f9dqm2ZTdOmRnxU_TbidaJ4JQJAuuRngBgj7P89CGedFqDtzFjoiphJpknVfEw
Requested by: Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.51.3.86 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:50 GMT

GET
H3-Q050

200

pixel
cm.g.doubleclick.net/ Frame 0690
Redirect Chain

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEFuq3LH4fqD_N1tfZjcJTL4&google_cver=1&google_push=AQvitULPcYLOI3OJU2A5B9PFNbYQMiDzIQ8Gbpb9do5irNA7nbuczvYDSwSvw7W_vLqlHXL_l4hEwLYAUHIhDzt-xgU-owE...
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AQvitULPcYLOI3OJU2A5B9PFNbYQMiDzIQ8Gbpb9do5irNA7nbuczvYDSwSvw7W_vLqlHXL_l4hEwLYAUHIhDzt-xgU-owESxc0&google_hm=NDc0NzI3OTg1...

170 B
190 B

43ms
42ms

Image
image/png

142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AQvitULPcYLOI3OJU2A5B9PFNbYQMiDzIQ8Gbpb9do5irNA7nbuczvYDSwSvw7W_vLqlHXL_l4hEwLYAUHIhDzt-xgU-owESxc0&google_hm=NDc0NzI3OTg1NzgwMjg5NDMzMw==

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=AQvitULPcYLOI3OJU2A5B9PFNbYQMiDzIQ8Gbpb9do5irNA7nbuczvYDSwSvw7W_vLqlHXL_l4hEwLYAUHIhDzt-xgU-owESxc0&google_hm=NDc0NzI3OTg1NzgwMjg5NDMzMw==
Date: Wed, 17 Mar 2021 21:33:50 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3-Q050 204 attr
cm.g.doubleclick.net/pixel/ Frame 0690 0
16 B 44ms
42ms Image
text/html 142.250.186.34
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KBYFyC3pl1LGCu86Qb89uSsIBW5G5nYMj7Y9HedJ5kyBZG57JPf4AbYsV2uQjnek0hGRzh7g

Requested by

Host: 56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
URL: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.34 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
server: HTTP server (unknown)
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3-Q050 200 JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js Show response
pagead2.googlesyndication.com/bg/ Frame A805 14 KB
6 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25c788c3d6b5a5f5931ef45abc5640af29b16f379c2e1634dc32c6c225327f38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 16:25:17 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 13:45:00 GMT
server: sffe
age: 104912
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5657
x-xss-protection: 0
expires: Wed, 16 Mar 2022 16:25:17 GMT

GET
H3-Q050 200 JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js Show response
pagead2.googlesyndication.com/bg/ Frame CD90 14 KB
6 KB 7ms
5ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25c788c3d6b5a5f5931ef45abc5640af29b16f379c2e1634dc32c6c225327f38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 16:25:17 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 13:45:00 GMT
server: sffe
age: 104912
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5657
x-xss-protection: 0
expires: Wed, 16 Mar 2022 16:25:17 GMT

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
485 B 19ms
19ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTQwOTM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MTYwMTY4MjIsInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImJpZF9mbG9vcl9maWxsZWQiOjAsImJpZF9mbG9vcl9wcmV2IjowLCJzdGF0X3NvdXJjZV9pZCI6MCwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwNTI3MSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6InZpZXdlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b50621000005f10d9a6000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=fWI%2FqjdtMLGiJj2qMYC1GVnYSa7b%2FVsYPVSpYzMssH3TGRjJcaFhrmZ2FNGFZIe%2Fb%2FybuzhQu1lsn3OWcH%2BcBnZbBUHxX7gCNTU8GoC%2BEhSZvzRFUAmrI8hhMAUrioClzTqHkEogMyGLZQ%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957836f7e05f1-FRA
expires: Tue, 16 Mar 2021 21:33:49 UTC

GET
H3-Q050 200 style.css
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 57A2 1 KB
537 B 9ms
8ms Stylesheet
text/css 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84c65cf6dccd23cbcc0603f73e434c41a4086431756078e8bd2c7a1ff182066f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 17896
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 511
x-xss-protection: 0
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 main.js Show response
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 57A2 1 KB
606 B 9ms
8ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f4e3441f0da47965d475c902c09d9c269054457d568226269c23335e0d43d766

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 08:41:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 46337
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 563
x-xss-protection: 0
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Thu, 18 Mar 2021 08:41:32 GMT

GET
H3-Q050 200 tweenmax_1.19.1_92cf05aba6ca4ea5cbc62b5a7cb924e3_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 57A2 110 KB
37 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_1.19.1_92cf05aba6ca4ea5cbc62b5a7cb924e3_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62b1cff44a5e34b9587ad49f7ca951160f1559c5c545bcf99e13574ccaa5425a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37930
x-xss-protection: 0
last-modified: Tue, 20 Jun 2017 21:14:35 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Mar 2021 21:33:49 GMT

GET
H3-Q050 200 back3.jpg
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 57A2 32 KB
32 KB 7ms
7ms Image
image/jpeg 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/back3.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

24fafa96014bb69b2d14236c4982326ae80293f8d04891dd080dd094084f8320

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17897
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33176
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 text4.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 57A2 1 KB
1 KB 6ms
6ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/text4.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

498e1816875171bad3e7bee172b561231eb2f8aa004e9b872fd5b651f5f84062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17897
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1050
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 text4b.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 57A2 3 KB
3 KB 6ms
6ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/text4b.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

01b91c27c2dd8d42bf4832466bfb4d3f0ab2eff59e855e4ad8446dc626637cc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17897
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3216
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 cta.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 57A2 1 KB
1 KB 13ms
11ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e25fa1dc383dab10261f885d1c39a604525d2cd2ea6ca908e2c2375c07e3884d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 22:45:59 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 82071
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1239
x-xss-protection: 0
expires: Wed, 17 Mar 2021 22:45:59 GMT

GET
H3-Q050 200 nissan_black.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 57A2 1 KB
1 KB 14ms
12ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/nissan_black.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

39e4c6e25be371a3026dc5ea8ae0e23e953d6916518811fcc5c1a1769767ab16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17897
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1420
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 back2.jpg
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 57A2 33 KB
33 KB 15ms
12ms Image
image/jpeg 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/back2.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91b4244ebe9f1ca90ed84b8b5c9fe2f340e35d55df94c668b89f824d57e9010c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 08:19:39 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 47651
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33890
x-xss-protection: 0
expires: Thu, 18 Mar 2021 08:19:39 GMT

GET
H3-Q050 200 text2.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 57A2 1 KB
1 KB 13ms
11ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/text2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4139b3e7ead7268f5e730fb9b32300273ce262da28ed4bdff16508d8d6d7314

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 19:35:11 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 7119
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1354
x-xss-protection: 0
expires: Thu, 18 Mar 2021 19:35:11 GMT

GET
H3-Q050 200 text2b.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 57A2 3 KB
3 KB 13ms
11ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/text2b.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd8cc56d4953209cb0bd10a1198b3726b03857abfe648c987b6dbd4e0f63513a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17897
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2791
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 back1.jpg
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 57A2 34 KB
34 KB 15ms
13ms Image
image/jpeg 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/back1.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a25f4e403cd3009578cf6ca056afac33ed6aae8f47d1ab575756804b52be203a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17897
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35261
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 text1.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 57A2 1 KB
1 KB 14ms
12ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/text1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9d9f49fc378d4322355f7fdf35e213afc7f835ab2542b772a4e25802a5ac5cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:06 GMT
server: sffe
age: 17897
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1337
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 logo.png
s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/ Frame 57A2 5 KB
5 KB 14ms
11ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/logo.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd5a91913a74d6a43b060f616dd109816717a7cfafa30f62e08890e3986758a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608741786426/JUKE_STOCK-INVENTORY_300x250_03/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:35:33 GMT
x-content-type-options: nosniff
last-modified: Wed, 23 Dec 2020 16:43:07 GMT
server: sffe
age: 17897
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4973
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:35:33 GMT

GET
H3-Q050 200 style.css
s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/ Frame 7CBB 1 KB
588 B 9ms
6ms Stylesheet
text/css 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84c65cf6dccd23cbcc0603f73e434c41a4086431756078e8bd2c7a1ff182066f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:27:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18397
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 511
x-xss-protection: 0
last-modified: Fri, 18 Dec 2020 09:53:02 GMT
server: sffe
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Thu, 18 Mar 2021 16:27:12 GMT

GET
H3-Q050 200 main.js Show response
s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/ Frame 7CBB 2 KB
685 B 10ms
7ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/main.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

013155683600f0d286333f6e450a1583f30ad2aabc884df3386932a53de9804c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 13:17:43 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29766
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 604
x-xss-protection: 0
last-modified: Fri, 18 Dec 2020 09:53:02 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Thu, 18 Mar 2021 13:17:43 GMT

GET
H3-Q050 200 tweenmax_1.19.1_92cf05aba6ca4ea5cbc62b5a7cb924e3_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 7CBB 110 KB
37 KB 15ms
13ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_1.19.1_92cf05aba6ca4ea5cbc62b5a7cb924e3_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62b1cff44a5e34b9587ad49f7ca951160f1559c5c545bcf99e13574ccaa5425a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37930
x-xss-protection: 0
last-modified: Tue, 20 Jun 2017 21:14:35 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 17 Mar 2021 21:33:50 GMT

GET
H3-Q050 200 back3.jpg
s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/ Frame 7CBB 32 KB
32 KB 7ms
6ms Image
image/jpeg 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/back3.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04d48b95f4f5f750450039ff5fd5c57184e2cb124e9c12151eaae7cbc0bd5484

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 21:55:06 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Dec 2020 09:53:03 GMT
server: sffe
age: 85124
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32771
x-xss-protection: 0
expires: Wed, 17 Mar 2021 21:55:06 GMT

GET
H3-Q050 200 text3.png
s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/ Frame 7CBB 858 B
937 B 12ms
12ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/text3.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

739d2fd1b9a04bcd81d39440eb5198a08bbf3e803a3073aa407162baee5ca722

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 08:09:00 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Dec 2020 09:53:02 GMT
server: sffe
age: 48290
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 858
x-xss-protection: 0
expires: Thu, 18 Mar 2021 08:09:00 GMT

GET
H3-Q050 200 text3a.png
s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/ Frame 7CBB 629 B
658 B 21ms
9ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/text3a.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7bc25531b8cc8c343dafe971d37212969df1c453a4dbe393149d93b1beebd1e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:11:33 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Dec 2020 09:53:02 GMT
server: sffe
age: 19337
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 629
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:11:33 GMT

GET
H3-Q050 200 text3b.png
s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/ Frame 7CBB 624 B
656 B 19ms
9ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/text3b.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

84f285172be3d41a4cc9b8bfcee3a1f8426ad11d04df0bee1e4a95ead399ab03

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:11:33 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Dec 2020 09:53:02 GMT
server: sffe
age: 19337
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 624
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:11:33 GMT

GET
H3-Q050 200 text3c.png
s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/ Frame 7CBB 815 B
903 B 19ms
9ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/text3c.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b7bc64fa17726261970893d6a380df88fbb4dddf18573f5d25be51b9779c4984

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:11:33 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Dec 2020 09:53:02 GMT
server: sffe
age: 19337
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 815
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:11:33 GMT

GET
H3-Q050 200 ml.png
s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/ Frame 7CBB 404 B
436 B 18ms
8ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/ml.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb66078ae708305d3cce1fddabe0874cd3bee93e0b5efab7afce71c626910aa0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:11:33 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Dec 2020 09:53:02 GMT
server: sffe
age: 19337
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 404
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:11:33 GMT

GET
H3-Q050 200 text4.png
s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/ Frame 7CBB 1 KB
1 KB 17ms
7ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/text4.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

498e1816875171bad3e7bee172b561231eb2f8aa004e9b872fd5b651f5f84062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:11:33 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Dec 2020 09:53:03 GMT
server: sffe
age: 19337
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1050
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:11:33 GMT

GET
H3-Q050 200 text4b.png
s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/ Frame 7CBB 1 KB
1 KB 17ms
7ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/text4b.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b5e482213a038b5e3ef28c5835023c3e22d9e2c4590fa5ce412b3a366df0fff9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:11:33 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Dec 2020 09:53:02 GMT
server: sffe
age: 19337
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1045
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:11:33 GMT

GET
H3-Q050 200 cta.png
s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/ Frame 7CBB 1 KB
1 KB 21ms
12ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/cta.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

42f1d4a6ca637b1d0da2d55933890169ed215a24535e39027836dfe1cdbe5b0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:11:33 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Dec 2020 09:53:03 GMT
server: sffe
age: 19337
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1114
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:11:33 GMT

GET
H3-Q050 200 nissan_black.png
s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/ Frame 7CBB 1 KB
1 KB 21ms
11ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/nissan_black.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

39e4c6e25be371a3026dc5ea8ae0e23e953d6916518811fcc5c1a1769767ab16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:11:33 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Dec 2020 09:53:02 GMT
server: sffe
age: 19337
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1420
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:11:33 GMT

GET
H3-Q050 200 back2.jpg
s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/ Frame 7CBB 33 KB
33 KB 20ms
11ms Image
image/jpeg 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/back2.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

91b4244ebe9f1ca90ed84b8b5c9fe2f340e35d55df94c668b89f824d57e9010c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:11:33 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Dec 2020 09:53:02 GMT
server: sffe
age: 19337
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33890
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:11:33 GMT

GET
H3-Q050 200 text2.png
s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/ Frame 7CBB 1 KB
1 KB 20ms
11ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/text2.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e4139b3e7ead7268f5e730fb9b32300273ce262da28ed4bdff16508d8d6d7314

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:11:33 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Dec 2020 09:53:02 GMT
server: sffe
age: 19337
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1354
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:11:33 GMT

GET
H3-Q050 200 text2b.png
s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/ Frame 7CBB 3 KB
3 KB 19ms
10ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/text2b.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd8cc56d4953209cb0bd10a1198b3726b03857abfe648c987b6dbd4e0f63513a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 22:15:11 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Dec 2020 09:53:02 GMT
server: sffe
age: 83919
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2791
x-xss-protection: 0
expires: Wed, 17 Mar 2021 22:15:11 GMT

GET
H3-Q050 200 back1.jpg
s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/ Frame 7CBB 34 KB
35 KB 21ms
12ms Image
image/jpeg 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/back1.jpg

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a25f4e403cd3009578cf6ca056afac33ed6aae8f47d1ab575756804b52be203a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 08:43:04 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Dec 2020 09:53:03 GMT
server: sffe
age: 46246
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35261
x-xss-protection: 0
expires: Thu, 18 Mar 2021 08:43:04 GMT

GET
H3-Q050 200 text1.png
s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/ Frame 7CBB 1 KB
1 KB 19ms
10ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/text1.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9d9f49fc378d4322355f7fdf35e213afc7f835ab2542b772a4e25802a5ac5cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 16:11:33 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Dec 2020 09:53:03 GMT
server: sffe
age: 19337
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1337
x-xss-protection: 0
expires: Thu, 18 Mar 2021 16:11:33 GMT

GET
H3-Q050 200 logo.png
s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/ Frame 7CBB 5 KB
5 KB 20ms
11ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/logo.png

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fd5a91913a74d6a43b060f616dd109816717a7cfafa30f62e08890e3986758a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/9929072/1608285182483/JUKE_OFFRE-PROFITEZ_300x250_04/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 20:49:35 GMT
x-content-type-options: nosniff
last-modified: Fri, 18 Dec 2020 09:53:02 GMT
server: sffe
age: 2655
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4973
x-xss-protection: 0
expires: Thu, 18 Mar 2021 20:49:35 GMT

GET
H3-Q050 200 JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js Show response
pagead2.googlesyndication.com/bg/ Frame E08C 14 KB
6 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25c788c3d6b5a5f5931ef45abc5640af29b16f379c2e1634dc32c6c225327f38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 16:25:17 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 13:45:00 GMT
server: sffe
age: 104913
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5657
x-xss-protection: 0
expires: Wed, 16 Mar 2022 16:25:17 GMT

GET
H3-Q050 200 JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js Show response
pagead2.googlesyndication.com/bg/ Frame 563E 14 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/JceIw9a1pfWTHvRavFZArymxbzecLhY03DLGwiUyfzg.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

25c788c3d6b5a5f5931ef45abc5640af29b16f379c2e1634dc32c6c225327f38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Tue, 16 Mar 2021 16:25:17 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Mon, 15 Mar 2021 13:45:00 GMT
server: sffe
age: 104913
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5657
x-xss-protection: 0
expires: Wed, 16 Mar 2022 16:25:17 GMT

GET
H2 200 Standard Show response
s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.200/e/2gSBggDA/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/ Frame 9FC7 90 KB
39 KB 62ms
61ms Script
text/javascript 37.157.6.234
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.200/e/2gSBggDA/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.234 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: ccbc725072200e9a92d7e29113264a647a0fa485f1df386dc85c48ef5ffebd1a

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:50 GMT
content-encoding: gzip
last-modified: Mon, 08 Mar 2021 15:51:47 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Fri, 19 Mar 2021 00:25:31 GMT

POST
H3-Q050 200 view
googleads4.g.doubleclick.net/pcs/ Frame 586A 0
50 B 69ms
69ms Other
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H3-Q050 200 view
googleads4.g.doubleclick.net/pcs/ Frame ED7D 0
27 B 69ms
68ms Other
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s07-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

timing-allow-origin: *
date: Wed, 17 Mar 2021 21:33:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H2 200 /
track.adform.net/csimpr/ Frame 9FC7 35 B
503 B 52ms
52ms Other
image/gif 37.157.6.245
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/csimpr/?bn=42916151&csi=H2WtRJnsB3Gy3yajLOjL8g5r4gzEBsT2IHy4QZ8_NK7rygPkIxxfk_vNmRGymPkuuUanjmg1KYFi6W_fQGBo2_LvErD9xNSG0

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.245 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:50 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
334 B 19ms
19ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTQwOTM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MTYwMTY4MjIsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwNTI3MSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9zaXplIiwidmFsIjoiWzk3MCw5MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjE0MDkzNzkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJhZF9wb3NpdGlvbiI6MTEwMCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDUyNzEsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJmaWxsZWRfZmx1aWQiLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTQwOTM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2MTYwMTY4MjIsImFkX3Bvc2l0aW9uIjoxMTAwLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwNTI3MSwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiIwIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:50 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b50752000005f137ab1000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=e4fmUFzsCAZFwjzdoHhk5il%2FkMueHHtrmTf03oz0V5QaZARe9AryDDdjuQM8JESGwvTFzHNloZNKhiiFR0S0gDdH1Q3f5mYBrxJZS4U7j86dE2aJ7JwzyMWu%2BVsqDn%2B4496UM7L%2F%2BoNOxw%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957854b4205f1-FRA
expires: Tue, 16 Mar 2021 21:33:50 UTC

GET
H2 200 9059022.js Show response
s1.adform.net/Banners/Elements/Files/2009362/9059022/ Frame 5EF8 3 KB
1 KB 49ms
48ms Script
application/x-javascript 37.157.6.234
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://s1.adform.net/Banners/Elements/Files/2009362/9059022/9059022.js?ADFassetID=9059022&bv=257

Requested by

Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.234 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

d938337502e1a8f744f387860470c857ffa95a00e5a3c0232eaf5bc884eba3b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:50 GMT
content-encoding: gzip
last-modified: Fri, 18 Dec 2020 14:47:26 GMT
server: nginx
etag: W/"5fdcc0fe-c96"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
content-type: application/x-javascript

GET
H2 200 css
fonts.googleapis.com/ Frame 5EF8 2 KB
561 B 16ms
14ms Stylesheet
text/css 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Jaldi:400,700

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.200/e/2gSBggDA/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d1b33e031c5497cce60526256780760f6c1facd3ac8b22541aad3f687a5fc438

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 17 Mar 2021 21:08:55 GMT
server: ESF
date: Wed, 17 Mar 2021 21:33:50 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 17 Mar 2021 21:33:50 GMT

GET
H2 200 style.css
s1.adform.net/Banners/Elements/Files/2009362/9059022/bvpath_257/ Frame 5EF8 5 KB
1 KB 52ms
51ms Stylesheet
text/css 37.157.6.234
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://s1.adform.net/Banners/Elements/Files/2009362/9059022/bvpath_257/style.css

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.200/e/2gSBggDA/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.234 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3e2855bea0628e4e1e3d77a1416517b65c286f9c361eac84624494545d1da5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:50 GMT
content-encoding: gzip
last-modified: Fri, 18 Dec 2020 14:47:25 GMT
server: nginx
etag: W/"5fdcc0fd-1345"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
content-type: text/css

GET
H2 200 Adform.DHTML.js Show response
s1.adform.net/banners/scripts/rmb/ Frame 5EF8 30 KB
13 KB 57ms
55ms Script
application/x-javascript 37.157.6.234
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/banners/scripts/rmb/Adform.DHTML.js?bv=620
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.200/e/2gSBggDA/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.234 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: d3759299ce00e3bac2782faf02d6f1962e5c88b04e9682224f5852d0c86b6480

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:50 GMT
content-encoding: gzip
last-modified: Mon, 12 Oct 2020 12:12:14 GMT
server: nginx
etag: W/"5f84481e-78ab"
x-cache-status: HIT
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
content-type: application/x-javascript

GET
H2 200 logo.png
s1.adform.net/Banners/Elements/Files/2009362/9059022/bvpath_257/images/ Frame 5EF8 3 KB
3 KB 58ms
55ms Image
image/png 37.157.6.234
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/2009362/9059022/bvpath_257/images/logo.png

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.200/e/2gSBggDA/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.234 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8c1e933820608ef3fbf4e1cedd827252747fbe30539b791aba5e0a2927f6575d

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:50 GMT
last-modified: Fri, 18 Dec 2020 14:47:25 GMT
server: nginx
etag: "5fdcc0fd-b5b"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 2907

GET
H2 200 logobig.png
s1.adform.net/Banners/Elements/Files/2009362/9059022/bvpath_257/images/ Frame 5EF8 6 KB
6 KB 60ms
58ms Image
image/png 37.157.6.234
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/2009362/9059022/bvpath_257/images/logobig.png

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.200/e/2gSBggDA/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.234 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

606c5ec516f355a575daf12654661e57385aba74f4d94f50b3b3ecbd002dbbe2

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:50 GMT
last-modified: Fri, 18 Dec 2020 14:47:25 GMT
server: nginx
etag: "5fdcc0fd-1625"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 5669

GET
H2 200 picto.png
s1.adform.net/Banners/Elements/Files/2009362/9059022/bvpath_257/images/ Frame 5EF8 2 KB
2 KB 60ms
58ms Image
image/png 37.157.6.234
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/2009362/9059022/bvpath_257/images/picto.png

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.200/e/2gSBggDA/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.234 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

197d4c9ad39b2dd2361af97f851d53146251c1b5b50e12ab1e796572eaa9894f

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:50 GMT
last-modified: Fri, 18 Dec 2020 14:47:25 GMT
server: nginx
etag: "5fdcc0fd-7d0"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 2000

GET
H2 404 pictobis.png
s1.adform.net/Banners/Elements/Files/2009362/9059022/bvpath_257/images/ Frame 5EF8 0
0 68ms
65ms Image
text/html 37.157.6.234
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s1.adform.net/Banners/Elements/Files/2009362/9059022/bvpath_257/images/pictobis.png
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.200/e/2gSBggDA/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.234 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

GET
H2 200 picto2.png
s1.adform.net/Banners/Elements/Files/2009362/9059022/bvpath_257/images/ Frame 5EF8 1 KB
1 KB 61ms
59ms Image
image/png 37.157.6.234
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/2009362/9059022/bvpath_257/images/picto2.png

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.200/e/2gSBggDA/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.234 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

d0d7aa9d488a2b2c152f5d64b7d4bb2da5ea74e901ccb9a580326c3c35224fb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:50 GMT
last-modified: Fri, 18 Dec 2020 14:47:25 GMT
server: nginx
etag: "5fdcc0fd-449"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 1097

GET
H2 200 back.jpg
s1.adform.net/Banners/Elements/Files/2009362/9059022/bvpath_257/images/ Frame 5EF8 11 KB
11 KB 65ms
63ms Image
image/jpeg 37.157.6.234
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/2009362/9059022/bvpath_257/images/back.jpg

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.200/e/2gSBggDA/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.234 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

48a75646b5e7bb0a6ad4ef08f953002e6f751c0b2df96120333267c388a72efb

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:50 GMT
last-modified: Fri, 18 Dec 2020 14:47:24 GMT
server: nginx
etag: "5fdcc0fc-2c53"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/jpeg
content-length: 11347

GET
H2 200 cta.png
s1.adform.net/Banners/Elements/Files/2009362/9059022/bvpath_257/images/ Frame 5EF8 3 KB
3 KB 66ms
65ms Image
image/png 37.157.6.234
ADFORM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s1.adform.net/Banners/Elements/Files/2009362/9059022/bvpath_257/images/cta.png

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.200/e/2gSBggDA/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.234 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e944c4f8dbbee9abb8e29a1aad4b253cb6b1e670e68b8bf8778def0f7915d5f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:50 GMT
last-modified: Fri, 18 Dec 2020 14:47:25 GMT
server: nginx
etag: "5fdcc0fd-a37"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
accept-ranges: bytes
content-type: image/png
content-length: 2615

GET
H2 200 TweenMax.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/2.1.2/ Frame 5EF8 113 KB
34 KB 12ms
10ms Script
application/javascript 2606:4700::6810:125e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/2.1.2/TweenMax.min.js

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.200/e/2gSBggDA/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:125e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a863a77e9ee263a0ec9c1e792bb33ed0f663582b7369f472261df7b6040990c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"report_to":"cf-nel","max_age":604800}
age: 410386
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 34771
cf-request-id: 08e3b507c900004aa9f18e4000000001
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:10:25 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e71-1c4b9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=xDZyrThSw7pJnd2OJFYFM5mx56lGR6p1gXj0V8MNMGtfwAzyv07roxUBFWdaiNBwsb3Lvl7BIOfyggCk7v3RTtSq8lsqm1CR5a9TmqQtHX2Dy2oJOgAP8tpJkx2%2BZYT3Rg%3D%3D"}],"max_age":604800,"group":"cf-nel"}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 631957860f424aa9-FRA
expires: Mon, 07 Mar 2022 21:33:50 GMT

GET
H2 200 main.js Show response
s1.adform.net/Banners/Elements/Files/2009362/9059022/bvpath_257/ Frame 5EF8 2 KB
770 B 60ms
59ms Script
application/x-javascript 37.157.6.234
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://s1.adform.net/Banners/Elements/Files/2009362/9059022/bvpath_257/main.js

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/load/v/0.0.200/e/2gSBggDA/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.234 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

ab8602ac62a289a7976e2e54ac0a870899b520467bc12e33cc75b669f8b1e8c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:50 GMT
content-encoding: gzip
last-modified: Fri, 18 Dec 2020 14:47:25 GMT
server: nginx
etag: W/"5fdcc0fd-7a1"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
content-type: application/x-javascript

GET
H2 200 or3hQ67z0_CI33voSYTwJrU.woff2
fonts.gstatic.com/s/jaldi/v7/ Frame 5EF8 22 KB
22 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/jaldi/v7/or3hQ67z0_CI33voSYTwJrU.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Jaldi:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f7db7d3088ed17cdf54fda1347dcd21087bc3a154070af514b819754ffcf0c52

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Thu, 11 Mar 2021 03:16:37 GMT
x-content-type-options: nosniff
last-modified: Tue, 01 Sep 2020 03:49:57 GMT
server: sffe
age: 584233
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 22780
x-xss-protection: 0
expires: Fri, 11 Mar 2022 03:16:37 GMT

GET
H2 200 or3sQ67z0_CI33NTbJE.woff2
fonts.gstatic.com/s/jaldi/v7/ Frame 5EF8 21 KB
22 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/jaldi/v7/or3sQ67z0_CI33NTbJE.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Jaldi:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4acba540de7bf942b0e41feb83e98273b599b7a70f0bbe67e84afce4450f6a3e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
Referer: https://fonts.googleapis.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Fri, 12 Mar 2021 07:57:36 GMT
x-content-type-options: nosniff
last-modified: Tue, 01 Sep 2020 03:52:31 GMT
server: sffe
age: 480974
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 21900
x-xss-protection: 0
expires: Sat, 12 Mar 2022 07:57:36 GMT

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
280 B 17ms
17ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8zIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDMzNzkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTBfMyIsInRfZXBvY2giOjE2MTYwMTY4MjIsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQzMzc5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wXzMiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiODQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:50 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b508f0000005f152174000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=j0633vQewqFIwkIpEwVBquK3sQc7Tli4oljhXhyT9thNF0rKeQE5UD1UO4SeZ4hEeJCODWM3x6J946kCyarEe2fI3T1PNdC7urhSXnr9jldC4qVUEgKyeV1oRRAhwiFMD5se8LipK16xbQ%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 63195787eeec05f1-FRA
expires: Tue, 16 Mar 2021 21:33:50 UTC

GET
H2 200 army.gif Show response
www.reisekostenabrechnung.com/porpoiseant/ 0
286 B 18ms
18ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM0MzM3OSIsImRvbWFpbl9pZCI6IjEyOTg1NiIsInVuaXQiOiJkaXYtZ3B0LWFkLXJlaXNla29zdGVuYWJyZWNobnVuZ19jb20tYm94LTItMF8yIiwidF9lcG9jaCI6MTYxNjAxNjgyMiwiYWRfcG9zaXRpb24iOjExMDMsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiOTVjNmM4NGQtMzk2YS00NTljLTRlNDMtNzQ5YjNhMzFhYzE5IiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjo0OTc0OTAyODMyLCJjcmVhdGl2ZV9pZCI6MTM4MjQxMTIzNTE3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjEzNDMzNzkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ1bml0IjoiZGl2LWdwdC1hZC1yZWlzZWtvc3RlbmFicmVjaG51bmdfY29tLWJveC0yLTBfMiIsInRfZXBvY2giOjE2MTYwMTY4MjIsImFkX3Bvc2l0aW9uIjoxMTAzLCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6Ijk1YzZjODRkLTM5NmEtNDU5Yy00ZTQzLTc0OWIzYTMxYWMxOSIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6NDk3NDkwMjgzMiwiY3JlYXRpdmVfaWQiOjEzODI0MTEyMzUxNywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMzQzMzc5IiwiZG9tYWluX2lkIjoiMTI5ODU2IiwidW5pdCI6ImRpdi1ncHQtYWQtcmVpc2Vrb3N0ZW5hYnJlY2hudW5nX2NvbS1ib3gtMi0wXzIiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJhZF9wb3NpdGlvbiI6MTEwMywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjQ5NzQ5MDI4MzIsImNyZWF0aXZlX2lkIjoxMzgyNDExMjM1MTcsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiODMifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:50 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b50913000005f13abb2000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=hKUgc29fzR5JLx9C9qzSIO49p15qOwUiZ3iCUYmHBDxtxf%2FxV7oGGk7XMvBi%2Fp4lGMHaTo9h2WMA1S6sWyn64YVP6B5EdmjOg3RxhOKbkfD%2Fs4iMvybyA39Bvb8K3gTDJ%2Bsdoiu5goud3g%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 631957881f3c05f1-FRA
expires: Tue, 16 Mar 2021 21:33:50 UTC

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A805 0
46 B 39ms
39ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BhiSDvXVSYLbsE8fP7_UPtquZmAYAAAAAOAHgBAI&bg=!NTalNnLNAAbUo7L91KM7ACkAdvg8WnYlRhVwlVFbR2R000zBms_qFPhH3Nx-UMEyFiV5tqIVlBrTWgIAAAKGUgAAACVoAQeZAocGWXQpdc9pp3An4WuWoSJCDRWa758OkEFQmoTqIeI31GIy4oipDdpB0WYHln9vWsDlPX4cfvfBPwZa0MrIYSMwwhg5g0WTANmRBNSal-vjzzY8jKyCP_ns6SJtUpyQCwhgJcvRuFi14E2oEfvG6wJeKoXV94TLJyMpZ0wdRuaQmE_oRi78Qz2R8TTiVkY8AEz9fM6I-OxoQ0VqpHaHtijCCyr9BdV5I6FcFIJtZs5bQVa8R3onDugBp1dmccWAPt6dlJmn_e9MfGnrUuey9eHigUPEQ6BbPc7xQpuMmBvKsivA6AABn0CGhKYheI51p7siSCQFsg5Hi9fI_GgKZNfWpuaCcifJ6Un0s64nNwzaHBJU4eFskvBhE-tYIdx3OzIVOK9vxm4lq2LRRCyzzMPrMuuGRJHOCybI5TF2gWVh17VBmfsIFLu66X6T_q7FRJTrxze6EuznrMa3uHdcaCXXJg5-F8AlRaZCTLD81y8h1ljPrchA1r8hMrznBONeYm-43ncV0gyjBEqsCMkhcp1hSxEg4pJKUnJJNVyFhuXXLak0LZX2_UbneYRS9on5blY91PhP6ZkntfVBiq9a8QNgCxSnxrO-wfPjjXcZIgXytL2g0cJgcdGLZ3OSQ9ILma7n8irjx5_4SDWb2fkwzMrIF8dLGJQJ24G3_vyAg-GYdSEBA8LNwsnC5ZKtT7xjXlAN4sZhX248e3Lg4lIIli0x6npnnzmNsCWqxA9bUM65UgqJvwNxMEJtdqGX-sIwsL01Og-S7zXyF7ynApusFNE8Yth8whM4zCmw18sjpCa-JWv0DB5kKV26x33tdh-vCPE6wimdkhrcJYZYoMtn4MQ2whSNQF9MTw

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame CD90 0
23 B 41ms
40ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B_KX8vXVSYNXeE8O17_UP2vWkqAwAAAAAOAHgBAI&bg=!kZKlktbNAAbUo7L91KM7ACkAdvg8Wp-gx_D7zY91-ZTw0LiZjCe2M7h-PI303gggke1D9KTaplJdcAIAAAJ6UgAAAChoAQcKAFOBMvf0HsJUQz5kd9ivKzY_aC38iLt8kYJsbwZjGBqbn0s3oZkI6h5u7htRQLIHpIAy-D3cxAYNIAqjk6ZBoIiGlrM8ssomrjcF8VGbdKmR4knXO5kCfqj3lqCMEM0OlHHZRZCDClZcMtkW9x60Yp7t2NDqDoEOzWPf9NCefwPCRbSgX7XyWAtq68ybddoQ93iNpXwrYqGK20Zq8g-16-6WzQgcVoCuIrPjbmW59SPUpoku7P_zLjmZs5_Hs-b7G9ek-Io7IFl0hZXuZor1mj1AO8N4uHBdVjAwwDma6FHiSTTaYaf5YfWx7Osqw6ndFSD9blnZxLzSupKHVIJG2Hj1qxtldZfpiwrwM08dnPjdJPGXwXdwLXGjhbMFkhOBfzyXpBnKxZFcHlmSjqktr5muGzRMblDLEPFPsBIo0WhJYhxp3qtNL4CXUQnfqNrAae7st-djweC7ATRbf_K-4ccrJnHGBeAPTGD_BYasbG_cgRyRppAxvJ4rHd8SE2amdCKLXObn854JxZAI1DZ_hkLe7CW49TaGFa9uKdTlgR2-_jk1BGUw6Bd4trZaPQwnbN1jryaxfin3HhtHZf5RPm6WCTBDpAKFFez--AEY4qxmFyA5_Ss-QztHCZHNyew9dyKuPUl9Pz4iUJfo5k4UtQzaZ1cJfXQCL2fqhreOg1Xk-lftRf5x49hY8La-kdFeSWs9tmsY5J8A2Reiaf5GC6pSX0P-1xzJkWg_rx8EVujA3TsLqsKjFKS5AkeQ-3GDj6EH-KRhpdfnYt7euTPOetLRs3bLMUWsaqHD9-skHIiP56pJnMwtEuWVnATWD-tX_uYimiI-cjiJEooeFr7M04DvL-r-InPL1q_WkNx8GLQnQD4-SL0fnLx1DztfRY8W0h2rzmRLb4AjZjz1ja_CKXEahiSllElVUNskI4_dcQGIOLyI3aa7eMyAXk0icjmy_xXWFLa2

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 563E 0
23 B 40ms
40ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BA71GvXVSYLL5FuKN7_UP2ZyP-AEAAAAAOAHgBAI&bg=!lJell9PNAAbUo7L91KM7ACkAdvg8Wjcte98EncDmGbfc8P3p4wH258roIuGf1FpkPRo0l9g20ppVVgIAAAIhUgAAACJoAQcKABJYLzWO-ri-N6GpQR3e-63n9g-ZAnqjJOkRiTCnwwA6XKTV1J7QmkJgCY-rCwZwYIe3HxLfTjLjPxZM5e0Vtfb6QCeDhVwsN7V4N0SgCe5kny2GuY7AEh5-S7qkl1tUtKF0IhgYwSnP3f7y9OQKVIsCfE0qsDtsViZsxpCczG7pgmxRuu5QBpVz2u4QVl7AY60b6eU3-zldsHifVvrT5UwXTSZWeNjsMKlcnV5tQzFyanDPWPdojpF3XvwhdRiTu6FOl85JTZy-8V-_hAA0sxeThllODyKBBp89VasFYqLiNZDYa1aTq6m0cGtvH1jY2UrfKJwYLjjtOVFUjNhraSfkMbIp-2Hei2B5Q3hpBpCfEv9NSdbBwno8FYVHJMev147SfXt9rD9IWCjUbumloXG-YoTnw2EbI8dI9EHzxa0SfMs0i7EFCCm9MsXgFAey6z0XD-6qqOytasPRkhzwIx57mOt6ZRnaGFvTsY4tZBHu0d2fO_ftiWsHSXzddvKW_mT0eX8WBZC5zZKexfu_OPGBWJvEAF5QSeItDGlrQ1AMIE-t_jfaJHyHDzMXhH9OczCNB5ZwG5V4T-SYEUnwlpmOrvC3hr54wxaMiM_8G6eZkSzpwb2C0cqEwMVkYiO5xRfJLNw8vb0PBcwaREpaxNW0qYENWu5Jbq6ONW6owm63t71rwJ7IMEkJHD-r02_BhlKBo7H4uiEF1ASkjDeZgba7qZXHo5TUJB6QAQXbslbPFM9VmXzIR7QMzle_l0SdDlZx3gXLeiAUi5jBPDsZxY3-2WIN0oQA8WYMxNHnD6cd1Tp7Q6iod7nbbElLeb42GH8uN0f5bTGEsusZjtsbcGxyxnIaBMkbUJVCXPlTnXjE

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E08C 0
23 B 40ms
40ms Image
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BwE6FvXVSYKiEF4WhrATju7XAAwAAAAA4AeAEAg&bg=!MzClMHTNAAbUo7L91KM7ACkAdvg8WjEWfPEDHrbGABJpqcyYQy4NLyPUDIXbpe_FOZMz1ETYdK-3XwIAAAI8UgAAAB9oAQcKAOkXT-3R34vkDWaTV3TrKZ8hz_JAuAVsMpteWe146oTevK0mCseJ6IaINQ1k2_6ap-tFg7-X4BeVs0B-JMxU7ZoJeh5DmiFZYEuc-GyNUoPgegt9vIDi-LaZOpGtns-EpDGmfq6sQzecxY9w50slKCFKCrXOKYV-w4bKzCwSh46Rlb6dbqeHTsOo2gC7IPA6I-IShgHJgdpmTysX9CPfsEhcDSJ1bK3q5-dTQs6v1F9fabweA6cZ0pITEd_ShkxoMbXnf5plAQOYr7LrPnkh4b5FfzBm_bRAzkYgXU4pYD-iI5AGmCovwg6TqZkChlBCZZawBeutdfTdpeZrll6PSRQvApf_ONgsako5aEXUNy5D7i4YqomjBjfGRmVaIC_C1u-LUIv6FhEelTGFm2NHbBstZ2lmfynReWUEu4XvTvffzqIEprBn4d68M7FOKiEokYPiDN8JrHM1FL7zy1b2rKmLg58HybUp172pXBVN17-YfSdSBbqHJqXaoKXMkKG5OvbevvAI5-_7BaJWE46oledlYLwzwx-z4VOcN_YPTKjAFD1hXacIR_SrYCp2jDrMSJBOdxS4VJVDNcCfIuzEUOtXx5zSXHHthiCsuXjGUCn2pN-Oh6dmglG4riFTto50bfBL6Foi6zUZfbIHJ2Dr8gDdSZYMIJcwSCsQxaN055KIZyr3WVurSK4WnrQCqqxD9Exd3yZ3X4h0FtX_J60L-FokSDkqxF2R1JoLRYdNGP8nCppQFUNixigrO74yppIQNhzESL7Mb9cjeaLanEA4OSN8JSQChBx_TA9ZdDPq2rUi3EyMhM7NUNO2-QyEGIdWLKNPuL-hPNJcobh-qG22s8_RBF_5P0s4U_iySAbuM_wGh3VavvUWV-yQNYm3KVhlSN9NRjM47PcvwcXNI4yBGtK5MzNX6lcHAXkGF-_B0jgscBZWTCJERSRv9zfwkTXt5-8HKT2-c67bzIdMBqGW2KTZwWvKaWLb0Df30rn9M0pkg-rW2zpHYX2KouH5cFIKT6iKR5FNA3MlB6BiwEkBGBB0bWd_y7rQXKAMfV-7XYC1zA35ouqo0h8MZpfPb7ACVElzhks5JtxTwSXWRH0GDuRZSg2ea98o0zAsSkueNGak5zVj6uHHmHbOXxswl1les6F4LIMpbP9iqmhbUG-3vVJCdas

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9FC7 42 B
89 B 40ms
40ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst7xjiVDhZwYHsRS1b3_K3i-36Zl1D7cdFKn2-nJZ3wBPpQsTa2iJPBx7YupLjGnlSeFy-zjlpirkoLB7H7Bp_WHcjuiB6Pqy_twONMItG9PKfccKmVPSicv-P5fg&sai=AMfl-YSrB2fT5lrmADRo5P9b6BGpmnkFmyfywOq3fWlhBkWnNLzjX8jd1M7ugxcIDC-SXqPc0tf96pFSDpelyF2KO7XAPVZ-qmkhbD_y40QGbS1RaisYGVNcFuVBfx--a6g&sig=Cg0ArKJSzB1J6z7gUhA0EAE&cid=CAASPeRonUriMgQtamsmiUO6vw-iFuVB1r-eFSS1cPqV5UEkRh3R11IpkAN36lRVl4PgSV9r_HyBNz7IzP-EbWw&id=osdim&mcvt=1002&p=1074,315,1168,1043&mtos=0,1002,1002,1002,1002&tos=0,1002,0,0,0&v=20210317&bin=7&avms=nio&bs=0,0&mc=0.96&if=1&app=0&itpl=20&adk=560436320&rs=4&met=mue&la=0&cr=0&osd=1&vs=4&rst=1616016828717&dlt=187&rpt=1&isd=0&msd=0&r=v&uup=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 greenoaks.gif Show response
www.reisekostenabrechnung.com/detroitchicago/ 0
336 B 18ms
17ms XHR
text/plain 2606:4700:3031::ac43:c4ab
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://www.reisekostenabrechnung.com/detroitchicago/greenoaks.gif?orig=0&ds=W3sidHlwZSI6InBhZ2V2aWV3IiwicGFnZXZpZXdfaWQiOiI5NWM2Yzg0ZC0zOTZhLTQ1OWMtNGU0My03NDliM2EzMWFjMTkiLCJkb21haW5faWQiOiIxMjk4NTYiLCJ0X2Vwb2NoIjoxNjE2MDE2ODIyLCJkYXRhIjpbeyJuYW1lIjoiZGlzcGxheV9hZF92aWV3cG9ydF9weCIsInZhbCI6IjMxODAwMCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfdmlld3BvcnRfY291bnQiLCJ2YWwiOiI1In0seyJuYW1lIjoibmF0aXZlX2FkX3ZpZXdwb3J0X3B4IiwidmFsIjoiMCJ9LHsibmFtZSI6Im5hdGl2ZV9hZF92aWV3cG9ydF9jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJkaXNwbGF5X2FkX2RvY19weCIsInZhbCI6IjQzOTM4MCJ9LHsibmFtZSI6ImRpc3BsYXlfYWRfZG9jX2NvdW50IiwidmFsIjoiNSJ9LHsibmFtZSI6Im5hdGl2ZV9hZF9kb2NfcHgiLCJ2YWwiOiIwIn0seyJuYW1lIjoibmF0aXZlX2FkX2RvY19jb3VudCIsInZhbCI6IjAifSx7Im5hbWUiOiJ2aWV3cG9ydF9zaXplIiwidmFsIjoiMTYwMHgxMjAwIn0seyJuYW1lIjoidmlld3BvcnRfcHgiLCJ2YWwiOiIxOTIwMDAwIn0seyJuYW1lIjoiZG9jX3B4IiwidmFsIjoiODkyMzIwMCJ9LHsibmFtZSI6ImRvY19oZWlnaHQiLCJ2YWwiOiI1NTc3In1dfV0=
Requested by: Host: www.reisekostenabrechnung.com
URL: https://www.reisekostenabrechnung.com/detroitchicago/memphis.js?gcb=192-2&cb=5
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3031::ac43:c4ab , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.reisekostenabrechnung.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date: Wed, 17 Mar 2021 21:33:51 GMT
cf-cache-status: BYPASS
nel: {"report_to":"cf-nel","max_age":604800}
x-middleton-display: ezp_sol
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
cf-request-id: 08e3b50a8d000005f103063000000001
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=z6XxVuhKchQqFOUNCteFKyhkv9%2Fgt0CkzvJWMc%2FVb47RO6uCRD%2BQ8kredOLT8pyB1jSyoaTlSjVdC3yZS3HOc%2BF39T4K%2BCBDYza08ietix1Zuu%2BfqNJvojBLsfzU99vEZ828IEDgRVQVDA%3D%3D"}],"group":"cf-nel"}
content-type: text/plain; charset=utf-8
cache-control: max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6319578a7ab905f1-FRA
expires: Tue, 16 Mar 2021 21:33:51 UTC

POST
H2 200 /
track.adform.net/serving/unload/ Frame 9FC7 35 B
494 B 51ms
50ms Other
image/gif 37.157.6.245
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://track.adform.net/serving/unload/?version=15&unload=9148768704996281325@@42916151,6449536337032687860,100|1100|0|0|0|0|0|0|0||38|1|||||1|0|0|LZlUcuy48py78CzqZ5NBP6JnQ2mhoeU_69BF6WaYltBBZkT85E0-p1hjhKHht8G20|||11|

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/620/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.245 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 17 Mar 2021 21:33:51 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: um.wbtrk.net
URL: https://um.wbtrk.net/doubleclick/user/match?google_gid=CAESEBTRFCbDpt0tXaUj6zJcWcg&google_cver=1&google_push=AQvitULGkUy1vfc7Bq2N7CynGEVKYPla_-0Ndjs8ZzgB6MmJlIpJMzdhg6sogfBHtay65788atMQuD9YIfM_OIyEd1ihg8X9TRs

Verdicts & Comments Add Verdict or Comment

213 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.reisekostenabrechnung.com/	1970-01-19 16:55:03	Name: _gid Value: GA1.2.1109861681.1616016824
.reisekostenabrechnung.com/	1970-01-20 10:24:48	Name: _ga Value: GA1.2.984434283.1616016824
www.reisekostenabrechnung.com/	1970-01-22 06:12:48	Name: ezohw Value: w%3D1600%2Ch%3D1200
www.reisekostenabrechnung.com/	1969-12-31 23:59:59	Name: ezouspva Value: 0
.reisekostenabrechnung.com/	1970-01-20 01:39:12	Name: ezCMPCCS Value: false
.reisekostenabrechnung.com/	1970-01-19 16:53:38	Name: lp_129856 Value: https://www.reisekostenabrechnung.com/
.reisekostenabrechnung.com/	1970-01-19 16:53:38	Name: ezovuuid_129856 Value: 96e15438-9cc6-40e6-5f1e-7aeccf3bf1aa
.reisekostenabrechnung.com/	1970-01-19 16:56:29	Name: ezovuuidtime_129856 Value: 1616016823
.reisekostenabrechnung.com/	1970-01-19 16:53:36	Name: _gat_gtag_UA_2827868_10 Value: 1
www.reisekostenabrechnung.com/	1970-01-22 06:12:48	Name: ezds Value: ffid%3D1%2Cw%3D1600%2Ch%3D1200
.reisekostenabrechnung.com/	1970-01-19 16:53:38	Name: ezovid_129856 Value: 1015559731
.reisekostenabrechnung.com/	1970-01-19 16:55:03	Name: ezepvv Value: 658
.reisekostenabrechnung.com/	1970-01-19 16:53:38	Name: ezoadgid_129856 Value: -1
.reisekostenabrechnung.com/	1970-01-19 16:53:38	Name: ezopvc_129856 Value: 1
.reisekostenabrechnung.com/	1970-01-19 16:53:44	Name: ezoref_129856 Value:
.reisekostenabrechnung.com/	1970-01-19 16:56:29	Name: active_template::129856 Value: pub_site.1616016822
.reisekostenabrechnung.com/	1970-01-19 16:53:44	Name: ezoab_129856 Value: mod38
www.reisekostenabrechnung.com/	1969-12-31 23:59:59	Name: ezouspvv Value: 0
.reisekostenabrechnung.com/	1970-01-19 17:36:48	Name: __cfduid Value: d336f91fa9647db1c49d8280de6285f681616016822

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://s0.2mdn.net/9080429/1589458396737/index.html(Line 230) Message: TweenLite:: Animation Here
console-api	debug	URL: https://static.adsafeprotected.com/sca.17.5.1.js(Line 32) Message: a: 0.0029296875 ms

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

56991dffba48022703c865e192ed81f9.safeframe.googlesyndication.com
a.rfihub.com
ad.atdmt.com
ad.doubleclick.net
ad.turn.com
ads.travelaudience.com
ads.yieldmo.com
adservice.google.com
adservice.google.fr
c.amazon-adsystem.com
cc.adingo.jp
cdn-1.reisekostenabrechnung.com
cdnjs.cloudflare.com
cm.g.doubleclick.net
cms.quantserve.com
d5p.de17a.com
dsp.adkernel.com
dsum-sec.casalemedia.com
dt.adsafeprotected.com
edf.solution.weborama.fr
ezodn.com
fonts.googleapis.com
fonts.gstatic.com
fw.adsafeprotected.com
g.ezodn.com
g.ezoic.net
gcm.ctnsnet.com
go.ezodn.com
go.ezoic.net
google-sync.rutarget.ru
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
ib.adnxs.com
impression.link
match.sharethrough.com
pagead2.googlesyndication.com
pixel.everesttech.net
pool.admedo.com
r.turn.com
s.ad.smaato.net
s0.2mdn.net
s1.adform.net
securepubads.g.doubleclick.net
sm.rtb.mts.ru
ssbsync.smartadserver.com
ssp.adriver.ru
static.adsafeprotected.com
sync.bumlam.com
sync.go.sonobi.com
sync3.sniperlog.ru
tech.rtb.mts.ru
tpc.googlesyndication.com
track.adform.net
tracking.m6r.eu
um.wbtrk.net
ups.analytics.yahoo.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
www.reisekostenabrechnung.com
x.bidswitch.net
um.wbtrk.net
104.108.145.8
13.226.158.204
13.226.159.104
13.226.159.36
142.250.185.162
142.250.186.130
142.250.186.34
142.250.74.198
174.137.133.49
178.162.133.149
18.179.156.111
18.193.131.107
185.33.220.244
185.86.137.121
193.0.160.128
195.54.48.26
2001:678:cb4:bbbb::11
213.155.156.182
213.87.44.207
217.66.147.170
23.37.42.216
2600:9000:206f:a200:2:cb38:840:93a1
2606:4700:3031::ac43:c4ab
2606:4700:3036::6815:3444
2606:4700::6810:125e
2606:4700:e4::ac40:a708
2620:116:800d:21:f916:5049:f87f:108e
2a00:1450:4001:800::2003
2a00:1450:4001:800::200e
2a00:1450:4001:809::2001
2a00:1450:4001:809::2002
2a00:1450:4001:810::2002
2a00:1450:4001:810::2004
2a00:1450:4001:812::2002
2a00:1450:4001:813::2004
2a00:1450:4001:813::2006
2a00:1450:4001:827::2001
2a00:1450:4001:827::2008
2a00:1450:4001:82a::200a
2a03:2880:f01c:8004:face:b00c:0:8c
3.120.242.149
3.126.56.137
3.127.76.126
31.172.81.160
31.172.81.172
34.255.248.151
35.173.0.225
35.186.193.173
35.190.0.66
35.210.53.219
37.157.6.234
37.157.6.245
46.228.164.11
52.17.202.120
52.51.3.86
80.64.106.147
81.222.128.216
99.80.199.35
0074b127a29ae376437ff1b01ed01c6f60b0ab72b5aaf81e50cc7939e626d620
013155683600f0d286333f6e450a1583f30ad2aabc884df3386932a53de9804c
01b91c27c2dd8d42bf4832466bfb4d3f0ab2eff59e855e4ad8446dc626637cc8
04d48b95f4f5f750450039ff5fd5c57184e2cb124e9c12151eaae7cbc0bd5484
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
08375cebca0d36f2fa3ec9e027a974146af7161553e4319a418d4cee6b38bed7
0925e8ad7bd971391a8b1e98be8e87a6971919eb5b60c196485941c3c1df089a
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c7aa75647150fce78a2daf807b9a7ddd1501f45a4dc141aab369283179c3665
0d4072b36aa1a5fdc3d7f63f495c0217d7fae137a403588b4a312deabebdcdb7
0f087bb8341880a9a60af996272030bf86504927f2f64b62da3a53389211cbfd
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
10f6e6a4fc6ec19d54cbadf37af57dd9f8770c90889e969fd803a70bd11ffe07
1170a116f6521465e0d4f0df36d070b1502f257e88dbeb459d31d3e2c3fb861b
11ca2b97c357478751eaf975d488b2bb3fe244e18a570e122ee239f27890aec1
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
134bdfef6b19c84bcb7dfc55f32065853ffdf1b05a8661caf172e56edacd427f
13f86bd1a6d578ee82ca0c54a9a634e03d8d7db09380d72590b158f173f53790
15f0626dd31e3e991a1c21d6304f2e370b92b3c91650de3d7ed8a38f1159a457
18876aa194dc231d0c3bc858cd881885107d8bedbab226c369018fb83488eae4
197d4c9ad39b2dd2361af97f851d53146251c1b5b50e12ab1e796572eaa9894f
1b68431bd479f66f60cca8fef9520547c0f28390680174d8b36c5591085e8393
1c5ad2fd42dffdf04a0f1d757c1cccb4d840218d7ecada79d6cc9db33ca40319
1ea218661f49e28158ba378bd053b70c878adb09953e5ae48cab3768651a4abe
1f37e108a103ae6d6ed4ca9047d415434b8a1edefa81ddb7d4314ecb21587010
22abd45f1c986bcef595abde9c04687cbf9e0aaba50cae7ed74adf43a60e48cd
24fafa96014bb69b2d14236c4982326ae80293f8d04891dd080dd094084f8320
25c788c3d6b5a5f5931ef45abc5640af29b16f379c2e1634dc32c6c225327f38
26b4485584314aa0850427462143a6a28b66c982db28deb42766214fad7744c7
28161d419de84b0fb3c3bb264e0b244f907bb1bf505da450c833c34edf95d3a9
29d07745f18e4749b2e736b113cc6445c904080eff34da9080fa054fd742c030
29f413e714f523cdf2b9c97b6a27474779682b6da0abbbaf89972140f13eb741
3153a3db000c87f17b7e96eb5346655401baf25ec6fde84fcd05475b5a686260
322b1e4ed7c507891b57e9f2de050bbf9e13d3b43a32164f81bd74e1cfe41748
32a6991dfe05f1f9f4cfd4a424dfeb221761d70fb219ee42150fe90de41a3c9f
34ef40de06f89a7924f26fdbafd35352f7fa67a8c5eb8840fdb6eeafb818240e
3514bda8c0485fc4f389308759afffa01a67af483112a31a9569c906acfeeb3e
37d4ae593a1268d4afce8c38f61ea933982184d2d6055300c2bfdb8ca28c2846
389ec2c26664b880f0c6561ed43a0458a86e2a9d18192740f125843fa643842b
39e4c6e25be371a3026dc5ea8ae0e23e953d6916518811fcc5c1a1769767ab16
3bde76c6950203c0ab0a0a7316bb04503e0d8aa5dfae95e4d7509256ca208186
3ded49272000064adcec14280964aea6d2253f83ce9ae507f25e24721f3ec8ca
408d8516f6a084ae826e070be2167a5f7fef39dac5eb848d6094ce57fcfe4944
41eb9054d5d5527274926b32631be8eb22dd6254f15a4d9d14cfe2688ea4f538
42f1d4a6ca637b1d0da2d55933890169ed215a24535e39027836dfe1cdbe5b0d
43fe272ec1281bdced0ec26c62061faf66ed5615aae765a89eef6ed28ab1959c
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
48a75646b5e7bb0a6ad4ef08f953002e6f751c0b2df96120333267c388a72efb
498e1816875171bad3e7bee172b561231eb2f8aa004e9b872fd5b651f5f84062
49e1dcef611a905b866974d135554059ecd77a0ae022553178ec359ea0b64504
4acba540de7bf942b0e41feb83e98273b599b7a70f0bbe67e84afce4450f6a3e
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b73436f7c44562199d88eacfdaee95d10c34e3cbf03c77756653e4b9447d142
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
5578a62b81f315375d072cfe506fc13813e844f94c910bdb15ce20e1fc3ef50a
570c04b30a5c8fa6ceaff96ea6d3a0dfabd85dee3edae40e38b0344a7278f254
5b598f6b8e6244f2ba676cc0f9fa2749ac3e7b9b04ef153df6770145bd593b66
5c7246a30f947138add9e8a4f08af29a2bbe677690075ec238eb87f02ca9fc2f
5e03a7aaf1268afc2377a1c4d36959d7213380c40527ac50ccca39b8c16ce610
606c5ec516f355a575daf12654661e57385aba74f4d94f50b3b3ecbd002dbbe2
62b1cff44a5e34b9587ad49f7ca951160f1559c5c545bcf99e13574ccaa5425a
657df3443b334f17bd33ac827932e2395ddc2d5a28b697c91e21fc8fabebf8e7
6649958b1a60f4c559d05df4699238b3824338f5f24aacd94d7cb9c8aa53256a
686df60545fbf0a0d59457fc410d3f997b5c904afdedb6d1b67a48984d6a2cda
68984aa0e0192c05e3385c29a8e60cc4a1c37a9273ce62503006a85e09e92246
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
70d82c6075989e0082b4917c6685f5f6bec1e673d0a80160eac61b3f1cdcb1a1
731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233
739d2fd1b9a04bcd81d39440eb5198a08bbf3e803a3073aa407162baee5ca722
741628e3cc4a52bff09cf26c22429b26f3d55618a9d63e9bd1a97e2e79de83d1
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
771401f92c9927cc3149966b99f476dfde0f392077a06790559647781669d11e
77690e448be45a574fb4a397faf4934ddd1fbcc36f3f76cb94416ee526e035df
77757c2654e4525cd61d7a3fe8f29fb352aad3c4f7cbe47178abf3b1429a29fc
77a6e7584722f285dd6b3039728b6f1aab3948e60b4c26298600f1a5ee155bbb
7ab0362198bfacd73852b08292ca2765dbf4c1fba9acb4772f4fafabdd9f8025
7b16a81c8d220bd11bde8d34c34cbe5be38612e2b4fc1f58a82d7b8f23114611
7bc25531b8cc8c343dafe971d37212969df1c453a4dbe393149d93b1beebd1e4
801b78af2ab57cfc67d37f8137feac63f1b722b8812dea418b43759e9baddef8
8024f896824781eb08e614b5ffe0cbfd2020fe08cc833062010d7573714ecd4f
8154aa9057e3367d9d3e4bb1f85db9645c01fc0690091aadc57dbae849ba3499
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83bc9c7d0ba363ee8e4f48002596290e8c08cd64b3e510a00ad5a0af0cfbef3f
84c65cf6dccd23cbcc0603f73e434c41a4086431756078e8bd2c7a1ff182066f
84f285172be3d41a4cc9b8bfcee3a1f8426ad11d04df0bee1e4a95ead399ab03
85aef15e15535a3497f55f748129fd2744772229e00a72eff6d2b5aaca4f0fb1
86cef609c85d2c2ce6a507af54e77a9c150e2fa408043e1454082614c4b0ce2b
880fc31656d53a1510787f75b74b466eb4e1fdee66ae9b74defb381ab5d955f0
8969b7273c752efcffdbaa9fa9eef8cefcab328ede0bd72302693d6e9bdf319c
8c1e933820608ef3fbf4e1cedd827252747fbe30539b791aba5e0a2927f6575d
91b4244ebe9f1ca90ed84b8b5c9fe2f340e35d55df94c668b89f824d57e9010c
924d230035283500771737b8dd94ac0dce42946fa339bf2d1d0445bdfcba8189
941c260356b6aa75782a27384179a63581c9e41b42155774982f36b0d84cde9c
966ee1486939f4b7c9815a6ce8dd42420c5859a42efdbbd5b91aff45e0b1cc38
977e2a7ebfdf57c55274f6a1191eefdf637e4055e05d38386de41281209f993a
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9ba3dcc29141bf41b69a403d7fa22bc24ff9850377c50586c621737138623d6c
9e12c1c950a6746bfde4cced285da0418086d6295dd388d7e471205b2c78e2e8
9ec204561656bab028c2fb1d77312a95e26333f39b4a2a274049423f023acf5f
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a2597098b7399a8cfcd439b9af387be361db498438b90fb788b1c07177b28b52
a25f4e403cd3009578cf6ca056afac33ed6aae8f47d1ab575756804b52be203a
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a677ebd50879d5c89a66566e301e98cee34f985664cbbc13f887feca7a1e6c2f
a68f554f71963880eee6d2c65b585a9a5469dcbec019738b4a2ee3eda70815aa
a863a77e9ee263a0ec9c1e792bb33ed0f663582b7369f472261df7b6040990c4
a9c59945c470e1fabdd79c4f07d0d22527869fb4eca62b78ad95b30e19ac9626
aa722b5fb4aa7ac814df29a55b56788dfc54ed17133f0a8c616f3ed1b57706cc
ab8602ac62a289a7976e2e54ac0a870899b520467bc12e33cc75b669f8b1e8c9
aba387bcb56de1503c6196d03295b70469425af39b649cf05b38b6949e8456c2
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b5e482213a038b5e3ef28c5835023c3e22d9e2c4590fa5ce412b3a366df0fff9
b61b5702e02282165f2916dcf5e71a0beb332b4966d0432c13f34f1f045827d8
b7bc64fa17726261970893d6a380df88fbb4dddf18573f5d25be51b9779c4984
b7dabd76ad06582c66fd0838e1e831a74a425bc01f73870eadd2ecc67af87b38
b89903edd56119100b9399dc21d347244373ce36f56c78c399d2672a6fdef78c
b9ac4313aac22318378364aad6fc6a2620a882b4373d705ddf6a4b4b778ea0de
bab158f2b326e9f2db0ee25f682afbe01ec4835c26564e68950d4170180cd80b
bb66078ae708305d3cce1fddabe0874cd3bee93e0b5efab7afce71c626910aa0
bc4a532d1cc0e0681799df7243d94d96e3949e93d6951765e738c2e455ba5738
c80203c7eae413cecc09a4ed0974e31a8538060cddd5bc1f1a5bfa53db672c9e
ca625f204331905abf3b4d86a89dfb9799c63771723b9b15c5b54c1f9fb2b83c
cc470a93cb0f84356b1f95b20e67560edef307fb653294bdf7f050460b8ffabb
ccbc725072200e9a92d7e29113264a647a0fa485f1df386dc85c48ef5ffebd1a
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0d7aa9d488a2b2c152f5d64b7d4bb2da5ea74e901ccb9a580326c3c35224fb5
d0da92b77812f9be5a18d54d33e9a212381f690048fcce8486424e0c761dfa88
d14179c52c8976762b2a18c43bf2bf151281ea48aaa8b2fd4433ea046cebba64
d17b84f0cbd97c80fcfee28f36b7a4122035195ecbfbaba9ce6d54ba414dbad3
d1b33e031c5497cce60526256780760f6c1facd3ac8b22541aad3f687a5fc438
d269f9bebbbe631349351d50b4696ff0d94649dbb03889b769687d0290dd12bf
d3759299ce00e3bac2782faf02d6f1962e5c88b04e9682224f5852d0c86b6480
d4541768d977bafc2a0a4215e5dbeeee0b39965aeb2fc8b2a3ac6e7b42a25c26
d7576d49fa9e896aa6c50a5a9278ac6c37b1367320292fc34d1a90b50da2e5b7
d798d8773831f64f1228bc59f6dc361eae9b0811b1cbce20d639a8695b1d118c
d938337502e1a8f744f387860470c857ffa95a00e5a3c0232eaf5bc884eba3b8
d9cebb89ed3e16a74386f743f3fc12fe98cb4fc5c11f03af5febdf1141ca6a39
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
e1a156c3daa4ae0c41f21ef266131ca5a34d56695e3d860b232da142ef031234
e1ef44bacf5da572d77131f447646f8c3da2fc7765e90c73a664c69121c71e87
e25fa1dc383dab10261f885d1c39a604525d2cd2ea6ca908e2c2375c07e3884d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3e2855bea0628e4e1e3d77a1416517b65c286f9c361eac84624494545d1da5a
e4139b3e7ead7268f5e730fb9b32300273ce262da28ed4bdff16508d8d6d7314
e86479d6e54449d1085c2149e190a615c6bead407b20bacbcf5852b5d65f1fee
e944c4f8dbbee9abb8e29a1aad4b253cb6b1e670e68b8bf8778def0f7915d5f0
e9591f064ab3cd667a6d281a2566b45b0636e9da33108e0257c53bd3f5cda455
e965b21d6a23293b47f5deb510a49b0675f74ee2eeb6dc86c101c33ff921461c
eaaf0cf994d2fc2ccdd1cdca4a02d1df904b65b586b3ba4135764d7c631ed416
eba385c1782056501cdda10d5706441ab694be71c08db0a758160c6a16373171
ec8604d4eade6552031ca2e8d3af9b3a1393bdc11b39dcb8176c41f4e5fb678c
ec9a3b5dc41c4ebdb43bbdcad3675562898fe4cbdfc55708f680586c8cee361f
ee160714b80f6172a2bd888f2cc8a96d09e3be220730d5a5f99530bbce0a3366
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f10ee421996d2a7f3d0d160a3f1b1c2dc78e9d81a1fe0e319d494737fbe5dfea
f2b92530616ddbefbed0e825e094cd914f17ae899b42152f17028a0073f5eb62
f49b1d1bd49f5c61c93e08dc9b8427ae046c513af8ce30fa8d04162bb6f5b9df
f4e3441f0da47965d475c902c09d9c269054457d568226269c23335e0d43d766
f69dfe383fe0ef66df2c8de098fda546a826801c150ec22e7e09b8020b221dae
f7db7d3088ed17cdf54fda1347dcd21087bc3a154070af514b819754ffcf0c52
f9d9f49fc378d4322355f7fdf35e213afc7f835ab2542b772a4e25802a5ac5cf
fba0c3fbaa10ce71ff6ebe9307af1dba9f9d063a52afee72a0d0707f2ac9cadc
fd5a91913a74d6a43b060f616dd109816717a7cfafa30f62e08890e3986758a5
fd8cc56d4953209cb0bd10a1198b3726b03857abfe648c987b6dbd4e0f63513a
fdad7e0cf0ea2a8c3706cfabedbdaa747b16e701e8df2d5aa9bd6e03fa38d628

www.reisekostenabrechnung.com Open in urlscan Pro 2606:4700:3031::ac43:c4ab Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

355 Requests

99 %HTTPS

34 %IPv6

46 Domains

62 Subdomains

40 IPs

11 Countries

2810 kBTransfer

6413 kBSize

19 Cookies

15 Outgoing links

Page URL History

Redirected requests

355 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.reisekostenabrechnung.com Open in urlscan Pro
2606:4700:3031::ac43:c4ab Public Scan

Screenshot
Live screenshot

Full Image

355
Requests

99 %
HTTPS

34 %
IPv6

46
Domains

62
Subdomains

40
IPs

11
Countries

2810 kB
Transfer

6413 kB
Size

19
Cookies

355 HTTP transactions
4 data transactions