congratulationsto.com Open in urlscan Pro
2606:4700:3036::6815:121c Public Scan

Software

Apache /

Resource Hash

047af5fb5fb9adffa951402dd24310835927adca5e295e45b02df6a5425e81bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-mnt-h: 10-3
content-encoding: gzip
server: Apache
etag: "c0d0c22f0c0f7a925623c910f888337a"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
date: Thu, 10 Feb 2022 14:57:37 GMT
strict-transport-security: max-age=604800
x-mnt-w: 8-19
expires: Thu, 10 Feb 2022 15:02:37 GMT

GET
H2 200 show_ads.js Show response
pagead2.googlesyndication.com/pagead/ 114 KB
39 KB 262ms
183ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/show_ads.js

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fc3e2df2c1271915dc51870f9228858b8456f7c18d3454e69fcb88fcc166836d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40183
x-xss-protection: 0
server: cafe
etag: 916079125236059407
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 10 Feb 2022 14:57:37 GMT

GET
H3 200 email-decode.min.js Show response
congratulationsto.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 35ms
34ms Script
application/javascript 2606:4700:3036::6815:121c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://congratulationsto.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3036::6815:121c , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 08 Feb 2022 10:43:21 GMT
server: cloudflare
etag: W/"62024949-4d7"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options: DENY
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qsy7yheoUO16mo1etSrR1g34%2BW4ZycJbnLXuKyxRTbappwfCr21nwhjOqAWTrdpDagATFDo9rJbydJif36Ta5gtefFKfg6OM4ekaInFwZnPzN2F%2F9YPZWagaWDsmqQ2cjIrUKml880VXhM9298lSMxBVvZc%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=172800, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6db630e18e426949-FRA
vary: Accept-Encoding
expires: Sat, 12 Feb 2022 14:57:37 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 153 KB
53 KB 146ms
69ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2e109b92a6baed6ce5733d4ecd54fe0a4074df30c2d1191a499424a1ecc78925

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53813
x-xss-protection: 0
server: cafe
etag: 10749069426645868957
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 10 Feb 2022 14:57:37 GMT

GET
H3 200 cmbv2.js Show response
congratulationsto.com/detroitchicago/ 67 KB
20 KB 130ms
129ms Script
application/javascript 2606:4700:3036::6815:121c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://congratulationsto.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-5y06-12y07-1y19-5y0b-5y0d-14y13-3y17-4y1c-2y21-3y53-1&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1cx21x53&abt=VignetteFloor
Requested by: Host: congratulationsto.com
URL: https://congratulationsto.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:121c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4c2f5a8bf709d8a411585661a75e6cc6a3f99e87d99aaeebdabf69301435b911

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:37 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 10 Feb 2022 14:57:37 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HhlAZK5lTmjJ%2Fu3Wfqx%2FTrjwIZn5HMzsqkxLWVP2wp2RXu0xW4MDNX1cR%2B3z04LvUqCKxEgHaFrk103iJFCLGSPBKWWKu6ZGWy0s%2FsVmDA88pB2TFhYBEoaLpPNjPhUCW4pgVTIY481qfWGnd3bcWaxkFzI%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public, max-age=31536000, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6db630e18e456949-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-robots-tag: noindex

GET
H3 200 ct-logo.gif
congratulationsto.com/include/ 6 KB
6 KB 206ms
206ms Image
image/gif 2606:4700:3036::6815:121c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://congratulationsto.com/include/ct-logo.gif
Requested by: Host: congratulationsto.com
URL: https://congratulationsto.com/media/css/main.screen.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:121c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d915cf218ef70c7a612471a30dc9b179b5529d6343463cc326f760256ffce038

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/media/css/main.screen.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:37 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2912
x-ezoic-cdn: Hit ds;mm;d0ba55da5b65d40e5ef322335ac5e826;2-179420-5;98a4c74f-d1cb-4d1d-58c0-2adb38a9b592
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-origin-cache-control: max-age=604800
response: 200
last-modified: Thu, 10 Feb 2022 07:11:36 GMT
server: cloudflare
etag: W/"16c7-5215c09d1b740-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, User-Agent,Origin,Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F%2Fp0axd%2Fs2%2F3IVTXrmoHtpX4ycTIs5JmevkveaiwDJpDJ6Xe0d3oTCB40jkWPE8hY6XI0Q4RTnh%2BP2Y1OB3tQPGe9AqPpuzC6zjedxseI9JvUqhqF5SMbORClHY1XVKwCORlkh%2Fiv7B1JRjnv5f1t0CubX8%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: max-age=2592000
cf-ray: 6db630e18e486949-FRA
display: staticcontent_sol

GET
H3 200 nav-bullet.gif
congratulationsto.com/media/ 1 KB
2 KB 68ms
67ms Image
image/gif 2606:4700:3036::6815:121c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://congratulationsto.com/media/nav-bullet.gif
Requested by: Host: congratulationsto.com
URL: https://congratulationsto.com/media/css/main.screen.css
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:121c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 8356922a8a8ed57fc6f80dedf1190ff58a3650002096b3d81f877133f6c317b0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/media/css/main.screen.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:37 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2912
x-ezoic-cdn: Hit ds;mm;60fb7bf7a32049a717b23afc96f59172;2-179420-5;8d50843d-ca79-49df-5ec4-15705bef216d
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-origin-cache-control: max-age=604800
response: 200
last-modified: Thu, 10 Feb 2022 12:12:35 GMT
server: cloudflare
etag: W/"581-522cc2cb0a480-gzip"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, User-Agent,Origin,Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qZBWk6xxhJrLskAjXOvIxWkO5hOiVLOajEGYWBl0RLegnb6jd0zYpKBVT9s8AWFYQZhFWaWy7dzauqhwlFiZePR8l4gDuQM3146TfysAqAW7Y9lL5WIejp%2F8npgWvAhTC4TEf0XKtHVvkVZpLZAOyExJRoQ%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
cache-control: max-age=2592000
cf-ray: 6db630e1ae776949-FRA
display: staticcontent_sol

GET
H3 200 imp.gif Show response
congratulationsto.com/detroitchicago/ 43 B
669 B 183ms
182ms XHR
image/gif 2606:4700:3036::6815:121c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://congratulationsto.com/detroitchicago/imp.gif?e=%7B%22ad_cache_level%22%3A0%2C%22ad_lazyload_version%22%3A0%2C%22ad_load_version%22%3A0%2C%22city%22%3A%22Frankfurt%20am%20Main%22%2C%22country%22%3A%22DE%22%2C%22days_since_last_visit%22%3A-1%2C%22domain_id%22%3A179420%2C%22engaged_time_visit%22%3A0%2C%22ezcache_level%22%3A2%2C%22ezcache_skip_code%22%3A0%2C%22form_factor_id%22%3A1%2C%22framework_id%22%3A1%2C%22is_return_visitor%22%3Afalse%2C%22is_sitespeed%22%3A1%2C%22last_page_load%22%3A%22%22%2C%22last_pageview_id%22%3A%22%22%2C%22lt_cache_level%22%3A0%2C%22metro_code%22%3A0%2C%22page_ad_positions%22%3A%22%22%2C%22page_view_count%22%3A0%2C%22page_view_id%22%3A%2216079be0-0a55-4ce3-7026-b2118352597f%22%2C%22position_selection_id%22%3A0%2C%22postal_code%22%3A%2260313%22%2C%22pv_event_count%22%3A0%2C%22response_size_orig%22%3A42274%2C%22response_time_orig%22%3A15%2C%22serverid%22%3A%223.122.107.18%3A26279%22%2C%22state%22%3A%22HE%22%2C%22t_epoch%22%3A1644505057%2C%22template_id%22%3A126%2C%22time_on_site_visit%22%3A0%2C%22url%22%3A%22https%3A%2F%2Fcongratulationsto.com%2F%22%2C%22user_id%22%3A0%2C%22word_count%22%3A2018%2C%22worst_bad_word_level%22%3A0%7D&ez_orig=1
Requested by: Host: congratulationsto.com
URL: https://congratulationsto.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-5y06-12y07-1y19-5y0b-5y0d-14y13-3y17-4y1c-2y21-3y53-1&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1cx21x53&abt=VignetteFloor
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:121c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:37 GMT
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XUBRTNBSikg7LRaNvXog8qUfJC1XVjOfQew5JCAe7NHfrUbhl5tm%2F6%2BKiOwUe5%2FeLpvA6XbPoIRxzwq9%2BFdpoo32aoWljgkB3qZY9JjONMZ8TIyuuU0leRIQlAkxiPEpkIePHKOgFYa%2BjO4dhVhYF2V6l6A%3D"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
accept-ranges: bytes
cf-ray: 6db630e268256949-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Wed, 09 Feb 2022 14:57:39 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 24 KB
10 KB 200ms
107ms Script
application/javascript 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: congratulationsto.com
URL: https://congratulationsto.com/detroitchicago/cmbv2.js?gcb=195-2&cb=04-1y02-5y06-12y07-1y19-5y0b-5y0d-14y13-3y17-4y1c-2y21-3y53-1&cmbcb=20&sj=x04x02x06x07x19x0bx0dx13x17x1cx21x53&abt=VignetteFloor
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: b236dccee1a0d5280842bdff52b4005e2b0c9ee5d74a15db3e939c53306576d3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:37 GMT
content-encoding: gzip
etag: "yoD6mq4JTyPdtDBolW+GUg=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
expires: Thu, 17 Feb 2022 14:57:37 GMT

GET
H3 200 cmbdv2.js Show response
congratulationsto.com/detroitchicago/ 43 KB
11 KB 155ms
155ms Script
application/javascript 2606:4700:3036::6815:121c
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://congratulationsto.com/detroitchicago/cmbdv2.js?gcb=195-2&cb=03-5y0c-5y18-4&cmbcb=20&sj=x03x0cx18&abt=VignetteFloor
Requested by: Host: congratulationsto.com
URL: https://congratulationsto.com/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3036::6815:121c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 035aee8541bbd5cab16f8daada7fd681caf4e8ac9fa946c71a242438c4b26e16

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:37 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Thu, 10 Feb 2022 14:57:37 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N5weANkYjGGi069MkeZnLondnkIMbOiztXcx86FoGK2UdifVSdWtQRb3cRR8qvQWij%2BROceocyEfQsTHatRYulGj3FSMH8luFH%2BaRY9u8sS6SLeYVEFMebs2W0YA10zTq5r6rhMDfNFF%2BrxfJP3RuL12Xk0%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-middleton-display: sol-js
cache-control: max-age=31536000, public, max-age=31536000, public
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 6db630e268386949-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-robots-tag: noindex

GET
H2 200 rules-p-31iz6hfFutd16.js Show response
rules.quantcount.com/ 3 B
428 B 62ms
20ms Script
application/javascript 2600:9000:223c:200:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-31iz6hfFutd16.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:200:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 07:16:03 GMT
via: 1.1 e9101023ffbe04130b9d4cac0cf9eebc.cloudfront.net (CloudFront)
age: 27694
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 3
last-modified: Sat, 04 Mar 2017 19:50:24 GMT
server: AmazonS3
etag: "8a80554c91d9fca8acb82f023de02f11"
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400
x-amz-cf-pop: FRA56-P2
accept-ranges: bytes
x-amz-cf-id: epi_h9uEIPkqmMH3LkL0fnQ4segam94fKEN6QxP84pYP7O2Ip8LMzQ==

GET
H2 200 smtr Show response
contextual.media.net/ 86 KB
32 KB 412ms
411ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=1&cid=8CU89N2CZ&cpcd=4Gvl7ZRTnRr6pLpbDUzPMQ%3D%3D&crid=311343129&size=300x600&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fcongratulationsto.com%2F&nse=5&vi=1644505057844410026&lw=1&ugd=4&pgid=p01278676877t202202101457&nb=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/nmedianet.js?cid=8CU89N2CZ

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

a081032f0bfb851d19537283b771bda2820c6b5940f993698b2731cb768ea4c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:38 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=0, no-cache, no-store
strict-transport-security: max-age=604800
content-length: 32686
expires: Thu, 10 Feb 2022 14:57:38 GMT

GET
H2 200 bping.php
lg3.media.net/ 35 B
189 B 110ms
65ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?&gdpr=1&prid=8PRHGG6T9&cid=8CU89N2CZ&crid=311343129&vi=1644505057844410026&ugd=4&lf=6&cc=DE&sc=HE&wsip=2886781336&r=1644505057950&requrl=https%3A%2F%2Fcongratulationsto.com%2F&vgd_l2type=sca&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=212238&vgd_rakh=1644505057148142127&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fnmedianet.js&vgd_pbcm=1&vgd_pgid=p01278676877t202202101457&vgd_pgids=1&vgd_uspa=0&hvsid=00001644505057945023283072008410&gdpr=1&vgd_end=1

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Thu, 10 Feb 2022 14:57:38 GMT
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Thu, 10 Feb 2022 14:57:38 GMT

GET
H2 200 smtr Show response
contextual.media.net/ 86 KB
33 KB 696ms
696ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=1&cid=8CU89N2CZ&cpcd=4Gvl7ZRTnRr6pLpbDUzPMQ%3D%3D&crid=142533074&size=336x280&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fcongratulationsto.com%2F&nse=5&vi=1644505057793382778&lw=1&ugd=4&pgid=p01278676877t202202101457&nb=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/nmedianet.js?cid=8CU89N2CZ

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

c632b38d2c55129a5c8e5e91e4ca14da1d689471e02d746a2dec4f4813cf7c83

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:38 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=0, no-cache, no-store
strict-transport-security: max-age=604800
content-length: 33068
expires: Thu, 10 Feb 2022 14:57:38 GMT

GET
H2 200 bping.php
lg3.media.net/ 35 B
189 B 68ms
62ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?&gdpr=1&prid=8PRHGG6T9&cid=8CU89N2CZ&crid=142533074&vi=1644505057793382778&ugd=4&lf=6&cc=DE&sc=HE&wsip=2886781336&r=1644505057992&requrl=https%3A%2F%2Fcongratulationsto.com%2F&vgd_l2type=sca&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=212238&vgd_rakh=1644505057148142127&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Fnmedianet.js&vgd_pbcm=1&vgd_pgid=p01278676877t202202101457&vgd_pgids=2&vgd_uspa=0&hvsid=00001644505057990023283072005283&gdpr=1&vgd_end=1

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

zrh04s06-in-f130.1e100.net

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Thu, 10 Feb 2022 14:57:38 GMT
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Thu, 10 Feb 2022 14:57:38 GMT

GET
H/1.1 200
OK widgets.js Show response
platform.twitter.com/ 96 KB
29 KB 169ms
10ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets.js
Requested by: Host: congratulationsto.com
URL: https://congratulationsto.com/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/669E) /
Resource Hash: 1f5a3cbf19a41df9f5e59f05ac4c668b3caa896cb3c2e5c96f7addf4f6a96479

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Thu, 10 Feb 2022 14:57:38 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Age: 120
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Content-Length: 29179
x-tw-cdn: VZ
Last-Modified: Tue, 01 Feb 2022 20:03:56 GMT
Server: ECS (frb/669E)
Etag: "94840c3a0697481258cd2b28513e7509+gzip"
Access-Control-Max-Age: 3000
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=1800

GET
H2 200 pixel;r=1168707515;labels=Domain.congratulationsto_com%2CDomainId.179420;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Fcongratulationsto.com%2F;uht=2;fpan=1;fpa=P0-1608779778-1644505058008;pbc=;ns=0;ce=...
pixel.quantserve.com/ 35 B
372 B 370ms
110ms Image
image/gif 2620:116:800b:21:44af:4f54:8af4:5563
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1168707515;labels=Domain.congratulationsto_com%2CDomainId.179420;rf=0;a=p-31iz6hfFutd16;url=https%3A%2F%2Fcongratulationsto.com%2F;uht=2;fpan=1;fpa=P0-1608779778-1644505058008;pbc=;ns=0;ce=1;qjs=1;qv=b4915a16-20220201183321;cm=;gdpr=0;ref=;d=congratulationsto.com;je=0;sr=1600x1200x24;dst=0;et=1644505058007;tzo=0;ogl=url.https%3A%2F%2Fcongratulationsto%252Ecom%2Ctitle.Congratulations%20quotes%20and%20wishes%2Cimage.https%3A%2F%2Fm%252Econgratulationsto%252Ecom%2Fassets%2Fpublic%2Fimg%2FlogoCongrats%252Epng%2Cdescription.Short%20congratulations%20quotes%20and%20wishes%20for%20various%20occasions

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800b:21:44af:4f54:8af4:5563 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:38 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202010201/ 284 KB
102 KB 61ms
44ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202010201/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8040849356053987&plah=congratulationsto.com&bust=31064752

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/show_ads.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5af031bae13ebbdc73d242c164e8ad1eb9e51881b5cc9395ae11690f62eff9d2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 104617
x-xss-protection: 0
server: cafe
etag: 3171602628018986307
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Thu, 10 Feb 2022 14:57:38 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220208/r20190131/ Frame 7B0C 10 KB
5 KB 66ms
17ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220208/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a575e2f63d79cdaf5a92b4453bfcaadb462119aa1216b4f28920e37e2d9b8e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4612
x-xss-protection: 0
date: Wed, 09 Feb 2022 21:54:54 GMT
expires: Wed, 23 Feb 2022 21:54:54 GMT
cache-control: public, max-age=1209600
age: 61364
etag: 18247940800414524076
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 42ms
20ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e0cdc258405ff53d78576d19d43e56f6c91e40f3d62b324596c953726b4fc9cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: +TTlaZ22Lai0Gf4+xgdNpA==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 1687
x-fb-rlafr: 0
x-fb-debug: 4vwbHqTkafblvYP2R0GG+iaiuNiSGiSSTXeC3WkMQfgShWGQ4Dbt3lhxObLKKELttbKVfYXai9ZgXpti/ibxNQ==
x-fb-trip-id: 686109401
x-fb-content-md5: e7f56e9343cb40d1ef108d25d0aaf328
x-frame-options: DENY
date: Thu, 10 Feb 2022 14:57:38 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "b8885c0224079ab1b379e7d8badf62bf"
timing-allow-origin: *
priority: u=3,i
expires: Thu, 10 Feb 2022 15:08:06 GMT

GET
H2 200 plusone.js Show response
apis.google.com/js/ 52 KB
21 KB 110ms
78ms Script
application/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/plusone.js

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

0d58874df689aa5f7fa093241def6a379ea8e40104f612f435f12d02447c5ed2

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-s57K53DUupjIC9vG3k8Jeg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
cross-origin-opener-policy: same-origin
etag: "c287f014806a9e4c693e7509987366ea"
x-frame-options: SAMEORIGIN
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
content-security-policy: script-src 'report-sample' 'nonce-s57K53DUupjIC9vG3k8Jeg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin: *
expires: Thu, 10 Feb 2022 14:57:38 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 51ms
20ms Script
text/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 02 Nov 2021 17:39:06 GMT
server: Golfe2
age: 3166
date: Thu, 10 Feb 2022 14:04:52 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Thu, 10 Feb 2022 16:04:52 GMT

GET
H/1.1 200
OK widget_iframe.4e067713e19d4fff483536ddc4df18b9.html Show response
platform.twitter.com/widgets/ Frame 7F17 319 KB
104 KB 15ms
14ms Document
text/html 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/widget_iframe.4e067713e19d4fff483536ddc4df18b9.html?origin=https%3A%2F%2Fcongratulationsto.com
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/669E) /
Resource Hash: c6d03b7a5561687268e57b13d9d4a6a4c71ee570ea74718040ce9227676e3e5e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 157737
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Thu, 10 Feb 2022 14:57:38 GMT
Etag: "8321d7cf58d70200c1423dfa0bca40f6+gzip"
Last-Modified: Tue, 01 Feb 2022 20:00:09 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/669E)
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 105433

GET
H3 200 sdk.js Show response
connect.facebook.net/en_US/ 290 KB
82 KB 21ms
9ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=8354aaf689db54cfd8c6e4a909e17735

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

a902c49ad36c232d4e5021773994e5a8c7f571f22b01e1eb19bc3cf1b9ea2c88

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://congratulationsto.com/
Origin: https://congratulationsto.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: zHdy+VHtjq6VqhZJjySJjw==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600,h3-29=":443"; ma=3600
content-length: 83544
x-fb-rlafr: 0
x-fb-debug: xL5oLit09m4V7wrjo4NsMC7GfHef2GHwSYPicv/IbyizHjvyT3Jn6RwdJZ+JwK8Ke4fdVZoUKUhZT16N6eotdQ==
x-fb-content-md5: 53d7a84bc8147db7549063185be0b4b8
x-frame-options: DENY
date: Thu, 10 Feb 2022 14:57:38 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "3715aff9deaceec4fbbc2ba9a8f2d6a0"
timing-allow-origin: *
priority: u=3,i
expires: Fri, 10 Feb 2023 13:53:39 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 225 B
650 B 50ms
15ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=congratulationsto.com&callback=_gfp_s_&client=ca-pub-8040849356053987

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202010201/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8040849356053987&plah=congratulationsto.com&bust=31064752

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7f2184734b772c2d10380f506506faaf61c97a6bf8f710d403e0b8ea4dbe552e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 206
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 40ms
15ms Script
application/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=congratulationsto.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 10 Feb 2022 14:57:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 51ms
23ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=congratulationsto.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 10 Feb 2022 14:57:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 1893 111 KB
40 KB 536ms
520ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8040849356053987&output=html&h=600&slotname=7717621511&adk=3802710358&adf=1887524271&pi=t.ma~as.7717621511&w=160&lmt=1644505058&url=https%3A%2F%2Fcongratulationsto.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505058170&bpp=17&bdt=808&idt=117&shv=r20220208&mjsv=m202202010201&ptt=5&saldr=sa&abxe=1&correlator=4730654175138&frm=20&pv=2&ga_vid=1975016378.1644505058&ga_sid=1644505058&ga_hid=1525151954&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1129&ady=268&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064752%2C31062930&oid=2&pvsid=1557632711904141&pem=378&tmod=52278239&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=btZ4bifPou&p=https%3A//congratulationsto.com&dtd=137

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a477d26b6b413c3c7a4ec6bd630cd6fd4fd1487ebfb14c17086610f2dde92dc9

Security Headers

Name	Value
Content-Security-Policy	child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CPDs1d6y9fUCFW7DuwgdDzAFpQ&gqi=4icFYtSrFL217_UP-dC5yAI&layout=/sadbundle/%24csp%253Der3%24/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-security-policy: child-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html;frame-src 'unsafe-inline' cm.g.doubleclick.net googleads.g.doubleclick.net www.google.com accounts.google.com pagead2.googlesyndication.com/pagead/s/cookie_push.html gmsg: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html;report-uri https://pagead2.googlesyndication.com/pagead/gen_csp?id=adbundle&qqi=CPDs1d6y9fUCFW7DuwgdDzAFpQ&gqi=4icFYtSrFL217_UP-dC5yAI&layout=/sadbundle/%24csp%253Der3%24/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 10 Feb 2022 14:57:38 GMT
server: cafe
content-length: 41163
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 10 Feb 2022 14:57:38 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame AD6E 22 KB
9 KB 329ms
327ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8040849356053987&output=html&h=90&slotname=9229440319&adk=4232537071&adf=4049373715&pi=t.ma~as.9229440319&w=180&lmt=1644505058&url=https%3A%2F%2Fcongratulationsto.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505058187&bpp=4&bdt=825&idt=141&shv=r20220208&mjsv=m202202010201&ptt=5&saldr=sa&abxe=1&prev_slotnames=7717621511&correlator=4730654175138&frm=20&pv=1&ga_vid=1975016378.1644505058&ga_sid=1644505058&ga_hid=1525151954&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1119&ady=886&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064752%2C31062930&oid=2&pvsid=1557632711904141&pem=378&tmod=52278239&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=5nMI0hYEwR&p=https%3A//congratulationsto.com&dtd=145

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b2b35eb313b63b60654b3a070be26fbb6baf98a46bf8960d6102bc6fbe958e9f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 10 Feb 2022 14:57:38 GMT
server: cafe
content-length: 9552
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 10 Feb 2022 14:57:38 GMT
cache-control: private

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame AFBA 14 KB
7 KB 707ms
707ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1171585364407251&output=html&h=250&slotname=2014106406&adk=2819396792&adf=3296887587&pi=t.ma~as.2014106406&w=300&lmt=1644505058&psa=0&format=300x250&url=https%3A%2F%2Fcongratulationsto.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505058213&bpp=1&bdt=850&idt=125&shv=r20220208&mjsv=m202202010201&ptt=9&saldr=aa&abxe=1&prev_slotnames=7717621511%2C9229440319&correlator=4730654175138&frm=20&pv=2&ga_vid=1975016378.1644505058&ga_sid=1644505058&ga_hid=1525151954&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=296&ady=236&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064752%2C31062930&oid=2&pvsid=1557632711904141&pem=378&tmod=52278239&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=4c4nIPyGIk&p=https%3A//congratulationsto.com&dtd=129

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

678b76569235f9d34ffe2e7ec1ff17a0a393e1e9635849f49a94bfb7138959ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 10 Feb 2022 14:57:39 GMT
server: cafe
content-length: 7496
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 10 Feb 2022 14:57:39 GMT
cache-control: private

GET
H2 200 settings Show response
syndication.twitter.com/ Frame 7F17 232 B
447 B 214ms
196ms Fetch
application/json 104.244.42.200
TWITTER

General

Check archive.org

Show headers Download Go to

Full URL

https://syndication.twitter.com/settings?session_id=112d34220c5e367e030f3b0699ab91a21e21604d

Requested by

Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.4e067713e19d4fff483536ddc4df18b9.html?origin=https%3A%2F%2Fcongratulationsto.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.200 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

726906ee6ce6dfe1b6e35ddad151196c50277e31520de30e916e9cd9affc0ef3

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://platform.twitter.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-response-time: 168
date: Thu, 10 Feb 2022 14:57:38 GMT
content-encoding: gzip
last-modified: Thu, 10 Feb 2022 14:57:38 GMT
server: tsa_o
vary: Origin
strict-transport-security: max-age=631138519
content-type: application/json; charset=utf-8
access-control-allow-origin: https://platform.twitter.com
cache-control: must-revalidate, max-age=600
access-control-allow-credentials: true
x-connection-hash: bea8ef14c92e813e2482925ca48cfbaf899cef0c94aeee2400e30ed8196ca5b4
content-length: 166

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 36ms
21ms XHR
text/plain 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1525151954&t=pageview&_s=1&dl=https%3A%2F%2Fcongratulationsto.com%2F&ul=en-us&de=UTF-8&dt=Congratulations%20quotes%20and%20wishes&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IAhAAAABAAAAAC~&jid=501388664&gjid=1335943364&cid=1975016378.1644505058&tid=UA-39730775-1&_gid=818830409.1644505058&_r=1&_slc=1&z=22722520

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://congratulationsto.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:38 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://congratulationsto.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
295 B 32ms
7ms Image
image/gif 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=756156561090444&ev=fb_page_view&dl=https%3A%2F%2Fcongratulationsto.com%2F&rl=&if=false&ts=1644505058393&sw=1600&sh=1200&at=

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:38 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
content-length: 44
expires: Thu, 10 Feb 2022 14:57:38 GMT

GET
H3 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.G0yl221Lv3A.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCOeO42Ypl4xUcKP-57wrSkEIrYebg/ 150 KB
51 KB 28ms
10ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.G0yl221Lv3A.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCOeO42Ypl4xUcKP-57wrSkEIrYebg/cb=gapi.loaded_0?le=oz

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

24eba652967915088a60ca2e5d1827abe08c344883a55e580834470411a4e65a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 05:06:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 35456
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52422
x-xss-protection: 0
last-modified: Tue, 11 Jan 2022 03:49:34 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding, Origin
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Fri, 10 Feb 2023 05:06:42 GMT

GET
H3 200 cb=gapi.loaded_1 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.G0yl221Lv3A.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCOeO42Ypl4xUcKP-57wrSkEIrYebg/ 96 KB
33 KB 28ms
11ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.G0yl221Lv3A.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCOeO42Ypl4xUcKP-57wrSkEIrYebg/cb=gapi.loaded_1?le=oz

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/plusone.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e6fb0bde857589d88dc88ad98acd403cf6ba29b3f6a1dc1527d1cf746bf5d8b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 09 Feb 2022 11:52:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 97522
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 33932
x-xss-protection: 0
last-modified: Tue, 11 Jan 2022 03:49:34 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding, Origin
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Thu, 09 Feb 2023 11:52:16 GMT

GET
H3 404 fastbutton Show response
apis.google.com/u/0/se/0/_/+1/ Frame 0143 2 KB
2 KB 17ms
8ms Document
text/html 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://apis.google.com/u/0/se/0/_/+1/fastbutton?usegapi=1&origin=https%3A%2F%2Fcongratulationsto.com&url=https%3A%2F%2Fcongratulationsto.com%2F&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.de.G0yl221Lv3A.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCOeO42Ypl4xUcKP-57wrSkEIrYebg%2Fm%3D__features__
Requested by: Host: apis.google.com
URL: https://apis.google.com/js/plusone.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: ac15d1868a55adcea61641c78efbb86feda3a65882f21bfe9fedd7348fb54be8

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/

Response headers

content-type: text/html; charset=UTF-8
referrer-policy: no-referrer
content-length: 1585
date: Thu, 10 Feb 2022 14:57:38 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 einslmedianet.js Show response
contextual.media.net/ 275 KB
92 KB 110ms
110ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/einslmedianet.js?cid=8CU89N2CZ&crid=567182975&size=641x481

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=1&cid=8CU89N2CZ&cpcd=4Gvl7ZRTnRr6pLpbDUzPMQ%3D%3D&crid=311343129&size=300x600&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fcongratulationsto.com%2F&nse=5&vi=1644505057844410026&lw=1&ugd=4&pgid=p01278676877t202202101457&nb=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

de4a94d4132b6c70527d7b5ead8952768b7b993f9c2f14e790b54f982108beda

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

x-mnt-h: 10-9
content-encoding: gzip
server: Apache
etag: "444195d6377c00e61da606e318c77e07"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=300
date: Thu, 10 Feb 2022 14:57:38 GMT
strict-transport-security: max-age=604800
x-mnt-w: 8-18
expires: Thu, 10 Feb 2022 15:02:38 GMT

GET
DATA 200
OK truncated
/ Frame 8ECF 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 8ECF 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 bql.php Show response
lg3.media.net/ Frame 8ECF 15 B
216 B 20ms
19ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?&&vgd_l2type=sca&v=1&gdpr=1&geo=50.13%7C8.67&dlper=25&lper=100&lpid=&tsid=18&q=&prv=&type=&ps=&hint=&td=&cc=DE&wsip=170721296&bca=0&ugd=4&vgd_chost=&vgd_fcic=0&vgde_setid=Nfu&ksu=224&fdkt=456&kwd[]=Awards+and+Recognition&kwt[]=456&kbc[]=235f678aac6607f15d55d88d099c0c83.d2s&kwp[]=1&kid[]=2748657&kbc2[]=1%7C%7Crps_60%3D0.42%7C%7Crps_62%3D0.48%7C%7Crps%3D0.42%7C%7Cps%3D1.271%7C%7Crpc%3D0.14%7C%7Clvl%3D1.00&ktd[]=1416445888233728&kwd[]=Congratulation+Messages&kwt[]=456&kbc[]=235f678aac6607f15d55d88d099c0c83.d2s&kwp[]=2&kid[]=6760161&kbc2[]=1%7C%7Crps_60%3D0.23%7C%7Crps%3D0.23%7C%7Cps%3D1.271%7C%7Crpc%3D0.12%7C%7Clvl%3D1.00&ktd[]=1416445871456512&kwd[]=Sample+Congratulations+Letter&kwt[]=456&kbc[]=235f678aac6607f15d55d88d099c0c83.d2s&kwp[]=3&kid[]=25091785&kbc2[]=1%7C%7Crps_60%3D0.34%7C%7Crps_12%3D0.18%7C%7Crps_62%3D1.06%7C%7Crps%3D0.33%7C%7Cps%3D1.271%7C%7Crpc%3D0.13%7C%7Clvl%3D1.00&ktd[]=290545964613888&kwd[]=Humorous+Marriage+Advice&kwt[]=456&kbc[]=235f678aac6607f15d55d88d099c0c83.d2s&kwp[]=4&kid[]=14481658&kbc2[]=1%7C%7Crps_60%3D0.38%7C%7Crps%3D0.38%7C%7Cps%3D1.271%7C%7Crpc%3D0.03%7C%7Clvl%3D1.00&ktd[]=1416445888233728&kwd[]=Employee+Recognition+Awards&kwt[]=456&kbc[]=235f678aac6607f15d55d88d099c0c83.d2s&kwp[]=5&kid[]=9728213&kbc2[]=1%7C%7Crps_60%3D0.39%7C%7Crps%3D0.38%7C%7Cps%3D1.271%7C%7Crpc%3D1.92%7C%7Clvl%3D1.00&ktd[]=1416445888233728&kwd[]=Thank+You+Note+Wordings&kwt[]=456&kbc[]=235f678aac6607f15d55d88d099c0c83.d2s&kwp[]=6&kid[]=168578845&kbc2[]=1%7C%7Crps_60%3D0.30%7C%7Crps%3D0.30%7C%7Cps%3D1.271%7C%7Crpc%3D0.06%7C%7Clvl%3D1.00&ktd[]=290545981391104&kwd[]=Engagement+Gifts+for+Couple&kwt[]=456&kbc[]=235f678aac6607f15d55d88d099c0c83.d2s&kwp[]=7&kid[]=326729245&kbc2[]=1%7C%7Crps_60%3D0.10%7C%7Crps_62%3D0.14%7C%7Crps%3D0.10%7C%7Cps%3D1.271%7C%7Crpc%3D0.08%7C%7Clvl%3D1.00&ktd[]=290545964613888&kwd[]=Prayer+for+Today&kwt[]=456&kbc[]=235f678aac6607f15d55d88d099c0c83.d2s&kwp[]=8&kid[]=23011113&kbc2[]=1%7C%7Crps_60%3D0.18%7C%7Crps%3D0.18%7C%7Cps%3D1.271%7C%7Crpc%3D0.04%7C%7Clvl%3D1.00&ktd[]=290545964613888&cid=8CU89N2CZ&vwid=1644505057844410026&vi=1644505057844410026&tdAdd[]=ib%3D0&kbbq=asn%3D212238%26&tdAdd[]=asnum%3D212238&vgd_l3_sc=he&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_l2wsip=170721296&vgd_nrrv=64488&vgd_nrrmf=1c80a&vgd_nrrsf=scrr&vgd_cty=frankfurt+am+main&vgd_kalog=SI%3D2266%7C%7CUUID%3D338Sq30k9tC2Ui03q8%7C%7CMPTD%3D656%7C%7CCI%3D2617%7C%7CSID%3D9%7C%7CHID%3D1%7C%7CMI%3D2266%7C%7CTPTD%3D4947852857860&&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&vgd_l1rakh=1644505057148142127&sttm=1644505057945&upk=1644505058.16291&hvsid=00001644505057945023283072008410&verid=9111299&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1&vgd_hbReqId=T1644500322C8S35U948&vgd_isiolc=1&rtbsd=6&katen=1&pc=100&pid=8PON4XI2B&&abpl=2&&vgd_vstrid=DefVid&vgd_optout=0&vgd_cfud=191230&vgd_scsver=130&vgd_icat=476&vgd_spcat=501254&vgd_l2ch=0&vgd_rensize=310_600&vgd_scr_h=1200&vgd_scr_w=1600&vgd_ect=4g&vgd_mbr=1&vgd_pbcm=1&vgd_l1rpth=%2Fnmedianet.js&vgd_pgids=1&&tdAdd[]=uiparams%3D%3Brend_w%3A310%3Brend_h%3A600%3Bwin_w%3A1600%3Bwin_h%3A1200&&vgd_uspa=0&vgd_sc=HE&vgd_l1rhst=contextual.media.net&hvsid=00001644505057945023283072008410&fp=5B90VhwsBdeCeJO0F2b1M1LZPFhO4c7hiW9iT0zUUUrkX1PuAhV7mG5rK6-qgy007h8-rcE0fculTeMD3PYoo66Z5buXZUu2J6kE7MXDJplCpF-6-AGz9qD5N9NgXVX4ZCj2SRdf6dc%3D&cme=CV8r3QhW2_shwdeSBjjo5N7umsaspgQ8lcTMWRUmgcONtRtkDU7fmcK0ONcBqRwIpDt5iMswBbKvgMuDak77bb_BPZp09altvfiQIdmisLEziD04-yK9kYWSDi9sGYf8HuQs0QDzYQzpbA21XlIg33M8ZjuEJMXYsrTPYTx3pvXdYNIY9ndJM-s6AFL5EUYmxCCnlLWiLsYzs9rpVXDRrQ%3D%3D%7C%7CMhSffBRfuCOyCp4u_bjS9Q%3D%3D%7Ct9MPFyjImcVAbj9eBWVByX6u4_rU2c6FM6vH1oKVrPF8Ki5N4_BehUhWxHnTGrp7AKpf0Llfx4GEUZ10IWTnM4z0AL0zrFMeG0QcrE-RhkmZUU30xmrpGpU0EhzGd76UxG6PlgTJDoq5L8MmBikwsPYjXe4bSzXnDe9Zs6-RNAEv4aSm0SWZuzKUX_ePW6lNM4_q-3CHnJ-ROIGxxFUZeTCMSPEje_fgHLXpkPgc9Z0%3D%7CkeodcAZi9ijMeFiT1XLfwA%3D%3D%7Cgax-c-MIckLtv23AqACcDw%3D%3D%7CECZQquDAdXO219s_zvdUcg%3D%3D%7CppNk17S2CV-gaSG0pjtdYg%3D%3D%7CgNTUc7MBYV04UVzmztpDDQ%3D%3D%7Ca0AmFUYXmD635En15IbQ_PhM1oCrfgNXim_JXAAkY88QtPUn_DGZQg%3D%3D%7C&rc=0&rand=1644505058428&tdAdd%5B%5D=rtbsd%253D6&matm=1644505058428&requrl=https%3A%2F%2Fcongratulationsto.com&vgd_x_pos=291&vgd_y_pos=601&vgd_ren_page_h=7907&vgd_ltime=509&vgd_ltimesrc=2&vgd_l1hcsd=N3%7C949&vgd_l1ch=1&vgd_lhl=1147&vgd_pgid=p01278676877t202202101457&vgd_kals=base%7C%7Cpc%3D100%7C%7Cfat%3D2&vgd_kalog=SI%3D2266%7C%7CUUID%3D338Sq30k9tC2Ui03q8%7C%7CMPTD%3D656%7C%7CCI%3D2617%7C%7CSID%3D9%7C%7CHID%3D1%7C%7CMI%3D2266%7C%7CTPTD%3D4947852857860&vgd_sbSup=1&vgd_nrrs=64488&vgd_cntrdt=S%7CDIV&oRurl=adomain%3D%26cb%3Dwindow._mNDetails.initAd%26cc%3DDE%26cid%3D8CU89N2CZ%26cpcd%3D4Gvl7ZRTnRr6pLpbDUzPMQ%253D%253D%26crid%3D311343129%26gdpr%3D1%26https%3D1%26lw%3D1%26matchstring%3D%26nb%3D1%26nse%3D5%26requrl%3Dhttps%253A%252F%252Fcongratulationsto.com%252F%26size%3D300x600%26ugd%3D4%26vif%3D1&vgd_end=1

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Thu, 10 Feb 2022 14:57:38 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Thu, 10 Feb 2022 14:57:38 GMT

GET
H2 200 googlelogo_color_150x54dp.png
www.google.com/images/branding/googlelogo/1x/ Frame 0143 3 KB
4 KB 96ms
52ms Image
image/png 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png

Requested by

Host: apis.google.com
URL: https://apis.google.com/u/0/se/0/_/+1/fastbutton?usegapi=1&origin=https%3A%2F%2Fcongratulationsto.com&url=https%3A%2F%2Fcongratulationsto.com%2F&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.de.G0yl221Lv3A.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCOeO42Ypl4xUcKP-57wrSkEIrYebg%2Fm%3D__features__

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dbef5e5530003b7233e944856c23d1437902a2d3568cdfd2beaf2166e9ca9139

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://apis.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:38 GMT
x-content-type-options: nosniff
last-modified: Tue, 22 Oct 2019 18:30:00 GMT
server: sffe
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: private, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3170
x-xss-protection: 0
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Thu, 10 Feb 2022 14:57:38 GMT

GET
H2 200 postmessageRelay Show response
accounts.google.com/o/oauth2/ Frame D347 566 B
902 B 109ms
37ms Document
text/html 2a00:1450:4001:810::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fcongratulationsto.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.de.G0yl221Lv3A.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCOeO42Ypl4xUcKP-57wrSkEIrYebg%2Fm%3D__features__

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.G0yl221Lv3A.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCOeO42Ypl4xUcKP-57wrSkEIrYebg/cb=gapi.loaded_1?le=oz

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

07e40cf5155714c8260c2e39af4cd641925cfc4ae0b1a17f7ec7b31d84b462e6

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-mEgrhPpl0tBLLT20TRMV8Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport require-trusted-types-for 'script';report-uri /o/cspreport
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/

Response headers

content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Thu, 10 Feb 2022 14:57:38 GMT
content-security-policy: script-src 'report-sample' 'nonce-mEgrhPpl0tBLLT20TRMV8Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport require-trusted-types-for 'script';report-uri /o/cspreport
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1 200
OK button.1c2a6e168692ffea6cc8d4efc5b6f6bc.js Show response
platform.twitter.com/js/ 7 KB
3 KB 27ms
27ms Script
application/javascript 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/js/button.1c2a6e168692ffea6cc8d4efc5b6f6bc.js
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/669E) /
Resource Hash: e4adc260fa5bff268e2359ba73814e154d7e3cd828dd946b8076d6b5129218a3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Thu, 10 Feb 2022 14:57:38 GMT
Content-Encoding: gzip
Age: 157737
X-Cache: HIT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=2
Content-Length: 2293
x-tw-cdn: VZ
Last-Modified: Tue, 01 Feb 2022 19:59:50 GMT
Server: ECS (frb/669E)
Etag: "0fe442c8a1482a5540ef9bb91b588585+gzip"
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET
Content-Type: application/javascript; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=315360000

POST
H3 204 cspreport
accounts.google.com/o/ Frame D347 0
19 B 120ms
54ms Other
text/html 2a00:1450:4001:810::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/cspreport

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-B2E6uCG+hWd2xXg+L9YZpQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fcongratulationsto.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.de.G0yl221Lv3A.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCOeO42Ypl4xUcKP-57wrSkEIrYebg%2Fm%3D__features__
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: application/csp-report

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:38 GMT
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'report-sample' 'nonce-B2E6uCG+hWd2xXg+L9YZpQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 3087399934-postmessagerelay.js Show response
ssl.gstatic.com/accounts/o/ Frame D347 10 KB
5 KB 152ms
40ms Script
text/javascript 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.gstatic.com/accounts/o/3087399934-postmessagerelay.js

Requested by

Host: accounts.google.com
URL: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fcongratulationsto.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.de.G0yl221Lv3A.O%2Fam%3DAQ%2Fd%3D1%2Frs%3DAGLTcCOeO42Ypl4xUcKP-57wrSkEIrYebg%2Fm%3D__features__

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3f95544529bf5a220675a5144deef8a36863d63b94d13b5408341bbd3229691f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 13:06:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6658
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/federated-signon-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4296
x-xss-protection: 0
last-modified: Thu, 03 Feb 2022 17:08:41 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="federated-signon-mpm-access"
vary: Accept-Encoding
report-to: {"group":"federated-signon-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/federated-signon-mpm-access"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 10 Feb 2023 13:06:40 GMT

GET
H3 200 rpc:shindig_random.js Show response
apis.google.com/js/ Frame D347 13 KB
5 KB 104ms
104ms Script
application/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/rpc:shindig_random.js?onload=init

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

3dda4c9622860c4f1489d89d244a685f3d800ab5716947396e09922729de9c70

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-IbMDBQL2itD4vJTXUNuL5Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
cross-origin-opener-policy: same-origin
x-frame-options: SAMEORIGIN
etag: "6e9e69101a0a80410e499229708459b2"
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
content-security-policy: script-src 'report-sample' 'nonce-IbMDBQL2itD4vJTXUNuL5Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin: *
expires: Thu, 10 Feb 2022 14:57:38 GMT

GET
H/1.1 200
OK follow_button.4e067713e19d4fff483536ddc4df18b9.en.html Show response
platform.twitter.com/widgets/ Frame D0C4 36 KB
14 KB 39ms
39ms Document
text/html 2606:2800:234:46c:e8b:1e2f:2bd:694
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://platform.twitter.com/widgets/follow_button.4e067713e19d4fff483536ddc4df18b9.en.html
Requested by: Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (frb/669E) /
Resource Hash: d8e845c4e0ddaf71ae4255f8ba7e005e7d21177daec307afffcc48b688c793c9

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/

Response headers

Content-Encoding: gzip
Access-Control-Allow-Methods: GET
Access-Control-Allow-Origin: *
Age: 157731
Cache-Control: public, max-age=315360000
Content-Type: text/html; charset=utf-8
Date: Thu, 10 Feb 2022 14:57:38 GMT
Etag: "68d3a5c309935076804e1c738562cfc1+gzip"
Last-Modified: Tue, 01 Feb 2022 19:59:53 GMT
P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server: ECS (frb/669E)
Server-Timing: "x-cache;desc= HIT,x-tw-cdn;desc=VZ",edge;dur=1
Vary: Accept-Encoding
X-Cache: HIT
x-tw-cdn: VZ
Content-Length: 13629

GET
H2 200 smtr Show response
contextual.media.net/ 93 KB
33 KB 504ms
504ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://contextual.media.net/smtr?cb=window._mNDetails.initAd&&gdpr=1&cid=8CU89N2CZ&cpcd=4Gvl7ZRTnRr6pLpbDUzPMQ%3D%3D&crid=567182975&size=641x481&cc=DE&https=1&vif=1&requrl=https%3A%2F%2Fcongratulationsto.com%2F&nse=5&vi=1644505058971659179&lw=1&ugd=4&pgid=p01278676877t202202101457&insl=1&exitinsl=1&nb=1

Requested by

Host: contextual.media.net
URL: https://contextual.media.net/nmedianet.js?cid=8CU89N2CZ

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Resource Hash

af3d8efd1d8e46cd6ff1d5afbbf9ae2ef81b663fd38d06e607bb11dba3b0d61b

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:39 GMT
content-encoding: gzip
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=0, no-cache, no-store
strict-transport-security: max-age=604800
content-length: 33923
expires: Thu, 10 Feb 2022 14:57:39 GMT

GET
H2 200 bping.php
lg3.media.net/ 35 B
189 B 62ms
62ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bping.php?&gdpr=1&prid=8PRHGG6T9&cid=8CU89N2CZ&crid=567182975&vi=1644505058971659179&ugd=4&lf=6&cc=DE&sc=HE&insl=1&wsip=2886781335&r=1644505058673&requrl=https%3A%2F%2Fcongratulationsto.com%2F&vgd_l2type=sca&vgd_sbSup=1&vgd_is_amp=0&vgd_asn=212238&vgd_rakh=1644505058151727207&vgd_l1rhst=contextual.media.net&vgd_rpth=%2Feinslmedianet.js&vgd_pbcm=1&vgd_pgid=p01278676877t202202101457&vgd_pgids=2&vgd_uspa=0&hvsid=00001644505058663023283072007869&gdpr=1&vgd_end=1

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

0915fad60bc9b61b6dcd82d05da7ec4bc0232a647e75b8507c3cba6d4d6602f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Thu, 10 Feb 2022 14:57:38 GMT
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Thu, 10 Feb 2022 14:57:38 GMT

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame AD6E 2 KB
1 KB 142ms
52ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8040849356053987&output=html&h=90&slotname=9229440319&adk=4232537071&adf=4049373715&pi=t.ma~as.9229440319&w=180&lmt=1644505058&url=https%3A%2F%2Fcongratulationsto.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505058187&bpp=4&bdt=825&idt=141&shv=r20220208&mjsv=m202202010201&ptt=5&saldr=sa&abxe=1&prev_slotnames=7717621511&correlator=4730654175138&frm=20&pv=1&ga_vid=1975016378.1644505058&ga_sid=1644505058&ga_hid=1525151954&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1119&ady=886&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064752%2C31062930&oid=2&pvsid=1557632711904141&pem=378&tmod=52278239&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=5nMI0hYEwR&p=https%3A//congratulationsto.com&dtd=145

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:36:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1239
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 14:36:59 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AD6E 124 KB
38 KB 156ms
60ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 10 Feb 2022 14:57:38 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame AD6E 15 KB
7 KB 136ms
46ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:49:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 494
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 17798303060702513824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 14:49:24 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame AD6E 0
0 121ms
121ms Fetch
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C-MMS4icFYp7bFrTC7_UPvMitkAzJntKxXJXJlPdwwI23ARABIABglYKAgKwHggEXY2EtcHViLTgwNDA4NDkzNTYwNTM5ODegAdW20uoDyAEJqQLxtEcRny-zPqgDAaoExgFP0AvsEu5_kADyrgOLW45dSag4OnIVcOd0aUP9ChRuMpfM8GM4vJF7Kuq8hdC7BSkEXcdqzqXLEYbeMhJEJIYE3PrGkNkER7tRGpQGDXkzWS_kDJ8i3QfP25EjSsn6eh6Ak17e80OHMeIhaSsB7ARzsO9C5n63mavxN7gxQaU2KAnzts3cRLRC07enJFvuRFX7covjZfsqM-BF7GW-S1aKMF2HKt0dOrzpzL5f5HsVhOeeRTw3oCRdpWoKN2C9DOsOU18sS-SABv78vI71gtPqygGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAYAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi04MDQwODQ5MzU2MDUzOTg3GAA&sigh=vtJEY0WdRco&uach_m=[UACH]&cid=CAQSGwCNIrLM90I3JiivXb71Unz7C2LIegQnJt9D4hgB

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8040849356053987&output=html&h=90&slotname=9229440319&adk=4232537071&adf=4049373715&pi=t.ma~as.9229440319&w=180&lmt=1644505058&url=https%3A%2F%2Fcongratulationsto.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505058187&bpp=4&bdt=825&idt=141&shv=r20220208&mjsv=m202202010201&ptt=5&saldr=sa&abxe=1&prev_slotnames=7717621511&correlator=4730654175138&frm=20&pv=1&ga_vid=1975016378.1644505058&ga_sid=1644505058&ga_hid=1525151954&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1119&ady=886&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064752%2C31062930&oid=2&pvsid=1557632711904141&pem=378&tmod=52278239&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=a!2&fsb=1&xpc=5nMI0hYEwR&p=https%3A//congratulationsto.com&dtd=145
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 10 Feb 2022 14:57:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Thu, 10 Feb 2022 14:57:38 GMT

GET
H2 200 notify
rtb.nl.eu.criteo.com/google/auction/ Frame AD6E 0
0 160ms
59ms Fetch 2a02:2638:1::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.nl.eu.criteo.com/google/auction/notify?profile=14&payload=UPLXEcz6RLQBWp2DYgICAAAAhkKFbQ2eV9AQ4ScFYi3E0VCkKeafgcyFABI&wp=YgUn4gAFrZ4Iu-E0AAtkPKoc2UCnhMUd7u4EnQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:38 GMT
server: Kestrel
server-processing-duration-in-ticks: 285189
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 0121 127 KB
44 KB 283ms
115ms Document
text/html 2a02:2638::18
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=YgUn4gAFrZ4Iu-E0AAtkPKoc2UCnhMUd7u4EnQ&u=%7Ckkeq91YCGeJN1qfPrfSZWO9L%2FwVAFZAtkI628a87fj4%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpNfsuV4bKOZdAmUMUGYJxPB6k5G0_ZmFC-PMZBeqyvRTf4_qjiL7vX52ikYFOKfQpYciUm97IaxCoAYrDNyCyYnbTg7zT15dA5ElBL1NsfqgUQrrHg-O1pJTw-vcekCW5Cu5I1rTqt1X55wGrCmg8VGRtnwjqYfgDjXpzrGw0b1fKjrXTrbMklVbveyTVN8rT31I6lKUbE7ErLXfpQGJIC0iI30q7JTCk4GXBbO5hu4HcxCYI97NZQaV5IDF1luDQdFCFe06jwU5DLU_KxctIRE17i-PQ8CDGy7ZoxGYuytPBdPcrfTfNcRvACuKU3Me5XucmUtUCWH90ntyS4ZjwmmCnsBW_JRWSttaSIFJ1phiyHtL-6YeyrJcLC-CcPnckCQV2KZpD3lxMQIMpQJp5R0kISnTPZDifY&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCcJNs4icFYp7bFrTC7_UPvMitkAzJntKxXJXJlPdwwI23ARABIABglYKAgKwHggEXY2EtcHViLTgwNDA4NDkzNTYwNTM5ODegAdW20uoDyAEJqQLxtEcRny-zPqgDAaoEyQFP0AvsEu5_kADyrgOLW45dSag4OnIVcOd0aUP9ChRuMpfM8GM4vJF7Kuq8hdC7BSkEXcdqzqXLEYbeMhJEJIYE3PrGkNkER7tRGpQGDXkzWS_kDJ8i3QfP25EjSsn6eh6Ak17e80OHMeIhaSsB7ARzsO9C5n63mavxN7gxQaU2KAnzts3cRLRC07enJFvuRFX7covjZfsqM-BF7GW-S1aKcl-muFqSpq9WUKr8NEazfO6KT4o9jjzfEaI3kZICEscW1vWoWFs-vXmABv78vI71gtPqygGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0C-HXMgwg-_CvtnFjmtxtnltKE0w%26client%3Dca-pub-8040849356053987%26adurl%3D

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::18 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

abe10669d20ddeef91ac12c3f0507cf32a28f181b145e33a6f23cf66d36e5fc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

date: Thu, 10 Feb 2022 14:57:38 GMT
content-type: text/html
server: Kestrel
cache-control: private, max-age=0, no-cache
pragma: no-cache
expires: Mon, 26 Jul 1997 05:00:00 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cross-origin-resource-policy: cross-origin
p3p: CP='CUR ADM OUR NOR STA NID'
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=YMuqNedHAg6fMCS_9Dc2HT5mDzXKOf--loebpDPhHT9sH-a2y8TlJh4MbjhPqO_mVVKx7CdTgEnJH7skCA67txj-Cmt1fy56CgrduVJy22FYh3N5KhswuipDz4RMWdDaby9ULYpwJ2vJLZjO0Kv9ZE_Ao4w46oQrTSUhm5o7dltVNpfc-KzOfmui5-dwu0CoLeWOxKsvLA8V0By6X5v5yvXhu7vF2-sPO3kdhZOHxmAfucF2Mlk621TUj7gZHf5c0EEIdw"}], "max_age": 86400}
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
server-processing-duration-in-ticks: 71804874
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame D0C4 822 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET blank
/ Frame AE22 0
0

GET
DATA 200
OK truncated
/ Frame AE22 4 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 326c32d7ffbd04762a10cf5bb37441d418397959381d3893c9e9a48217aa5347

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame AE22 2 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b00af338864761a37a208806e2e8815b46327a5e7e47bf141f4fbdf6d1fd3bcc

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 bql.php Show response
lg3.media.net/ Frame AE22 15 B
216 B 63ms
62ms Script
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://lg3.media.net/bql.php?&&vgd_l2type=sca&v=1&gdpr=1&geo=50.13%7C8.67&dlper=25&lper=100&lpid=&tsid=7&q=&prv=&type=&ps=&hint=&td=&cc=DE&wsip=170785125&bca=0&ugd=4&vgd_chost=&vgd_fcic=0&vgde_setid=Nff&ksu=224&fdkt=456&kwd[]=Awards+and+Recognition&kwt[]=456&kbc[]=235f678aac6607f15d55d88d099c0c83.d2s&kwp[]=1&kid[]=2748657&kbc2[]=1%7C%7Co_r%3D0.21%7C%7Cp_r%3D0.50%7C%7Cl_r%3D40%7C%7Cc%3D1401%7C%7Cps%3D1.436%7C%7Crpc%3D0.14%7C%7Clvl%3D1.00&ktd[]=1416445888234240&kwd[]=Congratulation+Messages&kwt[]=456&kbc[]=235f678aac6607f15d55d88d099c0c83.d2s&kwp[]=2&kid[]=6760161&kbc2[]=1%7C%7Co_r%3D0.22%7C%7Cp_r%3D0.12%7C%7Cl_r%3D150%7C%7Cc%3D200%7C%7Cps%3D1.436%7C%7Crpc%3D0.12%7C%7Clvl%3D1.00&ktd[]=1416445871457024&kwd[]=Wedding+Day+Wishes&kwt[]=201&kbc[]=235f678aac6607f15d55d88d099c0c83.d2s&kwp[]=3&kid[]=30541095&kbc2[]=o_r%3D0.33%7C%7Cp_r%3D0.16%7C%7Cl_r%3D150%7C%7Cc%3D-871%7C%7Crpc%3D0.05%7C%7Clvl%3D1.00&ktd[]=1126174801527296&kwd[]=Humorous+Marriage+Advice&kwt[]=456&kbc[]=235f678aac6607f15d55d88d099c0c83.d2s&kwp[]=4&kid[]=14481658&kbc2[]=1%7C%7Co_r%3DNaN%7C%7Cp_r%3D0.00%7C%7Cl_r%3D58%7C%7Cc%3D-871%7C%7Cps%3D1.436%7C%7Crpc%3D0.03%7C%7Clvl%3D1.00&ktd[]=1416445888234240&kwd[]=Employee+Recognition+Awards&kwt[]=456&kbc[]=235f678aac6607f15d55d88d099c0c83.d2s&kwp[]=5&kid[]=9728213&kbc2[]=1%7C%7Co_r%3D0.33%7C%7Cp_r%3D0.12%7C%7Cl_r%3D150%7C%7Cc%3D-871%7C%7Cps%3D1.436%7C%7Crpc%3D1.92%7C%7Clvl%3D1.00&ktd[]=1416445888234240&cid=8CU89N2CZ&vwid=1644505057793382778&vi=1644505057793382778&tdAdd[]=ib%3D0&kbbq=asn%3D212238%26&tdAdd[]=asnum%3D212238&vgd_l3_sc=he&vgd_katbid=-2&vgd_altbql=sb&vgd_pdtid=1&vgd_implt=3&vgd_l2wsip=170785125&vgd_nrrv=64488&vgd_nrrmf=1c80a&vgd_nrrsf=scrr&vgd_cty=frankfurt+am+main&vgd_kalog=UUID%3D4uKyUKW7JswJGKz8YQ%7C%7CTPTD%3D549806281220%7C%7CCI%3D2619%7C%7CSI%3D2617%7C%7CSID%3D13%7C%7CHID%3D7%7C%7CMPTD%3D720%7C%7CMI%3D2619&&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&vgd_ifrmode=00&vgd_l1rakh=1644505057148142127&sttm=1644505057990&upk=1644505058.16291&hvsid=00001644505057990023283072005283&verid=3111299&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1&vgd_hbReqId=T1644500322C8S35U948&vgd_isiolc=1&npgv=1&rtbsd=6&pid=8PON4XI2B&&abpl=2&&vgd_vstrid=DefVid&vgd_optout=0&vgd_cfud=191218&vgd_scsver=130&vgd_icat=476&vgd_spcat=501254&vgd_l2ch=0&vgd_rensize=478_280&vgd_scr_h=1200&vgd_scr_w=1600&vgd_ect=4g&vgd_mbr=1&vgd_pbcm=1&vgd_l1rpth=%2Fnmedianet.js&vgd_pgids=2&&tdAdd[]=uiparams%3D%3Brend_w%3A478%3Brend_h%3A280%3Bwin_w%3A1600%3Bwin_h%3A1200&&vgd_uspa=0&vgd_sc=HE&vgd_l1rhst=contextual.media.net&hvsid=00001644505057990023283072005283&fp=5B90VhwsBdeCeJO0F2b1M1LZPFhO4c7hiW9iT0zUUUrkX1PuAhV7mG5rK6-qgy007h8-rcE0fcut-Trq_UUfggmEMosXaNHffcWLR64DLiMwiblyq1zLI0f9liYpipPx02X5aH3ZsAU%3D&cme=c54SEUsxKbGfqpKqu5dzyXvVIG7yVnhl6wfjx4BX0wla2HD64GWbiHO5AygJCOHZBc-R0WEolCGgyl29VOIPXnPx8wD8_nmEppwvqapk5YqRgMdEtuDm-GfDEUFn1FUUG5Emo-mf6gHsmNOkggcdbu9_5BXp6M780YnWfHu4COI24U6f4SYdSnbFJHvms6Gf5NEs3oUBEPeWqaFB5wzc08620QxAd9SO%7C%7CMhSffBRfuCOyCp4u_bjS9Q%3D%3D%7CFuVy7WYwuANKgJcvTM7hjPoUxB7KE4xKbguhmyadOsZHJQlxyi-27c7K8nHHNkE_KCjPeoVR96m_4fDOJ1xXZoAQTd_3KggXbKXIi5U1naZnSfXVDCgniK9DjNUpWnJqiG7kkL4dHHunrQD8CiIu4XxpeLuumSHrG4igol992kboq-CIz9OyfQDJ6u_hfsdiWguZY_y71GMkInSxqs3YUS2Mp_v6ns_I1SAo9OEVo9w%3D%7CkeodcAZi9ijMeFiT1XLfwA%3D%3D%7Cgax-c-MIckLtv23AqACcDw%3D%3D%7CECZQquDAdXO219s_zvdUcg%3D%3D%7CppNk17S2CV-gaSG0pjtdYg%3D%3D%7CgNTUc7MBYV04UVzmztpDDQ%3D%3D%7Ca0AmFUYXmD635En15IbQ_PhM1oCrfgNXim_JXAAkY88QtPUn_DGZQg%3D%3D%7C&rc=0&rand=1644505058747&tdAdd%5B%5D=rtbsd%253D6&matm=1644505058747&requrl=https%3A%2F%2Fcongratulationsto.com&vgd_x_pos=616&vgd_y_pos=2576&vgd_ren_page_h=8190&vgd_ltime=777&vgd_ltimesrc=2&vgd_l1hcsd=N3%7C949&vgd_l1ch=1&vgd_lhl=1058&vgd_pgid=p01278676877t202202101457&vgd_kalog=UUID%3D4uKyUKW7JswJGKz8YQ%7C%7CTPTD%3D549806281220%7C%7CCI%3D2619%7C%7CSI%3D2617%7C%7CSID%3D13%7C%7CHID%3D7%7C%7CMPTD%3D720%7C%7CMI%3D2619&vgd_sbSup=1&vgd_nrrs=64488&vgd_cntrdt=S%7CSECTION-content&oRurl=adomain%3D%26cb%3Dwindow._mNDetails.initAd%26cc%3DDE%26cid%3D8CU89N2CZ%26cpcd%3D4Gvl7ZRTnRr6pLpbDUzPMQ%253D%253D%26crid%3D142533074%26gdpr%3D1%26https%3D1%26lw%3D1%26matchstring%3D%26nb%3D1%26nse%3D5%26requrl%3Dhttps%253A%252F%252Fcongratulationsto.com%252F%26size%3D336x280%26ugd%3D4%26vif%3D1&vgd_end=1

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

c787e9dd6dc8ea3c935f5f0f30e3b9e4a3e066b4619bb244f569883f8e318a24

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Thu, 10 Feb 2022 14:57:38 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Thu, 10 Feb 2022 14:57:38 GMT

GET
H3 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.G0yl221Lv3A.O/m=rpc,shindig_random/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCOeO42Ypl4xUcKP-57wrSkEIrYebg/ Frame D347 54 KB
19 KB 48ms
48ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.de.G0yl221Lv3A.O/m=rpc,shindig_random/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCOeO42Ypl4xUcKP-57wrSkEIrYebg/cb=gapi.loaded_0?le=oz

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/rpc:shindig_random.js?onload=init

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fc388c7f751a00dbcccd3433298a647a8997df4a95dd36938b28f5211b7f75b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:22:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2089
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19352
x-xss-protection: 0
last-modified: Tue, 11 Jan 2022 03:49:34 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="social-frontend-mpm-access"
vary: Accept-Encoding, Origin
report-to: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]}
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Fri, 10 Feb 2023 14:22:49 GMT

GET
H3 200 cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/ Frame EB3B 5 KB
2 KB 106ms
39ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8040849356053987&output=html&h=600&slotname=7717621511&adk=3802710358&adf=1887524271&pi=t.ma~as.7717621511&w=160&lmt=1644505058&url=https%3A%2F%2Fcongratulationsto.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505058170&bpp=17&bdt=808&idt=117&shv=r20220208&mjsv=m202202010201&ptt=5&saldr=sa&abxe=1&correlator=4730654175138&frm=20&pv=2&ga_vid=1975016378.1644505058&ga_sid=1644505058&ga_hid=1525151954&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1129&ady=268&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064752%2C31062930&oid=2&pvsid=1557632711904141&pem=378&tmod=52278239&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=btZ4bifPou&p=https%3A//congratulationsto.com&dtd=137

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

87304f1b062f87dc933400b4fa334f48b9134561b1af5ab57bedca283cc22861

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
access-control-allow-origin: *
content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
timing-allow-origin: *
content-length: 1755
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Tue, 08 Feb 2022 03:31:05 GMT
expires: Wed, 08 Feb 2023 03:31:05 GMT
cache-control: public, max-age=31536000
last-modified: Wed, 02 Feb 2022 16:41:56 GMT
content-type: text/html
age: 213993
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 1893 0
0 106ms
104ms Fetch
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C7N3U4icFYvDzFO6G7_UPj-CUqArJtpySaK3E4dSgD9rZHhABIOaz3x9glYKAgKwHoAHHxOz3A8gBCagDAcgDSKoE1gFP0MpAVttPzywMJNLSgWWiuGnnBrp0_EoJlRyTxt6AjMQjBUS2VTRLsWzaU9zd23YFA26gNBTC6c0XOPX4gG75w0MmqWreTukRneWdRepgq99ihBOiBf6M3wjVg7-w0WnPIyCwKU6Jr6LgyE28s3YFWL2XkDJ2p1EmfbhkCht04uKeQS1l0bTiqdvtMbUcuUGjju-N_En71_VFTwoO6xjPLuPlQYbRzDf3Uz5ooiHIl4L_E_TKcnFzBPygSekLbvyNqCoCrWeKMFMFemqCrtCHQTl9fbJBwASO7ILfvQOSBQQIBBgBkgUECAUYBKAGLoAHsfq13QGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHBBD60wPSCAkIgOGAEBABGB-ACgHICwHYEwKIFAHQFQGAFwGyFxwKGggAEhRwdWItODA0MDg0OTM1NjA1Mzk4NxgA&sigh=pQTgRjQYr8E&uach_m=[UACH]&template_id=419

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8040849356053987&output=html&h=600&slotname=7717621511&adk=3802710358&adf=1887524271&pi=t.ma~as.7717621511&w=160&lmt=1644505058&url=https%3A%2F%2Fcongratulationsto.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505058170&bpp=17&bdt=808&idt=117&shv=r20220208&mjsv=m202202010201&ptt=5&saldr=sa&abxe=1&correlator=4730654175138&frm=20&pv=2&ga_vid=1975016378.1644505058&ga_sid=1644505058&ga_hid=1525151954&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1129&ady=268&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064752%2C31062930&oid=2&pvsid=1557632711904141&pem=378&tmod=52278239&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=btZ4bifPou&p=https%3A//congratulationsto.com&dtd=137
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 10 Feb 2022 14:57:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/ Frame 1893 19 KB
8 KB 103ms
40ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a22b29e11f6ad3ed458e71525b4edfaf0b9ab4cd962ae9a239b9509c106c826

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:42:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 920
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7817
x-xss-protection: 0
server: cafe
etag: 7051432691878289762
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 14:42:18 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame 1893 2 KB
1 KB 113ms
51ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:41:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 971
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 14:41:27 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1893 124 KB
38 KB 110ms
48ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 10 Feb 2022 14:57:38 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame 1893 15 KB
6 KB 97ms
36ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:53:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 266
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 17798303060702513824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 14:53:12 GMT

GET
H2 200 jot
syndication.twitter.com/i/ 43 B
335 B 223ms
223ms Image
image/gif 104.244.42.200
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://syndication.twitter.com/i/jot?dnt=1&l=%7B%22widget_origin%22%3A%22https%3A%2F%2Fcongratulationsto.com%2F%22%2C%22widget_frame%22%3Afalse%2C%22language%22%3A%22en%22%2C%22message%22%3A%22l%3Awithcount%3A%22%2C%22_category_%22%3A%22tfw_client_event%22%2C%22triggered_on%22%3A1644505058876%2C%22dnt%22%3Atrue%2C%22client_version%22%3A%220a8eea3%3A1643743420422%22%2C%22format_version%22%3A1%2C%22event_namespace%22%3A%7B%22client%22%3A%22tfw%22%2C%22page%22%3A%22button%22%2C%22section%22%3A%22follow%22%2C%22action%22%3A%22impression%22%7D%7D

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.200 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
status: 200 OK
x-twitter-response-tags: BouncerCompliant
content-length: 65
x-xss-protection: 0
x-response-time: 174
pragma: no-cache
last-modified: Thu, 10 Feb 2022 14:57:38 GMT
server: tsa_o
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
x-connection-hash: bea8ef14c92e813e2482925ca48cfbaf899cef0c94aeee2400e30ed8196ca5b4
x-transaction: 6ab4d1e3af280547
expires: Tue, 31 Mar 1981 05:00:00 GMT

GET
DATA 200
OK truncated
/ Frame AD6E 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d91861c4d954aa0d73cb9aec0e71f204b57cb076bc2f728123836df9ee75db84

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 356C 143 B
163 B 45ms
44ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8040849356053987&output=html&h=600&slotname=7717621511&adk=3802710358&adf=1887524271&pi=t.ma~as.7717621511&w=160&lmt=1644505058&url=https%3A%2F%2Fcongratulationsto.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505058170&bpp=17&bdt=808&idt=117&shv=r20220208&mjsv=m202202010201&ptt=5&saldr=sa&abxe=1&correlator=4730654175138&frm=20&pv=2&ga_vid=1975016378.1644505058&ga_sid=1644505058&ga_hid=1525151954&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1129&ady=268&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064752%2C31062930&oid=2&pvsid=1557632711904141&pem=378&tmod=52278239&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=1&uci=a!1&fsb=1&xpc=btZ4bifPou&p=https%3A//congratulationsto.com&dtd=137

Response headers

x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 145
x-xss-protection: 0
date: Thu, 10 Feb 2022 14:04:52 GMT
cache-control: public, max-age=3600
content-type: text/html; charset=UTF-8
age: 3167
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 exitapi-impl.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/api/ Frame EB3B 9 KB
3 KB 52ms
51ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/api/exitapi-impl.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d661244532ddce6a92fb96fde511e23ea4de69ff2e41a5bffb884caa71166e01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 13:42:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4489
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3271
x-xss-protection: 0
server: cafe
etag: 7483759447172721109
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 11 Feb 2022 13:42:50 GMT

GET
H3 200 addata.js Show response
tpc.googlesyndication.com/pagead/gadgets/html5/ Frame EB3B 26 KB
10 KB 53ms
52ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

54a66c4693bfd79901040269ae7d7304508cbd02859797a1780f2bbe72176e23

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:22:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2133
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10382
x-xss-protection: 0
server: cafe
etag: 12806417668659483808
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=86400
timing-allow-origin: *
expires: Fri, 11 Feb 2022 14:22:06 GMT

GET
H3 200 cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.css
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/ Frame EB3B 9 KB
2 KB 52ms
51ms Stylesheet
text/css 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.css

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3466a174f93e7899b690203f3fdb8b68ad714dc74506e41a4ec657ebb4c36d7

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 538263
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1563
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 16:41:56 GMT
server: sffe
date: Fri, 04 Feb 2022 09:26:36 GMT
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 04 Feb 2023 09:26:36 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame EB3B 8 KB
1 KB 167ms
60ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:300,400,700,900

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

348911bf910507c101d13d5c936cd42532b3c87a95bf4b21e3e5525750405cc2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 10 Feb 2022 13:44:12 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 10 Feb 2022 14:57:39 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 10 Feb 2022 14:57:39 GMT

GET
H3 200 cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_f1_bg_160x600.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/ Frame EB3B 12 KB
12 KB 27ms
27ms Image
image/jpeg 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_f1_bg_160x600.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

890df7dd3a94ee7f9a7b8153f66b7cfce728403cc484a1933a033abb5513810a

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 203952
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12333
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 16:41:56 GMT
server: sffe
date: Tue, 08 Feb 2022 06:18:27 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 08 Feb 2023 06:18:27 GMT

GET
H3 200 cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_dell_tec_160x600.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/ Frame EB3B 1 KB
1 KB 41ms
40ms Image
image/png 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_dell_tec_160x600.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

151981f0e21309c4853f88eb7b578d5eb9bbcd381ae6b5e708dc6a413e80dcaa

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 538097
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1212
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 16:41:56 GMT
server: sffe
date: Fri, 04 Feb 2022 09:29:22 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sat, 04 Feb 2023 09:29:22 GMT

GET
H3 200 cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_logo_160x600.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/ Frame EB3B 6 KB
6 KB 28ms
27ms Image
image/png 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_logo_160x600.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

826055e323d73f127d0c9e8e6e07f3e0489117f9ffeeaf4c1e3a820677f25e37

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 203862
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6259
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 16:41:56 GMT
server: sffe
date: Tue, 08 Feb 2022 06:19:57 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 08 Feb 2023 06:19:57 GMT

GET
H3 200 cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_bg2_160x600.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/ Frame EB3B 18 KB
18 KB 41ms
37ms Image
image/jpeg 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_bg2_160x600.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cb5a8b2c38ea5aebcedc7aff2bf8fca0d6a67a6169e5ca7c4fa99824a16c903f

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 114945
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18440
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 16:41:56 GMT
server: sffe
date: Wed, 09 Feb 2022 07:01:54 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 09 Feb 2023 07:01:54 GMT

GET
H3 200 cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_bg_160x600.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/ Frame EB3B 16 KB
16 KB 53ms
47ms Image
image/jpeg 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_bg_160x600.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

293150ebe58c1058c0fafc1a979de3ac16e6c4ce304ce720bdd69c1cc0ec76be

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 75711
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16266
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 16:41:56 GMT
server: sffe
date: Wed, 09 Feb 2022 17:55:48 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 09 Feb 2023 17:55:48 GMT

GET
H3 200 cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_product_f3_160x600.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/ Frame EB3B 31 KB
31 KB 61ms
57ms Image
image/png 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_product_f3_160x600.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

23119530e59accb0c64ce3e5bf51d25f7a8502bd8d0ada3d2dc1aad2c78fe02d

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 57332
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31986
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 16:41:56 GMT
server: sffe
date: Wed, 09 Feb 2022 23:02:07 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 09 Feb 2023 23:02:07 GMT

GET
H3 200 cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_bg4_160x600.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/ Frame EB3B 5 KB
5 KB 69ms
65ms Image
image/jpeg 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_bg4_160x600.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e011a766a4b05ba960dc669de58bda521b9eb13274d16e8686e110cf25c84fa0

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 170856
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5469
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 16:41:56 GMT
server: sffe
date: Tue, 08 Feb 2022 15:30:03 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 08 Feb 2023 15:30:03 GMT

GET
H3 200 cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_product_f4_160x600.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/ Frame EB3B 7 KB
8 KB 70ms
67ms Image
image/png 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_product_f4_160x600.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

49f406106db407e19b4039973ec1581b277601e78d647c7b0806d31a2a8cfcca

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 172172
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7678
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 16:41:56 GMT
server: sffe
date: Tue, 08 Feb 2022 15:08:07 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 08 Feb 2023 15:08:07 GMT

GET
H3 200 cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_bg-last_160x600.jpg
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/ Frame EB3B 8 KB
8 KB 72ms
68ms Image
image/jpeg 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_bg-last_160x600.jpg

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e64c3a6ed3eccd8a2526c3c5b26fee441aabdfc0bc6962c795edc23422dd9c0

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 204582
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8602
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 16:41:56 GMT
server: sffe
date: Tue, 08 Feb 2022 06:07:57 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 08 Feb 2023 06:07:57 GMT

GET
H3 200 cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_product_f5_160x600.png
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/ Frame EB3B 7 KB
8 KB 77ms
74ms Image
image/png 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_product_f5_160x600.png

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

47124aa1bf590a57e6f1fd6220a538477a3fb5d069d59178cc93f36307db1775

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
x-content-type-options: nosniff
age: 97374
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7664
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 16:41:56 GMT
server: sffe
date: Wed, 09 Feb 2022 11:54:45 GMT
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 09 Feb 2023 11:54:45 GMT

GET
H2 200 tweenmax_1.18.0_499ba64a23378545748ff12d372e59e9_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame EB3B 105 KB
36 KB 140ms
30ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/tweenmax_1.18.0_499ba64a23378545748ff12d372e59e9_min.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

001acbb15d9c69510c0817e6dde361bff098406fad182ab3c367f86ff3da8343

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35824
x-xss-protection: 0
last-modified: Fri, 09 Oct 2015 14:01:28 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 10 Feb 2022 14:57:39 GMT

GET
H3 200 cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.js Show response
tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/ Frame EB3B 3 KB
799 B 27ms
27ms Script
application/x-javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sadbundle/$csp%3Der3$/18439775809636229466/cs2101g0017_005_603316_de_cs_sb_fy23q1_oa_btr_prospecting_msft_160x600.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a040d7dba1d1d02efb1e8057dd3af867ac2f0037520e1310fb7ad5dd15fd5661

Security Headers

Name	Value
Content-Security-Policy	default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://.ggpht.com https://.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

content-security-policy: default-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; script-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://s0.2mdn.net/ads/studio/cached_libs/ https://storage.googleapis.com/vr-assets-static/test_ads/GMAPlayable/ https://www.gstatic.com/ads/ci/ https://www.gstatic.com/swiffy/; object-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com; style-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com 'unsafe-eval' 'unsafe-inline' https://ajax.googleapis.com/ajax/ https://fonts.googleapis.com; img-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com blob: data: https://*.ggpht.com https://*.gstatic.cn https://*.gstatic.com https://ajax.googleapis.com/ajax/ https://lh3.googleusercontent.com https://lh4.googleusercontent.com https://lh5.googleusercontent.com https://lh6.googleusercontent.com https://s0.2mdn.net/ads/studio/cached_libs/ https://static.doubleclick.net https://vr.google.com/shaders/w/techspecs/; media-src 'none'; frame-src 'unsafe-inline' javascript:; font-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com data: https://fonts.gstatic.com; connect-src https://tpc.googlesyndication.com https://pagead2.googlesyndication.com https://csi.gstatic.com/csi https://fonts.googleapis.com/css https://fonts.googleapis.com/css2 https://vr.google.com/shaders/w/techspecs/; report-uri /pagead/gen_csp?id=adbundle; child-src 'unsafe-inline' javascript:; form-action 'none'
content-encoding: gzip
x-content-type-options: nosniff
age: 171340
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 769
x-xss-protection: 0
last-modified: Wed, 02 Feb 2022 16:41:56 GMT
server: sffe
date: Tue, 08 Feb 2022 15:21:59 GMT
vary: Accept-Encoding
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 08 Feb 2023 15:21:59 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 0121 2 KB
1 KB 167ms
58ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YgUn4gAFrZ4Iu-E0AAtkPKoc2UCnhMUd7u4EnQ&u=%7Ckkeq91YCGeJN1qfPrfSZWO9L%2FwVAFZAtkI628a87fj4%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpNfsuV4bKOZdAmUMUGYJxPB6k5G0_ZmFC-PMZBeqyvRTf4_qjiL7vX52ikYFOKfQpYciUm97IaxCoAYrDNyCyYnbTg7zT15dA5ElBL1NsfqgUQrrHg-O1pJTw-vcekCW5Cu5I1rTqt1X55wGrCmg8VGRtnwjqYfgDjXpzrGw0b1fKjrXTrbMklVbveyTVN8rT31I6lKUbE7ErLXfpQGJIC0iI30q7JTCk4GXBbO5hu4HcxCYI97NZQaV5IDF1luDQdFCFe06jwU5DLU_KxctIRE17i-PQ8CDGy7ZoxGYuytPBdPcrfTfNcRvACuKU3Me5XucmUtUCWH90ntyS4ZjwmmCnsBW_JRWSttaSIFJ1phiyHtL-6YeyrJcLC-CcPnckCQV2KZpD3lxMQIMpQJp5R0kISnTPZDifY&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCcJNs4icFYp7bFrTC7_UPvMitkAzJntKxXJXJlPdwwI23ARABIABglYKAgKwHggEXY2EtcHViLTgwNDA4NDkzNTYwNTM5ODegAdW20uoDyAEJqQLxtEcRny-zPqgDAaoEyQFP0AvsEu5_kADyrgOLW45dSag4OnIVcOd0aUP9ChRuMpfM8GM4vJF7Kuq8hdC7BSkEXcdqzqXLEYbeMhJEJIYE3PrGkNkER7tRGpQGDXkzWS_kDJ8i3QfP25EjSsn6eh6Ak17e80OHMeIhaSsB7ARzsO9C5n63mavxN7gxQaU2KAnzts3cRLRC07enJFvuRFX7covjZfsqM-BF7GW-S1aKcl-muFqSpq9WUKr8NEazfO6KT4o9jjzfEaI3kZICEscW1vWoWFs-vXmABv78vI71gtPqygGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_0C-HXMgwg-_CvtnFjmtxtnltKE0w%26client%3Dca-pub-8040849356053987%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 05 Feb 2023 14:57:39 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 0121 2 KB
1 KB 166ms
57ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 05 Feb 2023 14:57:39 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 0121 308 B
636 B 164ms
56ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 05 Feb 2023 14:57:39 GMT

GET
H2 200 back_button.svg
static.criteo.net/flash/icon/ Frame 0121 507 B
835 B 164ms
57ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8f9a7962cf58f27b89c0627d094ee1b631ec118675f9eae1dc06031353360422

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
last-modified: Thu, 01 Apr 2021 14:03:13 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "6065d2a1-1fb"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 507
expires: Sun, 05 Feb 2023 14:57:39 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/m/delivery/ Frame 0121 43 B
347 B 202ms
31ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/m/delivery/lg.php?cppv=3&cpp=X-IEp3oHWf8YwwUrSN-XO6aOgr-10AB7YxdHW8J-o-Q8xswAPEDQV5iwJfDk_YaST7cMNdZNLIUAaZhok0peF3Eg3XFzkQJNLS5z85KUvBO-ypky-woh_9e7dpdqLasOeooKD9fiH5FiW3I6y4DfpJeWi_CMCM7nXR7CUjIhFs4dMOIelSPeJ-VekU2Sn5yR93wrdqhD0iZf7GM7VEAqB49u0Zg5CrPGgj2uhkhpivwzq3epAjN0tejLIFb_i23tu2RGxtDXlYUtL7Ts3v7FVVICbRN5fTk9_-_0aPF7SL0YM0u_PRvuyB4zY7E8PWv8ajxfq1tg5nFDOLQDVHPfANH_2Lr22_gfJG6HyrSGt0q6I_35O711qKdmYEuEbWnmhxNIc2jyRu6LC26hCzFGWekjQh5OQN1fd9rIRP3Vcga57mCOv9ssq6cApmVVxwGWnNCJvQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:39 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2896251
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 1893 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4292743f625e81345ef143c53e80532463bba30a5d60f0a6410f0e28ce059edd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame 0121 12 KB
5 KB 126ms
25ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 61470
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4420
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HP4ajWKRscaYLoEZVhbRZEZWWvf7kE0ru1MMzSe%2Fxavz64kryENoNRm7rb5EiLnSVM7ksYPwNbhBj%2BtnhczLbDwyqejz5iuZEKwMDnTo62t6f%2B7EFw2MYXNKCJoWIheun%2BWixngczNKo%2BTsTNnRiRXdT"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6db630ebed499211-FRA
expires: Tue, 31 Jan 2023 14:57:39 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame AFBA 42 B
63 B 87ms
86ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-A23jnt6T0ayxfOW70iiORh2N7ZgJMosvcMypQQJnKgNCo9vU1O-S3bl3p-yrHpnSjAYaWUMIgpjj4UfDtQwkld-939ZiOJJFxS87tZIVuT67UGY2M

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1171585364407251&output=html&h=250&slotname=2014106406&adk=2819396792&adf=3296887587&pi=t.ma~as.2014106406&w=300&lmt=1644505058&psa=0&format=300x250&url=https%3A%2F%2Fcongratulationsto.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505058213&bpp=1&bdt=850&idt=125&shv=r20220208&mjsv=m202202010201&ptt=9&saldr=aa&abxe=1&prev_slotnames=7717621511%2C9229440319&correlator=4730654175138&frm=20&pv=2&ga_vid=1975016378.1644505058&ga_sid=1644505058&ga_hid=1525151954&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=296&ady=236&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064752%2C31062930&oid=2&pvsid=1557632711904141&pem=378&tmod=52278239&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=4c4nIPyGIk&p=https%3A//congratulationsto.com&dtd=129

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame AFBA 2 KB
1 KB 45ms
44ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:41:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 972
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 14:41:27 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame AFBA 124 KB
38 KB 58ms
58ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 10 Feb 2022 14:57:39 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame AFBA 15 KB
6 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:53:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 267
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 17798303060702513824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 14:53:12 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame FCF3 624 B
299 B 66ms
66ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPaoDBDL5LgBGKqQscABMAE&v=APEucNWXvgApVSuE9UxxdQLco6nuzIlsa4HdLioNKf7ByJUR4t2ZeFIQZxb8NUsiGm-96QQuA45ETlq0RU1GO6cWnpBhNrRCjD-LT4qnhQrsGDPbpn45fDOvYLPlsXEEdWM6sVvm1_s_N8HBlvbIZ3MvWnhFoVPzHHwmSHpZEsS4KvofGehBfZU

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1171585364407251&output=html&h=250&slotname=2014106406&adk=2819396792&adf=3296887587&pi=t.ma~as.2014106406&w=300&lmt=1644505058&psa=0&format=300x250&url=https%3A%2F%2Fcongratulationsto.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505058213&bpp=1&bdt=850&idt=125&shv=r20220208&mjsv=m202202010201&ptt=9&saldr=aa&abxe=1&prev_slotnames=7717621511%2C9229440319&correlator=4730654175138&frm=20&pv=2&ga_vid=1975016378.1644505058&ga_sid=1644505058&ga_hid=1525151954&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=296&ady=236&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064752%2C31062930&oid=2&pvsid=1557632711904141&pem=378&tmod=52278239&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=4c4nIPyGIk&p=https%3A//congratulationsto.com&dtd=129

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 10 Feb 2022 14:57:39 GMT
server: cafe
cache-control: private
content-length: 276
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 10 Feb 2022 14:57:39 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame AFBA 74 KB
31 KB 93ms
92ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BaazmNWNmdMkzYX9Fy7VPAUh3qOcWcKsEwb19OawN8m7JfdflD6tYbJAEwmAlXNTN72ckdJJENQSRrGYoKkHiUClsX8qQExWSu-VE1az75gdeExbUcHgm3u2PBi3Mgie8RrEPGwlnO_iAUxnIw-TQmrmKKyA&dbm_d=AKAmf-DKGCsPWcqf5x5aIxy153P49BNTk-hoH4jz-2OHi-BShQD0a6fimYzx4AdKjhy7nFNquburGufm0FliA7S-xzti0_wMMx2WHVEy_cYAUjMrFfn__vr4MZKQH-0kolRnwvD3WVJj9cTvybkmSFSIUUJsoNnh82XzOXZlWw2L0wVGSOkEqrhEMjE4LxbKSKNi5R-Cl-Qm3BVzs5cQP2BJWrl3hKUWI2pasHeH8xtpkikV20KGGx3ZxhT3KdBYJT-0YURpets2fgp20KDgrn50gb6XNbTSpV4KYXrxaDi7Ar7_qBnU30MtIS3wLI_HKRIFk9mGvgnzBioFuYUddxiFu5vqPtTOiGvM7zBqOTDoU_FYlRqKuGZh6BhAnqHv1tI0fS_ksSTreG5XMyCyQm8CHRVDP4b8eHm74OrKnVILb1s0y3Sg1T4v-EOOipBJUPEd69pbaMfUMWtZdOG-qaQ-ELse4lGOmO1LHRDATyJrPuZGAtUQL9eZi2EZrNVc5SFeEqXL2Q8wWqd__7kLl8d6wk1I2conk9u3DuGU57-ucbXGGwFRM3iplTA_i1GIvaeXmz6THR9QFoatoYZLKBYmhRJG7-Cgzl7FLYcpNefiNZiSjiw5J4yDWj4u9Y6EDblKZfN46zzTs4benXfk2khv6gaRKPTarUWfrM-rFRTp7lmdlW1nfTK7UhnolHMaHu_rJx9KhZzKO6Dm5zzSsWHmq0F2kq_FSiU2cX83br3TqNmdcXlaGbRtAZAnBxhmEcZOqarMpjNuMTXu17jWfAR-wPhlhVX4Yg0fAhV-AhIENo3ZNy2I0GPbMMCVxZ1gw0-YGwbKVdkxogBKeH9a4FSs2BzFbUSbbCF3e4nKjhB9E1pi3lWeEXAPJBy5zJA6xvy7jY6rK_vlnV-ispmBZ9s2OMlLDj_kzqBVYhnzuPAjkZcxbrdwqo_X5SwHlTYUYlSx0ViIOhNd1FGwZPHpxXZzXyvHAMsCkWpDDzvfZN3S5SUJhOGYUaLQzSnZZaHxbp3YzSwBRj44mX3WkW020J3nzh8jm0n9ceecOe6wt5jAlAJ4ER4dP57oOZm7ZYAUOLJiivDd9FmlJZ3su5TqAD94xbpsMMygbAs6qFegTSyU346hbjoD1LXtl84RmDv1Ek4z8wqSCt0mc92yrAQ5piYY4DROKU1tWJc9jfLH1om8QPFcxopxRHrv1PqQHpW0nD1mFA2eZdSQiYhYD0h9-d2XT_TZ-EIXwaq5rJpzKic8OazQ8V1-zaR_wpaldgcV9orAzlFR7km2UTUkU5bKQ99O6Skk38SaYLbYBChuCJI8DNBhFKIGvcGs_2R3JKCeYRUhaEDXVm6QgpmTLzy1JqNmwsWuhz6VNZpNoswqUQp4ktVwg-o1WUdT63Zaeoc2G9vMBd59Z3LM4cifb4NpsTdZEJhnA67w5u4F-lJr3qC28u_fURhP4vCTgBDYfftUsHeM3XH0Fu4pa3Ed3f1gzQf5jLsmHwHNt4d_7zaCmeiI8BB5oBF5EChqxKXLbPTObPAwdIQu7vv_b3IDC9si8DIsorLvWD6XODuThFf_wf8egMeHC_0-K1P4WJISUW7gfgNfax-xt178LrIPiw-JBO89sTW5xZO3z_5Sv17H5lvm806-ppwESyrSigRLjX17Eza2YCnE_BKsW4q5P94PzJVj50eON0Kj-e2car9-kjtdwoiYlDxbV0jinQiDqwvP2F4H-gZRanoTSCsgIeFCCDj3lxWCOpjUqZRwjOMzV9OKglEz18FLArOENEWXJMZnyu64niYJFiA-ThcryqnGBMVb9et9nP3e46QpNW9J68hYbKTGl-KS2uXtlmOirAkK5rAkXrD-JyrTLXngNVZKFIm7cyFB2gVP8sOhOmuJLMfn04sZPUmTrTjhMVyJOJOSfvcCH0C5WP4uXf-2bHF1YD-2M8Pi_2uxNcYERPFjZlmRWEpJ4n2rGjsawGWMsANYV9cAFe-Iw4irGI-D6WACY4iWSwKKHf9Z_yew2v5p2h2OMto9Y5ZmMPP2x_tneRSOg439dtOqO_P6GrIXihCPGflNKTzwp0R2rX0fwOe_QeoZArdSCzC5O62WnVHGhZbjzSc3m7LdyTU7yyRyqtwcRIinaqeTBS9-SM3hOUVvZLSZYBxq2BJsUZ_yizzrb7yhVEdHkBZcdNxaKpdPlp4xwhirHm66P7fmX1wrAoiu1dJIexAo8kS2C3OemxcFkD-H2XfdYeuyPE03ieEbyxHTWLSNDW4tNo4veYvIXfwCqi4rXjfJFUgH_f7YD-ejJtzdsRS9v72UqFCBcMdead2RGF1p0K_RXMNfkSU2UmgewrknEGxde2AK8XID4EsWDuLYxKCIz8o8R7Al1SV4WjrzSD0bRZbDih1UpsiBSxFce8rWypiuC3_wcLIYB5qW8BQJIhjOk6a5n23Jb8btsxpvSE_CcHKhLxFYW41MfnT1hx3xiPK0UKGlCLLlr1ZagAy8QR472AJq9fV9JYIK1aecwI113vLyUYDCtcnb9JnZuiMLzfxpuJtjBHtd-ptVSrSMiyvsrsSx1-4WQnWQjhx-Ov51A2HF4dOBcIBlkCUxSVjsyhbBWGlPmz9gmNV5IdrNJAtSX91JTTMwbraodUOl4scVvcdSAnR6I9lt1BIDXA6MERTs0GVnuhv9wBOvU6Hjpl1qTpckjhF-3vELrOu0lEfpWpRobhSL5XllqzY9Oj9kmkAic7MvfKMa5_OcYWSvOHNuY7yio0Q-8PFR67W67YWzAmF4XC5fanMeIiUC73de8pQDd2Xh9ahWVtZlfFsgEEDyCJIYNJRTUBylhLj4-tdAd1rTNYdrG5U1cyAn3UQ5JN0BEHzcRxIcoiOHFfCLtrYjoq8kVahlrPN7Akk_gS7_GVgh3p8Fe8QQiMvthmqDId0mpwaa5bw&cid=CAASBORo10E&rfl=1%2Chttps%253A%252F%252Fcongratulationsto.com%252F%240

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

87bb83feedf849af82a4b487323f6429f7e8895004f04efcfd5b2d5bd8964550

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1171585364407251&output=html&h=250&slotname=2014106406&adk=2819396792&adf=3296887587&pi=t.ma~as.2014106406&w=300&lmt=1644505058&psa=0&format=300x250&url=https%3A%2F%2Fcongratulationsto.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505058213&bpp=1&bdt=850&idt=125&shv=r20220208&mjsv=m202202010201&ptt=9&saldr=aa&abxe=1&prev_slotnames=7717621511%2C9229440319&correlator=4730654175138&frm=20&pv=2&ga_vid=1975016378.1644505058&ga_sid=1644505058&ga_hid=1525151954&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=296&ady=236&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064752%2C31062930&oid=2&pvsid=1557632711904141&pem=378&tmod=52278239&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=4c4nIPyGIk&p=https%3A//congratulationsto.com&dtd=129
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:39 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31493
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 0121 12 KB
6 KB 81ms
56ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 05 Feb 2023 14:57:39 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0121 6 KB
7 KB 286ms
106ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=176&m=0&partner=91255&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F91255%2F220202%2F0890a32ca312414090e447d82c4e41bd_logo_n_square-1.png&v=3&w=196&s=3XkPyuJsMAo-hqxZIb7JcgZj

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

a4a8bd349867beb7f901dcbc61b0dc6a773a7743ccb8d454eb2fcfbecf1ff785

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:38 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=30393223
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 6649
expires: Sat, 28 Jan 2023 09:31:22 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0121 91 KB
92 KB 225ms
46ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=1200&m=0&partner=91255&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F91255%2F220202%2F7496135ad4854196857f51ba971cfdf2_valentinstag-2022-keyvisual-criteo-800x1200px_%2840bd060f-1b04-48db-abbb-7e0c4ead2c5f%29.jpg&v=3&w=1200&s=1wCJ0nllBTCQc0OBt0PRZGyS

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

9fa95c38c00ec84fe3b06da10359a21114e9eb458b220b0eb9fcb0145accfe1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30393223
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 93640
expires: Sat, 28 Jan 2023 09:31:22 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0121 10 KB
11 KB 285ms
106ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=91255&q=80&r=0&u=https%3A%2F%2Fhofats.com%2Fmedia%2F39%2F86%2Ffe%2F1642146350%2FBEER-BOX-feuerkorb-feuer-1-pdp.jpg&v=3&w=400&s=ykCbjpyRRSu8SXFeEj37tjMY&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

516d8778a677e00983e40150597df0b60fea5d975d06de422eb616678ff7521e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:38 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 10706
expires: Sun, 05 Feb 2023 14:57:39 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0121 2 KB
3 KB 224ms
45ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=91255&q=80&r=0&u=https%3A%2F%2Fhofats.com%2Fmedia%2F95%2F75%2F32%2F1615984929%2FSPIN-90-tischfeuer-grau-1-pdp.jpg&v=3&w=400&s=Pun4wKmhsTKk_FPglOk6-frK&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

55fec8412b7ecbdd859197d6917f6d807cb2441945e97e57419887eb90687ef6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 2462
expires: Sun, 05 Feb 2023 14:57:39 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 0121 10 KB
11 KB 225ms
46ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=91255&q=80&r=0&u=https%3A%2F%2Fhofats.com%2Fmedia%2F05%2F8e%2F2a%2F1635409622%2Fgeschenk-gutschein-EUR200.jpg&v=3&w=400&s=_r2iRtCBSnrfzWguCi5tMJe4&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

867.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

Finatra /

Resource Hash

b22c41a5c99cd0b7286b864285a59d19781b480e3bb52b10f9945fbb0f3e4c05

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:38 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 10646
expires: Sun, 05 Feb 2023 14:57:39 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 0121 0
127 B 155ms
38ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=YMuqNedHAg6fMCS_9Dc2HT5mDzXKOf--loebpDPhHT9sH-a2y8TlJh4MbjhPqO_mVVKx7CdTgEnJH7skCA67txj-Cmt1fy56CgrduVJy22FYh3N5KhswuipDz4RMWdDaby9ULYpwJ2vJLZjO0Kv9ZE_Ao4w46oQrTSUhm5o7dltVNpfc-KzOfmui5-dwu0CoLeWOxKsvLA8V0By6X5v5yvXhu7vF2-sPO3kdhZOHxmAfucF2Mlk621TUj7gZHf5c0EEIdw&sds=2&rev=unknown&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 10 Feb 2022 14:57:38 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 0121 2 KB
1 KB 35ms
31ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 05 Feb 2023 14:57:39 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 0121 2 KB
1 KB 28ms
23ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 05 Feb 2023 14:57:39 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 356C
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

85ms
84ms

Document
text/html

2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 10 Feb 2022 14:57:39 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires: Thu, 10 Feb 2022 14:57:39 GMT
cache-control: private

Redirect headers

location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control: private
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
date: Thu, 10 Feb 2022 14:57:39 GMT
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame FCF3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMfwBVqB__tuxXBlekgoqDw&google_cver=1

43 B
1014 B

68ms
36ms

Image
image/gif

2.21.141.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMfwBVqB__tuxXBlekgoqDw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPaoDBDL5LgBGKqQscABMAE&v=APEucNWXvgApVSuE9UxxdQLco6nuzIlsa4HdLioNKf7ByJUR4t2ZeFIQZxb8NUsiGm-96QQuA45ETlq0RU1GO6cWnpBhNrRCjD-LT4qnhQrsGDPbpn45fDOvYLPlsXEEdWM6sVvm1_s_N8HBlvbIZ3MvWnhFoVPzHHwmSHpZEsS4KvofGehBfZU
Protocol: HTTP/1.1
Server: 2.21.141.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 Feb 2022 14:57:39 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 10 Feb 2022 14:57:39 GMT

Redirect headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:39 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMfwBVqB__tuxXBlekgoqDw&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame FCF3
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YgUn4.XEW9GaQdgLF8.-UQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMfwBVqB__tuxXBlekgoqDw&google_cver=1&google_hm=2

43 B
894 B

26ms
26ms

Image
image/gif

2.21.141.232
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMfwBVqB__tuxXBlekgoqDw&google_cver=1&google_hm=2
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPaoDBDL5LgBGKqQscABMAE&v=APEucNWXvgApVSuE9UxxdQLco6nuzIlsa4HdLioNKf7ByJUR4t2ZeFIQZxb8NUsiGm-96QQuA45ETlq0RU1GO6cWnpBhNrRCjD-LT4qnhQrsGDPbpn45fDOvYLPlsXEEdWM6sVvm1_s_N8HBlvbIZ3MvWnhFoVPzHHwmSHpZEsS4KvofGehBfZU
Protocol: HTTP/1.1
Server: 2.21.141.232 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-21-141-232.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 Feb 2022 14:57:39 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 10 Feb 2022 14:57:39 GMT

Redirect headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:39 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMfwBVqB__tuxXBlekgoqDw&google_cver=1&google_hm=2
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame FCF3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEH6CBIqmCtvfgRTguMoI7YQ&google_cver=1

43 B
1006 B

102ms
71ms

Image
image/gif

37.252.173.215
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEH6CBIqmCtvfgRTguMoI7YQ&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPaoDBDL5LgBGKqQscABMAE&v=APEucNWXvgApVSuE9UxxdQLco6nuzIlsa4HdLioNKf7ByJUR4t2ZeFIQZxb8NUsiGm-96QQuA45ETlq0RU1GO6cWnpBhNrRCjD-LT4qnhQrsGDPbpn45fDOvYLPlsXEEdWM6sVvm1_s_N8HBlvbIZ3MvWnhFoVPzHHwmSHpZEsS4KvofGehBfZU

Protocol

HTTP/1.1

Server

37.252.173.215 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 10 Feb 2022 14:57:39 GMT
X-Proxy-Origin: 138.199.38.132; 138.199.38.132; 867.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 4f8d9a7e-4b1e-46dd-aa03-428e59710f61
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:39 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEH6CBIqmCtvfgRTguMoI7YQ&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame FCF3
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODI5MDM4NDg2MzY4Mjk5NTk2MA%3D%3D

170 B
188 B

46ms
46ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODI5MDM4NDg2MzY4Mjk5NTk2MA%3D%3D

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:39 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 10 Feb 2022 14:57:39 GMT
X-Proxy-Origin: 138.199.38.132; 138.199.38.132; 867.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: a77423a0-2243-417c-9e0c-c8d650e46208
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODI5MDM4NDg2MzY4Mjk5NTk2MA%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame EB3B 15 KB
16 KB 88ms
36ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,700,900

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 18:59:49 GMT
x-content-type-options: nosniff
age: 158270
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 08 Feb 2023 18:59:49 GMT

GET
H2 200 KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame EB3B 15 KB
15 KB 103ms
51ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmYUtfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,700,900

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0e868ca932480407e63d27e8e868cb1514581142928b9be15ec9039bf5fe348f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Sat, 05 Feb 2022 12:42:18 GMT
x-content-type-options: nosniff
age: 440121
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15724
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:37 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Sun, 05 Feb 2023 12:42:18 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame EB3B 15 KB
16 KB 89ms
37ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:300,400,700,900

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: null
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 20:07:55 GMT
x-content-type-options: nosniff
age: 154184
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 08 Feb 2023 20:07:55 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame AFBA 106 KB
37 KB 61ms
23ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a23e44d9d02a2a9641a9bd3b47693656054c00b71890aed2fa7fc90151750f73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:19:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2283
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37892
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:52 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 11 Feb 2022 14:19:36 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220208/r20110914/elements/html/ Frame AFBA 8 KB
3 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220208/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BaazmNWNmdMkzYX9Fy7VPAUh3qOcWcKsEwb19OawN8m7JfdflD6tYbJAEwmAlXNTN72ckdJJENQSRrGYoKkHiUClsX8qQExWSu-VE1az75gdeExbUcHgm3u2PBi3Mgie8RrEPGwlnO_iAUxnIw-TQmrmKKyA&dbm_d=AKAmf-DKGCsPWcqf5x5aIxy153P49BNTk-hoH4jz-2OHi-BShQD0a6fimYzx4AdKjhy7nFNquburGufm0FliA7S-xzti0_wMMx2WHVEy_cYAUjMrFfn__vr4MZKQH-0kolRnwvD3WVJj9cTvybkmSFSIUUJsoNnh82XzOXZlWw2L0wVGSOkEqrhEMjE4LxbKSKNi5R-Cl-Qm3BVzs5cQP2BJWrl3hKUWI2pasHeH8xtpkikV20KGGx3ZxhT3KdBYJT-0YURpets2fgp20KDgrn50gb6XNbTSpV4KYXrxaDi7Ar7_qBnU30MtIS3wLI_HKRIFk9mGvgnzBioFuYUddxiFu5vqPtTOiGvM7zBqOTDoU_FYlRqKuGZh6BhAnqHv1tI0fS_ksSTreG5XMyCyQm8CHRVDP4b8eHm74OrKnVILb1s0y3Sg1T4v-EOOipBJUPEd69pbaMfUMWtZdOG-qaQ-ELse4lGOmO1LHRDATyJrPuZGAtUQL9eZi2EZrNVc5SFeEqXL2Q8wWqd__7kLl8d6wk1I2conk9u3DuGU57-ucbXGGwFRM3iplTA_i1GIvaeXmz6THR9QFoatoYZLKBYmhRJG7-Cgzl7FLYcpNefiNZiSjiw5J4yDWj4u9Y6EDblKZfN46zzTs4benXfk2khv6gaRKPTarUWfrM-rFRTp7lmdlW1nfTK7UhnolHMaHu_rJx9KhZzKO6Dm5zzSsWHmq0F2kq_FSiU2cX83br3TqNmdcXlaGbRtAZAnBxhmEcZOqarMpjNuMTXu17jWfAR-wPhlhVX4Yg0fAhV-AhIENo3ZNy2I0GPbMMCVxZ1gw0-YGwbKVdkxogBKeH9a4FSs2BzFbUSbbCF3e4nKjhB9E1pi3lWeEXAPJBy5zJA6xvy7jY6rK_vlnV-ispmBZ9s2OMlLDj_kzqBVYhnzuPAjkZcxbrdwqo_X5SwHlTYUYlSx0ViIOhNd1FGwZPHpxXZzXyvHAMsCkWpDDzvfZN3S5SUJhOGYUaLQzSnZZaHxbp3YzSwBRj44mX3WkW020J3nzh8jm0n9ceecOe6wt5jAlAJ4ER4dP57oOZm7ZYAUOLJiivDd9FmlJZ3su5TqAD94xbpsMMygbAs6qFegTSyU346hbjoD1LXtl84RmDv1Ek4z8wqSCt0mc92yrAQ5piYY4DROKU1tWJc9jfLH1om8QPFcxopxRHrv1PqQHpW0nD1mFA2eZdSQiYhYD0h9-d2XT_TZ-EIXwaq5rJpzKic8OazQ8V1-zaR_wpaldgcV9orAzlFR7km2UTUkU5bKQ99O6Skk38SaYLbYBChuCJI8DNBhFKIGvcGs_2R3JKCeYRUhaEDXVm6QgpmTLzy1JqNmwsWuhz6VNZpNoswqUQp4ktVwg-o1WUdT63Zaeoc2G9vMBd59Z3LM4cifb4NpsTdZEJhnA67w5u4F-lJr3qC28u_fURhP4vCTgBDYfftUsHeM3XH0Fu4pa3Ed3f1gzQf5jLsmHwHNt4d_7zaCmeiI8BB5oBF5EChqxKXLbPTObPAwdIQu7vv_b3IDC9si8DIsorLvWD6XODuThFf_wf8egMeHC_0-K1P4WJISUW7gfgNfax-xt178LrIPiw-JBO89sTW5xZO3z_5Sv17H5lvm806-ppwESyrSigRLjX17Eza2YCnE_BKsW4q5P94PzJVj50eON0Kj-e2car9-kjtdwoiYlDxbV0jinQiDqwvP2F4H-gZRanoTSCsgIeFCCDj3lxWCOpjUqZRwjOMzV9OKglEz18FLArOENEWXJMZnyu64niYJFiA-ThcryqnGBMVb9et9nP3e46QpNW9J68hYbKTGl-KS2uXtlmOirAkK5rAkXrD-JyrTLXngNVZKFIm7cyFB2gVP8sOhOmuJLMfn04sZPUmTrTjhMVyJOJOSfvcCH0C5WP4uXf-2bHF1YD-2M8Pi_2uxNcYERPFjZlmRWEpJ4n2rGjsawGWMsANYV9cAFe-Iw4irGI-D6WACY4iWSwKKHf9Z_yew2v5p2h2OMto9Y5ZmMPP2x_tneRSOg439dtOqO_P6GrIXihCPGflNKTzwp0R2rX0fwOe_QeoZArdSCzC5O62WnVHGhZbjzSc3m7LdyTU7yyRyqtwcRIinaqeTBS9-SM3hOUVvZLSZYBxq2BJsUZ_yizzrb7yhVEdHkBZcdNxaKpdPlp4xwhirHm66P7fmX1wrAoiu1dJIexAo8kS2C3OemxcFkD-H2XfdYeuyPE03ieEbyxHTWLSNDW4tNo4veYvIXfwCqi4rXjfJFUgH_f7YD-ejJtzdsRS9v72UqFCBcMdead2RGF1p0K_RXMNfkSU2UmgewrknEGxde2AK8XID4EsWDuLYxKCIz8o8R7Al1SV4WjrzSD0bRZbDih1UpsiBSxFce8rWypiuC3_wcLIYB5qW8BQJIhjOk6a5n23Jb8btsxpvSE_CcHKhLxFYW41MfnT1hx3xiPK0UKGlCLLlr1ZagAy8QR472AJq9fV9JYIK1aecwI113vLyUYDCtcnb9JnZuiMLzfxpuJtjBHtd-ptVSrSMiyvsrsSx1-4WQnWQjhx-Ov51A2HF4dOBcIBlkCUxSVjsyhbBWGlPmz9gmNV5IdrNJAtSX91JTTMwbraodUOl4scVvcdSAnR6I9lt1BIDXA6MERTs0GVnuhv9wBOvU6Hjpl1qTpckjhF-3vELrOu0lEfpWpRobhSL5XllqzY9Oj9kmkAic7MvfKMa5_OcYWSvOHNuY7yio0Q-8PFR67W67YWzAmF4XC5fanMeIiUC73de8pQDd2Xh9ahWVtZlfFsgEEDyCJIYNJRTUBylhLj4-tdAd1rTNYdrG5U1cyAn3UQ5JN0BEHzcRxIcoiOHFfCLtrYjoq8kVahlrPN7Akk_gS7_GVgh3p8Fe8QQiMvthmqDId0mpwaa5bw&cid=CAASBORo10E&rfl=1%2Chttps%253A%252F%252Fcongratulationsto.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:55:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 112
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 14:55:47 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220208/r20110914/ Frame AFBA 24 KB
9 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220208/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

406dae81a8e95037a3bca53ca771f446df097cf86084d76de62fd308e2bf32a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:51:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 357
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9577
x-xss-protection: 0
server: cafe
etag: 11201793935764353180
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 14:51:42 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 0121 4 KB
619 B 80ms
48ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8aed12b8b95a1d49011f3e134dc8e71804a3576818d1d1334145aaa96d71aa5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 10 Feb 2022 13:29:52 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 10 Feb 2022 14:57:39 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 10 Feb 2022 14:57:39 GMT

GET
H3 200 2021_AG_Display_Google_PrairieDog_300x250.html Show response
s0.2mdn.net/sadbundle/1740666690976350208/2021_AG_Display_Google_PrairieDog_300x250/ Frame C96C 6 KB
2 KB 52ms
24ms Document
text/html 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1740666690976350208/2021_AG_Display_Google_PrairieDog_300x250/2021_AG_Display_Google_PrairieDog_300x250.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ce8549ecaa0c6065e50abd0a0b5019dc163dcffcb44e7592fdb740c3117a3609

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
content-length: 2251
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Tue, 08 Feb 2022 17:59:07 GMT
expires: Wed, 08 Feb 2023 17:59:07 GMT
cache-control: public, max-age=31536000
age: 161912
last-modified: Tue, 25 Jan 2022 10:22:56 GMT
content-type: text/html
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame AFBA 0
571 B 295ms
106ms Ping
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuC7XBdred-1I8R_lhO_0fzzAkrfsxjB20s_bos-zLD6UbZ9aW6XjARfPRxzw8Hy90FbZWgOuwYc5V5H4EMVTpAR_tBrbiJzlTnQ5dZJ46MbmSJnYgn-Gq54t5v2Rv7FiKADkysKEhtH2V80Rc3LrQODtlDw2Ui-yISMvz4PGhXmd6W2GdsOaWuArlQuCcb3pgBO2hqxR6DH8UC4GIDbaRWgK86lcdGZishikHvHeLqo87Vn5yUuUBB65AVqeVN6uVVpX2WcOoGB53ph819xD2ss8579SnQLVjUASUyI_MRFUWvZnPmo1ZuxXRDjRGmkyZc7cEG_Qr7sy1pmXGzM0e5-5lHhHR73VuCrWqUICGECr4BIKtAHTq0uaDSHJv3Biu6YCtbSi-SejD_qxmAJNlFE6EtFsZMog5rgc5nwfvPUPajgJgyG2QO5Iqd9suDB5I5pnC97rWLhXYWAucve5lTQG0sthm0giB1ho30wCd14wxL5OLz2zCr_9-qdJZpk_xXqt8jkFWkuyTs_53ls4N1Mey0M9YKrkufCuSQktnHjW9HA32wl0bFZ1C4CNcG0zbI1Gt5Wrz9HKc5gGab40zdiDdOzIhdicNtlUU3toAcTdeKUgAZB7lQ4dq1SXJyTodU-94RHmJ8xsiWUuZZlHkIMP_2DvdBOdEc8Qd_yBEcl2GjW0lDgdLcCT2PjegRTUP3QzQMQ1f2QqZ9dcUVPCiIDt9Kj4N1_NvojwCn0c2bfEyQw4HeAsPM2QHNwL5Jqbd5MwNGnQUbOAbpYSEqan8YApWbrwto93T7XHXLWlND7GvfELRUYNUpQigfgtvbrNGmhIVhgzinkryL-c3rl-ZJ6NpikYF2jXUf8sZpzTaMI4PRTA3-aqJzy95FBlA072a__3kRiu2oJdo19XZxAvE2uePtWySi5whshG_N2DUV414lGrohOxNBVn0yV7M-W8h8p-oox12zWWm7wQs7jc_GfzHqKJwlDG2zoIiuNtiszQ6_6Uqy8EBZcXMfJ2HiCwd_NgrHCFkSVtKPu-3fdZVbUkrAu-h4LDpb-IUPrTCUKqo9xoX2lyALBsaHSTZHEjNgYheDami14VJKXDyG9dkQfCYQz1a5JSalsUnwDTYE&sai=AMfl-YRQpz3i1hheOvWVF9gF1aehaC38DLKKzSQxvxU-aStBS1HhC10_6Yl46inBvne4D4B59hyffD3oulw1-dAJH8hKmDOsfpBEinYuxUJdnkt8aP-dbh21Fa_4Y-g4u8t0YKkk&sig=Cg0ArKJSzOjtPAbLNbo6EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=127&cbvp=1&cstd=124&cisv=r20220208.80206&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Thu, 10 Feb 2022 14:57:39 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H2 200 4690
americangreetings.sjv.io/i/0/302301/ Frame AFBA 50 B
447 B 224ms
35ms Image
image/gif 35.227.211.136
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://americangreetings.sjv.io/i/0/302301/4690?adcampaign=AGDigital_Programmatic_FY2020&adid=326765144&siteid=4817856
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-1171585364407251&output=html&h=250&slotname=2014106406&adk=2819396792&adf=3296887587&pi=t.ma~as.2014106406&w=300&lmt=1644505058&psa=0&format=300x250&url=https%3A%2F%2Fcongratulationsto.com%2F&flash=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505058213&bpp=1&bdt=850&idt=125&shv=r20220208&mjsv=m202202010201&ptt=9&saldr=aa&abxe=1&prev_slotnames=7717621511%2C9229440319&correlator=4730654175138&frm=20&pv=2&ga_vid=1975016378.1644505058&ga_sid=1644505058&ga_hid=1525151954&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=296&ady=236&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064752%2C31062930&oid=2&pvsid=1557632711904141&pem=378&tmod=52278239&uas=0&nvt=1&eae=0&fc=640&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CpeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=3&uci=a!3&fsb=1&xpc=4c4nIPyGIk&p=https%3A//congratulationsto.com&dtd=129
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.211.136 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 136.211.227.35.bc.googleusercontent.com
Software: /
Resource Hash: ec34cd386427fe6deacf99f4fdbeea4b1d1ed25f505411650d7ceaa843a7fc63

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:39 GMT
via: 1.1 google
p3p: policyref="/w3c/p3p.xml", CP="ALL BUS LEG DSP COR ADM CUR DEV PSA OUR NAV INT"
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 50
expires: Thu, 10 Feb 2022 14:57:39 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame AFBA 41 KB
15 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:38:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1152
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 10 Feb 2023 14:38:27 GMT

GET
DATA 200
OK truncated
/ Frame AFBA 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3aa20d380fbcd02eeefae2e9a5ec40efa5ed2ec7113d69264db22631cfb5d594

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 51HlaoDq_D6uZSgBzZWUemIfoZ0TtR6K4rqMqSgJuCQ.js Show response
pagead2.googlesyndication.com/bg/ Frame EB3B 36 KB
14 KB 19ms
19ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/51HlaoDq_D6uZSgBzZWUemIfoZ0TtR6K4rqMqSgJuCQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/pagead/gadgets/html5/addata.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e751e56a80eafc3eae652801cd95947a621fa19d13b51e8ae2ba8ca92809b824

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:19:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2266
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13873
x-xss-protection: 0
last-modified: Mon, 07 Feb 2022 12:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 10 Feb 2023 14:19:53 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 0121 15 KB
15 KB 54ms
23ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.eu.criteo.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 18:59:49 GMT
x-content-type-options: nosniff
age: 158270
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 08 Feb 2023 18:59:49 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame B9E8 22 KB
8 KB 27ms
27ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 10 Feb 2022 14:25:50 GMT
expires: Fri, 10 Feb 2023 14:25:50 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 1909
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame 0121 15 KB
15 KB 21ms
20ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.eu.criteo.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 20:07:55 GMT
x-content-type-options: nosniff
age: 154184
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 08 Feb 2023 20:07:55 GMT

GET
H2 200 bqi.php
lg3.media.net/ 15 B
15 B 54ms
54ms Image
text/javascript 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/bqi.php?lf=3&&vgd_l2type=sca&katen=1&kasts=tstype=-10401||gbid=-2&pc=100&katbid=-2&kals=base||pc=100||fat=2&kata=at2&cme=CV8r3QhW2_shwdeSBjjo5N7umsaspgQ8lcTMWRUmgcONtRtkDU7fmcK0ONcBqRwIpDt5iMswBbKvgMuDak77bb_BPZp09altvfiQIdmisLEziD04-yK9kYWSDi9sGYf8HuQs0QDzYQzpbA21XlIg33M8ZjuEJMXYsrTPYTx3pvXdYNIY9ndJM-s6AFL5EUYmxCCnlLWiLsYzs9rpVXDRrQ==||MhSffBRfuCOyCp4u_bjS9Q==|t9MPFyjImcVAbj9eBWVByX6u4_rU2c6FM6vH1oKVrPF8Ki5N4_BehUhWxHnTGrp7AKpf0Llfx4GEUZ10IWTnM4z0AL0zrFMeG0QcrE-RhkmZUU30xmrpGpU0EhzGd76UxG6PlgTJDoq5L8MmBikwsPYjXe4bSzXnDe9Zs6-RNAEv4aSm0SWZuzKUX_ePW6lNM4_q-3CHnJ-ROIGxxFUZeTCMSPEje_fgHLXpkPgc9Z0=|keodcAZi9ijMeFiT1XLfwA==|gax-c-MIckLtv23AqACcDw==|ECZQquDAdXO219s_zvdUcg==|ppNk17S2CV-gaSG0pjtdYg==|gNTUc7MBYV04UVzmztpDDQ==|a0AmFUYXmD635En15IbQ_PhM1oCrfgNXim_JXAAkY88QtPUn_DGZQg==|&vgd_pbcm=1&gdpr=1&prid=8PRHGG6T9&cid=8CU89N2CZ&crid=311343129&requrl=https%3A%2F%2Fcongratulationsto.com%2F&vi=1644505057844410026&ugd=4&cc=DE&sc=HE&startTime=1644505057937&l2type=sca&vgd_l1rakh=1644505057148142127&l1ch=1&sttm=1644505057945&upk=1644505058.16291&hvsid=00001644505057945023283072008410&verid=9111299&vgd_sc=HE&tdAdd[]=%7C%40%7Csde%3D1%7C%40%7Cadepth%3D1%7C%40%7Cddepth%3D1%7C%40%7Cfsap%3D0&kbbq=%26sde%3D1%26adepth%3D1%26ddepth%3D1&vgd_hbReqId=T1644500322C8S35U948&l1hcsd=l1!N3|949&vgd_l1rhst=contextual.media.net&vgd_uspa=0&vgd_isiolc=1&pvl=%7B%22mbr%22%3A1%2C%22pbcm%22%3A1%2C%22l1rpth%22%3A%22%2Fnmedianet.js%22%2C%22pgids%22%3A1%7D&rtbsd=6&kalog=SI%3D2266%7C%7CUUID%3D338Sq30k9tC2Ui03q8%7C%7CMPTD%3D656%7C%7CCI%3D2617%7C%7CSID%3D9%7C%7CHID%3D1%7C%7CMI%3D2266%7C%7CTPTD%3D4947852857860&l2ch=0&pid=8PON4XI2B&vgd_pgid=p01278676877t202202101457&vgd_pgids=1

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=21600
server: Apache
date: Thu, 10 Feb 2022 14:57:39 GMT
ntcoent-length: 15
vary: Accept-Encoding
content-type: text/javascript;charset=UTF-8
cache-control: max-age=0, no-cache, no-store
content-length: 15
expires: Thu, 10 Feb 2022 14:57:39 GMT

GET
H2 200 createjs.min.js Show response
code.createjs.com/1.0.0/ Frame C96C 236 KB
63 KB 333ms
31ms Script
text/javascript 2a02:26f0:fb::5f65:5922
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://code.createjs.com/1.0.0/createjs.min.js
Requested by: Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1740666690976350208/2021_AG_Display_Google_PrairieDog_300x250/2021_AG_Display_Google_PrairieDog_300x250.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:fb::5f65:5922 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Apache /
Resource Hash: e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
content-encoding: gzip
server: Apache
cache-control: max-age=900
vary: Accept-Encoding
content-type: text/javascript
x-n: S
accept-ranges: bytes
expires: Thu, 10 Feb 2022 15:12:39 GMT

GET
H3 200 2021_AG_Display_Google_PrairieDog_300x250.js Show response
s0.2mdn.net/sadbundle/1740666690976350208/2021_AG_Display_Google_PrairieDog_300x250/ Frame C96C 33 KB
9 KB 24ms
24ms Script
application/x-javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1740666690976350208/2021_AG_Display_Google_PrairieDog_300x250/2021_AG_Display_Google_PrairieDog_300x250.js?1632508219916

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1740666690976350208/2021_AG_Display_Google_PrairieDog_300x250/2021_AG_Display_Google_PrairieDog_300x250.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61e6225f5ecc4b875f7cbef5f6adb5cc2d4913ffd1b1274eb3254eacce2b5124

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1740666690976350208/2021_AG_Display_Google_PrairieDog_300x250/2021_AG_Display_Google_PrairieDog_300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 17:59:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 161912
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9048
x-xss-protection: 0
last-modified: Tue, 25 Jan 2022 10:22:56 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 08 Feb 2023 17:59:07 GMT

GET
H3 200 51HlaoDq_D6uZSgBzZWUemIfoZ0TtR6K4rqMqSgJuCQ.js Show response
pagead2.googlesyndication.com/bg/ Frame B9E8 36 KB
14 KB 28ms
28ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/51HlaoDq_D6uZSgBzZWUemIfoZ0TtR6K4rqMqSgJuCQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e751e56a80eafc3eae652801cd95947a621fa19d13b51e8ae2ba8ca92809b824

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:19:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2266
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13873
x-xss-protection: 0
last-modified: Mon, 07 Feb 2022 12:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 10 Feb 2023 14:19:53 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame B9E8 0
20 B 66ms
66ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B3Cqs4ycFYsDIBsfSgQebsrKYDgAAAAA4AeAEAg&bg=!cHOlczfNAAbS3PJy0tw7ACkAdvg8Wn7mma8oy-msILe1F7Fp1twABk729mhYqHRGmjSHBQEp2cB1qQIAAACMUgAAAAJoAQcKALBvS7KKQ3-nwTLbrfHO3RIsB8hTtx6BDtdDyhr-vnw5DRmCOXwAevfIfhW2w8K2JwcKq8IcDv4xJopjUd9MEsD19-xyJSVwGZWKjamInLhpo4-bgxIeHmL6y0i8fMyeSXElaZ6gkRZR6GQYIwLP-CvpCg3ZFHmRi-0t0nrMx0XjIt22e7N0kiavpUOW3CY8bK5_b9Lba_2BP0JROxGYmqLjeK-rREqdo02rodULGICZd5kCqYYIkpzcZB2LgFfGLJwJNbDqbJPIhKsd41lmbWmGcXJ6EdUnCAIAoPXpui-d89JuCIwj7Vs5FSvgB_KKTouiTpmd_IhGP7hbPniHQm7J2eoft4IRzyZ5JVPgOLY6h32ZUquATNWPxB62fVZClGDpT4LQT_m6K6cv-Rhwr4nRnUuUMiDl2Pl0UQ-dsTeQAUMPpSxx61yGHNu5l--gnJysLuzacBcxJJ7aYcfKeNGZXilze7C5pYtkkyArOAu1QsaOCP2yqU3rGY60wGRe5Zokm4Qccs2_rhkCEFpqoDZMJAGIm5Q8UQLc74r8ThjYb0OFiGm8Guh_eWA_zR6P2hbJHoregQLO-oEWLnR3-ks3CbHIvzp677KQ4bvfvwY8Vd0qygH4IAaTuLzTkvn3KEE0O8bPSXR4QDRsUbBIT1xV9TkN82TpWgFwVIHTowDsYFzCLegdVHqSIbDnokPZKab8kyblP-TvuYCaljlIvgI1RewvmuSuHdDR5WkTP6-2dNKsbtKXegNKiB1Y7e0Z3yNAtxv4DUkZoPC0QRnhPY9986TC-_zjntBl-Cfw6VmeKhNgy8WEKU6cD0hTVjssfw4NgXar90BIjh66NVHunhGFRxyMu7_BcT6FoEV1R3REbhrDNelvtx4-_eZ2bK9lxB-j2Q4p33cVAO_vQvgZi-yBkk3_t-I4Fv7rUVDDQbsdDaC5CzrxrrpgOzC_BhYSZiUOXPd0qZkHU-on-bGtnShBo2fir7uIuQltHbVRTs3L8c_FXnKJH4AELbsDRrLE2sUOtGk5zPSpiUEjK8mSiabMXCkFqR7nksqPDg-UwgvxCIh4VYgmfRbfyZ5_FV_rdqDQrTrOZOBgL09aQX9v8bnC6qtS1h8U5gDuOY7K6drPYeGAMh0Tu8tTGzxPXA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 2021_AG_Display_Google_PrairieDog_300x250_atlas_1.png
s0.2mdn.net/sadbundle/1740666690976350208/2021_AG_Display_Google_PrairieDog_300x250/images/ Frame C96C 251 KB
251 KB 13ms
12ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/1740666690976350208/2021_AG_Display_Google_PrairieDog_300x250/images/2021_AG_Display_Google_PrairieDog_300x250_atlas_1.png?1632515479370

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fac6ec5a983958207fc7848ea674a483416497b5e2e31055d2e28a250cf07d67

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1740666690976350208/2021_AG_Display_Google_PrairieDog_300x250/2021_AG_Display_Google_PrairieDog_300x250.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 17:58:42 GMT
x-content-type-options: nosniff
age: 161937
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 256979
x-xss-protection: 0
last-modified: Tue, 25 Jan 2022 10:22:56 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 08 Feb 2023 17:58:42 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame AFBA 0
23 B 85ms
51ms Ping
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuC7XBdred-1I8R_lhO_0fzzAkrfsxjB20s_bos-zLD6UbZ9aW6XjARfPRxzw8Hy90FbZWgOuwYc5V5H4EMVTpAR_tBrbiJzlTnQ5dZJ46MbmSJnYgn-Gq54t5v2Rv7FiKADkysKEhtH2V80Rc3LrQODtlDw2Ui-yISMvz4PGhXmd6W2GdsOaWuArlQuCcb3pgBO2hqxR6DH8UC4GIDbaRWgK86lcdGZishikHvHeLqo87Vn5yUuUBB65AVqeVN6uVVpX2WcOoGB53ph819xD2ss8579SnQLVjUASUyI_MRFUWvZnPmo1ZuxXRDjRGmkyZc7cEG_Qr7sy1pmXGzM0e5-5lHhHR73VuCrWqUICGECr4BIKtAHTq0uaDSHJv3Biu6YCtbSi-SejD_qxmAJNlFE6EtFsZMog5rgc5nwfvPUPajgJgyG2QO5Iqd9suDB5I5pnC97rWLhXYWAucve5lTQG0sthm0giB1ho30wCd14wxL5OLz2zCr_9-qdJZpk_xXqt8jkFWkuyTs_53ls4N1Mey0M9YKrkufCuSQktnHjW9HA32wl0bFZ1C4CNcG0zbI1Gt5Wrz9HKc5gGab40zdiDdOzIhdicNtlUU3toAcTdeKUgAZB7lQ4dq1SXJyTodU-94RHmJ8xsiWUuZZlHkIMP_2DvdBOdEc8Qd_yBEcl2GjW0lDgdLcCT2PjegRTUP3QzQMQ1f2QqZ9dcUVPCiIDt9Kj4N1_NvojwCn0c2bfEyQw4HeAsPM2QHNwL5Jqbd5MwNGnQUbOAbpYSEqan8YApWbrwto93T7XHXLWlND7GvfELRUYNUpQigfgtvbrNGmhIVhgzinkryL-c3rl-ZJ6NpikYF2jXUf8sZpzTaMI4PRTA3-aqJzy95FBlA072a__3kRiu2oJdo19XZxAvE2uePtWySi5whshG_N2DUV414lGrohOxNBVn0yV7M-W8h8p-oox12zWWm7wQs7jc_GfzHqKJwlDG2zoIiuNtiszQ6_6Uqy8EBZcXMfJ2HiCwd_NgrHCFkSVtKPu-3fdZVbUkrAu-h4LDpb-IUPrTCUKqo9xoX2lyALBsaHSTZHEjNgYheDami14VJKXDyG9dkQfCYQz1a5JSalsUnwDTYE&sai=AMfl-YRQpz3i1hheOvWVF9gF1aehaC38DLKKzSQxvxU-aStBS1HhC10_6Yl46inBvne4D4B59hyffD3oulw1-dAJH8hKmDOsfpBEinYuxUJdnkt8aP-dbh21Fa_4Y-g4u8t0YKkk&sig=Cg0ArKJSzOjtPAbLNbo6EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=695&vt=11&dtpt=568&dett=3&cstd=124&cisv=r20220208.80206&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 10 Feb 2022 14:57:39 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 dark-top.css
cdnjs.cloudflare.com/ajax/libs/cookieconsent2/1.0.9/ 3 KB
1 KB 44ms
24ms Stylesheet
text/css 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/1.0.9/dark-top.css

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/m/assets/public/js/cookieconsent.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

242a75ba54f0b62ab4e7f78a503df8b6f1d475bc7a246ffa5dc7981a315bad04

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1407777
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 676
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:09:17 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03e2d-b6f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B1hECd60RK%2B68GzAYFPWeV2Iy2QCMKdaTcHdLAbZmrtw2wFnGWLClaHRR4ez%2FsvV0I%2B734NjpXwL%2B%2FWP1lRqzeo7RLd58VHhbpoZT8e4wetL8qJAxJTgYdk%2FAUruA7j3Ql8UE34%2BcC2%2B0MfMPLPySSbH"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6db630f0a8159034-FRA
expires: Tue, 31 Jan 2023 14:57:39 GMT

GET
H2 200 log
lg3.media.net/ 35 B
206 B 16ms
16ms Image
image/gif 2.18.235.93
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://lg3.media.net/log?&logid=kfk&evtid=adPrvLog&otherprov=1&tagsonpage=GO&cid=8CU89N2CZ&crid=142533074&cc=DE&ugd=4&timeTaken=1&vi=1644505057793382778&r=1644505059926

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

Software

Jetty(9.4.35.v20201120) /

Resource Hash

796c46ec10bc9105545f6f90d51593921b69956bd9087eb72bee83f40ad86f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:39 GMT
server: Jetty(9.4.35.v20201120)
strict-transport-security: max-age=21600
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 35
expires: Thu, 10 Feb 2022 14:57:39 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 49ms
26ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=congratulationsto.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 10 Feb 2022 14:57:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 46ms
26ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=congratulationsto.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 10 Feb 2022 14:57:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame EB8A 45 KB
15 KB 145ms
144ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8040849356053987&output=html&adk=1812271804&adf=3025194257&lmt=1644505059&plat=3%3A32%2C4%3A32%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A34635776%2C32%3A32&format=0x0&url=https%3A%2F%2Fcongratulationsto.com%2F&ea=0&flash=0&pra=7&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505059926&bpp=1&bdt=2564&idt=1&shv=r20220208&mjsv=m202202010201&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7aa3e34a6129c5f3-22e8711b3acd0091%3AT%3D1644505058%3ART%3D1644505058%3AS%3DALNI_MZ39jTCue-OLhXnZ4Od-Un7dkhrpg&prev_fmts=300x250&prev_slotnames=7717621511%2C9229440319&nras=1&correlator=4730654175138&frm=20&pv=1&ga_vid=1975016378.1644505058&ga_sid=1644505058&ga_hid=1525151954&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064752%2C31062930&oid=2&psts=AGkb-H_oRUbF3yFFCzic73m-1TDDyr1hMIWFKpor4K0kc55QSStC-ORJdtYIt2he3pRM-FMgyGl9fXVhpRZDYA%2CAGkb-H9C4BvkGxvHiYVMGgSvARuB6RxBmHBXARbd4LH4BcaPyFQqkuKcZfma9ZQV2UwJHxPaZqJgrxOOkfuDmA&pvsid=1557632711904141&pem=378&tmod=52278239&uas=0&nvt=1&eae=2&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=6&uci=a!6&fsb=1&dtd=8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

30d019baae3f623446633a0992c15e53d16fe8ad8807379385dfaf14add5957a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 10 Feb 2022 14:57:40 GMT
server: cafe
content-length: 15698
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 13 KB
10 KB 57ms
34ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220208&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

da02eae9306ef8015696b26eae4488e4a517650e27eec4d9333a7181e9b80d49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 10 Feb 2022 14:57:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9793
x-xss-protection: 0

GET
H3 200 like.php Show response
www.facebook.com/v2.11/plugins/ Frame 9438 0
24 B 68ms
51ms Document
text/html 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/v2.11/plugins/like.php?action=like&app_id=756156561090444&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df23eacf48316a4%26domain%3Dcongratulationsto.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fcongratulationsto.com%252Ffa8bc7b0e417bc%26relation%3Dparent.parent&container_width=140&href=https%3A%2F%2Fwww.facebook.com%2Fcongratulationsto&layout=button_count&locale=en_US&sdk=joey&share=false&show_faces=false

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js?hash=8354aaf689db54cfd8c6e4a909e17735

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: attachment.fbsbx.com ws://localhost:* blob: .cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/

Response headers

content-type: text/html;charset=utf-8
pragma: no-cache
cache-control: private, no-cache, no-store, must-revalidate
expires: Sat, 01 Jan 2000 00:00:00 GMT
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-content-type-options: nosniff
x-xss-protection: 0
x-fb-debug: K9CawT6iTXKRMeEpFSFQoxF/HZ67D2ihVoOIlo2sEZpmiR9EoOy5Y7VdQGYq1pW8PYW7tPlXuwWZKnjSyNwzIg==
content-length: 0
date: Thu, 10 Feb 2022 14:57:39 GMT
priority: u=3,i
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame AD6E 42 B
64 B 47ms
47ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssqnaXXtx4kMg6QNs8qa30z2VqQUkwZvZ6aMC76wObo3d3kysPiFpooa9av2WamxtnBcSBH5-Phn67rsQ1Yfoq8&sig=Cg0ArKJSzMD1ChluFB09EAE&id=lidar2&mcvt=1000&p=0,0,90,180&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220209&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=4232537071&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1644505058334&rpt=637&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 10 Feb 2022 14:57:40 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 1893 42 B
64 B 49ms
49ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstZsZDNM7c_oENTjjl9csJxJdL6AJmZqE-shLbOOdfjbtdRInnvK8PiwNaZapTylXixE3qqU6hj8vCt7Dadgicq-HmVnwEuv8Nxf5dgnu5dFAe_X8g_yA&sai=AMfl-YTxqOrwdSwuEIyNssr-lWBf9iw-di4RMex0LbucwkLCIBFwrEzfm0WlHH6T5nHK7I1mNuc4ybjwfc32&sig=Cg0ArKJSzMVIpaliXgPTEAE&id=lidar2&mcvt=1033&p=0,0,600,160&mtos=1033,1033,1033,1033,1033&tos=1033,0,0,0,0&v=20220209&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=2&adk=3802710358&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1644505058309&rpt=742&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 18AF 13 KB
5 KB 7ms
7ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-length: 5046
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 10 Feb 2022 14:47:40 GMT
expires: Fri, 10 Feb 2023 14:47:40 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
content-type: text/html
age: 600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame E3BE 783 B
534 B 19ms
19ms Document
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

f28ff46a94d153c6a6370ea65a0b5e800360ae5bcebd19d9db340e68a3951328

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-cRLTcyLtFUkRFBukq7UL/g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/

Response headers

cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
expires: Thu, 10 Feb 2022 14:57:40 GMT
date: Thu, 10 Feb 2022 14:57:40 GMT
cache-control: private, max-age=300
content-type: text/html; charset=utf-8
content-security-policy: script-src 'report-sample' 'nonce-cRLTcyLtFUkRFBukq7UL/g' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 512
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H2 200 all
csm.eu.criteo.net/ Frame 0121 0
127 B 19ms
19ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 10 Feb 2022 14:57:39 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H3 200 reactive_library_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202010201/ 150 KB
54 KB 25ms
25ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202202010201/reactive_library_fy2019.js?bust=31064752

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

83622a3a90dfb4a017482f725c32b9a62a44da4a5e30a5f624d7db3644bf3707

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 54756
x-xss-protection: 0
server: cafe
etag: 1619126189771350979
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Thu, 10 Feb 2022 14:57:40 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 22ms
21ms Script
application/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=congratulationsto.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 10 Feb 2022 14:57:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 26ms
25ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=congratulationsto.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 10 Feb 2022 14:57:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 5767 21 KB
10 KB 687ms
687ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8040849356053987&output=html&h=250&adk=1037555716&adf=1730562248&pi=t.aa~a.3814817015~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1644505060&rafmt=1&to=qs&pwprc=6917648153&psa=1&format=310x250&url=https%3A%2F%2Fcongratulationsto.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505060191&bpp=1&bdt=2829&idt=1&shv=r20220208&mjsv=m202202010201&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7aa3e34a6129c5f3-22e8711b3acd0091%3AT%3D1644505058%3ART%3D1644505058%3AS%3DALNI_MZ39jTCue-OLhXnZ4Od-Un7dkhrpg&prev_fmts=300x250%2C0x0&prev_slotnames=7717621511%2C9229440319&nras=2&correlator=4730654175138&frm=20&pv=1&ga_vid=1975016378.1644505058&ga_sid=1644505058&ga_hid=1525151954&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=291&ady=1623&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064752%2C31062930&oid=2&psts=AGkb-H_oRUbF3yFFCzic73m-1TDDyr1hMIWFKpor4K0kc55QSStC-ORJdtYIt2he3pRM-FMgyGl9fXVhpRZDYA%2CAGkb-H9C4BvkGxvHiYVMGgSvARuB6RxBmHBXARbd4LH4BcaPyFQqkuKcZfma9ZQV2UwJHxPaZqJgrxOOkfuDmA&pvsid=1557632711904141&pem=378&tmod=52278239&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=1&fsb=1&xpc=xt865nc81t&p=https%3A//congratulationsto.com&dtd=16

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fffd61753b3f84fff00d899e9c452862fecd8c735e0f3dec209f0f5b155aa903

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: br
date: Thu, 10 Feb 2022 14:57:40 GMT
server: cafe
content-length: 10246
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame E3BE 0
0 57ms
56ms Image
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220208&jk=1557632711904141&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/ Frame E0FF 10 KB
5 KB 8ms
7ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a575e2f63d79cdaf5a92b4453bfcaadb462119aa1216b4f28920e37e2d9b8e7b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 4612
x-xss-protection: 0
date: Thu, 10 Feb 2022 04:17:51 GMT
expires: Thu, 24 Feb 2022 04:17:51 GMT
cache-control: public, max-age=1209600
age: 38389
etag: 18247940800414524076
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 51HlaoDq_D6uZSgBzZWUemIfoZ0TtR6K4rqMqSgJuCQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 18AF 36 KB
14 KB 11ms
11ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/51HlaoDq_D6uZSgBzZWUemIfoZ0TtR6K4rqMqSgJuCQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e751e56a80eafc3eae652801cd95947a621fa19d13b51e8ae2ba8ca92809b824

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:19:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2267
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13873
x-xss-protection: 0
last-modified: Mon, 07 Feb 2022 12:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 10 Feb 2023 14:19:53 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame E0FF 0
0 82ms
81ms Fetch
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CelRi4ycFYsy7Op_O7_UPxdC44AbJntKxXLWY49aTAcCNtwEQASAAYJWCgICsB4IBF2NhLXB1Yi04MDQwODQ5MzU2MDUzOTg3oAHVttLqA8gBCakC8bRHEZ8vsz6oAwGqBLkBT9DN7FgjXMqasgjF7rG5fbWcTKWlL4XjBLubUEEIVnUVUvDvzRFNV3O8aKPPP4CP499xX9CRcml58buUYI5pcAx-RiTWyaocgg3Rfs0Gqy3l3mvnJgSjeCjswprgR01YCPuOAsK9d_tb0ySBPIY1zmVxqF655NVafylUX_ODE1CjKElyiMQ4THi4i3pXswtgRE9omaSlHZLT69Eq935c3KuZu21_k0Iw22AYjDhFf1f19T8imFJCLjOABv78vI71gtPqygGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAYAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi04MDQwODQ5MzU2MDUzOTg3GAA&sigh=x0RF5o4ohI0&uach_m=[UACH]&cid=CAQSOwCNIrLM7vMqW8RGF8leGnrZs1kgADERW1W006Onakrr-HegHubpYd9xiWr4lsMRNBuE6JpfSGkaB-LEGAE

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Thu, 10 Feb 2022 14:57:40 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H2 200 notify
rtb.fr.eu.criteo.com/google/auction/ Frame E0FF 0
0 90ms
16ms Fetch 2a02:2638::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=UPLXEcz6RO0HfJ2DYgICAAAAWgOO_4hoI4AQ4ycFYoQHFKLF4ZNc7W1WABI&wp=YgUn4wAOncwIu-cfAA4oRU66gyjHxKo04Is1Vw

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
server: Kestrel
server-processing-duration-in-ticks: 276123
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame BFC2 214 KB
59 KB 208ms
200ms Document
text/html 2a02:2638::18
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=YgUn4wAOncwIu-cfAA4oRU66gyjHxKo04Is1Vw&u=%7CjyJbo5ZRvfO4%2B8MZt3JwPk6%2FmEMkwuzejQvHyNzTFFM%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpOtYk8A6_xGUBtBD6axc6WDMJXO29E7601cIHLcfaXsUuaHKkFac_J5CBkV5zxno8ryRtC1bJpEBLxm1NVf8HHE_OP3dZZWgSxWbKgQuEgT-_Ajf8UdEspuWJ5rHeiY3-ClUGxAmqL_JcmcMNd_oZfBzA99ZneRof77RAMf_n5tH-5Zp6aU3NK6XrKij-4Yst6hvh162jseGlJjFHQdJMhRuCIKLQcdBOnBdNRZPqHF9tLjV2PGh2mo1D1ywX8BPrWTMlQJasCXLtyFl9h_rC3pM6l_kAwipsEs2RjwkN2BPpuYobicVQeF0UZ6gPnLM0nYMyRkb_zzfUYudZNFMhWLdyQicwaiTwHFQ8HnKfQZXsPccLO1sK4pWV6eMVD-7IyalKR5vqp0p0xikDGDTQeG&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC4GPd4ycFYsy7Op_O7_UPxdC44AbJntKxXLWY49aTAcCNtwEQASAAYJWCgICsB4IBF2NhLXB1Yi04MDQwODQ5MzU2MDUzOTg3oAHVttLqA8gBCakC8bRHEZ8vsz6oAwGqBLwBT9DN7FgjXMqasgjF7rG5fbWcTKWlL4XjBLubUEEIVnUVUvDvzRFNV3O8aKPPP4CP499xX9CRcml58buUYI5pcAx-RiTWyaocgg3Rfs0Gqy3l3mvnJgSjeCjswprgR01YCPuOAsK9d_tb0ySBPIY1zmVxqF655NVafylUX_ODE1CjKElyiMQ4THi4i3pXswtgRE9o26aEjxVcd8KVa2r_DJY_Q2RrmfQ69XiaOPB42aVK6xM6HfjGPYz-MnKABv78vI71gtPqygGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1z_X59zimcGEpRbED8f1Ok4q7tFg%26client%3Dca-pub-8040849356053987%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::18 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

0bd1c595ffe5e0d5d85b92cd523259e7ba3bc0dabdfbe0bb9fd9c976f13d8843

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

date: Thu, 10 Feb 2022 14:57:40 GMT
content-type: text/html
server: Kestrel
cache-control: private, max-age=0, no-cache
pragma: no-cache
expires: Mon, 26 Jul 1997 05:00:00 GMT
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cross-origin-resource-policy: cross-origin
p3p: CP='CUR ADM OUR NOR STA NID'
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=tyVBMOdHAg6fMCS_fc7yTNit0BepTjGGQlr0eFJ_XfoBeUMaRR9zRvx1uq6LiWA2WvwuK4x2EkjWmaySQeATgPRa-K91r3gQqyTHVTst72efb9366FlJeh2ZfmQiTzSKq3WQmOZZ89qfLpGrhed2sMEQOTOPygLqW5JA5KeG-QBrT73BxDxNgj5g9YMyKnH7-kXLU0uWVSNATW0BZlO9-k3mLrgGpdnWvFCPYqb1don4v9wJHMGf8WgbHpndOVPhY1G5AQ"}], "max_age": 86400}
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
server-processing-duration-in-ticks: 181136050
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
vary: Accept-Encoding

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame E0FF 2 KB
1 KB 9ms
9ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:41:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 973
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 14:41:27 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 5173 1 KB
749 B 8ms
7ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Thu, 10 Feb 2022 13:26:12 GMT
expires: Fri, 11 Feb 2022 13:26:12 GMT
cache-control: public, max-age=86400
age: 5488
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame E0FF 124 KB
38 KB 16ms
16ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 10 Feb 2022 14:57:40 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame E0FF 15 KB
6 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:53:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 268
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 17798303060702513824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 14:53:12 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame E0FF 0
0 17ms
16ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTmdq1Gnz3KqBOM1dTLGtg90vDELLVJbIEuRnMvH7J1dGNs8ggKVRBUitMuqSawTts9W7L6yeindh4mR6mSwoY4-B46CA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
DATA 200
OK truncated
/ Frame E0FF 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d9a067578b5bb372b5a25cac73f1070dae62d1925d2dffbfc99c11176ccdd73e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dpixel
cms.quantserve.com/ Frame 5173 35 B
362 B 11ms
9ms Image
image/gif 2620:116:800d:21:36a9:ecb:e518:b308
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEFUYy99lvLV3_ZI7ytBUCd4&google_cver=1&google_push=AYg5qPLNJviyGEBz7UBIQ-wgBodl4G6b-9HSsRmEMDo9mJkBUQe7OHY7xioC2GlKueDhVVySZMgB9byOAr18fSa2IRQz8PYBwK7YLQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:40 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5173
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPIADN3Fkg41vymxFf1hFKhfblGZOxdPJWCiSRS...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWdVbjVBQUFCUkBSSWhEOA&google_push=AYg5qPIADN3Fkg41vymxFf1hFKhfblGZOxdPJWCiSRSBdDmhPdNEN_L4O_m1xeKtiULf0QTDgSXrLde8Ykv1Z1qWrf_P86Kl_5...

170 B
188 B

41ms
40ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWdVbjVBQUFCUkBSSWhEOA&google_push=AYg5qPIADN3Fkg41vymxFf1hFKhfblGZOxdPJWCiSRSBdDmhPdNEN_L4O_m1xeKtiULf0QTDgSXrLde8Ykv1Z1qWrf_P86Kl_59jLA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWdVbjVBQUFCUkBSSWhEOA&google_push=AYg5qPIADN3Fkg41vymxFf1hFKhfblGZOxdPJWCiSRSBdDmhPdNEN_L4O_m1xeKtiULf0QTDgSXrLde8Ykv1Z1qWrf_P86Kl_59jLA
Date: Thu, 10 Feb 2022 14:57:40 GMT
Server: Apache
Connection: keep-alive
Content-Length: 393
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 dds
rtb.openx.net/sync/ Frame 5173 43 B
351 B 38ms
18ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEEN3S1oG6M1y8ksJAjAFjRg&google_cver=1&google_push=AYg5qPI7RYGdxncuJsj1Dg_9xlkOCzWS0A_PEap4UYYXRWLpnc-Hhyrup79p204phwRkdVWipa0JvI8LRt_IaJjxK4BPCjtnTyvF
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:40 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: v59thhrbt6ng96jfcfdi6f4mrkfus2ti

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5173
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=btQq3zrnSO2Qalk9rYLI4g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

41ms
41ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=btQq3zrnSO2Qalk9rYLI4g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKYrRIhJMcZYy15GO8oIvOdbbz534FPenWrmp-RmpSklnnWaa5gVYt5_hq228iuXPG2wemiQZg_AYgZ17S44YYMOqKOGa-zBQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=btQq3zrnSO2Qalk9rYLI4g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKYrRIhJMcZYy15GO8oIvOdbbz534FPenWrmp-RmpSklnnWaa5gVYt5_hq228iuXPG2wemiQZg_AYgZ17S44YYMOqKOGa-zBQ
date: Thu, 10 Feb 2022 14:57:39 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5173
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEK3j7cY4hk6dR0vixPk2NAA&google_cver=1&google_push=AYg5qPJgvKISu1Mj_TcW4cPdC4LVA4xzudZXfSPlfd35Td5ZTFWce8TxvSbS7oeKmjGE63A8-6g...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pIM1VQTkMtMUQtMVJZOQ==&google_push=AYg5qPJgvKISu1Mj_TcW4cPdC4LVA4xzudZXfSPlfd35Td5ZTFWce8TxvSbS7oeKmjGE63A8-6glAkhXNthcPOTzrqi_op30b2F4

170 B
188 B

36ms
35ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pIM1VQTkMtMUQtMVJZOQ==&google_push=AYg5qPJgvKISu1Mj_TcW4cPdC4LVA4xzudZXfSPlfd35Td5ZTFWce8TxvSbS7oeKmjGE63A8-6glAkhXNthcPOTzrqi_op30b2F4

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:40 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pIM1VQTkMtMUQtMVJZOQ==&google_push=AYg5qPJgvKISu1Mj_TcW4cPdC4LVA4xzudZXfSPlfd35Td5ZTFWce8TxvSbS7oeKmjGE63A8-6glAkhXNthcPOTzrqi_op30b2F4
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame 5173
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_cver=1&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_push=AYg5qPKu0Hvllw0UvYWMAD3DFjV6AJxugLJX4...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_cver=1&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_push=AYg5qPKu0Hvllw0UvYWMAD3DFjV6AJxugLJX4...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_cver=1&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_push=AYg5qPKu0Hvllw0UvYWMAD3DFjV6AJxugLJX4...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_cver=1&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_push=AYg5qPKu0Hvllw0UvYWMAD3DFjV6AJxugLJX4...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_cver=1&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_push=AYg5qPKu0Hvllw0UvYWMAD3DFjV6AJxugLJX4...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_cver=1&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_push=AYg5qPKu0Hvllw0UvYWMAD3DFjV6AJxugLJX4...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_cver=1&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_push=AYg5qPKu0Hvllw0UvYWMAD3DFjV6AJxugLJX4...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_cver=1&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_push=AYg5qPKu0Hvllw0UvYWMAD3DFjV6AJxugLJX4...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_cver=1&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_push=AYg5qPKu0Hvllw0UvYWMAD3DFjV6AJxugLJX4...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_cver=1&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_push=AYg5qPKu0Hvllw0UvYWMAD3DFjV6AJxugLJX4...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_cver=1&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_push=AYg5qPKu0Hvllw0UvYWMAD3DFjV6AJxugLJX4...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_cver=1&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_push=AYg5qPKu0Hvllw0UvYWMAD3DFjV6AJxugLJX4...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_cver=1&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_push=AYg5qPKu0Hvllw0UvYWMAD3DFjV6AJxugLJX4...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_cver=1&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_push=AYg5qPKu0Hvllw0UvYWMAD3DFjV6AJxugLJX4...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_cver=1&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_push=AYg5qPKu0Hvllw0UvYWMAD3DFjV6AJxugLJX4...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_cver=1&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_push=AYg5qPKu0Hvllw0UvYWMAD3DFjV6AJxugLJX4...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_cver=1&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_push=AYg5qPKu0Hvllw0UvYWMAD3DFjV6AJxugLJX4...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_cver=1&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_push=AYg5qPKu0Hvllw0UvYWMAD3DFjV6AJxugLJX4...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_cver=1&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_push=AYg5qPKu0Hvllw0UvYWMAD3DFjV6AJxugLJX4...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_cver=1&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_push=AYg5qPKu0Hvllw0UvYWMAD3DFjV6AJxugLJX4...

0
0

GET
H2 200 trk
ag.innovid.com/ Frame 5173 43 B
296 B 175ms
25ms Image
image/gif 2a05:d01c:1d8:8102:7312:c82c:fb3:8dc6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEOumyEYMXmJKfiBjmwGctXs&google_cver=1&google_push=AYg5qPIhSS1PmBqom9pVLLBZ6VY59QD13eJLsY4UG-VCvrys6ejTJyD-cZTWqZ6np3R9RCUr94yKIGx6P5JMZL812ze5GDUqdzUp
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8102:7312:c82c:fb3:8dc6 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:40 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 5173 0
12 B 16ms
16ms Image
text/html 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K_at3K70zEwBkhbXYzLFNmE6t27Ho6GEl13gow0MQONsQSzd8RPD29wWXaaZa_tYHF7GqT

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220208/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:40 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 18AF 0
10 B 8ms
8ms Image
text/plain 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?hEUalA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:40 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ 0
20 B 51ms
51ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=225&t=2&li=gda_r20220208&jk=1557632711904141&bg=!JSalJmLNAAbS3PJy0tw7ACkAdvg8WvqtSJGaU79v8VnZe25dS-H6FjvqFV5jdYjmOCL2pIpHmZSZcAIAAACbUgAAAApoAQcKACkDJOrta71g16UFb7TdUe-UZaN4d3XCEZoviVsccQrl6TJK2plBIIjm5ZkCezQdR6GjWbPia_PoCDc247WnKJ7olc0OOSYHGJYHY3P__RwPpwihhXsBxhns-ukI74G4LycGlxGJ4jPh8CDzZr3KIOSoyppBLf2w3EmTBU31e11mTwKENqSrrRlMjYwDT7bNgrfpMmIr5YQggmde7heQRMgc1ubg0wQAuTGrxOJ_3hWf_Lt4TxPATR4D2JRZiOm81M04BR1MHnQd0fietMpVux8lBNrhN1K1Pe3_zbtu5ZMs1ZTpzX6gbL4ltWtRM8h_2DHQURXkKSt2iWQq4pvwFzkDK6RnAekoZioYowvPQ1PH8g-NLSUrMnFraDxmKV8my6KQPOQBgh1uTU7j2xAcf8kgdb1L645nuiFi5BQ9VPoOde8QkMPavAkQ-RmztkjAo42IX0wDDZw4GpSE1KPE-P5hEcQksUm9LFBp8emDUWzM-AHGRG20FCqPxBz0b_Ve8OMot1NxFA8jNsfwJIi49Qo6XjSokqlDTMW73AMJ5ZFV5AE_ibkgRh6-wzTcc15aIf-cfvUnAjRUKI48cjVM87pwDwUMrDuOeRm3gRjJgMifq4eq8SrZgpjAn7RpXE4zsdoEfuIc9TexWqft9qvO21nDtdTi-ufp3Fb86SiRAcexX7dL7tmWMJcqqvfLx1SMq20aSpk3cuBJChkPG-4bHxmJTbOwMrt1hsgGoWRNIJHV41_ScLuIZvT2bgKnHgPve_9LKR2UkUfK1cJjC9erLtrpCJbDOBSzdjQjSDtVDu3bcrBlu-goj5K4hf21NOeP0PDNKOlm4lzI8yzz7KXTmFXbDNDs35N504sde9TxlEKZraw4F9RYSTIW1d7nKQDjaQTRd9oECusA

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://congratulationsto.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame AFBA 42 B
64 B 53ms
52ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssg_AbwbXh3L6yqNoH4z-Ip8fxWZfn6M3DWfhAxj1CL4ljl7c45vuy_yvXUNLnfYNcOE5Vjd2hAjeWEjAdeGdVOP4zMBcZoabegEuNO&sai=AMfl-YSP9KxHkvdwaCPXb2wjnS94vZkTcYZ06gC2QRTNRtysrZx4Oy-kaHUdPfZgErV_pRGPRf8hhqGrarIS&sig=Cg0ArKJSzO8pPSmczUK4EAE&cid=CAASBORo10E&id=lidar2&mcvt=1008&p=0,0,250,300&mtos=1008,1008,1008,1008,1008&tos=1008,0,0,0,0&v=20220209&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=2819396792&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1644505058343&rpt=1142&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:40 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame BFC2 2 KB
1 KB 46ms
34ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=YgUn4wAOncwIu-cfAA4oRU66gyjHxKo04Is1Vw&u=%7CjyJbo5ZRvfO4%2B8MZt3JwPk6%2FmEMkwuzejQvHyNzTFFM%3D%7C&c1=JrbohDAzizBCiLKN5O6jHUI-6dJ9lV_AM8iEE4GHx4XAZ8-c9e5LlJfMjehYPJbM0j2hknANCpOtYk8A6_xGUBtBD6axc6WDMJXO29E7601cIHLcfaXsUuaHKkFac_J5CBkV5zxno8ryRtC1bJpEBLxm1NVf8HHE_OP3dZZWgSxWbKgQuEgT-_Ajf8UdEspuWJ5rHeiY3-ClUGxAmqL_JcmcMNd_oZfBzA99ZneRof77RAMf_n5tH-5Zp6aU3NK6XrKij-4Yst6hvh162jseGlJjFHQdJMhRuCIKLQcdBOnBdNRZPqHF9tLjV2PGh2mo1D1ywX8BPrWTMlQJasCXLtyFl9h_rC3pM6l_kAwipsEs2RjwkN2BPpuYobicVQeF0UZ6gPnLM0nYMyRkb_zzfUYudZNFMhWLdyQicwaiTwHFQ8HnKfQZXsPccLO1sK4pWV6eMVD-7IyalKR5vqp0p0xikDGDTQeG&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DC4GPd4ycFYsy7Op_O7_UPxdC44AbJntKxXLWY49aTAcCNtwEQASAAYJWCgICsB4IBF2NhLXB1Yi04MDQwODQ5MzU2MDUzOTg3oAHVttLqA8gBCakC8bRHEZ8vsz6oAwGqBLwBT9DN7FgjXMqasgjF7rG5fbWcTKWlL4XjBLubUEEIVnUVUvDvzRFNV3O8aKPPP4CP499xX9CRcml58buUYI5pcAx-RiTWyaocgg3Rfs0Gqy3l3mvnJgSjeCjswprgR01YCPuOAsK9d_tb0ySBPIY1zmVxqF655NVafylUX_ODE1CjKElyiMQ4THi4i3pXswtgRE9o26aEjxVcd8KVa2r_DJY_Q2RrmfQ69XiaOPB42aVK6xM6HfjGPYz-MnKABv78vI71gtPqygGgBiGoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_1z_X59zimcGEpRbED8f1Ok4q7tFg%26client%3Dca-pub-8040849356053987%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:40 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 05 Feb 2023 14:57:40 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame BFC2 2 KB
1 KB 43ms
34ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:40 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 05 Feb 2023 14:57:40 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame BFC2 308 B
636 B 41ms
32ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:40 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sun, 05 Feb 2023 14:57:40 GMT

GET
H2 200 back_button.svg
static.criteo.net/flash/icon/ Frame BFC2 507 B
835 B 36ms
33ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8f9a7962cf58f27b89c0627d094ee1b631ec118675f9eae1dc06031353360422

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:40 GMT
last-modified: Thu, 01 Apr 2021 14:03:13 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "6065d2a1-1fb"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 507
expires: Sun, 05 Feb 2023 14:57:40 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/m/delivery/ Frame BFC2 43 B
347 B 40ms
38ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/m/delivery/lg.php?cppv=3&cpp=plfRknoHWf8YwwUrSN-XO6aOgr_DBiUirnKK32AudqLnyrZHp60eWwr-jgQco_oIT6uDj2ld1egUZ9PlowcS8YfKrZz3A8HqUEcqSmfkHIM5PXRonbsygTJ7C-Va1YK5Ge1h4OObqM2dGV4EYzNu_sKRl9ixku84WhkcQn6xnSrk9gcN3SuIWLJZJDkWBrSU5tXZvw44ZEzFkP_dDeORzVei412XZFwxVoG_fA42BOjFui_dL6mbQPZn-jWGTNaWh8dyfUWolaVd5-ap-eizBCVQOShPs9BNkwge8dYMmkMPcFqWQaUV_sVQn3VDqvl07PUxxTsuFl2sUWwcGejllBCyaasEOrGqx-a12n5bVW6ETfWq_2I_ocSMZ0emj4g4zMpzx61VFNuphZpFmzBEZ4xnZphAvpcYCaJWYi25ylz9MeqyhokjRT2-ZmlX-nWdxe0I6Q

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:39 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 3192659
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H3 200 webfontloader.js Show response
cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/ Frame BFC2 12 KB
5 KB 24ms
24ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e0ee294b5487df566aad23b603fd902535634cfa957be8e7620396515afb1047

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:40 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1407788
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 4420
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:17:52 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb04030-30d9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yTD7gNWi7Y0LFtNjcZCdBc8zShhT5UfZ6vnL8y2GZUWkK6EOIpNVCoNSD7LTNd5STarXw03mpjrj3ipHl1ZNembKX0mSzDWb%2FZO3JGlBxc%2BDw9LqzJMmJytdY7wnb%2BAd7Tuxu06IDADma3jsWRPKqD2E"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6db630f4b8e89034-FRA
expires: Tue, 31 Jan 2023 14:57:40 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame BFC2 12 KB
6 KB 24ms
24ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:40 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 05 Feb 2023 14:57:40 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame BFC2 6 KB
7 KB 28ms
27ms Image
image/png 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=244&m=0&partner=91255&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F91255%2F220202%2F0890a32ca312414090e447d82c4e41bd_logo_n_square-1.png&v=3&w=196&s=deJdZ5t6IExXPfxaGnlNxQqv

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

a4a8bd349867beb7f901dcbc61b0dc6a773a7743ccb8d454eb2fcfbecf1ff785

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=30393222
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 6649
expires: Sat, 28 Jan 2023 09:31:22 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame BFC2 78 KB
78 KB 33ms
33ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=1200&m=0&partner=91255&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F91255%2F220202%2F5ee999cc9f6e47b5a1ab5e2b774303e8_valentinstag-2022-keyvisual-criteo-1200-628px_%28427471f3-69d8-42e6-a628-f6778e0e86a3%29.jpg&v=3&w=1200&s=jjAA3f92S-bbwuv8to-Pa0bS

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

b1c531bc6cfefc828b0ad829f45bf33edd3de731b33ef9b352276d0afe9cc432

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=30393261
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 79560
expires: Sat, 28 Jan 2023 09:32:01 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame BFC2 10 KB
11 KB 37ms
37ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=91255&q=80&r=0&u=https%3A%2F%2Fhofats.com%2Fmedia%2F39%2F86%2Ffe%2F1642146350%2FBEER-BOX-feuerkorb-feuer-1-pdp.jpg&v=3&w=800&s=WMT62vZrUnd4lkdNQaxFDUWI&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

516d8778a677e00983e40150597df0b60fea5d975d06de422eb616678ff7521e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 10706
expires: Sun, 05 Feb 2023 14:57:40 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame BFC2 4 KB
4 KB 28ms
27ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=91255&q=80&r=0&u=https%3A%2F%2Fhofats.com%2Fmedia%2F63%2Faf%2Fde%2F1615993388%2FJOHNNY-CATCH-CUP-flaschenoeffner-1-pdp.jpg&v=3&w=800&s=g50aKnPGDxosCC1R5ESG_A0w&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

aec986748b042314931cde700e4e636c48bd6fbc869f5e57c200d1492903dcbe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:40 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 3598
expires: Sun, 05 Feb 2023 14:57:40 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame BFC2 3 KB
3 KB 28ms
27ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=91255&q=80&r=0&u=https%3A%2F%2Fhofats.com%2Fmedia%2F1e%2F5e%2F0a%2F1615984726%2FSPIN-120-tischfeuer-silber-1-pdp.jpg&v=3&w=800&s=7uYzB6dem0lDP33f6Uh8rKiC&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

f7c25860576ae12841b44114e138d40232920baf9b8b4c6ab9f968cf94e16e6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 2606
expires: Sun, 05 Feb 2023 14:57:40 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame BFC2 3 KB
4 KB 29ms
28ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=91255&q=80&r=0&u=https%3A%2F%2Fhofats.com%2Fmedia%2F4d%2F45%2F41%2F1615993341%2FJOHNNY-CATCH-MAGNET-flaschenoeffner-1-pdp.jpg&v=3&w=800&s=rR51nYHrSzi9_wlawl_gg-qj&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

4e7302f3260bb259519fa551885fd11c64c7d4da0775f83706e0b382313480a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 3338
expires: Sun, 05 Feb 2023 14:57:40 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame BFC2 2 KB
3 KB 28ms
28ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=91255&q=80&r=0&u=https%3A%2F%2Fhofats.com%2Fmedia%2Fg0%2F1d%2Fbd%2F1615984850%2FSPIN-90-tischfeuer-silber-1-pdp.jpg&v=3&w=800&s=NjT0khWY9dXZ6FGFBAoqQvLa&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

5c1f5713cfb6f423b8567fad67b7f691a269f08f809748b665da1e6c97b8de38

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 2508
expires: Sun, 05 Feb 2023 14:57:40 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame BFC2 2 KB
3 KB 67ms
66ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=91255&q=80&r=0&u=https%3A%2F%2Fhofats.com%2Fmedia%2F95%2F75%2F32%2F1615984929%2FSPIN-90-tischfeuer-grau-1-pdp.jpg&v=3&w=800&s=Ohe9EeMtuTkv_btaf83IA4VY&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

55fec8412b7ecbdd859197d6917f6d807cb2441945e97e57419887eb90687ef6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:40 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 2462
expires: Sun, 05 Feb 2023 14:57:40 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame BFC2 11 KB
11 KB 31ms
31ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=91255&q=80&r=0&u=https%3A%2F%2Fhofats.com%2Fmedia%2F86%2F5d%2Fe9%2F1642406102%2FBEER-BOX-feuerkorb-rostig-Feuer-1-pdp.jpg&v=3&w=800&s=yI3GBF5AtPOmFKFK0icAlN1W&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

1161c955df2279e41fc16c4d66f20a0a0039808d22a4a00aded060e5da1700ca

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:40 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 11446
expires: Sun, 05 Feb 2023 14:57:40 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame BFC2 4 KB
4 KB 31ms
31ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=91255&q=80&r=0&u=https%3A%2F%2Fhofats.com%2Fmedia%2F96%2F79%2F75%2F1615993100%2FGRAVITY-CANDLE-windlicht-1-pdp.jpg&v=3&w=800&s=6pluBgbrrl-BFoRLH58TTszT&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

17713842ad3d09e0f475125440cb03261ffbb57249b1bfdf9c7f4b1e0b132395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 3916
expires: Sun, 05 Feb 2023 14:57:40 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame BFC2 2 KB
2 KB 55ms
55ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=91255&q=80&r=0&u=https%3A%2F%2Fhofats.com%2Fmedia%2F63%2F19%2Fe5%2F1638287220%2FSPIN-90-hangefeuer-silber-1-pdp.jpg&v=3&w=800&s=3Hv-llND7vv1ojIXkcKL7UwQ&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

3bdc461f63713df0be16d97312fa194a13c5f638aee65527c667392d592e5ec7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 1724
expires: Sun, 05 Feb 2023 14:57:40 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame BFC2 3 KB
3 KB 90ms
90ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=91255&q=80&r=0&u=https%3A%2F%2Fhofats.com%2Fmedia%2F50%2F6a%2Ffa%2F1615984889%2FSPIN-90-tischfeuer-schwarz-1-pdp.jpg&v=3&w=800&s=sxgJw1fptXyQmPmkdRKRQMNC&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

fc11bf937912209c8293b06af847c050d350e0ffa1c326e444b614a63b565279

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:40 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 2790
expires: Sun, 05 Feb 2023 14:57:40 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame BFC2 7 KB
8 KB 53ms
53ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=91255&q=80&r=0&u=https%3A%2F%2Fhofats.com%2Fmedia%2F6e%2F06%2F97%2F1629795360%2FBOWL-mit-Drahtfuss-feuerschale-feuer-1-pdp.jpg&v=3&w=800&s=dHAH6NMv6TmhyOdNSY9iKpva&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

cc788093c848413bf36bdeeaaae6289623a6181ad7bb4bd90699d30990a453bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:40 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 7434
expires: Sun, 05 Feb 2023 14:57:40 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame BFC2 3 KB
3 KB 54ms
54ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=800&m=0&partner=91255&q=80&r=0&u=https%3A%2F%2Fhofats.com%2Fmedia%2F08%2F88%2Fcf%2F1615984801%2FSPIN-120-tischfeuer-schwarz-1-pdp.jpg&v=3&w=800&s=k3a9gtsXpivcqNRC2b6m6h0Q&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

bd8670642bed0751fa73ce06b6fd44a4db845d2e3ce75391ebb44b8b9cba4c93

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:39 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=31104000
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 2936
expires: Sun, 05 Feb 2023 14:57:40 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame BFC2 0
127 B 25ms
25ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=tyVBMOdHAg6fMCS_fc7yTNit0BepTjGGQlr0eFJ_XfoBeUMaRR9zRvx1uq6LiWA2WvwuK4x2EkjWmaySQeATgPRa-K91r3gQqyTHVTst72efb9366FlJeh2ZfmQiTzSKq3WQmOZZ89qfLpGrhed2sMEQOTOPygLqW5JA5KeG-QBrT73BxDxNgj5g9YMyKnH7-kXLU0uWVSNATW0BZlO9-k3mLrgGpdnWvFCPYqb1don4v9wJHMGf8WgbHpndOVPhY1G5AQ&sds=2&rev=unknown&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 10 Feb 2022 14:57:40 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame BFC2 2 KB
1 KB 26ms
26ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:40 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 05 Feb 2023 14:57:40 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame BFC2 2 KB
1 KB 26ms
26ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:40 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sun, 05 Feb 2023 14:57:40 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame BFC2 4 KB
619 B 26ms
26ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Requested by

Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/webfont/1.6.28/webfontloader.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8aed12b8b95a1d49011f3e134dc8e71804a3576818d1d1334145aaa96d71aa5e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Thu, 10 Feb 2022 13:23:53 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 10 Feb 2022 14:57:40 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 10 Feb 2022 14:57:40 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame BFC2 15 KB
15 KB 10ms
9ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.eu.criteo.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 18:59:49 GMT
x-content-type-options: nosniff
age: 158271
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 08 Feb 2023 18:59:49 GMT

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame BFC2 15 KB
15 KB 18ms
18ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,700&subset=latin,cyrillic,latin-ext,cyrillic-ext,vietnamese,greek-ext,greek

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://ads.eu.criteo.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 20:07:55 GMT
x-content-type-options: nosniff
age: 154185
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 08 Feb 2023 20:07:55 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A1E5 640 B
316 B 21ms
20ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjFu9e9ATAB&v=APEucNX28QhVepRauVb-v_60Ha8F8nC686JHk2zsBlkRiOo5eZftylN85Nj0uuv1H8urVFo7L9HtXLJPcaVgukAOPxjYXXKI4oKUTa2NKmC5H9WwDaLzGQh_qDSjmbEMdloAXgNnc07AYy9DCe3hwahjILBYSih-CJThY3niDoS6d--4qZt4PaY

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8040849356053987&output=html&h=250&adk=1037555716&adf=1730562248&pi=t.aa~a.3814817015~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1644505060&rafmt=1&to=qs&pwprc=6917648153&psa=1&format=310x250&url=https%3A%2F%2Fcongratulationsto.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505060191&bpp=1&bdt=2829&idt=1&shv=r20220208&mjsv=m202202010201&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7aa3e34a6129c5f3-22e8711b3acd0091%3AT%3D1644505058%3ART%3D1644505058%3AS%3DALNI_MZ39jTCue-OLhXnZ4Od-Un7dkhrpg&prev_fmts=300x250%2C0x0&prev_slotnames=7717621511%2C9229440319&nras=2&correlator=4730654175138&frm=20&pv=1&ga_vid=1975016378.1644505058&ga_sid=1644505058&ga_hid=1525151954&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=291&ady=1623&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064752%2C31062930&oid=2&psts=AGkb-H_oRUbF3yFFCzic73m-1TDDyr1hMIWFKpor4K0kc55QSStC-ORJdtYIt2he3pRM-FMgyGl9fXVhpRZDYA%2CAGkb-H9C4BvkGxvHiYVMGgSvARuB6RxBmHBXARbd4LH4BcaPyFQqkuKcZfma9ZQV2UwJHxPaZqJgrxOOkfuDmA&pvsid=1557632711904141&pem=378&tmod=52278239&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=1&fsb=1&xpc=xt865nc81t&p=https%3A//congratulationsto.com&dtd=16

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8040849356053987&output=html&h=250&adk=1037555716&adf=1730562248&pi=t.aa~a.3814817015~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1644505060&rafmt=1&to=qs&pwprc=6917648153&psa=1&format=310x250&url=https%3A%2F%2Fcongratulationsto.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505060191&bpp=1&bdt=2829&idt=1&shv=r20220208&mjsv=m202202010201&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7aa3e34a6129c5f3-22e8711b3acd0091%3AT%3D1644505058%3ART%3D1644505058%3AS%3DALNI_MZ39jTCue-OLhXnZ4Od-Un7dkhrpg&prev_fmts=300x250%2C0x0&prev_slotnames=7717621511%2C9229440319&nras=2&correlator=4730654175138&frm=20&pv=1&ga_vid=1975016378.1644505058&ga_sid=1644505058&ga_hid=1525151954&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=291&ady=1623&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064752%2C31062930&oid=2&psts=AGkb-H_oRUbF3yFFCzic73m-1TDDyr1hMIWFKpor4K0kc55QSStC-ORJdtYIt2he3pRM-FMgyGl9fXVhpRZDYA%2CAGkb-H9C4BvkGxvHiYVMGgSvARuB6RxBmHBXARbd4LH4BcaPyFQqkuKcZfma9ZQV2UwJHxPaZqJgrxOOkfuDmA&pvsid=1557632711904141&pem=378&tmod=52278239&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=1&fsb=1&xpc=xt865nc81t&p=https%3A//congratulationsto.com&dtd=16

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
date: Thu, 10 Feb 2022 14:57:41 GMT
server: cafe
cache-control: private
content-length: 295
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame FE2A 77 KB
32 KB 103ms
102ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C54cpG_5IHn3wSjAt5i8urXKEtpZ5xa9UA6g6xoe0WFDrvfAVOAPQLqPjj6wfUfwp9W-QaHI0h8Mc94Jpp2YhOyksYsMOdRo2EPhhdsifRqgP-AJ77Lwex-VfFhU0U-BxM4fvcHUu1VvEtvAc95ndJHr7eXA&dbm_d=AKAmf-BwZrwWt2uNozd2lWQ-yRWjnwDm25hlSA572Ctln3CTVnj6uMiI9hXH8omzeKHVJvnREmypBZ9wwEL6UOpiXOmshShfhk51jJXSSsSJn6eaMSCMnZ0wdhL75Q-QQ0zIQ2gitmpSSndv-CvM68W0PYbXpmMjqPQnR2jV2wYU5TxPm8J-_gtgK2LEG0Y3VnXGTVsn8fcCNxl1NW5kjVbDCc_o2Y92gshwQCf1tk7sMDGxFKxDx6f4wLBmVrXi5DQVfUSfRqA45Vj1IKHFqqLh-P9t71B2oQaAxPubImENMEUvtlq4uFGC5A7deIDa-A8lwpCbAgGryYArQO8wCs4ikV-x5qss90_H9KA55sjCt48aDrKUrFdUDnFBJPUZTxcvaXzPUwSsB6slcGbaIkl3DPz0BZtlkHxo9JBS40_o5tfpUsU_4z7YMHqU-tv-QegPQ4oGim3B18-Bko696wgt3_1-UqGU_y5Pp2AGlvn22-qUyo7T5J9yFXyRMpk1wMGl7HcESw2p4nLE501p0oyueRLqOcbicOCruKNpJ06f1dpQGmxSLdN-Sa7EUP2IjxgHx6d4UE0QZSwtQi_Vz7kWcOfi4NEnRvQJqyFyl03SmWxAxiHmwxkVqo4bZYTbuL1-aVIogGaOP_ne8AO2xbgSjPyfaPjcoPCb5348OoiXzAI1-JCeOvtEtVCBcmfCA0M3fOqqBFhjsGwNArsbaxa-eNHmcEKkgvPm_PJyPdeOCjtgqQtl86zdx9If2WeN547wibn7gha1OTo2g5jkYnmuIc-ZhBQ32-ergUldnoiX5s7NS7dNyh6AdK-10OIXZHEvTlagGzbcgM0ueTTVzLPmhQSYoT-jdh4K5w9mCJ6JgaK9cdc77RCjmcSvyfTG_vr26TanRJCrkKYp4I4WYsej0Phfq3-_qEEJofForY1LIFzIrmhn-hIxKSksoMBIAq1zxGIWqmU7fbs6zMsbI4OMzlLfZE75Po4Cvrkvf0K0PP3wMkSSm2Yl3C3Ex3nIOQoEbdn6f315X1tbOPZ9eHDEcBAtaGz8-ilmrXShduNOC-_9W1thc_IKo7SX_odVL7gwb7BHrxDiaEeHjl2UtBru-POw5rVAKPC7iGpECUlp605ous02wceb2paDCfZQYY6aG-P_1OuHpryF0KfCVLA1ScPSZnFkJEPuYwCjtybkb8lQmsuzuN7gFqmbB3clG0vhW7VYGMNtI_jRYOpGvgFiIblRymzDyPauGx1f6_p866vcYpknKfAG1zq-2pQz-QP3uXfJWm8H2vxCvO49gaYfGMPrraVDcxMfIBSbWpCO2eJOKN4pAY1csETbvYTjpv6xr54BOjIzAvbpzDrKGlHuoVFtokX4hCF7xVwGv5wD6Bk9LqPHTgGf3vFpMBsR7NDf-V2voANMhJwlUDlBIqtHvg6Wj4x64Y5UydUHcIu2eT3KENGz11zg9-maeLJ79pddKBkLyRxx62YraRsXbHJBHcMlHuas-CkJSEDCWFp708a3UPW58QpjzbaycNoL7DqOpVa4ff8qqTNJWJQU5zhMehCmA6In5tauLTymHy72o1gIFRR8KvGak2KOFSIiL_IWraZ2fETWRvUY2SMt1jID4qdwpS7JAPOxH9T3ceVNRrdBoSMQviXhoGsO7hl9609TZ0iIq7PdsjyM0on_Jl_NjZHfmOZmfz_WxD4eSrKygIQjBIZnI_Eo91yaom4xonfZywXKnF63HKB_NxVJyYxFctLnYcDuFi9R2WM3RrJB_93TziaJCi4s-gxC9LBfzKIt56gCdmJ_amLmZD6wf_LFmsJuFiiAuzBbGCczE8xxEYf9Gfd6-b6MdNEGyoOSLv_Nvw34RESLt85TWXooWUtDy6-Vrzfuf0hmKsf-i2Wob3lI9ko5fl7hvclaqGqR2WMY3DqZANln0YcA1-R3xivW6yov_xi1Y_2oyEezpSNSEsz3G3Czt4mqmGxJ2f9b9sPMD8tS6Bi6DH59sUXpmvz0Sb6ipcQs20ZUTZwO7FiU_wooIm3YXSpsRcBjz9ArU-76Irrd0nokaqEGFeoqR67lcMGHIsrFVQLMh6hHp9Vp9kCfqy2NnS6p6DyblqYrLDBSAhr-KdKY8pWT_5gRyW-dPLzb5wTEeEW6_kRuV-r117MiwfWtqhS7ZuEhsl_BQmvySHRSdrD_HJDaoMORfIsFpafGMA180qtjcOk0ISitOVoRf7d8fNAX3SIj3DebUjD6Qar46YOwYvrw0gpj1KzQRTw_hTqe4DsJd6Ifh88NivySl8XGUQFBwGxMtbFfeq1mOVO6WuJ0pQR3Nn9QADSN-ol539T8es-joAzw2tPsgyWT7hipivAj6yZ3VffFF6q0_US4YqSnJebA6UVcmLojKco5wxf32dwohfzce5bsH3YNHxkC2D_jtVQ4n9xhIqpyxkcvYSt6vmmgJA153wXDDr8ee8d7KxXzWsSNjzvPI_zjS7aBAK_tZvBVpehYN1SP_0G0j6ciz1IzK602N_UVfSVJOUOkcxWVwodenUryQ6y0DiXUSKmHNqinSTLdkn5cq2iGQVEpAM6xaw_vJhTVs1Ico4buVa9w4SK1oKQAy68SahnM3clYnbLNLeQ1v2qOxQBv0OX1nwuZSaR_tyDqO4prgnsFugAW8UFOfiCyTCHLnQXaJAJI2SI7tL6Rh0_mjfdci5b0k6iRmfo-fSddsdNO8ikfgo1S8ExVIxa69VhvLBqIUUuqN29KLTbHOpjpxFOM4_18C8ndO_9NsnKAZbMbdDDksO6Z7i70Njbt3qXsDYO3MMTWWYR1YATZIOW7uSxHCV_c7bPw8ge7n03qbAYB3tKkjT1LSKC2_asSadOdyc0QXIeAdzp34naUzQ2pI2tMfK32tQaU8QUo5tyzz6Vf25ORywdmNVoOm41PMf6vkR8c2N1WSrXyTT_Qg0cWMGxJf7biCs-VNykIRRmtirVdXD-UAW5llBjUVMSg4YXrpCryLxIBSYPuPM0hlH3Sar29nOFMZ1auBzPzTrG_cNQgHLiOXfTUscTnIOvOsPWTg1lM83s&cid=CAASEuRopClbSXRcmhqVpvZG_KxZUg&rfl=2%2Chttps%253A%252F%252Fcongratulationsto.com%252F%240

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

77b2e94544f63279e9e37dd6f4eab38196ffa6bdcf6c1c9ddb610349fc421683

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8040849356053987&output=html&h=250&adk=1037555716&adf=1730562248&pi=t.aa~a.3814817015~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1644505060&rafmt=1&to=qs&pwprc=6917648153&psa=1&format=310x250&url=https%3A%2F%2Fcongratulationsto.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505060191&bpp=1&bdt=2829&idt=1&shv=r20220208&mjsv=m202202010201&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7aa3e34a6129c5f3-22e8711b3acd0091%3AT%3D1644505058%3ART%3D1644505058%3AS%3DALNI_MZ39jTCue-OLhXnZ4Od-Un7dkhrpg&prev_fmts=300x250%2C0x0&prev_slotnames=7717621511%2C9229440319&nras=2&correlator=4730654175138&frm=20&pv=1&ga_vid=1975016378.1644505058&ga_sid=1644505058&ga_hid=1525151954&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=291&ady=1623&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064752%2C31062930&oid=2&psts=AGkb-H_oRUbF3yFFCzic73m-1TDDyr1hMIWFKpor4K0kc55QSStC-ORJdtYIt2he3pRM-FMgyGl9fXVhpRZDYA%2CAGkb-H9C4BvkGxvHiYVMGgSvARuB6RxBmHBXARbd4LH4BcaPyFQqkuKcZfma9ZQV2UwJHxPaZqJgrxOOkfuDmA&pvsid=1557632711904141&pem=378&tmod=52278239&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=1&fsb=1&xpc=xt865nc81t&p=https%3A//congratulationsto.com&dtd=16
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:41 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32581
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame FE2A 2 KB
1 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

144822a1b5316a4e9a06ffbf5802b8c1cbbc0a3f230d81b98f362f7fe4c128c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:41:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 974
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1205
x-xss-protection: 0
server: cafe
etag: 18074202747124231361
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 14:41:27 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame FE2A 124 KB
38 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

096ebe5196b95f66c1c0b9f3dcea9e6e3f40f2d55cd5933af5e4942adb232593

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38562
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1644410386637351"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 10 Feb 2022 14:57:41 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/ Frame FE2A 15 KB
6 KB 12ms
11ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220208/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1460e4ba5d8a29324c75f80802081c73d2143d8c9581a84ca3df707fbc6e477c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:53:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 269
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6367
x-xss-protection: 0
server: cafe
etag: 17798303060702513824
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 14:53:12 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame FE2A 0
0 16ms
15ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS3XMi0ZbqWt8tCOGzxChSCuWhC6pavacmpdkcaN4eHO65QmyJg03pZj7QXUIN4YbFiWOYiowIOO6POzLAKK4ARb01o9A
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8040849356053987&output=html&h=250&adk=1037555716&adf=1730562248&pi=t.aa~a.3814817015~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1644505060&rafmt=1&to=qs&pwprc=6917648153&psa=1&format=310x250&url=https%3A%2F%2Fcongratulationsto.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505060191&bpp=1&bdt=2829&idt=1&shv=r20220208&mjsv=m202202010201&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7aa3e34a6129c5f3-22e8711b3acd0091%3AT%3D1644505058%3ART%3D1644505058%3AS%3DALNI_MZ39jTCue-OLhXnZ4Od-Un7dkhrpg&prev_fmts=300x250%2C0x0&prev_slotnames=7717621511%2C9229440319&nras=2&correlator=4730654175138&frm=20&pv=1&ga_vid=1975016378.1644505058&ga_sid=1644505058&ga_hid=1525151954&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=291&ady=1623&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064752%2C31062930&oid=2&psts=AGkb-H_oRUbF3yFFCzic73m-1TDDyr1hMIWFKpor4K0kc55QSStC-ORJdtYIt2he3pRM-FMgyGl9fXVhpRZDYA%2CAGkb-H9C4BvkGxvHiYVMGgSvARuB6RxBmHBXARbd4LH4BcaPyFQqkuKcZfma9ZQV2UwJHxPaZqJgrxOOkfuDmA&pvsid=1557632711904141&pem=378&tmod=52278239&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=1&fsb=1&xpc=xt865nc81t&p=https%3A//congratulationsto.com&dtd=16
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame FE2A 42 B
63 B 47ms
47ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DYjKvwzty2FqCUP_Zxeo7PD2W7AdqVz8F8nZ7vcjCvoM2-ewwQels7aHphq6saVK6iqMZZ2zCa3zuY9eQH9KVe-X5v4KbGKy4sgv5uTDpvYlE2HtQ

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame A1E5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOp6Qu3l037w4zh59hXdiMs&google_cver=1

43 B
114 B

34ms
33ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOp6Qu3l037w4zh59hXdiMs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjFu9e9ATAB&v=APEucNX28QhVepRauVb-v_60Ha8F8nC686JHk2zsBlkRiOo5eZftylN85Nj0uuv1H8urVFo7L9HtXLJPcaVgukAOPxjYXXKI4oKUTa2NKmC5H9WwDaLzGQh_qDSjmbEMdloAXgNnc07AYy9DCe3hwahjILBYSih-CJThY3niDoS6d--4qZt4PaY
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:41 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOp6Qu3l037w4zh59hXdiMs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame A1E5 43 B
305 B 85ms
33ms Image
image/gif 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjFu9e9ATAB&v=APEucNX28QhVepRauVb-v_60Ha8F8nC686JHk2zsBlkRiOo5eZftylN85Nj0uuv1H8urVFo7L9HtXLJPcaVgukAOPxjYXXKI4oKUTa2NKmC5H9WwDaLzGQh_qDSjmbEMdloAXgNnc07AYy9DCe3hwahjILBYSih-CJThY3niDoS6d--4qZt4PaY
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:41 GMT
content-encoding: gzip
server: OXGW/17.1.0
vary: Accept, Accept-Encoding
p3p: CP="CUR ADM OUR NOR STA NID"
via: 1.1 google
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame A1E5
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESENtl49lYM4BHDmNISDVPcFs&google_cver=1

23 B
172 B

68ms
63ms

Image
image/gif

104.89.28.165
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESENtl49lYM4BHDmNISDVPcFs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjFu9e9ATAB&v=APEucNX28QhVepRauVb-v_60Ha8F8nC686JHk2zsBlkRiOo5eZftylN85Nj0uuv1H8urVFo7L9HtXLJPcaVgukAOPxjYXXKI4oKUTa2NKmC5H9WwDaLzGQh_qDSjmbEMdloAXgNnc07AYy9DCe3hwahjILBYSih-CJThY3niDoS6d--4qZt4PaY
Protocol: H2
Server: 104.89.28.165 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-89-28-165.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:41 GMT
cache-control: max-age=0, no-cache, no-store
expires: Thu, 10 Feb 2022 14:57:41 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:41 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://sync.teads.tv/um?eid=3&uid=CAESENtl49lYM4BHDmNISDVPcFs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame A1E5 23 B
172 B 117ms
63ms Image
image/gif 104.89.28.165
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARjFu9e9ATAB&v=APEucNX28QhVepRauVb-v_60Ha8F8nC686JHk2zsBlkRiOo5eZftylN85Nj0uuv1H8urVFo7L9HtXLJPcaVgukAOPxjYXXKI4oKUTa2NKmC5H9WwDaLzGQh_qDSjmbEMdloAXgNnc07AYy9DCe3hwahjILBYSih-CJThY3niDoS6d--4qZt4PaY
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.89.28.165 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-89-28-165.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.7 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:41 GMT
cache-control: max-age=0, no-cache, no-store
expires: Thu, 10 Feb 2022 14:57:41 GMT
server: akka-http/10.2.7
content-length: 23
content-type: image/gif

GET
H3 200 html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame FE2A 169 KB
59 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:25:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1911
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60173
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 11 Feb 2022 14:25:50 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220208/r20110914/elements/html/ Frame FE2A 8 KB
3 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220208/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C54cpG_5IHn3wSjAt5i8urXKEtpZ5xa9UA6g6xoe0WFDrvfAVOAPQLqPjj6wfUfwp9W-QaHI0h8Mc94Jpp2YhOyksYsMOdRo2EPhhdsifRqgP-AJ77Lwex-VfFhU0U-BxM4fvcHUu1VvEtvAc95ndJHr7eXA&dbm_d=AKAmf-BwZrwWt2uNozd2lWQ-yRWjnwDm25hlSA572Ctln3CTVnj6uMiI9hXH8omzeKHVJvnREmypBZ9wwEL6UOpiXOmshShfhk51jJXSSsSJn6eaMSCMnZ0wdhL75Q-QQ0zIQ2gitmpSSndv-CvM68W0PYbXpmMjqPQnR2jV2wYU5TxPm8J-_gtgK2LEG0Y3VnXGTVsn8fcCNxl1NW5kjVbDCc_o2Y92gshwQCf1tk7sMDGxFKxDx6f4wLBmVrXi5DQVfUSfRqA45Vj1IKHFqqLh-P9t71B2oQaAxPubImENMEUvtlq4uFGC5A7deIDa-A8lwpCbAgGryYArQO8wCs4ikV-x5qss90_H9KA55sjCt48aDrKUrFdUDnFBJPUZTxcvaXzPUwSsB6slcGbaIkl3DPz0BZtlkHxo9JBS40_o5tfpUsU_4z7YMHqU-tv-QegPQ4oGim3B18-Bko696wgt3_1-UqGU_y5Pp2AGlvn22-qUyo7T5J9yFXyRMpk1wMGl7HcESw2p4nLE501p0oyueRLqOcbicOCruKNpJ06f1dpQGmxSLdN-Sa7EUP2IjxgHx6d4UE0QZSwtQi_Vz7kWcOfi4NEnRvQJqyFyl03SmWxAxiHmwxkVqo4bZYTbuL1-aVIogGaOP_ne8AO2xbgSjPyfaPjcoPCb5348OoiXzAI1-JCeOvtEtVCBcmfCA0M3fOqqBFhjsGwNArsbaxa-eNHmcEKkgvPm_PJyPdeOCjtgqQtl86zdx9If2WeN547wibn7gha1OTo2g5jkYnmuIc-ZhBQ32-ergUldnoiX5s7NS7dNyh6AdK-10OIXZHEvTlagGzbcgM0ueTTVzLPmhQSYoT-jdh4K5w9mCJ6JgaK9cdc77RCjmcSvyfTG_vr26TanRJCrkKYp4I4WYsej0Phfq3-_qEEJofForY1LIFzIrmhn-hIxKSksoMBIAq1zxGIWqmU7fbs6zMsbI4OMzlLfZE75Po4Cvrkvf0K0PP3wMkSSm2Yl3C3Ex3nIOQoEbdn6f315X1tbOPZ9eHDEcBAtaGz8-ilmrXShduNOC-_9W1thc_IKo7SX_odVL7gwb7BHrxDiaEeHjl2UtBru-POw5rVAKPC7iGpECUlp605ous02wceb2paDCfZQYY6aG-P_1OuHpryF0KfCVLA1ScPSZnFkJEPuYwCjtybkb8lQmsuzuN7gFqmbB3clG0vhW7VYGMNtI_jRYOpGvgFiIblRymzDyPauGx1f6_p866vcYpknKfAG1zq-2pQz-QP3uXfJWm8H2vxCvO49gaYfGMPrraVDcxMfIBSbWpCO2eJOKN4pAY1csETbvYTjpv6xr54BOjIzAvbpzDrKGlHuoVFtokX4hCF7xVwGv5wD6Bk9LqPHTgGf3vFpMBsR7NDf-V2voANMhJwlUDlBIqtHvg6Wj4x64Y5UydUHcIu2eT3KENGz11zg9-maeLJ79pddKBkLyRxx62YraRsXbHJBHcMlHuas-CkJSEDCWFp708a3UPW58QpjzbaycNoL7DqOpVa4ff8qqTNJWJQU5zhMehCmA6In5tauLTymHy72o1gIFRR8KvGak2KOFSIiL_IWraZ2fETWRvUY2SMt1jID4qdwpS7JAPOxH9T3ceVNRrdBoSMQviXhoGsO7hl9609TZ0iIq7PdsjyM0on_Jl_NjZHfmOZmfz_WxD4eSrKygIQjBIZnI_Eo91yaom4xonfZywXKnF63HKB_NxVJyYxFctLnYcDuFi9R2WM3RrJB_93TziaJCi4s-gxC9LBfzKIt56gCdmJ_amLmZD6wf_LFmsJuFiiAuzBbGCczE8xxEYf9Gfd6-b6MdNEGyoOSLv_Nvw34RESLt85TWXooWUtDy6-Vrzfuf0hmKsf-i2Wob3lI9ko5fl7hvclaqGqR2WMY3DqZANln0YcA1-R3xivW6yov_xi1Y_2oyEezpSNSEsz3G3Czt4mqmGxJ2f9b9sPMD8tS6Bi6DH59sUXpmvz0Sb6ipcQs20ZUTZwO7FiU_wooIm3YXSpsRcBjz9ArU-76Irrd0nokaqEGFeoqR67lcMGHIsrFVQLMh6hHp9Vp9kCfqy2NnS6p6DyblqYrLDBSAhr-KdKY8pWT_5gRyW-dPLzb5wTEeEW6_kRuV-r117MiwfWtqhS7ZuEhsl_BQmvySHRSdrD_HJDaoMORfIsFpafGMA180qtjcOk0ISitOVoRf7d8fNAX3SIj3DebUjD6Qar46YOwYvrw0gpj1KzQRTw_hTqe4DsJd6Ifh88NivySl8XGUQFBwGxMtbFfeq1mOVO6WuJ0pQR3Nn9QADSN-ol539T8es-joAzw2tPsgyWT7hipivAj6yZ3VffFF6q0_US4YqSnJebA6UVcmLojKco5wxf32dwohfzce5bsH3YNHxkC2D_jtVQ4n9xhIqpyxkcvYSt6vmmgJA153wXDDr8ee8d7KxXzWsSNjzvPI_zjS7aBAK_tZvBVpehYN1SP_0G0j6ciz1IzK602N_UVfSVJOUOkcxWVwodenUryQ6y0DiXUSKmHNqinSTLdkn5cq2iGQVEpAM6xaw_vJhTVs1Ico4buVa9w4SK1oKQAy68SahnM3clYnbLNLeQ1v2qOxQBv0OX1nwuZSaR_tyDqO4prgnsFugAW8UFOfiCyTCHLnQXaJAJI2SI7tL6Rh0_mjfdci5b0k6iRmfo-fSddsdNO8ikfgo1S8ExVIxa69VhvLBqIUUuqN29KLTbHOpjpxFOM4_18C8ndO_9NsnKAZbMbdDDksO6Z7i70Njbt3qXsDYO3MMTWWYR1YATZIOW7uSxHCV_c7bPw8ge7n03qbAYB3tKkjT1LSKC2_asSadOdyc0QXIeAdzp34naUzQ2pI2tMfK32tQaU8QUo5tyzz6Vf25ORywdmNVoOm41PMf6vkR8c2N1WSrXyTT_Qg0cWMGxJf7biCs-VNykIRRmtirVdXD-UAW5llBjUVMSg4YXrpCryLxIBSYPuPM0hlH3Sar29nOFMZ1auBzPzTrG_cNQgHLiOXfTUscTnIOvOsPWTg1lM83s&cid=CAASEuRopClbSXRcmhqVpvZG_KxZUg&rfl=2%2Chttps%253A%252F%252Fcongratulationsto.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:55:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 114
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 14:55:47 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220208/r20110914/ Frame FE2A 24 KB
9 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220208/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

406dae81a8e95037a3bca53ca771f446df097cf86084d76de62fd308e2bf32a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:51:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 359
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9577
x-xss-protection: 0
server: cafe
etag: 11201793935764353180
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 24 Feb 2022 14:51:42 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame FE2A 41 KB
15 KB 53ms
52ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:38:27 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1154
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 10 Feb 2023 14:38:27 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E2F2 1 KB
749 B 51ms
50ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 724
x-xss-protection: 0
date: Thu, 10 Feb 2022 13:26:12 GMT
expires: Fri, 11 Feb 2022 13:26:12 GMT
cache-control: public, max-age=86400
age: 5489
etag: 48472445140208031
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
DATA 200
OK truncated
/ Frame FE2A 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8420522a4b0e798712813cfc22a70b21c557e49e7de54a3420fc6db5d4a1974f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 300x250.html Show response
s0.2mdn.net/sadbundle/17698305681699897344/ Frame 219A 41 KB
10 KB 26ms
25ms Document
text/html 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/17698305681699897344/300x250.html?e=69&leftOffset=0&topOffset=0&c=jZmmPgsxN3&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e153ccf6af88376819a1b8295c8a3f90beb0e5ccc0f35e24ad1c2e6dd8d35c77

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-type: text/html
access-control-allow-origin: *
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
timing-allow-origin: *
date: Thu, 10 Feb 2022 14:57:41 GMT
expires: Fri, 10 Feb 2023 14:57:41 GMT
cache-control: public, max-age=31536000
last-modified: Fri, 11 Jun 2021 18:32:39 GMT
x-content-type-options: nosniff
x-dns-prefetch-control: off
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FE2A 0
24 B 98ms
97ms Ping
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssrWueiasP8DFeMO9oN5yYutoZyf4WsBtp6xyIHvz8-n1qgTUwu8hsTyPguFHqkQo_Xq2fGBpjxFgjqgrCoWM4pnl4ODpyowNylYO-bhnKtBY96vjLXEAIGoRDFG7wzjO7xqjXQjyLS8pUl7CMEVuZCPgE2oCDo_mLRafQZFPj8w_G0HpAETlESmS0uJEEAg2KgGTRs-Gog5m3vXrNiRvAh406SqXt0ZNF4ojtPT-ffMIZZV0ArHNB1uHP-Iuv3gLJAfK_yt7g5nlI4qjxj68i6iDpwz8bpYUqA8Fgo2uf1YvZAvK0FYViujfiqtek4xY1FHlqiuK2OJCHOAIhBgQwHYiMA293Q5DcCGh0evSoOjAkGHWfR-ipo8GeQ2G_9KeIhz2gdeCzC0wS5oB_2Q4kLZAKnKjZMGyaiggxrYQoIswSecBj7_Z7hU_NTDhyBWRq2uWn1ax65ILSja_aAI7SdEcuDdZVmTxxtUAAZIimUMHSZGREgLFnPe5jpscVsDH5K_PS3R7yYIMytXvXsbp_wsOmkz2NlQRnFD_ZHK3pBlBUCq1PDi7nBYGfN20TG-DvoGhOVjgOA8XbOx-KuKQhKdYIFd0rHfHB9pvytkzCAPiJInPlzFXY8bJlOkV3vKTHwoBotsr1wRtnNRi-GOBV4mj6vmgZfh3R2KWK5YTrGX0u1Goqdo2XABZreSXFPF1yI9tbQiyZfmUMqVlQuA7C7M7JoDZxktXPNGhadQEaDnfFTKua7vn3iBhsxBygubDKvD4q41V1DF5g5i0vGphdYw2IJm7Im33aOsXFv611vhNLc72aq6R0hWCLBZsXlHshCw7zzTqrHPVy-sGKcqMseLMdUa3GHOVXopg-HhZoP_4b6ppTYcSwMOw2-q6mvsSau_6bdcIpe5r9dyJ-iEa-cXllTskzbTQLZYtDg_oerrJw5LRc-fORegrfbxSLE3JLhmqPNWZ3m0F-pgZ8FqQjhkkWCFWcDWrESNbgNXj4Qa3QqBh_nDDjJitNFDKEL4bThdYlK0TmZAUcId6BkBEKHHDLcap7Ix4KLhD1wLqSZpuAIT5-HFcGkPyvx4hPEXWF0mFVp7GR0mcpjpy_LVEts7HpRgp7sUpJqYeVXy3SHlOm6eXPRLBMTmtlXy7qL4MMvq9kGe_dLJfZGyf2oLCVP12jFjkt9vzUvKzRWqS-d84lrMI9G9NowDbiZX_lnH0Wst74yHTqi60FIAuY&sai=AMfl-YQ4nBQulU61oVLnFCx1HcDKPVyRWCw1Yc6Ny9WJUES8mGZ4UjdjK0Y1JpY3lDHOJgWj9-gJhC5e5VxIIBTeaXlKP1Tctyo5F5IcvI9_ndnvOYKa_AB_QW9omjRx-YjIfT2uuyZVVsHvwKngJwGO3v18ZXpgFg&sig=Cg0ArKJSzGNj0iLFwLmpEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=124&cbvp=1&cstd=112&cisv=r20220208.45947&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
date: Thu, 10 Feb 2022 14:57:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 27DC 22 KB
8 KB 20ms
20ms Document
text/html 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8395
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 10 Feb 2022 14:25:50 GMT
expires: Fri, 10 Feb 2023 14:25:50 GMT
cache-control: public, max-age=31536000
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
content-type: text/html
age: 1911
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 Enabler_01_245.js Show response
s0.2mdn.net/879366/ Frame 219A 110 KB
38 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_245.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17698305681699897344/300x250.html?e=69&leftOffset=0&topOffset=0&c=jZmmPgsxN3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4642568b405b3750fb18df621889e27def95e8162c1cdd256a21b319c9a4e24b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17698305681699897344/300x250.html?e=69&leftOffset=0&topOffset=0&c=jZmmPgsxN3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 11:30:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 12414
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38568
x-xss-protection: 0
last-modified: Wed, 14 Oct 2020 19:32:54 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 11 Feb 2022 11:30:47 GMT

GET
H3 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 219A 60 KB
24 KB 26ms
26ms Script
text/javascript 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/17698305681699897344/300x250.html?e=69&leftOffset=0&topOffset=0&c=jZmmPgsxN3&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17698305681699897344/300x250.html?e=69&leftOffset=0&topOffset=0&c=jZmmPgsxN3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 10 Feb 2022 14:57:41 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E2F2
Redirect Chain

https://pixel.everesttech.net/1/m?url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Deverest%26google_hm%3D__EFGSURFER_USB64__%26google_push%3DAYg5qPLC2MLoux8waUlEz7JqyJ3SATxp6krjtoKDfon...
https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWdVbjVRQUFBYzhLeWxMRQ&google_push=AYg5qPLC2MLoux8waUlEz7JqyJ3SATxp6krjtoKDfont0nIz0WsOBHxViFDYPFBn6wimJ_zsd5FUXcMU0wpwDkCDyIum7jiC8L...

170 B
188 B

46ms
42ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWdVbjVRQUFBYzhLeWxMRQ&google_push=AYg5qPLC2MLoux8waUlEz7JqyJ3SATxp6krjtoKDfont0nIz0WsOBHxViFDYPFBn6wimJ_zsd5FUXcMU0wpwDkCDyIum7jiC8L6-SA

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=everest&google_hm=WWdVbjVRQUFBYzhLeWxMRQ&google_push=AYg5qPLC2MLoux8waUlEz7JqyJ3SATxp6krjtoKDfont0nIz0WsOBHxViFDYPFBn6wimJ_zsd5FUXcMU0wpwDkCDyIum7jiC8L6-SA
Date: Thu, 10 Feb 2022 14:57:41 GMT
Server: Apache
Connection: keep-alive
Content-Length: 393
Content-Type: text/html; charset=iso-8859-1

GET
H3 200 dds
rtb.openx.net/sync/ Frame E2F2 43 B
64 B 58ms
26ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEEN3S1oG6M1y8ksJAjAFjRg&google_cver=1&google_push=AYg5qPLugHYt9ihRZYq4MFkCbpvCcXsdOz1nWFO987CUXKzm1688Gqsvo5ZYhWEXSRsssTG5Y2-RilJwr44aKoy0IDVbO1fnL6JviQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8040849356053987&output=html&h=250&adk=1037555716&adf=1730562248&pi=t.aa~a.3814817015~rp.4&w=310&fwrn=4&fwrnh=100&lmt=1644505060&rafmt=1&to=qs&pwprc=6917648153&psa=1&format=310x250&url=https%3A%2F%2Fcongratulationsto.com%2F&flash=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&dt=1644505060191&bpp=1&bdt=2829&idt=1&shv=r20220208&mjsv=m202202010201&ptt=9&saldr=aa&abxe=1&cookie=ID%3D7aa3e34a6129c5f3-22e8711b3acd0091%3AT%3D1644505058%3ART%3D1644505058%3AS%3DALNI_MZ39jTCue-OLhXnZ4Od-Un7dkhrpg&prev_fmts=300x250%2C0x0&prev_slotnames=7717621511%2C9229440319&nras=2&correlator=4730654175138&frm=20&pv=1&ga_vid=1975016378.1644505058&ga_sid=1644505058&ga_hid=1525151954&ga_fc=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=291&ady=1623&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=42531397%2C44750774%2C31064752%2C31062930&oid=2&psts=AGkb-H_oRUbF3yFFCzic73m-1TDDyr1hMIWFKpor4K0kc55QSStC-ORJdtYIt2he3pRM-FMgyGl9fXVhpRZDYA%2CAGkb-H9C4BvkGxvHiYVMGgSvARuB6RxBmHBXARbd4LH4BcaPyFQqkuKcZfma9ZQV2UwJHxPaZqJgrxOOkfuDmA&pvsid=1557632711904141&pem=378&tmod=52278239&uas=0&nvt=1&eae=0&fc=896&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=7&uci=a!7&btvi=1&fsb=1&xpc=xt865nc81t&p=https%3A//congratulationsto.com&dtd=16
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:40 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: 5o3fifm254gn0872tvt1clin5p6i46o0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E2F2
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=btQq3zrnSO2Qalk9rYLI4g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

39ms
38ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=btQq3zrnSO2Qalk9rYLI4g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKzXToKSdjL245p9GLbQEOP9q96w0ITn7Kbk1PLErETGbLZjLruREnf464HG6E0k-pT4x_DypUINrErJGUfwz-XqC503WflNA

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=btQq3zrnSO2Qalk9rYLI4g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKzXToKSdjL245p9GLbQEOP9q96w0ITn7Kbk1PLErETGbLZjLruREnf464HG6E0k-pT4x_DypUINrErJGUfwz-XqC503WflNA
date: Thu, 10 Feb 2022 14:57:40 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E2F2
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEK3j7cY4hk6dR0vixPk2NAA&google_cver=1&google_push=AYg5qPIx8b1jxHKfwYQydmUiXnvTKsO7FJXfpiJfIwTl_3xklyBeGC20RaSSr6xCU255IEPPkQ6...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pIM1VRTDEtMTEtSUtKOQ==&google_push=AYg5qPIx8b1jxHKfwYQydmUiXnvTKsO7FJXfpiJfIwTl_3xklyBeGC20RaSSr6xCU255IEPPkQ6mdK9Tof8j3kUxoUOv8VvXPBnqCA

170 B
188 B

52ms
45ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pIM1VRTDEtMTEtSUtKOQ==&google_push=AYg5qPIx8b1jxHKfwYQydmUiXnvTKsO7FJXfpiJfIwTl_3xklyBeGC20RaSSr6xCU255IEPPkQ6mdK9Tof8j3kUxoUOv8VvXPBnqCA

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=S1pIM1VRTDEtMTEtSUtKOQ==&google_push=AYg5qPIx8b1jxHKfwYQydmUiXnvTKsO7FJXfpiJfIwTl_3xklyBeGC20RaSSr6xCU255IEPPkQ6mdK9Tof8j3kUxoUOv8VvXPBnqCA
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: 6f9fd0201ed801884e5299d5aabca094
Expires: 0

GET

pixel
cm.g.doubleclick.net/ Frame E2F2
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&google_push=AYg5qPIjtdwasRoSE60nVrzGLQuq1BzcDb34o...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&google_push=AYg5qPIjtdwasRoSE60nVrzGLQuq1BzcDb34o...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&google_push=AYg5qPIjtdwasRoSE60nVrzGLQuq1BzcDb34o...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&google_push=AYg5qPIjtdwasRoSE60nVrzGLQuq1BzcDb34o...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&google_push=AYg5qPIjtdwasRoSE60nVrzGLQuq1BzcDb34o...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&google_push=AYg5qPIjtdwasRoSE60nVrzGLQuq1BzcDb34o...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&google_push=AYg5qPIjtdwasRoSE60nVrzGLQuq1BzcDb34o...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&google_push=AYg5qPIjtdwasRoSE60nVrzGLQuq1BzcDb34o...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&google_push=AYg5qPIjtdwasRoSE60nVrzGLQuq1BzcDb34o...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&google_push=AYg5qPIjtdwasRoSE60nVrzGLQuq1BzcDb34o...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&google_push=AYg5qPIjtdwasRoSE60nVrzGLQuq1BzcDb34o...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&google_push=AYg5qPIjtdwasRoSE60nVrzGLQuq1BzcDb34o...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&google_push=AYg5qPIjtdwasRoSE60nVrzGLQuq1BzcDb34o...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&google_push=AYg5qPIjtdwasRoSE60nVrzGLQuq1BzcDb34o...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&google_push=AYg5qPIjtdwasRoSE60nVrzGLQuq1BzcDb34o...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&google_push=AYg5qPIjtdwasRoSE60nVrzGLQuq1BzcDb34o...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&google_push=AYg5qPIjtdwasRoSE60nVrzGLQuq1BzcDb34o...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&google_push=AYg5qPIjtdwasRoSE60nVrzGLQuq1BzcDb34o...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&google_push=AYg5qPIjtdwasRoSE60nVrzGLQuq1BzcDb34o...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YgUn4-XEW9GaQdgLF8-_UQAABGIAAAIB&google_gid=CAESEHuvgTHHPf5oaMqjWZHx4vo&google_cver=1&google_push=AYg5qPIjtdwasRoSE60nVrzGLQuq1BzcDb34o...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E2F2
Redirect Chain

https://ag.innovid.com/trk?tid=11711&google_gid=CAESEOumyEYMXmJKfiBjmwGctXs&google_cver=1&google_push=AYg5qPLEbj6VN3jAwEjRM_mi3d0lrg2PPownKM1V9PG5FoUEPNquuqTWGP6uwW95-2_ns8ToG_z3xbTmL_G2V9w5MhETv1z...
https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPLEbj6VN3jAwEjRM_mi3d0lrg2PPownKM1V9PG5FoUEPNquuqTWGP6uwW95-2_ns8ToG_z3xbTmL_G2V9w5MhETv1z8NBEOrg&google_hm=m6UnwjTLTymVJt...

170 B
188 B

37ms
36ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPLEbj6VN3jAwEjRM_mi3d0lrg2PPownKM1V9PG5FoUEPNquuqTWGP6uwW95-2_ns8ToG_z3xbTmL_G2V9w5MhETv1z8NBEOrg&google_hm=m6UnwjTLTymVJtr3Uffjyg

Requested by

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=innovid_ddp&google_push=AYg5qPLEbj6VN3jAwEjRM_mi3d0lrg2PPownKM1V9PG5FoUEPNquuqTWGP6uwW95-2_ns8ToG_z3xbTmL_G2V9w5MhETv1z8NBEOrg&google_hm=m6UnwjTLTymVJtr3Uffjyg
pragma: no-cache
date: Thu, 10 Feb 2022 14:57:41 GMT
cache-control: no-cache
content-length: 0
request-time: 2
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E2F2
Redirect Chain

https://googlecm.hit.gemius.pl/googleredir?rid=tknhntsqez&id=ndBK6L_fzwx7rssCbe8.iLes3yi8eMbF6r2JE6Xu.b7.N7&google_gid=CAESEGHK5xnGzVUpzrJ0S-MTqh8&google_cver=1&google_push=AYg5qPI8eK5SGzpDy9GoSXgF...
https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPI8eK5SGzpDy9GoSXgFwTiPex-S2MPmIbOYmp-8KVQ6kZDcO3YA72Zawed5iqggrFf2gaaU2OaoKBFcBjKTeaUuGoBwaTNqsOI&google_hm=

170 B
188 B

35ms
34ms

Image
image/png

142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPI8eK5SGzpDy9GoSXgFwTiPex-S2MPmIbOYmp-8KVQ6kZDcO3YA72Zawed5iqggrFf2gaaU2OaoKBFcBjKTeaUuGoBwaTNqsOI&google_hm=

Protocol

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:41 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:41 GMT
server: GHC
p3p: CP="NOI DSP COR NID PSAo OUR IND"
location: https://cm.g.doubleclick.net/pixel?google_nid=gemius_adh&google_push=AYg5qPI8eK5SGzpDy9GoSXgFwTiPex-S2MPmIbOYmp-8KVQ6kZDcO3YA72Zawed5iqggrFf2gaaU2OaoKBFcBjKTeaUuGoBwaTNqsOI&google_hm=
cache-control: no-store, no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
accept-ranges: none
content-length: 0
expires: Wed, 09 Feb 2022 14:57:41 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame E2F2 0
12 B 30ms
30ms Image
text/html 142.250.74.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IhIimMtYzjXWbakZSDx4ahmwrrN_rzfomLjLyoUqbPrL6HOHPhCNCrvW4lOiwNJve1GRMT3Q

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.74.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:41 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame E0FF 42 B
64 B 55ms
54ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstyRFgq938p6L0pmmh3MrYOWkjfZs5akG7p5cZEr6pqunbbOmfSe6NIUwDqJfX2u83pmK8B0G2STLj-CfxbNguHUg&sig=Cg0ArKJSzDSCGVH2xZuaEAE&cid=CAASF-RouVRwN_Fbhl2bmprm2zWIWmVjz84z&id=lidar2&mcvt=1008&p=0,0,124,1005&mtos=97,824,1008,1120,1321&tos=97,727,184,112,201&v=20220209&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0%3D&vs=4&r=v&rst=1644505060236&rpt=114&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame FE2A 0
23 B 59ms
59ms Ping
image/gif 142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssrWueiasP8DFeMO9oN5yYutoZyf4WsBtp6xyIHvz8-n1qgTUwu8hsTyPguFHqkQo_Xq2fGBpjxFgjqgrCoWM4pnl4ODpyowNylYO-bhnKtBY96vjLXEAIGoRDFG7wzjO7xqjXQjyLS8pUl7CMEVuZCPgE2oCDo_mLRafQZFPj8w_G0HpAETlESmS0uJEEAg2KgGTRs-Gog5m3vXrNiRvAh406SqXt0ZNF4ojtPT-ffMIZZV0ArHNB1uHP-Iuv3gLJAfK_yt7g5nlI4qjxj68i6iDpwz8bpYUqA8Fgo2uf1YvZAvK0FYViujfiqtek4xY1FHlqiuK2OJCHOAIhBgQwHYiMA293Q5DcCGh0evSoOjAkGHWfR-ipo8GeQ2G_9KeIhz2gdeCzC0wS5oB_2Q4kLZAKnKjZMGyaiggxrYQoIswSecBj7_Z7hU_NTDhyBWRq2uWn1ax65ILSja_aAI7SdEcuDdZVmTxxtUAAZIimUMHSZGREgLFnPe5jpscVsDH5K_PS3R7yYIMytXvXsbp_wsOmkz2NlQRnFD_ZHK3pBlBUCq1PDi7nBYGfN20TG-DvoGhOVjgOA8XbOx-KuKQhKdYIFd0rHfHB9pvytkzCAPiJInPlzFXY8bJlOkV3vKTHwoBotsr1wRtnNRi-GOBV4mj6vmgZfh3R2KWK5YTrGX0u1Goqdo2XABZreSXFPF1yI9tbQiyZfmUMqVlQuA7C7M7JoDZxktXPNGhadQEaDnfFTKua7vn3iBhsxBygubDKvD4q41V1DF5g5i0vGphdYw2IJm7Im33aOsXFv611vhNLc72aq6R0hWCLBZsXlHshCw7zzTqrHPVy-sGKcqMseLMdUa3GHOVXopg-HhZoP_4b6ppTYcSwMOw2-q6mvsSau_6bdcIpe5r9dyJ-iEa-cXllTskzbTQLZYtDg_oerrJw5LRc-fORegrfbxSLE3JLhmqPNWZ3m0F-pgZ8FqQjhkkWCFWcDWrESNbgNXj4Qa3QqBh_nDDjJitNFDKEL4bThdYlK0TmZAUcId6BkBEKHHDLcap7Ix4KLhD1wLqSZpuAIT5-HFcGkPyvx4hPEXWF0mFVp7GR0mcpjpy_LVEts7HpRgp7sUpJqYeVXy3SHlOm6eXPRLBMTmtlXy7qL4MMvq9kGe_dLJfZGyf2oLCVP12jFjkt9vzUvKzRWqS-d84lrMI9G9NowDbiZX_lnH0Wst74yHTqi60FIAuY&sai=AMfl-YQ4nBQulU61oVLnFCx1HcDKPVyRWCw1Yc6Ny9WJUES8mGZ4UjdjK0Y1JpY3lDHOJgWj9-gJhC5e5VxIIBTeaXlKP1Tctyo5F5IcvI9_ndnvOYKa_AB_QW9omjRx-YjIfT2uuyZVVsHvwKngJwGO3v18ZXpgFg&sig=Cg0ArKJSzGNj0iLFwLmpEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=280&vt=11&dtpt=156&dett=3&cstd=112&cisv=r20220208.45947&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXV0.&adurl=

Requested by

Host: congratulationsto.com
URL: https://congratulationsto.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 10 Feb 2022 14:57:41 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

POST
H2 200 all
csm.eu.criteo.net/ Frame BFC2 0
127 B 33ms
32ms Ping
text/plain 178.250.0.162
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.162 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Thu, 10 Feb 2022 14:57:41 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H3 200 51HlaoDq_D6uZSgBzZWUemIfoZ0TtR6K4rqMqSgJuCQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 27DC 36 KB
14 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/51HlaoDq_D6uZSgBzZWUemIfoZ0TtR6K4rqMqSgJuCQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e751e56a80eafc3eae652801cd95947a621fa19d13b51e8ae2ba8ca92809b824

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:19:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2268
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13873
x-xss-protection: 0
last-modified: Mon, 07 Feb 2022 12:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 10 Feb 2023 14:19:53 GMT

GET
H3 200 OnAir-Bold.woff2
s0.2mdn.net/creatives/assets/4140742/ Frame 219A 47 KB
47 KB 8ms
8ms Font
font/woff2 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4140742/OnAir-Bold.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c284299aeec8595fd3a10dcd2c27022edfda37c815571843a90c45cad18ace95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17698305681699897344/300x250.html?e=69&leftOffset=0&topOffset=0&c=jZmmPgsxN3&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:45:26 GMT
x-content-type-options: nosniff
age: 735
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47676
x-xss-protection: 0
last-modified: Thu, 06 May 2021 11:38:39 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 10 Feb 2022 15:00:26 GMT

GET
H3 200 OnAir-Regular.woff2
s0.2mdn.net/creatives/assets/4140742/ Frame 219A 47 KB
47 KB 12ms
12ms Font
font/woff2 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/4140742/OnAir-Regular.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c110419995948214e5b16d9d0df8f7d91536cc42783edd90c7fc1810308309ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/17698305681699897344/300x250.html?e=69&leftOffset=0&topOffset=0&c=jZmmPgsxN3&t=1&renderingType=2
Origin: https://s0.2mdn.net
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:48:55 GMT
x-content-type-options: nosniff
age: 526
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47848
x-xss-protection: 0
last-modified: Thu, 06 May 2021 11:38:29 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 10 Feb 2022 15:03:55 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 219A 7 KB
5 KB 56ms
56ms XHR
application/json 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_245&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

edcb986600e761ec8a3ec551859151f34f8e8c756dd532ce8353f71d738fdf51

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 10 Feb 2022 14:57:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5469
x-xss-protection: 0

GET
H3 200 60005582_20210602065022905_300x250_LOOK-01.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 219A 7 KB
7 KB 24ms
23ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20210602065022905_300x250_LOOK-01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

64647b5f7a99c098a611ee6bd6fbbc3290d3fa83186450cc9092010515852894

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17698305681699897344/300x250.html?e=69&leftOffset=0&topOffset=0&c=jZmmPgsxN3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 13:20:13 GMT
x-content-type-options: nosniff
age: 5848
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7477
x-xss-protection: 0
last-modified: Wed, 02 Jun 2021 13:50:22 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 11 Feb 2022 13:20:13 GMT

GET
H3 200 60005582_20210602065026259_300x250_LOOK-02.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 219A 6 KB
6 KB 24ms
24ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20210602065026259_300x250_LOOK-02.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cec67605b4ecbd77d6bfccd196d326d2b8439292377db3a5082ac16fde691da1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17698305681699897344/300x250.html?e=69&leftOffset=0&topOffset=0&c=jZmmPgsxN3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Wed, 09 Feb 2022 16:41:29 GMT
x-content-type-options: nosniff
age: 80172
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6076
x-xss-protection: 0
last-modified: Wed, 02 Jun 2021 13:50:26 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 10 Feb 2022 16:41:29 GMT

GET
H3 200 60005582_20210507060843268_Asset_Transparent.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 219A 2 KB
2 KB 23ms
22ms Image
image/png 2a00:1450:4001:828::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20210507060843268_Asset_Transparent.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f741883eafc84067b80014e53fbfab2505aca4f7cf767b17404a291fffb79d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/17698305681699897344/300x250.html?e=69&leftOffset=0&topOffset=0&c=jZmmPgsxN3&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 08:03:59 GMT
x-content-type-options: nosniff
age: 24822
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2040
x-xss-protection: 0
last-modified: Fri, 07 May 2021 13:08:43 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 11 Feb 2022 08:03:59 GMT

GET
H/1.1 200
OK postview.gif
portal.o2online.de/nws/img/ Frame 219A 43 B
609 B 99ms
13ms Image
image/gif 82.113.101.132
TDDE-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://portal.o2online.de/nws/img/postview.gif?partnerId=O2_DSP_TRA_HAV_14114_PV&mediacode=26952494_4307561_323351153_100434585_-0&ref=26952494_4307561_323351153_100434585_-0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 82.113.101.132 Kassel, Germany, ASN6805 (TDDE-ASN1, DE),
Reverse DNS: portal.o2online.de
Software: Apache /
Resource Hash: e46eb58f99814c32c849b97a268129ddb14ca88e9070964ee75a2cd987c66839

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

Date: Thu, 10 Feb 2022 14:57:42 GMT
Last-Modified: Wed, 26 Aug 2020 10:11:24 GMT
Server: Apache
ETag: "2b-5adc50abeeb00"
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Connection: close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 43

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 219A 17 KB
6 KB 35ms
35ms Script
text/javascript 2a00:1450:4001:82a::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_245.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:57:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 10 Feb 2022 14:57:42 GMT

GET
H3 200 51HlaoDq_D6uZSgBzZWUemIfoZ0TtR6K4rqMqSgJuCQ.js Show response
pagead2.googlesyndication.com/bg/ Frame 8350 36 KB
14 KB 56ms
55ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/51HlaoDq_D6uZSgBzZWUemIfoZ0TtR6K4rqMqSgJuCQ.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e751e56a80eafc3eae652801cd95947a621fa19d13b51e8ae2ba8ca92809b824

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

date: Thu, 10 Feb 2022 14:19:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 2269
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13873
x-xss-protection: 0
last-modified: Mon, 07 Feb 2022 12:58:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 10 Feb 2023 14:19:53 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 27DC 0
20 B 100ms
99ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BhlQT5ScFYqKCFqKBx_APsbGJ-AwAAAAAOAHgBAI&bg=!MTKlMnbNAAbS3PJy0tw7ACkAdvg8WohhT5t38yax0_AmizPQQi4qI3Bq5rCgkUVxOzANpD-gp8pvqQIAAAEqUgAAAAtoAQeZAtSAV_0OpOEN-2n9I-VLCHlmO7lnXhL4VqNjYuhmfwVimt8DIIXs0ZDEqB7G0kQIyGqiV8TkbfihfqxQXBA6cEI087AZv_X5729a4ETxGDgfFSEmAaqr1D0bCsUD1eWsNCcfzt51NpwwSRofbuHKW7fqInLrVjTAIihCg685Pw-oBP4MpCEVws0Ab0nir3Zw_BihzBikaqF3x9yKFnXN3eLs5KDck0QKdoAz6cRQ3Al7opiXxGVB2ldxjB-tX8o1YPYL0yS0DvH4KE31ud4SKcLMX3lhEZrIOx4Z_3gx8Q7acBVEeqXNLcIc54rrns8k3mR0pUiwhhxz2ZY4jbQo9GCPosn8lMl2qViZz88PQ-_AGohVv3d_C7uVguGecNA_OkAiLT3WYFg_kqJUKaYItQN71eRkRKwCaNBirV8HIkQ9sTcBNQRgd5mM6A3y7G5n7qjkJ_xoNwrNjGbYAodBtjGqc7ndTBY7iQVKURG7xi0c3AAHVE_j3k7PDrhoTwovnSFQnDLsZHKnW9mvnaZL7rb0EJ0pRZ98hXFhrYM0VSKDMjlf-hqVJhGC5odnmkhaKo01gN9oBWwTmacwbcf667-hNW3k-gxE102PLQVdqz1vTVBjbUfn5mu0kchiAaGTYEh1oUBR_d98ptKQU26U5BpbfnQKnRv4LitlQ1S9Wqy7e-j8jzzzXdg6nPH0pHzAb1Qrf2v6sOsde8gnBJIdGzH_7BzHtTWQxIJ-91AEkRtfZV9x8gM-hx-a1JquJ9Pn9s-Yum1hE2EiezzHUnel83ZOXCp_VUmsBqcX6btbLrTmwsrPctp7-0j5Vq0ok_PrUubKE9sHGl2QwRic0CnGq_h_gMrfWyGgkQlQigNC_fzUvgv27h-g-H0ibASr4a_wgbO2mQ_dk0BEpocKDvokeLeakcAb4sRs7ZYyv7Ldh3iL6uF16i2TnMUJv3NvhA8Okm33bUci

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 10 Feb 2022 14:57:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame BFC2 10 KB
11 KB 18ms
18ms Image
image/webp 178.250.0.139
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.139 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS