www.normaculta.com.br Open in urlscan Pro
146.19.95.66 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://normaculta.com.br/
Effective URL:
https://www.normaculta.com.br/
Submission: On March 02 via api (March 2nd 2023, 2:28:39 pm UTC) from US — Scanned from DE

Summary HTTP 217 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 73 IPs in 12 countries across 55 domains to perform 217 HTTP transactions. The main IP is 146.19.95.66, located in São Paulo, Brazil and belongs to EDGOO EDGOO NETWORKS, US. The main domain is www.normaculta.com.br.
TLS certificate: Issued by R3 on January 2nd 2023. Valid for: 3 months.

This is the only time www.normaculta.com.br was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 6	146.19.95.66 146.19.95.66	47787 (EDGOO EDG...) (EDGOO EDGOO NETWORKS)
8	2a00:1450:400... 2a00:1450:400d:80c::2002	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:400d:80c::2008	15169 (GOOGLE) (GOOGLE)
1	167.114.90.133 167.114.90.133	16276 (OVH) (OVH)
5	2001:4860:480... 2001:4860:4802:34::178	15169 (GOOGLE) (GOOGLE)
2 3	2606:4700::68... 2606:4700::6810:7aaf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
3	108.138.4.10 108.138.4.10	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:829::2002	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c06::9a	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400d:805::2003	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:400d:80c::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400d:80d::200e	15169 (GOOGLE) (GOOGLE)
1	108.138.4.150 108.138.4.150	16509 (AMAZON-02) (AMAZON-02)
1	143.204.89.24 143.204.89.24	16509 (AMAZON-02) (AMAZON-02)
1	104.86.47.65 104.86.47.65	16625 (AKAMAI-AS) (AKAMAI-AS)
2	2606:4700:10:... 2606:4700:10::6816:3456	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	52.20.67.201 52.20.67.201	14618 (AMAZON-AES) (AMAZON-AES)
1	13.32.110.123 13.32.110.123	16509 (AMAZON-02) (AMAZON-02)
1	141.95.33.111 141.95.33.111	16276 (OVH) (OVH)
2	162.19.138.82 162.19.138.82	16276 (OVH) (OVH)
2	158.69.248.161 158.69.248.161	16276 (OVH) (OVH)
33	2a00:1450:400... 2a00:1450:400d:80a::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:827::2004	15169 (GOOGLE) (GOOGLE)
1	34.102.146.192 34.102.146.192	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2a02:2638:3::3 2a02:2638:3::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2606:4700::68... 2606:4700::6810:5914	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	34.96.70.87 34.96.70.87	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	13.225.78.128 13.225.78.128	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:225... 2600:9000:2250:f600:a:e047:752:b361	16509 (AMAZON-02) (AMAZON-02)
1 21	2a00:1450:400... 2a00:1450:4001:827::2001	15169 (GOOGLE) (GOOGLE)
1	54.72.237.23 54.72.237.23	16509 (AMAZON-02) (AMAZON-02)
2	35.190.39.111 35.190.39.111	15169 (GOOGLE) (GOOGLE)
6	2a00:1450:400... 2a00:1450:4001:806::2002	15169 (GOOGLE) (GOOGLE)
2	52.17.150.184 52.17.150.184	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:831::2002	15169 (GOOGLE) (GOOGLE)
1 2	2a02:2638:3::c 2a02:2638:3::c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1 2	34.120.107.143 34.120.107.143	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	178.250.0.157 178.250.0.157	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
8 19	142.250.185.66 142.250.185.66	15169 (GOOGLE) (GOOGLE)
3 5	185.80.39.216 185.80.39.216	27381 (CASALE-MEDIA) (CASALE-MEDIA)
2 3	185.89.210.244 185.89.210.244	29990 (ASN-APPNEX) (ASN-APPNEX)
3	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1 4	104.111.217.42 104.111.217.42	16625 (AKAMAI-AS) (AKAMAI-AS)
4	108.138.5.230 108.138.5.230	16509 (AMAZON-02) (AMAZON-02)
1	2a02:26f0:350... 2a02:26f0:3500:11::215:14cb	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	13.32.99.43 13.32.99.43	16509 (AMAZON-02) (AMAZON-02)
4	34.250.199.12 34.250.199.12	16509 (AMAZON-02) (AMAZON-02)
4	138.201.63.164 138.201.63.164	24940 (HETZNER-AS) (HETZNER-AS)
1 4	88.99.219.174 88.99.219.174	24940 (HETZNER-AS) (HETZNER-AS)
3	99.86.4.17 99.86.4.17	16509 (AMAZON-02) (AMAZON-02)
1 1	145.239.193.130 145.239.193.130	16276 (OVH) (OVH)
1	88.198.250.30 88.198.250.30	24940 (HETZNER-AS) (HETZNER-AS)
1	2a0b:4d07:401::1 2a0b:4d07:401::1	44239 (PROINITY ...) (PROINITY PROINITY)
1 2	2a01:4f8:d0a:... 2a01:4f8:d0a:2321::2	24940 (HETZNER-AS) (HETZNER-AS)
1	49.12.22.42 49.12.22.42	24940 (HETZNER-AS) (HETZNER-AS)
1	18.169.231.46 18.169.231.46	16509 (AMAZON-02) (AMAZON-02)
1 2	142.250.184.230 142.250.184.230	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
1	18.66.15.100 18.66.15.100	16509 (AMAZON-02) (AMAZON-02)
1	13.225.78.118 13.225.78.118	16509 (AMAZON-02) (AMAZON-02)
4	2a00:1450:400... 2a00:1450:4001:80f::2003	15169 (GOOGLE) (GOOGLE)
2	2a02:fa8:8806... 2a02:fa8:8806:16::1370	41041 (VCLK-EU-SE) (VCLK-EU-SE)
1 2	2606:4700::68... 2606:4700::6812:19ad	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	3.33.220.150 3.33.220.150	16509 (AMAZON-02) (AMAZON-02)
2 2	37.157.5.142 37.157.5.142	198622 (ADFORM) (ADFORM)
1	35.227.252.103 35.227.252.103	15169 (GOOGLE) (GOOGLE)
2 2	13.248.245.213 13.248.245.213	16509 (AMAZON-02) (AMAZON-02)
3 4	185.94.180.126 185.94.180.126	35220 (SPOTX-AMS) (SPOTX-AMS)
2 2	3.75.62.37 3.75.62.37	16509 (AMAZON-02) (AMAZON-02)
11	2a00:1450:400... 2a00:1450:4001:812::2006	15169 (GOOGLE) (GOOGLE)
1 2	2001:678:cb4:... 2001:678:cb4:bbbb::11	56396 (AMOBEE) (AMOBEE)
2 2	3.124.88.238 3.124.88.238	16509 (AMAZON-02) (AMAZON-02)
1 1	2600:9000:211... 2600:9000:211e:b800:1b:5138:8a40:93a1	16509 (AMAZON-02) (AMAZON-02)
1	185.86.138.152 185.86.138.152	201081 (SMARTADSE...) (SMARTADSERVER)
1 1	185.89.210.212 185.89.210.212	29990 (ASN-APPNEX) (ASN-APPNEX)
2	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
217	73

6 146.19.95.66 (São Paulo, Brazil) 1 redirects

ASN47787 (EDGOO EDGOO NETWORKS, US)

normaculta.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.normaculta.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
static.normaculta.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:400d:80c::2002 (Ireland)

ASN15169 (GOOGLE, US)

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:400d:80c::2008 (Ireland)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 167.114.90.133 (Montreal, Canada)

ASN16276 (OVH, FR)
PTR: ip133.ip-167-114-90.net

eu.7gra.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2001:4860:4802:34::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6810:7aaf (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

unpkg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ampcid.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 108.138.4.10 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-4-10.fra56.r.cloudfront.net

c.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c06::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400d:805::2003 (Ireland)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:400d:80c::2001 (Ireland)

ASN15169 (GOOGLE, US)

07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400d:80d::200e (Ireland)

ASN15169 (GOOGLE, US)

ampcid.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 108.138.4.150 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-4-150.fra56.r.cloudfront.net

aax-dtb-cf.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.89.24 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-89-24.fra50.r.cloudfront.net

ats.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.86.47.65 (Berlin, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-86-47-65.deploy.static.akamaitechnologies.com

secure.cdn.fastclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::6816:3456 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.20.67.201 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-20-67-201.compute-1.amazonaws.com

prod.us-east-1.cxm-bcn.publisher-services.amazon.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.110.123 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-110-123.vie50.r.cloudfront.net

geo.privacymanager.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.95.33.111 (Germany)

ASN16276 (OVH, FR)
PTR: ns3203177.ip-141-95-33.eu

lb.eu-1-id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 162.19.138.82 (France)

ASN16276 (OVH, FR)
PTR: ns31532337.ip-162-19-138.eu

id5-sync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 158.69.248.161 (Montreal, Canada)

ASN16276 (OVH, FR)
PTR: ns542920.ip-158-69-248.net

7gra.us	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 2a00:1450:400d:80a::2002 (Ireland)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.102.146.192 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 192.146.102.34.bc.googleusercontent.com

oa.openxcdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638:3::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:5914 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.70.87 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 87.70.96.34.bc.googleusercontent.com

invstatic101.creativecdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.78.128 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-128.fra2.r.cloudfront.net

tags.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2250:f600:a:e047:752:b361 (United States)

ASN16509 (AMAZON-02, US)

cdn.prod.uidapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2a00:1450:4001:827::2001 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.72.237.23 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-72-237-23.eu-west-1.compute.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.39.111 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 111.39.190.35.bc.googleusercontent.com

esp.rtbhouse.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.17.150.184 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-150-184.eu-west-1.compute.amazonaws.com

as.euw1.jivox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:831::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638:3::c (France) 1 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.120.107.143 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 143.107.120.34.bc.googleusercontent.com

oajs.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.0.157 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

mug.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 142.250.185.66 (United States) 8 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s48-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 185.80.39.216 (Canada) 3 redirects

ASN27381 (CASALE-MEDIA, CA)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.89.210.244 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.98.64.218 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
google-bidout-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.111.217.42 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-217-42.deploy.static.akamaitechnologies.com

sync.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 108.138.5.230 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-5-230.fra56.r.cloudfront.net

playercdn.jivox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:11::215:14cb (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

code.createjs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 13.32.99.43 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-43.fra60.r.cloudfront.net

assets.euw1.jivox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.250.199.12 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-250-199-12.eu-west-1.compute.amazonaws.com

evs.euw1.jivox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 138.201.63.164 (Böblingen, Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.164.63.201.138.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 88.99.219.174 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.174.219.99.88.clients.your-server.de

hal900029.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 99.86.4.17 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-17.fra6.r.cloudfront.net

cdn.euw1.jivox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 145.239.193.130 (France) 1 redirects

ASN16276 (OVH, FR)

pv.medialead.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 88.198.250.30 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.88-198-250-30.clients.your-server.de

pb.media01.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a0b:4d07:401::1 (Switzerland)

ASN44239 (PROINITY PROINITY, CH)

adv.office-partner.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a01:4f8:d0a:2321::2 (Gunzenhausen, Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)

cdn.retailads.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 49.12.22.42 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: lb-3.futalis.de

futalis.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.169.231.46 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-169-231-46.eu-west-2.compute.amazonaws.com

track.webgains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.184.230 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f6.1e100.net

5994599.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.15.100 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-15-100.vie50.r.cloudfront.net

analytics.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.78.118 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-118.fra2.r.cloudfront.net

cdn.track.production.webgains.team	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:fa8:8806:16::1370 (Singapore)

ASN41041 (VCLK-EU-SE, US)

dclk-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:19ad (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.33.220.150 (United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 37.157.5.142 (Denmark) 2 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.252.103 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 103.252.227.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.248.245.213 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com

eb2.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.94.180.126 (Amsterdam, Netherlands) 3 redirects

ASN35220 (SPOTX-AMS, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.75.62.37 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-75-62-37.eu-central-1.compute.amazonaws.com

ups.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2a00:1450:4001:812::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s0.2mdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:678:cb4:bbbb::11 (United Kingdom) 1 redirects

ASN56396 (AMOBEE, GB)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.124.88.238 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-88-238.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:211e:b800:1b:5138:8a40:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.ad.smaato.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.86.138.152 (France)

ASN201081 (SMARTADSERVER, FR)

ssbsync.smartadserver.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.89.210.212 (Frankfurt am Main, Germany) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

googleads4.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
59	googlesyndication.com 1 redirects 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 102 tpc.googlesyndication.com — Cisco Umbrella Rank: 140	440 KB
39	doubleclick.net 9 redirects securepubads.g.doubleclick.net — Cisco Umbrella Rank: 184 stats.g.doubleclick.net — Cisco Umbrella Rank: 77 googleads.g.doubleclick.net — Cisco Umbrella Rank: 35 cm.g.doubleclick.net — Cisco Umbrella Rank: 202 5994599.fls.doubleclick.net — Cisco Umbrella Rank: 221779 googleads4.g.doubleclick.net — Cisco Umbrella Rank: 319	284 KB
17	jivox.com as.euw1.jivox.com — Cisco Umbrella Rank: 181210 playercdn.jivox.com — Cisco Umbrella Rank: 3751 assets.euw1.jivox.com — Cisco Umbrella Rank: 195723 evs.euw1.jivox.com — Cisco Umbrella Rank: 180105 cdn.euw1.jivox.com — Cisco Umbrella Rank: 238432	1 MB
11	2mdn.net s0.2mdn.net — Cisco Umbrella Rank: 271	198 KB
8	redintelligence.net 1 redirects hal9000.redintelligence.net — Cisco Umbrella Rank: 35870 hal900029.redintelligence.net — Cisco Umbrella Rank: 276050	56 KB
8	google.com ampcid.google.com — Cisco Umbrella Rank: 2216 adservice.google.com — Cisco Umbrella Rank: 73 region1.analytics.google.com — Cisco Umbrella Rank: 4370 www.google.com — Cisco Umbrella Rank: 2	3 KB
6	openx.net 1 redirects oajs.openx.net — Cisco Umbrella Rank: 2450 us-u.openx.net — Cisco Umbrella Rank: 422 google-bidout-d.openx.net — Cisco Umbrella Rank: 2399 rtb.openx.net — Cisco Umbrella Rank: 1367	1 KB
6	normaculta.com.br 1 redirects normaculta.com.br www.normaculta.com.br static.normaculta.com.br	33 KB
5	casalemedia.com 3 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 531 ssum-sec.casalemedia.com — Cisco Umbrella Rank: 431	4 KB
5	google.de adservice.google.de — Cisco Umbrella Rank: 8947 www.google.de — Cisco Umbrella Rank: 6149 ampcid.google.de — Cisco Umbrella Rank: 66651	2 KB
5	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 30	20 KB
4	spotxchange.com 3 redirects sync.search.spotxchange.com — Cisco Umbrella Rank: 709	2 KB
4	gstatic.com fonts.gstatic.com www.gstatic.com	43 KB
4	teads.tv 1 redirects sync.teads.tv — Cisco Umbrella Rank: 1218	799 B
4	adnxs.com 3 redirects ib.adnxs.com — Cisco Umbrella Rank: 203 secure.adnxs.com — Cisco Umbrella Rank: 377	4 KB
4	id5-sync.com cdn.id5-sync.com — Cisco Umbrella Rank: 912 id5-sync.com — Cisco Umbrella Rank: 404	35 KB
4	amazon-adsystem.com c.amazon-adsystem.com — Cisco Umbrella Rank: 282 aax-dtb-cf.amazon-adsystem.com — Cisco Umbrella Rank: 476	60 KB
3	criteo.com 1 redirects gum.criteo.com — Cisco Umbrella Rank: 378 mug.criteo.com — Cisco Umbrella Rank: 2719	7 KB
3	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 183	146 KB
3	unpkg.com 2 redirects unpkg.com — Cisco Umbrella Rank: 761	3 KB
3	7gra.us eu.7gra.us — Cisco Umbrella Rank: 149987 7gra.us — Cisco Umbrella Rank: 85086	7 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 44	164 KB
2	bidswitch.net 2 redirects x.bidswitch.net — Cisco Umbrella Rank: 277	1 KB
2	turn.com 1 redirects ad.turn.com — Cisco Umbrella Rank: 755 r.turn.com — Cisco Umbrella Rank: 3104	869 B
2	yahoo.com 2 redirects ups.analytics.yahoo.com — Cisco Umbrella Rank: 265	569 B
2	3lift.com 2 redirects eb2.3lift.com — Cisco Umbrella Rank: 338	951 B
2	adform.net 2 redirects c1.adform.net — Cisco Umbrella Rank: 590	1 KB
2	tribalfusion.com 1 redirects a.tribalfusion.com — Cisco Umbrella Rank: 741 s.tribalfusion.com — Cisco Umbrella Rank: 1813	1 KB
2	dotomi.com dclk-match.dotomi.com — Cisco Umbrella Rank: 2856	207 B
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 36	2 KB
2	retailads.net 1 redirects cdn.retailads.net — Cisco Umbrella Rank: 105848	6 KB
2	rtbhouse.com esp.rtbhouse.com — Cisco Umbrella Rank: 3797	315 B
2	crwdcntrl.net tags.crwdcntrl.net — Cisco Umbrella Rank: 1183 bcp.crwdcntrl.net — Cisco Umbrella Rank: 858	10 KB
2	amazon.dev prod.us-east-1.cxm-bcn.publisher-services.amazon.dev — Cisco Umbrella Rank: 673	458 B
1	smartadserver.com ssbsync.smartadserver.com — Cisco Umbrella Rank: 782	75 B
1	smaato.net 1 redirects s.ad.smaato.net — Cisco Umbrella Rank: 701	438 B
1	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 296	265 B
1	webgains.team cdn.track.production.webgains.team — Cisco Umbrella Rank: 46652	3 KB
1	webgains.io analytics.webgains.io — Cisco Umbrella Rank: 18601	31 KB
1	webgains.com track.webgains.com — Cisco Umbrella Rank: 40433	2 KB
1	futalis.de futalis.de — Cisco Umbrella Rank: 158522	401 B
1	office-partner.de adv.office-partner.de — Cisco Umbrella Rank: 132014	931 B
1	media01.eu pb.media01.eu — Cisco Umbrella Rank: 48696	628 B
1	medialead.de 1 redirects pv.medialead.de — Cisco Umbrella Rank: 49470	591 B
1	createjs.com code.createjs.com — Cisco Umbrella Rank: 1288	63 KB
1	uidapi.com cdn.prod.uidapi.com — Cisco Umbrella Rank: 2734	2 KB
1	creativecdn.com invstatic101.creativecdn.com — Cisco Umbrella Rank: 3461	2 KB
1	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 339	1 KB
1	criteo.net static.criteo.net — Cisco Umbrella Rank: 625	13 KB
1	openxcdn.net oa.openxcdn.net — Cisco Umbrella Rank: 2643	8 KB
1	eu-1-id5-sync.com lb.eu-1-id5-sync.com — Cisco Umbrella Rank: 995	408 B
1	privacymanager.io geo.privacymanager.io — Cisco Umbrella Rank: 1686	596 B
1	fastclick.net secure.cdn.fastclick.net — Cisco Umbrella Rank: 1140	17 KB
1	rlcdn.com ats.rlcdn.com — Cisco Umbrella Rank: 1772	36 KB
0	ad-server.eu Failed ad-server.eu Failed
217	55

	Domain	Requested by
33	pagead2.googlesyndication.com	securepubads.g.doubleclick.net 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com www.normaculta.com.br
21	tpc.googlesyndication.com	1 redirects securepubads.g.doubleclick.net 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com tpc.googlesyndication.com googleads.g.doubleclick.net
19	cm.g.doubleclick.net	8 redirects googleads.g.doubleclick.net 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
11	s0.2mdn.net	www.normaculta.com.br s0.2mdn.net 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
8	securepubads.g.doubleclick.net	www.normaculta.com.br securepubads.g.doubleclick.net
6	googleads.g.doubleclick.net	07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com pagead2.googlesyndication.com
5	07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com	securepubads.g.doubleclick.net
5	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com www.normaculta.com.br
4	sync.search.spotxchange.com	3 redirects googleads.g.doubleclick.net
4	hal900029.redintelligence.net	1 redirects 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com hal900029.redintelligence.net
4	hal9000.redintelligence.net	07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com hal900029.redintelligence.net
4	evs.euw1.jivox.com	as.euw1.jivox.com 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
4	assets.euw1.jivox.com	as.euw1.jivox.com
4	playercdn.jivox.com	as.euw1.jivox.com
4	sync.teads.tv	1 redirects googleads.g.doubleclick.net 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
4	dsum-sec.casalemedia.com	2 redirects googleads.g.doubleclick.net
4	www.google.com	tpc.googlesyndication.com 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
4	static.normaculta.com.br	www.normaculta.com.br static.normaculta.com.br
3	fonts.gstatic.com	fonts.googleapis.com
3	cdn.euw1.jivox.com	as.euw1.jivox.com
3	ib.adnxs.com	2 redirects googleads.g.doubleclick.net
3	www.googletagservices.com	07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
3	c.amazon-adsystem.com	www.normaculta.com.br c.amazon-adsystem.com
3	unpkg.com	2 redirects www.normaculta.com.br
3	www.googletagmanager.com	www.normaculta.com.br www.googletagmanager.com adv.office-partner.de
2	googleads4.g.doubleclick.net	www.normaculta.com.br
2	x.bidswitch.net	2 redirects
2	ups.analytics.yahoo.com	2 redirects
2	eb2.3lift.com	2 redirects
2	c1.adform.net	2 redirects
2	dclk-match.dotomi.com	07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
2	fonts.googleapis.com	hal900029.redintelligence.net 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
2	5994599.fls.doubleclick.net	1 redirects www.normaculta.com.br
2	cdn.retailads.net	1 redirects futalis.de
2	us-u.openx.net	googleads.g.doubleclick.net
2	oajs.openx.net	1 redirects
2	gum.criteo.com	1 redirects static.criteo.net
2	as.euw1.jivox.com	07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com as.euw1.jivox.com
2	esp.rtbhouse.com	invstatic101.creativecdn.com
2	7gra.us	www.normaculta.com.br static.normaculta.com.br
2	id5-sync.com	cdn.id5-sync.com
2	prod.us-east-1.cxm-bcn.publisher-services.amazon.dev	c.amazon-adsystem.com
2	cdn.id5-sync.com	www.normaculta.com.br securepubads.g.doubleclick.net
2	www.google.de	www.normaculta.com.br
2	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
2	adservice.google.com	securepubads.g.doubleclick.net 5994599.fls.doubleclick.net
2	adservice.google.de	securepubads.g.doubleclick.net
1	secure.adnxs.com	1 redirects
1	ssbsync.smartadserver.com	07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
1	s.ad.smaato.net	1 redirects
1	r.turn.com	07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
1	ad.turn.com	1 redirects
1	ssum-sec.casalemedia.com	1 redirects
1	rtb.openx.net	07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
1	match.adsrvr.org	07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
1	s.tribalfusion.com
1	a.tribalfusion.com	1 redirects
1	www.gstatic.com	07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
1	cdn.track.production.webgains.team	07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
1	analytics.webgains.io	track.webgains.com
1	track.webgains.com	www.normaculta.com.br
1	futalis.de	hal900029.redintelligence.net
1	adv.office-partner.de	hal900029.redintelligence.net
1	pb.media01.eu	hal900029.redintelligence.net
1	pv.medialead.de	1 redirects
1	code.createjs.com	as.euw1.jivox.com
1	google-bidout-d.openx.net	oa.openxcdn.net
1	mug.criteo.com
1	bcp.crwdcntrl.net	tags.crwdcntrl.net
1	cdn.prod.uidapi.com	securepubads.g.doubleclick.net
1	tags.crwdcntrl.net	securepubads.g.doubleclick.net
1	invstatic101.creativecdn.com	securepubads.g.doubleclick.net
1	cdn.jsdelivr.net	securepubads.g.doubleclick.net
1	static.criteo.net	securepubads.g.doubleclick.net
1	oa.openxcdn.net	securepubads.g.doubleclick.net
1	lb.eu-1-id5-sync.com	cdn.id5-sync.com
1	geo.privacymanager.io	ats.rlcdn.com
1	secure.cdn.fastclick.net	www.normaculta.com.br
1	ats.rlcdn.com	www.normaculta.com.br
1	aax-dtb-cf.amazon-adsystem.com	c.amazon-adsystem.com
1	ampcid.google.de	www.google-analytics.com
1	region1.analytics.google.com	www.googletagmanager.com
1	ampcid.google.com	www.google-analytics.com
1	eu.7gra.us	www.normaculta.com.br
1	www.normaculta.com.br
1	normaculta.com.br	1 redirects
0	ad-server.eu Failed	07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
217	87

This site contains links to these domains. Also see Links.

Domain
www.7graus.com

Subject Issuer	Validity	Valid
normaculta.com.br R3	`2023-01-02` - `2023-04-02`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
eu.7gra.us R3	`2023-02-14` - `2023-05-15`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
c.amazon-adsystem.com Amazon	`2022-05-09` - `2023-04-18`	a year	crt.sh
*.google.de GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com Amazon	`2022-06-15` - `2023-06-15`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2023-02-02` - `2024-03-03`	a year	crt.sh
secure.cdn.fastclick.net DigiCert TLS RSA SHA256 2020 CA1	`2022-12-02` - `2023-12-02`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-06-07` - `2023-06-06`	a year	crt.sh
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev Amazon RSA 2048 M02	`2022-12-27` - `2024-01-25`	a year	crt.sh
*.privacymanager.io Amazon	`2022-08-26` - `2023-09-24`	a year	crt.sh
*.eu-1-id5-sync.com R3	`2023-01-25` - `2023-04-25`	3 months	crt.sh
*.id5-sync.com R3	`2023-01-25` - `2023-04-25`	3 months	crt.sh
7gra.us R3	`2023-01-24` - `2023-04-24`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
oa.openxcdn.net GTS CA 1D4	`2023-01-29` - `2023-04-29`	3 months	crt.sh
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-13` - `2023-04-15`	3 months	crt.sh
invstatic101.creativecdn.com GTS CA 1D4	`2023-02-28` - `2023-05-29`	3 months	crt.sh
*.crwdcntrl.net Go Daddy Secure Certificate Authority - G2	`2022-05-01` - `2023-06-02`	a year	crt.sh
cdn.prod.uidapi.com R3	`2023-02-25` - `2023-05-26`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
esp.rtbhouse.com GTS CA 1D4	`2023-01-21` - `2023-04-21`	3 months	crt.sh
*.app.euw1.jivox.com Amazon RSA 2048 M02	`2023-02-10` - `2023-12-15`	10 months	crt.sh
*.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-04` - `2023-03-31`	3 months	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2022-07-21` - `2023-08-21`	a year	crt.sh
teads.tv R3	`2023-02-21` - `2023-05-22`	3 months	crt.sh
*.jivox.com DigiCert TLS RSA SHA256 2020 CA1	`2022-05-13` - `2023-06-13`	a year	crt.sh
tls.adobe.com DigiCert TLS RSA SHA256 2020 CA1	`2022-04-29` - `2023-05-30`	a year	crt.sh
euw1.jivox.com Amazon RSA 2048 M01	`2023-02-22` - `2023-12-11`	10 months	crt.sh
redintelligence.net R3	`2023-02-08` - `2023-05-09`	3 months	crt.sh
*.media01.eu RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2022-05-20` - `2023-05-21`	a year	crt.sh
adv.office-partner.de R3	`2023-01-01` - `2023-04-01`	3 months	crt.sh
*.futalis.de R3	`2023-02-16` - `2023-05-17`	3 months	crt.sh
*.webgains.com Amazon RSA 2048 M01	`2023-02-22` - `2023-07-13`	5 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
cdn.retailads.net Encryption Everywhere DV TLS CA - G1	`2022-06-17` - `2023-06-18`	a year	crt.sh
*.webgains.io Amazon	`2022-08-23` - `2023-09-21`	a year	crt.sh
cdn.track.production.webgains.team Amazon RSA 2048 M01	`2023-02-28` - `2023-10-28`	8 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-02-08` - `2023-05-03`	3 months	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2022-08-09` - `2023-09-10`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2022-03-31` - `2023-05-02`	a year	crt.sh
*.smartadserver.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2023-01-21` - `2024-01-23`	a year	crt.sh

This page contains 27 frames:

Primary Page: https://www.normaculta.com.br/
Frame ID: 65F53B323D7DC01B620634F1D01D783D
Requests: 60 HTTP requests in this frame

Frame: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: E05A01B70F63516F290A8E93499204D3
Requests: 1 HTTP requests in this frame

Frame: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 48675B7C44506C5B479CCF5C1E129A1F
Requests: 16 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI-DLxCv7fgBGMXf39MBMAE&v=APEucNWKfA-GbPJBJgRj7tI-wkB420sL-DcH_V-mBnebLwrDVi73lqnNL-3wMj64vW1_dKHQ16tk7P4CelxGk20XSjiB4xASqWaO2rLByT8qsq6y51rLRPTZfKKifLLpjcN6bYwqpJYm1NpW1t4dHmITMS2yLv187tnRky0kHGS8twUmt8Swy0E
Frame ID: 1CBF012BA46F837EB06707B0B2E8AC73
Requests: 5 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.normaculta.com.br
Frame ID: A6E885F7EB6E14707F9A2065ACDF2EB3
Requests: 2 HTTP requests in this frame

Frame: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 677338BAE68520046BF915DC467082A6
Requests: 18 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: D80C0AC6FB739F722C6AA7210BAC25CF
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 8803B4637250B16DA53A1DD4ED48F144
Requests: 2 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNU3Uu9a1_M0HB8kPdmMTsAEmiI7EXFojQO_x_nTgfSw0XQUvl6kezt8UNcVUtN-ypFcPU1T7TQfaWdqwakE5MY9ZJ9awvOJAJhm9FyjsizHZrTW_v1kEgNe6EDi2nsgBydD3Ni3lZgT0pfdnXFXhzCSfIryGOqm4WGewh5LIWWsk4VLWuI
Frame ID: 72134881710ED67C270CFF9EAD98CA8F
Requests: 5 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: E6A56F7D423C0A5697CB91DE75CE745B
Requests: 3 HTTP requests in this frame

Frame: https://as.euw1.jivox.com/unit/layout_renderer.php?es_pId=29ba8ce&isDynamic=1&campaignId=159897&gdpr_consent=&dspId=DBM&bDim=300x600&ap_DataSignal1=18269839860&jvxVer=2&gdpr=&bUnitId=2200&r=1677767313119433&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCethXkbIAZImlB6Km3gP594L4CcW_pLtugKPL290Q99KivcABEAEglov5G2CV4pCCoAegAebj3ukCyAEJqQIBTfXXC9OxPqgDAaoE9QFP0FAy42Q5XqnzbLMfOD3A25XsrFM9Vqm4KiY9TqgjsRMVc6mC-ml_TUc_RDVzfGERZ2sdFpdkNhJWJvUBKUwBGHuok82JNe1SJAeV4UnbSALc51989DR7tLtLtCaU0qun_ArEhXIUJlQD-viRcteUgA_upAg-ulVMXlBVIkoSPGhqRS4OEisBdSU49R3hErotkSS6aR9qC7nSrCNRsod3CCGDe4x5_KefsPqzDui8FVazkHNV0KSAXJodiH-QpRFt9fkHKQUnqD-10krq3bf0pyGGf9CDQ0FSgKEvq0tVcW9lHXnnqpr9ueuLQ8JKcvKDct9ecsAEkdWLvZIE4AQDkAYBoAZNgAeCnKGWAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATrv_oEdATANgTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSSwDUE5ymuHIv-7LgktZ2daLfOnEztA_uDSjNDPz3tRVtVmTVIS3FLgxSYNQ-KQFedQvkHIVIV0oicbUBHeS4T59YmPTAkbmKZt9FSBgB%26sig%3DAOD64_0ti9CWBr5iyckF5ICZRzooWrls2g%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-AkC6NJc8SUnqcI3jQJGTXlTqCoZsM_7FjwMhVQ6uC1rys_3keXF7n4nN5bVEwWhKl6MG9OwsMXL1gON-y5EuPYjBo2Xyxi6Z9CPKeUEU2oksu7LNF0Unl7M34f0GFTDu5GjExRsPwIx1wrSmKIjBfVwPehP6Cab2bZUiGoW9YD59fFfdk%26cry%3D1%26dbm_d%3DAKAmf-Aa-pjgaw9NJCJ908QgMQFBAJBCXMCT_0XpDKtY2ObS4-wTQTjb2G9N1kLPdL4_WR2TDxX2gOYDpy2_iBj8DerP7pUanVmhzOOKy9nc8BPLghiZt98avrsCLK5dFtiX3mP-Q1TMUx6iEI7izrDPEqwNBFRFiEDNokhK7_y602cRSn-5U7LrRrbv_juJE1cCVJ0EZWm004gktzBN_hNRlz99jtjxhsQ6Uel7t7_y6gzDF4js2ki10yKpwMQMv6qImTsYbPkYVDCePRveADRHLa4BirF-n2SYHYjWY8ejFpnzYv3Jcq5xKNBONwF6JT7B8PA1qF0JyFYqwLkVtLenj2zf3etOsr3wAQZ0gWZ6FfJ1oTfjhR_7tKtq5jYLx2VUfdWqfC26U2gYGdlUk0cKh5B84T2q5E0cKQki4zNB2SFv6mroWe3u_rz39oK5gh8ijNhNJ3Obick6ygANrjI7aVAtvu-yatBbQ9JV4kMx_si1t2dHWgy9gUAArKoYYE9eok9Zp-z9bm1WW0EG01m5Ifzf9M2kUiCBXc28QD9Iusvs6MldYVw%26adurl%3D&us_privacy=%24%7BUS_PRIVACY%7D&ts_pId=29ba8ce&siteId=961ee94c58df6c&creativeUnitType=22&objectName=jvx_6400b291b0976&adUnitId=2200&jvxSessionId=1677767313.9651&base=1&creativeResolveBeginTime=1677767314000&omid=0&localTimeOffset=0&pageURL=https%3A%2F%2F07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Frame ID: 06A8B1FC320F1094077725039CDB48DE
Requests: 7 HTTP requests in this frame

Frame: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Frame ID: 6A95153A6AC17A9A414BE0B52113405D
Requests: 1 HTTP requests in this frame

Frame: https://playercdn.jivox.com/1651821427/widgets/jivoxWidgetApi/gz/jivoxWidgetApiV2.min.js
Frame ID: 283B6BECB52B63AE217B7B6A0D28F597
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: F5ACB049256ADCC9422B9A6436A314E4
Requests: 3 HTTP requests in this frame

Frame: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=10184700101160304444554012251029&actionid=981741&produktid=&dt_url=
Frame ID: 786AF8BF07BEA1AEED1E776D1969A5FB
Requests: 1 HTTP requests in this frame

Frame: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Frame ID: 86F1BBC943919B8911BE7E91D4185009
Requests: 2 HTTP requests in this frame

Frame: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=2342307533
Frame ID: ABE4A713A49B47CB46B65976BADE3AD7
Requests: 2 HTTP requests in this frame

Frame: https://5994599.fls.doubleclick.net/activityi;dc_pre=CISsvqa6vf0CFbnKOwIdw6ULrA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8384233870674.873
Frame ID: 0D0CC16AFB38C0784D5DDC6CE59CD786
Requests: 2 HTTP requests in this frame

Frame: https://hal900029.redintelligence.net/request_content.php?s=10184700101160304444554012251029&a=487b44c1
Frame ID: 4183E4CC9A481292B3A2B68E5B828F4E
Requests: 8 HTTP requests in this frame

Frame: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: 4DCB2D85873BC7117D4990F9FD59361C
Requests: 15 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 93FDBDA9E29984C635DFE246EB564ED9
Requests: 9 HTTP requests in this frame

Frame: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Frame ID: D57628425116E6CAD610DF04C2FE997B
Requests: 19 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGOnz9uABMAE&v=APEucNVXrF7NK1w4W1xv8Vg74PlJ15S6XW90jhg50WOnBVXdWcZ58XVK_KbLElgOUHufAQ-LRjT6ZG3tJqQo7DIorLdrv7b1Yuz_0rD-b6JhKY-NoSHtzCrWPKtbAAuX38rYdB_U3pPanoYv8-AMMbjMQZ_KZ6qJiGjqwcdfbZ9cGfPO9wl6A4E
Frame ID: CD20E7CD3E08A7BA0BE9E7544E8A9E82
Requests: 4 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/U1KVG_mJ4Y43Q94sC__L5Y27Ilp_TqM8IF3zBLVmW9g.js
Frame ID: 2D83724D3AEFF62EF62F31C494455FE2
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 2973870DD3F81F2C5C7F40720AABA172
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: D968717A98F83DD48D087AA63AC839BD
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/11308741736642966965/index.html
Frame ID: BB88855535C5E93E5DED23DB565FC2EE
Requests: 10 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Português - Língua Portuguesa - Norma Culta

Page URL History Show full URLs

http://normaculta.com.br/ HTTP 307
https://normaculta.com.br/ HTTP 301
https://www.normaculta.com.br/ Page URL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

DoubleClick Campaign Manager (DCM) (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

2mdn\.net

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/
2mdn\.net

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Webgains (Affiliate programs) Expand

Overall confidence: 100%
Detected patterns

analytics\.webgains\.io

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

217
Requests

88 %
HTTPS

41 %
IPv6

55
Domains

87
Subdomains

73
IPs

12
Countries

2981 kB
Transfer

6095 kB
Size

37
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.7graus.com/
Title: 7Graus

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://normaculta.com.br/ HTTP 307
https://normaculta.com.br/ HTTP 301
https://www.normaculta.com.br/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10

https://unpkg.com/web-vitals HTTP 302
https://unpkg.com/web-vitals@3.1.1 HTTP 302
https://unpkg.com/web-vitals@3.1.1/dist/web-vitals.iife.js

Request Chain 65

https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.normaculta.com.br%2F&rid=esp HTTP 302
https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.normaculta.com.br%2F&rid=esp&cc=1

Request Chain 66

https://gum.criteo.com/sid/json?origin=publishertagids&domain=normaculta.com.br&sn=ChromeSyncframe&so=0&topUrl=www.normaculta.com.br&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
https://mug.criteo.com/sid?cpp=ANxvCHxPT2dDYzVlVUwwMlJmSUhKYkxLK25TajU3YlZUSFhJS3YreUw5RmxwMVBBcmovSHJTcDA1Ti9kQUtsdWR3K3hDOFI1RjkrWm5JVUd2VDRUVUpnM3oybTBDc0VMRHlITWo2SnFhWk9DNU1iSityWG94OXkyNmsrL0N2M1J3cVNxbkVGZVhlNzZ5aTBFQjI3aEJqVXlRM29ubGtiUWppVDJ5cEZFdXhWQm9HcWpRWWNRN3NzWmFHRlA5bHNGRHRvYUdhYWJUbStwWlUrUE1EcjJxVlRqQjg0Y0F2eHNwbVRBazJkcnhPWG05YlVOUXl3UitmcVZIMTNnTEQvcXdLZUpSSHl3ZFkwd3J3WjBXU3RoWlIyRmFhQT09fA&cppv=2

Request Chain 74

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIofYQBLKv6gyKRqlWdfV9Y&google_cver=1

Request Chain 75

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZACykvdTPwzYZBuhxfTOwAAA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIofYQBLKv6gyKRqlWdfV9Y&google_cver=1

Request Chain 76

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
https://ib.adnxs.com/setuid?entity=101&code=CAESEAccQIMdWzKRwH3eEG9fcXc&google_cver=1

Request Chain 77

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjMwOTgyMTA2NzIzOTc2NTUzMQ%3D%3D

Request Chain 92

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEN18lK5wzLw9XhJ0uz1N14A&google_cver=1

Request Chain 94

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
https://sync.teads.tv/um?eid=3&uid=CAESEIORxYD45mf7niMyWVsnEp8&google_cver=1

Request Chain 117

https://hal900029.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=4d04425c1e&subid=&uid=03193bfd0c76275f&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCs2PxkbIAZKfAHYPT3gOJ-JYQpuW9oGmtlZynyQ_wLhABIJaL-RtgleKQgqAHyAEJqQIg2X_MoNixPqgDAaoE8gFP0E85c8SvIpwVsjYF-QoYx0SPoWb4KH4k1oGXky6jvjOK_ZVsY-bX0OOm1DXHIpo4NX_O94UTVDt4iSMBRGu1aSUxseJjcN35XFidn7VzvOZAL0R-go-FCTO1wq-VjETezsgDUsEwnhYyRr-H7SqAntB2a28fZnn3_WDlo1pVY8mQZ21Zb0gvO_TPK9-J29NrDirpYD7ZdH4gp4EEA7-kK9atvEvY9AHotSOMMBtCS3n0kgdZZcB9tSHLZiohg7xQHwq_lrC4XE4GkbKwdS4RivqdTUzfAwsxKFIhgURcajtuVF7NSTGe79GZxbT-zNjOWMAE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATj7XRDtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTADUE5ymtqRW3NKjQlof8F0--41KGCJmlHMZqCahStUSi9khsC1oNZ54Xfw4dga7pwORmAu1pSsZxQYBRxUIS3KUUk59EhmCNd7casMYAQ%26sig%3DAOD64_0wvjlwPpm4T4hL68bJeTRGG-sFxA%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-DiykL71Oqe417cwi5nZ-hADxOMDNp5KNDGhHn0v5DI6QKZbAH_2s__ywLvgHQbQMRxDHL0QhaZofltHhdpMUGYVI28pVZ02Gsw40PL1VcKkTcU_q0Oqlpen8P-hLuXce7pkUIjQfCwk0fUtvCrPua6ytAxMje4AnjLzkfChjshtx8ynq4%26cry%3D1%26dbm_d%3DAKAmf-A33lq2C9xf4FSueoNjcuUfkyQENSYmR7Ens0BD8tOunXghay5Ylz1Gii_gwuMVk72EaXicECwNqLerL4Jk9ISyuNNBwYde2S6AS6yl3n_7Z_TY0R8IGwcG2i69_gL-KONVsWXKi0aMFPGag92lHnas7sqV0BRxIDZV17sKnAAw8DjuZvgXvXMcxlIzfb4awrvoNMwR5Ot2l0odw1oryFgyHMuGNKdC2uSDDMElzuYWXoSx-ZOiNR19AIFGegpgkbOvVSyAI_szsV0c1cyujxn1y3dlYiqiDVvdTn_3LSP2Y9p9Bq4U0efGjs5pmcZrevAYq6oWRDwm6Uf_NgIWAMIrO9PKAmTDS7dOmgSM4yiDTE5o0zxkfJhTv9mhReiVjhKEOh5SmyEyL3omGkTDpw1dwVe9JZNkSuYm2OthIbXVwWuOrD81QWbljYUev87DqCTJCU6KKITj0M-fd-sd5U3gXTGF7U3mV7AhDRcbjL00kIiiwQEKiJy5HdhahpAfZhoM0ku87-GqxRbIGOP8ffRuZQ78PsFFhqwvwFM9iMYHo5x_tWw%26adurl%3D&documentReferer=https%3A%2F%2Fwww.normaculta.com.br%2F&ancestorOrigins=https%3A%2F%2Fwww.normaculta.com.br&random=5634855285187&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal900029.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=4d04425c1e&subid=&uid=03193bfd0c76275f&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCs2PxkbIAZKfAHYPT3gOJ-JYQpuW9oGmtlZynyQ_wLhABIJaL-RtgleKQgqAHyAEJqQIg2X_MoNixPqgDAaoE8gFP0E85c8SvIpwVsjYF-QoYx0SPoWb4KH4k1oGXky6jvjOK_ZVsY-bX0OOm1DXHIpo4NX_O94UTVDt4iSMBRGu1aSUxseJjcN35XFidn7VzvOZAL0R-go-FCTO1wq-VjETezsgDUsEwnhYyRr-H7SqAntB2a28fZnn3_WDlo1pVY8mQZ21Zb0gvO_TPK9-J29NrDirpYD7ZdH4gp4EEA7-kK9atvEvY9AHotSOMMBtCS3n0kgdZZcB9tSHLZiohg7xQHwq_lrC4XE4GkbKwdS4RivqdTUzfAwsxKFIhgURcajtuVF7NSTGe79GZxbT-zNjOWMAE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATj7XRDtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTADUE5ymtqRW3NKjQlof8F0--41KGCJmlHMZqCahStUSi9khsC1oNZ54Xfw4dga7pwORmAu1pSsZxQYBRxUIS3KUUk59EhmCNd7casMYAQ%26sig%3DAOD64_0wvjlwPpm4T4hL68bJeTRGG-sFxA%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-DiykL71Oqe417cwi5nZ-hADxOMDNp5KNDGhHn0v5DI6QKZbAH_2s__ywLvgHQbQMRxDHL0QhaZofltHhdpMUGYVI28pVZ02Gsw40PL1VcKkTcU_q0Oqlpen8P-hLuXce7pkUIjQfCwk0fUtvCrPua6ytAxMje4AnjLzkfChjshtx8ynq4%26cry%3D1%26dbm_d%3DAKAmf-A33lq2C9xf4FSueoNjcuUfkyQENSYmR7Ens0BD8tOunXghay5Ylz1Gii_gwuMVk72EaXicECwNqLerL4Jk9ISyuNNBwYde2S6AS6yl3n_7Z_TY0R8IGwcG2i69_gL-KONVsWXKi0aMFPGag92lHnas7sqV0BRxIDZV17sKnAAw8DjuZvgXvXMcxlIzfb4awrvoNMwR5Ot2l0odw1oryFgyHMuGNKdC2uSDDMElzuYWXoSx-ZOiNR19AIFGegpgkbOvVSyAI_szsV0c1cyujxn1y3dlYiqiDVvdTn_3LSP2Y9p9Bq4U0efGjs5pmcZrevAYq6oWRDwm6Uf_NgIWAMIrO9PKAmTDS7dOmgSM4yiDTE5o0zxkfJhTv9mhReiVjhKEOh5SmyEyL3omGkTDpw1dwVe9JZNkSuYm2OthIbXVwWuOrD81QWbljYUev87DqCTJCU6KKITj0M-fd-sd5U3gXTGF7U3mV7AhDRcbjL00kIiiwQEKiJy5HdhahpAfZhoM0ku87-GqxRbIGOP8ffRuZQ78PsFFhqwvwFM9iMYHo5x_tWw%26adurl%3D&documentReferer=https%3A%2F%2Fwww.normaculta.com.br%2F&ancestorOrigins=https%3A%2F%2Fwww.normaculta.com.br&random=5634855285187&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 126

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=10184700101160304444554012251029&t=htlp HTTP 302
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=10184700101160304444554012251029&actionid=981741&produktid=&dt_url=

Request Chain 128

https://cdn.retailads.net/tb.php?t=150337V2172132532M&subid=10184700101160304444554012251029&ra_cnt_active=1&ra_cnt=1 HTTP 302
https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=2342307533

Request Chain 130

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8384233870674.873 HTTP 302
https://5994599.fls.doubleclick.net/activityi;dc_pre=CISsvqa6vf0CFbnKOwIdw6ULrA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8384233870674.873

Request Chain 132

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=10184700101160304444554012251029 HTTP 302
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=10184700101160304444554012251029 HTTP 302
https://ad-server.eu/wm/pb/native.png

Request Chain 160

https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgKDnj86ZywEQ9AMY9AMyCGN8MsJOAEwL HTTP 301
https://tpc.googlesyndication.com/simgad/4091503581208051288

Request Chain 165

https://a.tribalfusion.com/i.match?p=b6&u=CAESEIep6N6mMozirpwAjNU5sYo&google_cver=1&google_push=Aa02lx9mppZI-VUnR5VTlpJHEUmvjs3WYYErnWUaScgf4cUQ1kYXnvvgt6E-fWb6JJt_v0T5akUUTs7EGyi1LobxRb_viPdIJogB&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAa02lx9mppZI-VUnR5VTlpJHEUmvjs3WYYErnWUaScgf4cUQ1kYXnvvgt6E-fWb6JJt_v0T5akUUTs7EGyi1LobxRb_viPdIJogB%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEIep6N6mMozirpwAjNU5sYo&google_cver=1&google_push=Aa02lx9mppZI-VUnR5VTlpJHEUmvjs3WYYErnWUaScgf4cUQ1kYXnvvgt6E-fWb6JJt_v0T5akUUTs7EGyi1LobxRb_viPdIJogB&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAa02lx9mppZI-VUnR5VTlpJHEUmvjs3WYYErnWUaScgf4cUQ1kYXnvvgt6E-fWb6JJt_v0T5akUUTs7EGyi1LobxRb_viPdIJogB%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 167

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEH5S714_2UN6yFhGgSQ7hkk&google_cver=1&google_push=Aa02lx_Hrluj04Zq9elh3Ypx2vIywOvL8sDGdvLexlHg3cqo1MFhRA5Agt5QMwN_3oEkbmDWD4kn_8YnVCT5ABrtcJjEjLb7vfo HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEH5S714_2UN6yFhGgSQ7hkk&google_cver=1&google_push=Aa02lx_Hrluj04Zq9elh3Ypx2vIywOvL8sDGdvLexlHg3cqo1MFhRA5Agt5QMwN_3oEkbmDWD4kn_8YnVCT5ABrtcJjEjLb7vfo HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjgwNzkyNzcwNTcxNTk3OTMyOQ&google_push=Aa02lx_Hrluj04Zq9elh3Ypx2vIywOvL8sDGdvLexlHg3cqo1MFhRA5Agt5QMwN_3oEkbmDWD4kn_8YnVCT5ABrtcJjEjLb7vfo

Request Chain 169

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEKyzhR0M1JsBNRABexzFm9Q&google_cver=1&google_push=Aa02lx_e9tbLPl-N2bcLo8tYV47IvtOY7b6zCl1w66XEmDdxOdNbMq8U_OkZj3nx8pykkQQv4uqFneQRRFxUFa59TG2u3IAjh1yp HTTP 302
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEKyzhR0M1JsBNRABexzFm9Q&google_hm=ZACykvdTPwzYZBuhxfTOwAAACLkAAAAB&google_nid=index&google_push=Aa02lx_e9tbLPl-N2bcLo8tYV47IvtOY7b6zCl1w66XEmDdxOdNbMq8U_OkZj3nx8pykkQQv4uqFneQRRFxUFa59TG2u3IAjh1yp

Request Chain 170

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEDSDFPY_MRfA0Vgg5FO0wcw&google_cver=1&google_push=Aa02lx9L06x5xtFTt7LqCtLQsWYGoQrH0GaO3LagEiGJGq6YRtBuaNajiCtYHFUYiN8zT-1K0F167mNj6IE67hrts_nMjFwCoeB9 HTTP 302
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=Aa02lx9L06x5xtFTt7LqCtLQsWYGoQrH0GaO3LagEiGJGq6YRtBuaNajiCtYHFUYiN8zT-1K0F167mNj6IE67hrts_nMjFwCoeB9&google_gid=CAESEDSDFPY_MRfA0Vgg5FO0wcw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMxODA5NTI0MDE5MTA2MTg4MjQxMA%3D%3D&google_push=Aa02lx9L06x5xtFTt7LqCtLQsWYGoQrH0GaO3LagEiGJGq6YRtBuaNajiCtYHFUYiN8zT-1K0F167mNj6IE67hrts_nMjFwCoeB9

Request Chain 184

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEDRlhRUFXCpF6j2X4xuVFyQ&google_cver=1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEDRlhRUFXCpF6j2X4xuVFyQ&google_cver=1&__user_check__=1&sync_id=8416c18b-b906-11ed-a34e-16821cb20306

Request Chain 185

https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_id=841690b2-b906-11ed-8955-1891fad20506 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=ODQxNjkwNjEtYjkwNi0xMWVkLTg5NTUtMTg5MWZhZDIwNTA2

Request Chain 186

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true HTTP 302
https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true&verify=true HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1MbnE2cnUxRTJ1SDQ4c3RXdkZ1MklnbHRfanJVd3V4UH5B

Request Chain 197

https://ad.turn.com/r/cs?pid=3&google_gid=CAESELabp1IMKfSa6A-9lgUQAdg&google_cver=1&google_push=Aa02lx9T7WAbVPktpWLrCZ0YhkVn_7vwO3XuopP-AFOyMsIE-yaaWYjVEsQQhR8eF4pcWVDPip7aaCjaKqgxzM9DKxwwFfsZOH0 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjY1ODY2MTkzNzEyMTUyNzY0Ng==&gdpr=&gdpr_consent= HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESELabp1IMKfSa6A-9lgUQAdg&google_cver=1

Request Chain 199

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEDU5TXVOFgBWvPKKFM3yMb8&google_cver=1&google_push=Aa02lx9b_ge63lBx7ult2rBnMAK9rKeS6LM2E92rC3ybk2ela-cYJ9wqLwvp2MEqz0oFlGJchB4c8B_6OoHvgwpNS3O3GKa6VxI HTTP 302
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEDU5TXVOFgBWvPKKFM3yMb8&google_cver=1&google_push=Aa02lx9b_ge63lBx7ult2rBnMAK9rKeS6LM2E92rC3ybk2ela-cYJ9wqLwvp2MEqz0oFlGJchB4c8B_6OoHvgwpNS3O3GKa6VxI HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=Aa02lx9b_ge63lBx7ult2rBnMAK9rKeS6LM2E92rC3ybk2ela-cYJ9wqLwvp2MEqz0oFlGJchB4c8B_6OoHvgwpNS3O3GKa6VxI&google_hm=tj8K5AcVTZmIIc_zhOAmTA==

Request Chain 200

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEJiaySUEgcoRavbcx6MO6rg&google_cver=1&google_push=Aa02lx_uUjNVZO5VdRW89Dwd7aralSEv7Duej7FiSDyS1l-yThBB0-gOwvhTW-BWgvki0wAY2jZBr0ENNIQai-vuB5E6PQr62RwO HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=Aa02lx_uUjNVZO5VdRW89Dwd7aralSEv7Duej7FiSDyS1l-yThBB0-gOwvhTW-BWgvki0wAY2jZBr0ENNIQai-vuB5E6PQr62RwO

Request Chain 202

https://sync.teads.tv/um?eid=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESELMWvXvIyzy_1cdeQI7-uPM&google_cver=1&google_push=Aa02lx90D_aYnano6OF68w6VSeaDZ9-vbkyiKU8ujhu9sprebg2bGMyHHkS1NVGcAzFD39gtxmn1-7drX74E9LTv7HahAA1-MzHl HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=Aa02lx90D_aYnano6OF68w6VSeaDZ9-vbkyiKU8ujhu9sprebg2bGMyHHkS1NVGcAzFD39gtxmn1-7drX74E9LTv7HahAA1-MzHl HTTP 302
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

Request Chain 203

https://secure.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=${BASE64_UID_ENC}&google_gid=CAESENgn2mvQ3jI3_VRLbQTC_Y4&google_cver=1&google_push=Aa02lx8bsFPXSNwfdirNWoFdw5s-IUgbMOxiDtohykMNxgorlD7Yvk5ZtYcOan4GInCOax8Pt3SWUbCO2ukoqpw576Rnnn1nOEcmiw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MjMwOTgyMTA2NzIzOTc2NTUzMQ%3D%3D&google_gid=CAESENgn2mvQ3jI3_VRLbQTC_Y4&google_cver=1&google_push=Aa02lx8bsFPXSNwfdirNWoFdw5s-IUgbMOxiDtohykMNxgorlD7Yvk5ZtYcOan4GInCOax8Pt3SWUbCO2ukoqpw576Rnnn1nOEcmiw

217 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.normaculta.com.br/
Redirect Chain

http://normaculta.com.br/
https://normaculta.com.br/
https://www.normaculta.com.br/

68 KB
17 KB

337ms
308ms

Document
text/html

146.19.95.66
EDGOO EDGOO NETWORKS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.normaculta.com.br/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

146.19.95.66 São Paulo, Brazil, ASN47787 (EDGOO EDGOO NETWORKS, US),

Reverse DNS

Software

nginx /

Resource Hash

5ae0a7e2181324bc3ed556098999fa578b6f2366515f40ae8fed1470016c03d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
cache-control: max-age=432000
content-encoding: gzip
content-length: 17312
content-type: text/html; charset=UTF-8
date: Thu, 02 Mar 2023 14:28:32 GMT
server: nginx
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Accept-Encoding, User-Agent
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-ua-compatible: IE=edge

Redirect headers

content-length: 162
content-type: text/html
date: Thu, 02 Mar 2023 14:28:32 GMT
location: https://www.normaculta.com.br/
server: nginx
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-frame-options: DENY

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 77 KB
27 KB 247ms
98ms Script
text/javascript 2a00:1450:400d:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a333febc7175daba5bcc74ef22756fbb160b1e6b71dd2ab004e44452a7864fcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26992
x-xss-protection: 0
server: sffe
etag: "1498 / 805 of 1000 / last-modified: 1677758862"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 02 Mar 2023 14:28:32 GMT

GET
H2 200 logo-slogan.png
static.normaculta.com.br/assets/img/ 3 KB
3 KB 208ms
155ms Image
image/png 146.19.95.66
EDGOO EDGOO NETWORKS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.normaculta.com.br/assets/img/logo-slogan.png

Requested by

Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

146.19.95.66 São Paulo, Brazil, ASN47787 (EDGOO EDGOO NETWORKS, US),

Reverse DNS

Software

nginx /

Resource Hash

9c658e100e7c9318e87faf238e3244996feef4ef46852ab83951f573a62458d9

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:32 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Tue, 28 Jun 2022 15:08:21 GMT
server: nginx
x-frame-options: DENY
content-type: image/png
cache-control: max-age=2592000
x-server: BR.A
accept-ranges: bytes
content-length: 2879
expires: Sat, 01 Apr 2023 14:28:32 GMT

GET
H2 200 normaculta_027.js Show response
static.normaculta.com.br/assets/ 18 KB
7 KB 184ms
163ms Script
application/javascript 146.19.95.66
EDGOO EDGOO NETWORKS

General

Check archive.org

Show headers Download Go to

Full URL

https://static.normaculta.com.br/assets/normaculta_027.js

Requested by

Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

146.19.95.66 São Paulo, Brazil, ASN47787 (EDGOO EDGOO NETWORKS, US),

Reverse DNS

Software

nginx /

Resource Hash

6b3c5cf30cf066f9f275b3b4bf5d424a4542ea94a27754fd5a147705b63387e5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
last-modified: Tue, 28 Jun 2022 15:08:21 GMT
server: nginx
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/javascript; charset=utf-8
cache-control: max-age=31536000
x-server: BR.A
accept-ranges: bytes
content-length: 7239
expires: Fri, 01 Mar 2024 14:28:32 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 123 KB
47 KB 193ms
76ms Script
application/javascript 2a00:1450:400d:80c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-W437CGB

Requested by

Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

56fbe1e9450b6913ffcbc41b5c3c86c6ee69b179f93db5bacdfc738f5e45f433

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:32 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48088
x-xss-protection: 0
last-modified: Thu, 02 Mar 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Mar 2023 14:28:32 GMT

GET
H2 200 / Show response
eu.7gra.us/ 1 B
208 B 342ms
93ms XHR
text/plain 167.114.90.133
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://eu.7gra.us/
Requested by: Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 167.114.90.133 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ip133.ip-167-114-90.net
Software: nginx /
Resource Hash: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:32 GMT
server: nginx
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain
access-control-allow-origin: *
cache-control: max-age=315360000
access-control-allow-credentials: true
content-length: 1
expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H2 200 normaculta_027.css
static.normaculta.com.br/assets/ 12 KB
3 KB 157ms
156ms Stylesheet
text/css 146.19.95.66
EDGOO EDGOO NETWORKS

General

Check archive.org

Show headers Download Go to

Full URL

https://static.normaculta.com.br/assets/normaculta_027.css

Requested by

Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

146.19.95.66 São Paulo, Brazil, ASN47787 (EDGOO EDGOO NETWORKS, US),

Reverse DNS

Software

nginx /

Resource Hash

6bfdd85aebca39401548d957a4864ccc151f82f693d28cc0134a8d2b3bd26378

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains; preload
last-modified: Tue, 28 Jun 2022 15:08:21 GMT
server: nginx
vary: Accept-Encoding
x-frame-options: DENY
content-type: text/css; charset=utf-8
cache-control: max-age=31536000
x-server: BR.A
accept-ranges: bytes
content-length: 3089
expires: Fri, 01 Mar 2024 14:28:32 GMT

GET
H2 200 normaculta_001.woff2
static.normaculta.com.br/assets/fonts/ 1 KB
1 KB 483ms
158ms Font
font/woff2 146.19.95.66
EDGOO EDGOO NETWORKS

General

Check archive.org

Show headers Download Go to

Full URL

https://static.normaculta.com.br/assets/fonts/normaculta_001.woff2

Requested by

Host: static.normaculta.com.br
URL: https://static.normaculta.com.br/assets/normaculta_027.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

146.19.95.66 São Paulo, Brazil, ASN47787 (EDGOO EDGOO NETWORKS, US),

Reverse DNS

Software

nginx /

Resource Hash

faed2d77bd3a93640d5a252972fdd969c711af44be66a41ccc76f85d5d6b35f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://static.normaculta.com.br/assets/normaculta_027.css
Origin: https://www.normaculta.com.br
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:33 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Tue, 28 Jun 2022 15:08:21 GMT
server: nginx
x-frame-options: DENY
content-type: font/woff2
access-control-allow-origin: *
cache-control: max-age=2592000
x-server: BR.A
accept-ranges: bytes
content-length: 1200
expires: Sat, 01 Apr 2023 14:28:33 GMT

GET
H2 200 pubads_impl_2023022701.js Show response
securepubads.g.doubleclick.net/gpt/ 384 KB
130 KB 48ms
47ms Script
text/javascript 2a00:1450:400d:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c6265a847e8ef645ae49eefb6efdd0659672dd17c55167c74bb067750daa399f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 05:39:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 31728
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 132634
x-xss-protection: 0
last-modified: Mon, 27 Feb 2023 09:35:45 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 01 Mar 2024 05:39:44 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 763 B
384 B 176ms
80ms XHR
application/json 2a00:1450:400d:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.normaculta.com.br

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80c::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8f9d5fc23afcdea9f10879170e361a914b5c9f60aea4f988c87ffc6c14d25c71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:32 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 359
x-xss-protection: 0
expires: Thu, 02 Mar 2023 14:28:32 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 48ms
14ms Script
text/javascript 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W437CGB

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 02 Mar 2023 12:43:15 GMT
last-modified: Tue, 10 Jan 2023 21:29:14 GMT
server: Golfe2
age: 6317
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20085
expires: Thu, 02 Mar 2023 14:43:15 GMT

GET
H2

200

web-vitals.iife.js Show response
unpkg.com/web-vitals@3.1.1/dist/
Redirect Chain

https://unpkg.com/web-vitals
https://unpkg.com/web-vitals@3.1.1
https://unpkg.com/web-vitals@3.1.1/dist/web-vitals.iife.js

7 KB
3 KB

26ms
26ms

Script
application/javascript

2606:4700::6810:7aaf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://unpkg.com/web-vitals@3.1.1/dist/web-vitals.iife.js

Requested by

Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/

Protocol

Server

2606:4700::6810:7aaf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3c5ae596988bc5f95f8a3b7f05c6ecf6336c81b7ba42827c7dcb70ae2dacb77e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:32 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 4379302
last-modified: Sat, 26 Oct 1985 08:15:00 GMT
fly-request-id: 01GPEV5AZDEKRQGG0J1ZTMFJ16-fra
server: cloudflare
etag: W/"1b24-GqgswdM7opiZOqFSwUlHVut+Xpk"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 7a1a53a9ddb5bb59-FRA

Redirect headers

date: Thu, 02 Mar 2023 14:28:32 GMT
via: 1.1 fly.io
x-content-type-options: nosniff
cf-cache-status: HIT
fly-request-id: 01GRVHD9ANY89M4Y0W5XWA6VC0-fra
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 1805836
vary: Accept, Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
location: /web-vitals@3.1.1/dist/web-vitals.iife.js
cache-control: public, max-age=31536000
cf-ray: 7a1a53a9ad83bb59-FRA

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 219 KB
77 KB 86ms
86ms Script
application/javascript 2a00:1450:400d:80c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-0D2VJ191CX&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W437CGB

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d3ee25f194ba40c1f0c7e98ab4103f6e526425d69fe1b95326b374bbec6b34a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:32 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 78514
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 02 Mar 2023 14:28:32 GMT

POST
H2 200 publisher:getClientId Show response
ampcid.google.com/v1/ 74 B
443 B 183ms
46ms XHR
application/json 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ampcid.google.com/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.normaculta.com.br/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 02 Mar 2023 14:28:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.normaculta.com.br
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 94
x-xss-protection: 0

GET
H2 200 apstag.js Show response
c.amazon-adsystem.com/aax2/ 222 KB
55 KB 53ms
8ms Script
application/javascript 108.138.4.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/aax2/apstag.js
Requested by: Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.4.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-4-10.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e796bbf820b6c82c648fc30c1ef0936de768c4236715b40c938faa67175f8eb5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 13:59:12 GMT
content-encoding: gzip
via: 1.1 857b0dca772798c338c78a1be69c955c.cloudfront.net (CloudFront), 1.1 002af2e4f72157b8b4bd2de012b5b57c.cloudfront.net (CloudFront)
last-modified: Wed, 01 Mar 2023 21:30:51 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P1, FRA56-P6
age: 1762
x-amz-server-side-encryption: AES256
etag: W/"289dcef8d722ba2b64392cc0764df16b"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=3600
x-amz-cf-id: cIjBXsGc6Ux5kN7T5RaXniyxS6iHSjJta1gtdfb6Y-6VKYdPKdLtgQ==

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
531 B 160ms
47ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.normaculta.com.br

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
456 B 164ms
48ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.normaculta.com.br

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

POST
H2 204 collect
region1.analytics.google.com/g/ 0
258 B 68ms
19ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-0D2VJ191CX&gtm=45je32r0&_p=1305819003&_gaz=1&cid=574628834.1677767313&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1677767313&sct=1&seg=0&dl=https%3A%2F%2Fwww.normaculta.com.br%2F&dt=Portugu%C3%AAs%20-%20L%C3%ADngua%20Portuguesa%20-%20Norma%20Culta&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-0D2VJ191CX&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:33 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.normaculta.com.br
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
258 B 86ms
19ms Ping
text/plain 2a00:1450:400c:c06::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-0D2VJ191CX&cid=574628834.1677767313&gtm=45je32r0&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-0D2VJ191CX&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c06::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:33 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.normaculta.com.br
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 220ms
84ms Image
image/gif 2a00:1450:400d:805::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-0D2VJ191CX&cid=574628834.1677767313&gtm=45je32r0&aip=1&z=402431728

Requested by

Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:805::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 18 KB
8 KB 474ms
473ms XHR
text/plain 2a00:1450:400d:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3558250168591124&correlator=1203853052507911&eid=31072562&output=ldjh&gdfp_req=1&vrg=2023022701&ptt=17&impl=fif&iu_parts=1062898%2CNORMACULTA_BR_HOME_SIDEBARSTICKY&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600%7C240x400%7C160x600%7C300x250%7C120x600%7C250x250%7C200x200%7C300x100&ifi=1&adks=4170589126&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1677767313045&lmt=1677767313&dlt=1677767312493&idt=468&adxs=945&adys=2884&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.normaculta.com.br%2F&frm=20&vis=1&psz=335x11708&msz=336x297&fws=512&ohw=0&ga_vid=574628834.1677767313&ga_sid=1677767313&ga_hid=1305819003&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80c::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78ecfb0f50f7c8d4ed3cdb4c0d2dec199d3819a68f6fe089a1b852ce8058bae5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:33 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8129
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.normaculta.com.br
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame E05A 6 KB
3 KB 245ms
79ms Document
text/html 2a00:1450:400d:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.normaculta.com.br/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 02 Mar 2023 14:28:33 GMT
expires: Fri, 01 Mar 2024 14:28:33 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 19 KB
8 KB 681ms
680ms XHR
text/plain 2a00:1450:400d:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3558250168591124&correlator=1203853052507911&eid=31072562&output=ldjh&gdfp_req=1&vrg=2023022701&ptt=17&impl=fif&iu_parts=1062898%2CNORMACULTA_BR_HOME_SIDEBAR_TOP&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C250x250%7C200x200%7C300x100&ifi=2&adks=754213437&sfv=1-0-40&eri=1&sc=1&cookie_enabled=1&abxe=1&dt=1677767313066&lmt=1677767313&dlt=1677767312493&idt=468&adxs=963&adys=157&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.normaculta.com.br%2F&frm=20&vis=1&psz=335x11708&msz=336x300&fws=0&ohw=0&ga_vid=574628834.1677767313&ga_sid=1677767313&ga_hid=1305819003&ga_fc=true

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80c::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

983fca2440516aa2e81dfbbfd3c5b86b3dc61fb2418ecc5722a187c844a9358b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:33 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8344
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.normaculta.com.br
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 publisher:getClientId Show response
ampcid.google.de/v1/ 3 B
372 B 222ms
67ms XHR
application/json 2a00:1450:400d:80d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ampcid.google.de/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80d::200e , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.normaculta.com.br/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 02 Mar 2023 14:28:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.normaculta.com.br
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H2 200 config Show response
c.amazon-adsystem.com/cdn/prod/ 2 KB
2 KB 9ms
9ms XHR
application/json 108.138.4.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fwww.normaculta.com.br&pubid=031d2526-e3d7-48d3-94fd-8cec14da13e5
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.4.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-4-10.fra56.r.cloudfront.net
Software: Server /
Resource Hash: ea0efdafd9030543e048a32e3dd9991fa78066196248811a19e4f1e3301688a9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 11:56:18 GMT
via: 1.1 002af2e4f72157b8b4bd2de012b5b57c.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P6
age: 9135
x-cache: Hit from cloudfront
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.normaculta.com.br
cache-control: max-age=21550, s-maxage=21600
access-control-allow-credentials: true
content-length: 1638
x-amz-cf-id: kPzB4HtZnLVSea_iAvrnkzfKPkrSgGscp805cUgQW-wblNqjiUE6CA==

GET
H2 200 bid Show response
aax-dtb-cf.amazon-adsystem.com/e/dtb/ 23 B
465 B 105ms
46ms XHR
text/javascript 108.138.4.150
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://aax-dtb-cf.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fwww.normaculta.com.br%2F&pid=CjL8E7TMIFDzD&cb=0&ws=1600x1200&v=23.225.2013&t=2000&slots=%5B%7B%22sd%22%3A%22div-gpt-sg-2dda7abf770ece7a88b0216442451876%22%2C%22s%22%3A%5B%22300x250%22%2C%22250x250%22%2C%22200x200%22%2C%22300x100%22%5D%2C%22sn%22%3A%22%2F1062898%2FNORMACULTA_BR_HOME_SIDEBAR_TOP%22%7D%2C%7B%22sd%22%3A%22div-gpt-sg-edf803de8a69c7a8a32e5d532ab3bf43%22%2C%22s%22%3A%5B%22300x600%22%2C%22240x400%22%2C%22160x600%22%2C%22300x250%22%2C%22120x600%22%2C%22250x250%22%2C%22200x200%22%2C%22300x100%22%5D%2C%22sn%22%3A%22%2F1062898%2FNORMACULTA_BR_HOME_SIDEBARSTICKY%22%7D%2C%7B%22sd%22%3A%22div-gpt-sg-cb951c547fa5d4a67493a5c53785f827%22%2C%22s%22%3A%5B%22970x90%22%2C%22728x90%22%2C%22970x66%22%2C%22468x60%22%5D%2C%22sn%22%3A%22%2F1062898%2FNORMACULTA_BR_ROS_BOTTOM%22%7D%5D&pubid=031d2526-e3d7-48d3-94fd-8cec14da13e5&gdprl=%7B%22status%22%3A%22no-cmp%22%7D

Requested by

Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.138.4.150 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-4-150.fra56.r.cloudfront.net

Software

Server /

Resource Hash

745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8

Security Headers

Name	Value
Strict-Transport-Security	max-age=47474747; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:33 GMT
strict-transport-security: max-age=47474747; includeSubDomains; preload
via: 1.1 22ec86e3f4ec676e17ef8eea76eefba2.cloudfront.net (CloudFront)
server: Server
x-amz-cf-pop: FRA56-P6
x-amz-rid: 267WJT73GKFPYMYGS3Z6
vary: Accept-Encoding,User-Agent
x-cache: Miss from cloudfront
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: https://www.normaculta.com.br
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 23
x-amz-cf-id: 0Rw7CYKCFwH-VcIzC55gLCiAYTtvptHvhU36porTY87ucYwo2To0Sg==

GET
H2 200 aps_csm.js Show response
c.amazon-adsystem.com/bao-csm/aps-comm/ 6 KB
3 KB 26ms
9ms XHR
application/javascript 108.138.4.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.4.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-4-10.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-amz-version-id: pfXD8LfbTWwWYbVa8nASYbe6_QUldhGN
content-encoding: gzip
via: 1.1 e96aebc8d7c9ec82b88c3160a18fed96.cloudfront.net (CloudFront)
date: Thu, 02 Mar 2023 07:01:37 GMT
x-amz-cf-pop: FRA56-P6
age: 26817
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Wed, 15 Feb 2023 23:43:01 GMT
server: AmazonS3
etag: W/"a4d296427fc806b21335359e398c025c"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
vary: Accept-Encoding,Origin
x-amz-cf-id: DH3c3s_peOVimCXgeQp4e7aPuz3EuJ0KASnzWdqU_jfAci9spywOjg==

GET
H2 200 ats.js Show response
ats.rlcdn.com/ 109 KB
36 KB 43ms
10ms Script
application/x-javascript 143.204.89.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://ats.rlcdn.com/ats.js
Requested by: Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.89.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-89-24.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9dd295f1b8047318855e74e81dbeb02d463452670f2997dd64764a6ad88f3884

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-amz-version-id: FdZQKnEndO3mqmnRp7XQ3uMfeJERmMlw
content-encoding: br
via: 1.1 a148356b14492df0e216c234ac2c2308.cloudfront.net (CloudFront)
date: Thu, 02 Mar 2023 12:10:30 GMT
x-amz-cf-pop: FRA50-C1
age: 8284
x-amz-server-side-encryption: AES256
x-amz-meta-codebuild-buildarn: arn:aws:codebuild:eu-west-1:469675294282:build/ATSLibrary-prod:96f94076-69de-4a4b-8bd0-6fb739c06860
x-cache: Hit from cloudfront
x-amz-meta-codebuild-content-md5: e16bd58aa55fcc98af3b10870aad5974
last-modified: Thu, 19 Jan 2023 10:03:36 GMT
server: AmazonS3
etag: W/"0820c3a8da5dbe428619a7328c53b95f"
vary: Accept-Encoding
content-type: application/x-javascript
x-amz-meta-codebuild-content-sha256: 3efbae2e7f7f574316dfc685479946d213531c0b483ab4a61e653a0088f0cae8
cache-control: must-revalidate,public,max-age=86400
x-amz-cf-id: -3ck7d_V81x8LosYfVIq41FKbUwzwWXBK4gkYme9U2yCFKErKyupbQ==

GET
H2 200 pubcid.min.js Show response
secure.cdn.fastclick.net/js/pubcid/latest/ 54 KB
17 KB 77ms
18ms Script
application/javascript 104.86.47.65
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.cdn.fastclick.net/js/pubcid/latest/pubcid.min.js
Requested by: Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.86.47.65 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-86-47-65.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:33 GMT
content-encoding: gzip
last-modified: Mon, 23 Jan 2023 19:40:17 GMT
server: Apache
etag: "d734-5f2f3919e751f-gzip"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=900
accept-ranges: bytes
content-length: 17407
expires: Thu, 02 Mar 2023 14:43:33 GMT

GET
H2 200 id5-api.js Show response
cdn.id5-sync.com/api/1.0/ 58 KB
17 KB 67ms
22ms Script
text/javascript 2606:4700:10::6816:3456
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/id5-api.js

Requested by

Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

05e77dab19940dd457e00282837faecc886434cc8cc5f631575a5e6c386de774

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:33 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 13 Feb 2023 11:21:55 GMT
server: cloudflare
x-amz-request-id: 096K3226QDY3KGD8
age: 528
etag: W/"7586740695219e27c1483ac351f18884"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7a1a53ab69c88ffa-FRA
x-amz-id-2: era4u+9xJ3DV9FOuPQL4pVQhoUtc57Bv4W0UTfUT0Mb/QzJFBhIdV3+z6hzoUFB2ECdEsEMBN1o=

POST
H2 200 recordVendorsLoaded Show response
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/ 0
458 B 109ms
109ms XHR
text/plain 52.20.67.201
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/recordVendorsLoaded
Requested by: Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.20.67.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-67-201.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.normaculta.com.br/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: *
date: Thu, 02 Mar 2023 14:28:33 GMT
content-length: 0
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

OPTIONS
H2 200 recordVendorsLoaded
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/ Frame 0
0 333ms
110ms Preflight 52.20.67.201
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://prod.us-east-1.cxm-bcn.publisher-services.amazon.dev/v1/recordVendorsLoaded
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.20.67.201 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-20-67-201.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.normaculta.com.br
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 1800
allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH
content-length: 0
date: Thu, 02 Mar 2023 14:28:33 GMT
vary: Origin Access-Control-Request-Method Access-Control-Request-Headers

GET
H2 200 / Show response
geo.privacymanager.io/ 30 B
596 B 84ms
18ms Fetch
application/json 13.32.110.123
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://geo.privacymanager.io/
Requested by: Host: ats.rlcdn.com
URL: https://ats.rlcdn.com/ats.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.110.123 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-110-123.vie50.r.cloudfront.net
Software: /
Resource Hash: e257df7266563e157bb7df93fd09c6d13afb1c9554468b21c7378e09a94d3250

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 00:53:09 GMT
via: 1.1 5c79308f72e53cdf81a950b478a7e144.cloudfront.net (CloudFront), 1.1 8cfc2a35d3218c50ced5f2d05f5dcbd0.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P3, VIE50-C2
age: 48924
x-amzn-requestid: c3eb4e61-e065-4bc4-b91a-303ea55b1bc3
x-amzn-trace-id: Root=1-63fff375-76aa1a8139f9f51a3dcc8683;Sampled=0
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
content-type: application/json
access-control-allow-origin: *
x-cache: Hit from cloudfront
x-amz-apigw-id: BIL6XH_JDoEFUYg=
content-length: 30
x-amz-cf-id: tBWEeBvnIfWv4BsES3eEud3ZhDnuKMDU9n_BesnQ33q__PYPIvnu5w==
access-control-allow-headers: Content-Type,Authorization,X-Amz-Date,X-Api-Key,X-Amz-Security-Token

GET
H/1.1 200 v1 Show response
lb.eu-1-id5-sync.com/lb/ 33 B
408 B 41ms
8ms XHR
application/json 141.95.33.111
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://lb.eu-1-id5-sync.com/lb/v1

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

141.95.33.111 , Germany, ASN16276 (OVH, FR),

Reverse DNS

ns3203177.ip-141-95-33.eu

Software

Resource Hash

a63f6ee7811c95c619d7c10da51d3cfcfd5cf3ae067428df7f49f63ea3e3c99e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.normaculta.com.br/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.normaculta.com.br
date: Thu, 02 Mar 2023 14:28:32 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

POST
H/1.1 200 1239.json Show response
id5-sync.com/g/v2/ 216 B
631 B 42ms
7ms XHR
application/json 162.19.138.82
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/g/v2/1239.json

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/id5-api.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.82 , France, ASN16276 (OVH, FR),

Reverse DNS

ns31532337.ip-162-19-138.eu

Software

Resource Hash

a7166e62648587b6b8175e203f08c67db89012ba802d413fc478dbac0b03f9a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.normaculta.com.br/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.normaculta.com.br
date: Thu, 02 Mar 2023 14:28:33 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin
transfer-encoding: chunked
content-type: application/json;charset=UTF-8

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
151 B 19ms
18ms XHR
text/plain 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j99&a=1305819003&t=pageview&_s=1&dl=https%3A%2F%2Fwww.normaculta.com.br%2F&ul=en-us&de=UTF-8&dt=Portugu%C3%AAs%20-%20L%C3%ADngua%20Portuguesa%20-%20Norma%20Culta&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAEABAAQCACAAI~&jid=1703368181&gjid=1089151511&cid=574628834.1677767313&tid=UA-10605777-55&_gid=652557325.1677767313&_r=1&_slc=1&gtm=45He32r0n81W437CGB&z=138338029

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.normaculta.com.br/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.normaculta.com.br
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
194 B 14ms
14ms Image
image/gif 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j99&a=1305819003&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.normaculta.com.br%2F&ul=en-us&de=UTF-8&dt=Portugu%C3%AAs%20-%20L%C3%ADngua%20Portuguesa%20-%20Norma%20Culta&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Web%20VitalsWeb%20Vitals&ea=FCP&el=v3-1677767313080-6272159214010&ev=1045&_u=aADAAEABAAQCACAAI~&jid=&gjid=&cid=574628834.1677767313&tid=UA-10605777-55&_gid=652557325.1677767313&gtm=45He32r0n81W437CGB&cg1=contentGroup1&cg2=contentGroup2&cg3=contentGroup3&cg4=contentGroup4&z=1187801726

Requested by

Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Mar 2023 22:17:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 58240
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
151 B 19ms
18ms XHR
text/plain 2a00:1450:400c:c06::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j99&tid=UA-10605777-55&cid=574628834.1677767313&jid=1703368181&gjid=1089151511&_gid=652557325.1677767313&_u=aADAAEAAAAQCACAAI~&z=563248906

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c06::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.normaculta.com.br/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 02 Mar 2023 14:28:33 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.normaculta.com.br
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 consent-bar.min.js Show response
7gra.us/consentbar/ 23 KB
7 KB 299ms
90ms Script
application/javascript 158.69.248.161
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://7gra.us/consentbar/consent-bar.min.js?v=8

Requested by

Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

158.69.248.161 Montreal, Canada, ASN16276 (OVH, FR),

Reverse DNS

ns542920.ip-158-69-248.net

Software

nginx /

Resource Hash

d9467d95786b03f066eef98f39be104de6c31d9eb4983f80e4a7ca730017534c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

expires: Fri, 01 Mar 2024 14:28:33 GMT
date: Thu, 02 Mar 2023 14:28:33 GMT
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
last-modified: Mon, 03 Oct 2022 13:00:00 GMT
server: nginx
content-encoding: gzip
etag: W/"633adcd0-5cb2"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=31536000
x-xss-protection: 1; mode=block
x-ua-compatible: IE=Edge

GET
H2 200 bhof.js Show response
7gra.us/ 15 B
334 B 300ms
92ms Script
text/javascript 158.69.248.161
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://7gra.us/bhof.js

Requested by

Host: static.normaculta.com.br
URL: https://static.normaculta.com.br/assets/normaculta_027.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

158.69.248.161 Montreal, Canada, ASN16276 (OVH, FR),

Reverse DNS

ns542920.ip-158-69-248.net

Software

nginx /

Resource Hash

94e0db1d92e7f7bca01cc07a16abb8c2e9bf762e9742100be5103daa4603539c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

expires: Thu, 02 Mar 2023 14:28:33 GMT
pragma: no-cache
date: Thu, 02 Mar 2023 14:28:33 GMT
strict-transport-security: max-age=63072000
x-content-type-options: nosniff
server: nginx
content-type: text/javascript;charset=UTF-8
cache-control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
x-xss-protection: 1; mode=block
x-ua-compatible: IE=Edge

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 15 KB
11 KB 221ms
92ms XHR
application/json 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2023022701&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c1b270636454553dee6d0b5f117a8d4fa16d93ffbe98e38cae9452cef394b735

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:33 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11218
x-xss-protection: 0

GET
H2 200 collect
www.google-analytics.com/ 35 B
91 B 15ms
14ms Image
image/gif 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j99&a=1305819003&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.normaculta.com.br%2F&ul=en-us&de=UTF-8&dt=Portugu%C3%AAs%20-%20L%C3%ADngua%20Portuguesa%20-%20Norma%20Culta&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Web%20VitalsWeb%20Vitals&ea=TTFB&el=v3-1677767313081-7586975973186&ev=983&_u=aADAAEABAAQCACAAI~&jid=&gjid=&cid=574628834.1677767313&tid=UA-10605777-55&_gid=652557325.1677767313&gtm=45He32r0n81W437CGB&cg1=contentGroup1&cg2=contentGroup2&cg3=contentGroup3&cg4=contentGroup4&z=1473861658

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Mar 2023 22:17:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 58240
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
408 B 137ms
58ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-10605777-55&cid=574628834.1677767313&jid=1703368181&_u=aADAAEAAAAQCACAAI~&z=1106562369

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 84ms
82ms Image
image/gif 2a00:1450:400d:805::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j99&tid=UA-10605777-55&cid=574628834.1677767313&jid=1703368181&_u=aADAAEAAAAQCACAAI~&z=1106562369

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:805::2003 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 esp.js Show response
oa.openxcdn.net/ 24 KB
8 KB 93ms
15ms Script
application/javascript 34.102.146.192
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oa.openxcdn.net/esp.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.102.146.192 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 192.146.102.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 08 Feb 2023 16:53:07 GMT
content-encoding: gzip
age: 1892126
x-guploader-uploadid: ADPycduE5L2eeFp6uIBZXVmQzp1L-SpgDvDmbY_Q_CWTzkfDxzhrR4U1i09pt8tFiyeePrtu2s28XPWyuBaA4jWN06J35g
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7927
last-modified: Thu, 27 May 2021 18:30:51 GMT
server: UploadServer
etag: "df5542b88bc0e368c6999754a5b9e2ba"
x-goog-generation: 1622140251693895
x-goog-hash: crc32c=f21hYg==, md5=31VCuIvA42jGmZdUpbniug==
content-type: application/javascript
cache-control: no-transform
x-goog-stored-content-length: 7927
accept-ranges: bytes
expires: Thu, 08 Feb 2024 16:53:07 GMT

GET
H2 200 publishertag.ids.js Show response
static.criteo.net/js/ld/ 39 KB
13 KB 63ms
16ms Script
text/javascript 2a02:2638:3::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/js/ld/publishertag.ids.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

c7fc8dae04703101d705fac5268f8900d96149d6b2d3fdd6c1fac249ed16cf1b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:33 GMT
content-encoding: gzip
strict-transport-security: max-age=31536000; preload;
last-modified: Fri, 24 Feb 2023 07:57:32 GMT
server: nginx
etag: W/"63f86dec-9c21"
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Fri, 03 Mar 2023 14:28:33 GMT

GET
H2 200 pubcid.min.js Show response
cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/ 732 B
1 KB 34ms
17ms Script
application/javascript 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/shared-id/pubcid.js/docs/pubcid.min.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:33 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 21280
x-jsd-version: master
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra-eddf8230042-FRA, cache-yyz4568-YYZ
x-jsd-version-type: branch
server: cloudflare
etag: W/"2dc-IrZxm/sP4aqtIfs1EfEw6Dg5q1Y"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vB2tsLu573Fwb4AJUvu%2BOjJ5fI25xiiTdGSqIO4m0Te%2FoXIijI%2Fz1pW889YSdmIlGfAte9AMfRKAdt6lKIdCHRnwvYoktUWECNwN3Q1lolg%2FtBxU4orPGCjzLgiIPMDM9O5blQe3LPaD3aLRfaw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
timing-allow-origin: *
cf-ray: 7a1a53adcd466961-FRA

GET
H2 200 esp.js Show response
cdn.id5-sync.com/api/1.0/ 58 KB
17 KB 26ms
25ms Script
text/javascript 2606:4700:10::6816:3456
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.id5-sync.com/api/1.0/esp.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3456 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5b1546ae8f493de03b1ca99f9f955a20785679be18625354b363f2f8311f421b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:33 GMT
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 13 Feb 2023 11:21:55 GMT
server: cloudflare
x-amz-request-id: 6MMRD07QTTVY5WE3
age: 1137
etag: W/"b988c8d91b8a22dcd50f129d3a9d67f1"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: text/javascript;charset=utf-8
cache-control: public, max-age=3600
cf-ray: 7a1a53adbcbd8ffa-FRA
x-amz-id-2: 2raq5Jnx6oAX0Ycps1Kzff9dKV6lHrZYj85JjHi2+p+G7SpeSO3d8BOABFEkDiqsZaTPahc5GGY=

GET
H2 200 encrypted-tag-g.js Show response
invstatic101.creativecdn.com/encrypted-signals/ 1 KB
2 KB 52ms
14ms Script
text/javascript 34.96.70.87
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.70.87 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 87.70.96.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 23bc1d893ce2d2f30b68e549aa3cb991c2a7b7dd87e3df67d9fbb6a8dd113bf8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:17:05 GMT
via: 1.1 google
age: 688
x-guploader-uploadid: ADPycdvUHuU1Ti2gz_LlQnUIAZWGrEHIZtWu7ziDvBnLjWaO7ezbZT6XqA1siJdtohk060gO7vvVLRGiD0Ct4EKC6MnqeA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1258
last-modified: Fri, 29 Jul 2022 16:55:09 GMT
server: UploadServer
etag: "f5bc066f146e3dbb049aa6c86c7012e6"
vary: X-Goog-Allowed-Resources
x-goog-generation: 1659113709880056
x-goog-hash: crc32c=6QojvA==, md5=9bwGbxRuPbsEmqbIbHAS5g==
content-type: text/javascript
cache-control: public, max-age=3600
x-goog-stored-content-length: 1258
accept-ranges: bytes
expires: Thu, 02 Mar 2023 15:17:05 GMT

GET
H2 200 sync.min.js Show response
tags.crwdcntrl.net/lt/c/16589/ 32 KB
10 KB 40ms
7ms Script
text/javascript 13.225.78.128
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.128 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-128.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4ea737ac05e8ee5e490220d97b820834c18cd7c6f1da7d85007a51a5c64425df

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 11:20:11 GMT
content-encoding: gzip
via: 1.1 c7015d60d4f8f2170aaaa75e69e40618.cloudfront.net (CloudFront)
last-modified: Thu, 05 Jan 2023 20:08:05 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C2
age: 11303
etag: W/"87ee016ad429d1c83712b8d81ccb3c59"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: max-age: 86400
x-amz-cf-id: zLjg5J3JEwes1mqAja7dI9PGIfACbjJfUPhUxzTui_e-dIMF5TmGLg==

GET
H/1.1 200
OK uid2SecureSignal.js Show response
cdn.prod.uidapi.com/ 2 KB
2 KB 62ms
7ms Script
text/javascript 2600:9000:2250:f600:a:e047:752:b361
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.prod.uidapi.com/uid2SecureSignal.js
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:f600:a:e047:752:b361 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 71fc1599035adc6bc34df2117b8631285905f97737ba730af28644ee6a0d8dde

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Thu, 02 Mar 2023 04:08:37 GMT
Via: 1.1 03249875678629095a5ec311a6f1a298.cloudfront.net (CloudFront)
Last-Modified: Mon, 23 Jan 2023 04:07:36 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA60-P2
Age: 37197
x-amz-server-side-encryption: AES256
ETag: "aded621b17723f487b3c9d0e43cf2f94"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1859
X-Amz-Cf-Id: g3N4Nu2AJeiIvTdUAi3M8Aacz5fF6TwEOSeC23ep2Hsl-P9uJiMqMQ==

GET
H2 200 container.html Show response
07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 4867 6 KB
3 KB 48ms
47ms Document
text/html 2a00:1450:400d:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400d:80c::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.normaculta.com.br/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 02 Mar 2023 14:28:33 GMT
expires: Fri, 01 Mar 2024 14:28:33 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 204 increment Show response
id5-sync.com/api/esp/ 0
330 B 83ms
28ms XHR
text/plain 162.19.138.82
OVH

General

Check archive.org

Show headers Download Go to

Full URL

https://id5-sync.com/api/esp/increment?counter=no-config

Requested by

Host: cdn.id5-sync.com
URL: https://cdn.id5-sync.com/api/1.0/esp.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

162.19.138.82 , France, ASN16276 (OVH, FR),

Reverse DNS

ns31532337.ip-162-19-138.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

Referer: https://www.normaculta.com.br/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://www.normaculta.com.br
date: Thu, 02 Mar 2023 14:28:33 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers, Origin

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 219ms
118ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 02 Mar 2023 14:28:33 GMT

POST
H2 200 map Show response
bcp.crwdcntrl.net/6/ 60 B
338 B 93ms
29ms XHR
application/json 54.72.237.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://bcp.crwdcntrl.net/6/map
Requested by: Host: tags.crwdcntrl.net
URL: https://tags.crwdcntrl.net/lt/c/16589/sync.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.72.237.23 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-72-237-23.eu-west-1.compute.amazonaws.com
Software: Jetty(9.4.38.v20210224) /
Resource Hash: 106fd3bc4b54a13bc9f2200fd4a940cc41e92ec0b1d188c078a7497cf94d8806

Request headers

Referer: https://www.normaculta.com.br/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:33 GMT
server: Jetty(9.4.38.v20210224)
content-type: application/json;charset=utf-8
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: https://www.normaculta.com.br
cache-control: no-cache
x-server: 10.45.20.81
access-control-allow-credentials: true
content-length: 60
expires: 0

POST
H2 200 encrypt Show response
esp.rtbhouse.com/ 221 B
315 B 29ms
28ms Fetch
application/json 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Requested by: Host: invstatic101.creativecdn.com
URL: https://invstatic101.creativecdn.com/encrypted-signals/encrypted-tag-g.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash: 3b4dcce6674aac1bcea6aaae2155b49630758b1663aaa9d38fdcca58cb55ba4a

Request headers

Referer: https://www.normaculta.com.br/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 02 Mar 2023 14:28:33 GMT
via: 1.1 google
server: Google Frontend
content-type: application/json
access-control-allow-origin: *
x-cloud-trace-context: 2af98e8609f74553624a4bf8aeb36e4c
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 221

OPTIONS
H2 200 encrypt
esp.rtbhouse.com/ Frame 0
0 69ms
25ms Preflight
text/plain 35.190.39.111
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://esp.rtbhouse.com/encrypt
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.39.111 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 111.39.190.35.bc.googleusercontent.com
Software: Google Frontend /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.normaculta.com.br
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: POST, GET
access-control-allow-origin: https://www.normaculta.com.br
access-control-max-age: 600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2
content-type: text/plain; charset=utf-8
date: Thu, 02 Mar 2023 14:28:33 GMT
server: Google Frontend
vary: Origin
via: 1.1 google
x-cloud-trace-context: f32e539988a9093feee8ca1ef2aab4d1

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 1CBF 624 B
826 B 161ms
73ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CI-DLxCv7fgBGMXf39MBMAE&v=APEucNWKfA-GbPJBJgRj7tI-wkB420sL-DcH_V-mBnebLwrDVi73lqnNL-3wMj64vW1_dKHQ16tk7P4CelxGk20XSjiB4xASqWaO2rLByT8qsq6y51rLRPTZfKKifLLpjcN6bYwqpJYm1NpW1t4dHmITMS2yLv187tnRky0kHGS8twUmt8Swy0E

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 02 Mar 2023 14:28:33 GMT
expires: Thu, 02 Mar 2023 14:28:33 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 4867 78 KB
27 KB 223ms
126ms Script
text/javascript 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

16b432ac8f43a6b2d8aa358f41ee60e2ef5923b2645bf2c37f3a06f8334b1557

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:33 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27790
x-xss-protection: 0
server: cafe
etag: 3677590245327912432
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 02 Mar 2023 14:28:33 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4867 42 B
63 B 176ms
80ms Image
image/gif 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B_J6geQbRDheLRfuh1mWXHHvhQVCBfWwnUwVoSznVirg0cALigpYfcqKBbkS5YBHcEwgROasSM4SRa0SpJgxP3chN4kCyP51lCB4twyXfJTi_G5aw

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4867 0
20 B 175ms
79ms Image
image/gif 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=7430210997166509638&x=1&ct=77

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK unit_renderer.php Show response
as.euw1.jivox.com/unit/ Frame 4867 100 KB
27 KB 120ms
37ms Script
application/javascript 52.17.150.184
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://as.euw1.jivox.com/unit/unit_renderer.php?es_pId=29ba8ce&isDynamic=1&campaignId=159897&gdpr_consent=&dspId=DBM&bDim=300x600&ap_DataSignal1=18269839860&jvxVer=2&gdpr=&bUnitId=2200&r=1677767313119433&cMacro=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCethXkbIAZImlB6Km3gP594L4CcW_pLtugKPL290Q99KivcABEAEglov5G2CV4pCCoAegAebj3ukCyAEJqQIBTfXXC9OxPqgDAaoE9QFP0FAy42Q5XqnzbLMfOD3A25XsrFM9Vqm4KiY9TqgjsRMVc6mC-ml_TUc_RDVzfGERZ2sdFpdkNhJWJvUBKUwBGHuok82JNe1SJAeV4UnbSALc51989DR7tLtLtCaU0qun_ArEhXIUJlQD-viRcteUgA_upAg-ulVMXlBVIkoSPGhqRS4OEisBdSU49R3hErotkSS6aR9qC7nSrCNRsod3CCGDe4x5_KefsPqzDui8FVazkHNV0KSAXJodiH-QpRFt9fkHKQUnqD-10krq3bf0pyGGf9CDQ0FSgKEvq0tVcW9lHXnnqpr9ueuLQ8JKcvKDct9ecsAEkdWLvZIE4AQDkAYBoAZNgAeCnKGWAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATrv_oEdATANgTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSSwDUE5ymuHIv-7LgktZ2daLfOnEztA_uDSjNDPz3tRVtVmTVIS3FLgxSYNQ-KQFedQvkHIVIV0oicbUBHeS4T59YmPTAkbmKZt9FSBgB%26sig%3DAOD64_0ti9CWBr5iyckF5ICZRzooWrls2g%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-AkC6NJc8SUnqcI3jQJGTXlTqCoZsM_7FjwMhVQ6uC1rys_3keXF7n4nN5bVEwWhKl6MG9OwsMXL1gON-y5EuPYjBo2Xyxi6Z9CPKeUEU2oksu7LNF0Unl7M34f0GFTDu5GjExRsPwIx1wrSmKIjBfVwPehP6Cab2bZUiGoW9YD59fFfdk%26cry%3D1%26dbm_d%3DAKAmf-Aa-pjgaw9NJCJ908QgMQFBAJBCXMCT_0XpDKtY2ObS4-wTQTjb2G9N1kLPdL4_WR2TDxX2gOYDpy2_iBj8DerP7pUanVmhzOOKy9nc8BPLghiZt98avrsCLK5dFtiX3mP-Q1TMUx6iEI7izrDPEqwNBFRFiEDNokhK7_y602cRSn-5U7LrRrbv_juJE1cCVJ0EZWm004gktzBN_hNRlz99jtjxhsQ6Uel7t7_y6gzDF4js2ki10yKpwMQMv6qImTsYbPkYVDCePRveADRHLa4BirF-n2SYHYjWY8ejFpnzYv3Jcq5xKNBONwF6JT7B8PA1qF0JyFYqwLkVtLenj2zf3etOsr3wAQZ0gWZ6FfJ1oTfjhR_7tKtq5jYLx2VUfdWqfC26U2gYGdlUk0cKh5B84T2q5E0cKQki4zNB2SFv6mroWe3u_rz39oK5gh8ijNhNJ3Obick6ygANrjI7aVAtvu-yatBbQ9JV4kMx_si1t2dHWgy9gUAArKoYYE9eok9Zp-z9bm1WW0EG01m5Ifzf9M2kUiCBXc28QD9Iusvs6MldYVw%26adurl%3D&us_privacy=${US_PRIVACY}&ts_pId=29ba8ce&siteId=961ee94c58df6c&creativeUnitType=22
Requested by: Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.17.150.184 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-17-150-184.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: 9fac063a7ee926d334e43ef8b68a43064d60cd49ee7c48200a8732624ab44f88

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 02 Mar 2023 14:28:33 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
Content-Type: application/javascript
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Connection: keep-alive
Content-Length: 26915

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230227/r20110914/client/ Frame 4867 3 KB
1 KB 120ms
51ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230227/r20110914/client/window_focus_fy2021.js

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 09:37:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17440
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 16 Mar 2023 09:37:53 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230227/r20110914/client/ Frame 4867 20 KB
9 KB 115ms
47ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230227/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a6c19d8875246d4def23e273e3c6d2887aeba815c80128b91c8b86dc35e38e25

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 19:26:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68535
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5959907985313552934
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Mar 2023 19:26:18 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4867 158 KB
49 KB 133ms
46ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04e8409a13fe19247cf7c55cda100bb4097f3fe49e326a04302a30ba4ccb0333

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1677673803517815"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 02 Mar 2023 14:28:33 GMT

GET
H2 200 syncframe Show response
gum.criteo.com/ Frame A6E8 15 KB
6 KB 50ms
16ms Document
text/html 2a02:2638:3::c
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/syncframe?origin=publishertagids&topUrl=www.normaculta.com.br

Requested by

Host: static.criteo.net
URL: https://static.criteo.net/js/ld/publishertag.ids.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:3::c , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

97d67f8c2575e19d30ae28a32bad7610849e0e56c81ca66e51178124a5c5eed2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://www.normaculta.com.br/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 02 Mar 2023 14:28:33 GMT
server: Kestrel
server-processing-duration-in-ticks: 352323
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

esp Show response
oajs.openx.net/
Redirect Chain

https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.normaculta.com.br%2F&rid=esp
https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.normaculta.com.br%2F&rid=esp&cc=1

85 B
203 B

278ms
277ms

Fetch
application/json

34.120.107.143
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://oajs.openx.net/esp?url=https%3A%2F%2Fwww.normaculta.com.br%2F&rid=esp&cc=1
Protocol: H2
Server: 34.120.107.143 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 143.107.120.34.bc.googleusercontent.com
Software: / Express
Resource Hash: eb46dbd7570018a67837c6a7394b64096c629071dd4806ba6fc98aae57417761

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:34 GMT
via: 1.1 google
x-powered-by: Express
etag: W/"55-v0jfZNifY7QA2Wz6LQRp2XfBXyc"
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.normaculta.com.br
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 85

Redirect headers

date: Thu, 02 Mar 2023 14:28:33 GMT
via: 1.1 google
x-powered-by: Express
vary: Origin
access-control-allow-origin: https://www.normaculta.com.br
location: /esp?url=https%3A%2F%2Fwww.normaculta.com.br%2F&rid=esp&cc=1
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2

200

sid Show response
mug.criteo.com/ Frame A6E8
Redirect Chain

https://gum.criteo.com/sid/json?origin=publishertagids&domain=normaculta.com.br&sn=ChromeSyncframe&so=0&topUrl=www.normaculta.com.br&cw=1&lsw=1&topicsavail=0&fledgeavail=0
https://mug.criteo.com/sid?cpp=ANxvCHxPT2dDYzVlVUwwMlJmSUhKYkxLK25TajU3YlZUSFhJS3YreUw5RmxwMVBBcmovSHJTcDA1Ti9kQUtsdWR3K3hDOFI1RjkrWm5JVUd2VDRUVUpnM3oybTBDc0VMRHlITWo2SnFhWk9DNU1iSityWG94OXkyNmsrL0...

473 B
677 B

254ms
20ms

Fetch
application/json

178.250.0.157
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=ANxvCHxPT2dDYzVlVUwwMlJmSUhKYkxLK25TajU3YlZUSFhJS3YreUw5RmxwMVBBcmovSHJTcDA1Ti9kQUtsdWR3K3hDOFI1RjkrWm5JVUd2VDRUVUpnM3oybTBDc0VMRHlITWo2SnFhWk9DNU1iSityWG94OXkyNmsrL0N2M1J3cVNxbkVGZVhlNzZ5aTBFQjI3aEJqVXlRM29ubGtiUWppVDJ5cEZFdXhWQm9HcWpRWWNRN3NzWmFHRlA5bHNGRHRvYUdhYWJUbStwWlUrUE1EcjJxVlRqQjg0Y0F2eHNwbVRBazJkcnhPWG05YlVOUXl3UitmcVZIMTNnTEQvcXdLZUpSSHl3ZFkwd3J3WjBXU3RoWlIyRmFhQT09fA&cppv=2

Protocol

Server

178.250.0.157 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

624192f38816b2c0cf3a0598c9e7c8ed5fd58b8615923a0684cd251590439816

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://gum.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:33 GMT
strict-transport-security: max-age=31536000; preload;
content-encoding: gzip
server: Kestrel
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: https://gum.criteo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 3203071
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:33 GMT
strict-transport-security: max-age=31536000; preload;
server: Kestrel
location: https://mug.criteo.com/sid?cpp=ANxvCHxPT2dDYzVlVUwwMlJmSUhKYkxLK25TajU3YlZUSFhJS3YreUw5RmxwMVBBcmovSHJTcDA1Ti9kQUtsdWR3K3hDOFI1RjkrWm5JVUd2VDRUVUpnM3oybTBDc0VMRHlITWo2SnFhWk9DNU1iSityWG94OXkyNmsrL0N2M1J3cVNxbkVGZVhlNzZ5aTBFQjI3aEJqVXlRM29ubGtiUWppVDJ5cEZFdXhWQm9HcWpRWWNRN3NzWmFHRlA5bHNGRHRvYUdhYWJUbStwWlUrUE1EcjJxVlRqQjg0Y0F2eHNwbVRBazJkcnhPWG05YlVOUXl3UitmcVZIMTNnTEQvcXdLZUpSSHl3ZFkwd3J3WjBXU3RoWlIyRmFhQT09fA&cppv=2
cache-control: no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 386635
content-length: 0
expires: 0

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 18ms
18ms Image
image/gif 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j99&a=1305819003&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.normaculta.com.br%2F&ul=en-us&de=UTF-8&dt=Portugu%C3%AAs%20-%20L%C3%ADngua%20Portuguesa%20-%20Norma%20Culta&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Web%20VitalsWeb%20Vitals&ea=LCP&el=v3-1677767313080-7422479127371&ev=1045&_u=aADAAEABAAQCACAAI~&jid=&gjid=&cid=574628834.1677767313&tid=UA-10605777-55&_gid=652557325.1677767313&gtm=45He32r0n81W437CGB&cg1=contentGroup1&cg2=contentGroup2&cg3=contentGroup3&cg4=contentGroup4&z=237677548

Protocol

Security

QUIC, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 01 Mar 2023 21:53:59 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 59674
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6773 6 KB
3 KB 61ms
52ms Document
text/html 2a00:1450:400d:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80c::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.normaculta.com.br/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 02 Mar 2023 14:28:33 GMT
expires: Fri, 01 Mar 2024 14:28:33 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame D80C 13 KB
5 KB 45ms
34ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.normaculta.com.br/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 4544
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 02 Mar 2023 13:12:49 GMT
expires: Fri, 01 Mar 2024 13:12:49 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 8803 783 B
967 B 53ms
43ms Document
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

a547e30016e39719bcadef4902ffc69cf2fd4afdffca78bf34a3f5e712da0471

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-wVXOxf1rMSCyCuUr_iyILA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.normaculta.com.br/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-length: 511
content-security-policy: script-src 'report-sample' 'nonce-wVXOxf1rMSCyCuUr_iyILA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 02 Mar 2023 14:28:33 GMT
expires: Thu, 02 Mar 2023 14:28:33 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4867 0
20 B 81ms
81ms Ping
image/gif 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=3564953023183&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4867 0
20 B 78ms
78ms Ping
image/gif 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=3564953023183&version=m202301230201&ct=77&x=1&cor=7430210997166510000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:33 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 4867 28 KB
17 KB 69ms
68ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Aya6Uk-OupwjqpIfq_pFXpS-7WHWSM1DJCAdnfZl7w_8WHLQAuq-ZLXSO6eIS14UUsCnZUssaJpzS5qg7jrvB1QGusmGolfTPgv54ELnQvRPyyNnRHXMLSoMNdwhgwOzz-auiG_Ew2VwoWSoQiRiOhvyj_HuGESZV0zl7PpAvkdLrUsA0&cry=1&dbm_d=AKAmf-AnG_I5uzeNz5g7MPXQef1rcm2leKDHmbLBTxleIajVdHiAIQA4WREuHN8RMsiKIbCho73IeXRBKqhJJGnIbSzI0ZNJrj4BtZ1OUy3PY-foLrl_5a-uBmNO8JWwzFGxVZM1upT9S_eXwIdT5Tzh-YQ9TcpjeitQXiUnRj-v_kAs--o29jaDidHLV2ciGzEBy5BCHdUmRD9kvOg0yD6sxw_up9G222JcBELUUdVDrAvFaZhQzzdJoqWzUW8TaDcGcszgM26oGxDLND0cs3Uv3Q5ehVIATZrR7AGB75Z8bUdQtuICY6xPrD9abY2yOI6vLY5MeLThv41yUUmTgFwESXXSNsTpQjCgltD34U5Lq4UlMFy0I13nj0a1iZHVAA6Wkd_GVSsnF_9qJKBA63dsJufPXs8h_qyJYei5X0TvK0rQc2n7l4ycQB-5nRxdkTA5NvqkEsyXdGBCwm6md2g70kPz167rPDHeXOHEZJWocg0U3d67Ldz3Kf_kqEmFQnJyFkbT0VswN_7u543P3zGsBtC8k3LDHtlMm1jbHRlM8Q-zwLZ8u_EPf_ljytXRPAgPHeJkRnOxI66c4vp4ULCibDqWKBtkkAAbwVYpBEbSpJkkqHc2GUJ6_u3osl0-dZa_W_cm18CMQLlvDsbf1cNysLatEloVoTmTj7w-671nFgT4VinAotJjvAa_SNNy4mR4mfmmN0830Xg-GRIBneBHDNDvaFJ4ey4_ncYhbNke6nsYR8JlI6ngZKlNobkYAarGUasSsjhoHaMK1wqX7qyUTnlahzVk7IUSgxLhUueIKBhdz03fq9ZxipNJGx7xZyYUseBqkZ-6CkwFlSjzMege_S9wfKtGoyBf67hCr8o-OsI7mEavablJgC7QkAmkN78--sBJLZJJd5BAonFT47RTVw75DMow0nNpFrvldtf_byfD9G1ucBVdGhK1uQnVIXYhWaXjly6PTdHusRoVU36xGsaXpyj5JL_GOfwb5Y4eNZTgTIL6R1Q7CiBdahBE11ay8dtWSuaieQdwQvXNve_1ibJ9mzFtoEBdwJPtK7vappGRieRzVsM-EISy3VN2DxEw9_rpKQNLGIfpou_RPZPvU7E3boVDbo6QpTUzSq7KwuuyZH4iOGDs-fhpaKxTMxJTlW3X15_oadMJTcWHXGC5qYb7vpGtzD0ecJXubugTvtVJcDAvk9eRNi3XDz2ILZ1oPq9zR_crN6UiLUJM6I00oi3kZK4KQon9TLu-cTzEbUn_yImF2ki5YlcCQEDlgyIy3Ms6hJOZ2bXgm78lK9Bpj3l3ssWyJqj7nei7lEfJscCxLNa8yd8TPfkVQ6o2cLFZgBqJImmNe9bWmlu47Q2-I9QA5BBDGUUF_am3zfOixmSk1ZN-ku2xvmDYMN1Qt-ZKPAiUcuZghCXBP0jTjjKmje5r5Kqo8DvUUsI-7RmncJWFxpH2E-YzXGxHcQYA3eBP2jNZOuc13PNmrTw4PyjhyHJ-3gDR0wKpNt7zEl6wdWQutgWXKreWgzdZU51MABoYmoJntlAs7PR1wcUx7Hub80boK0fz4A58MIzm_1UMPUb7-0cieNSzWaxNlL40PRfpzRiOF53nTiy8jj5FNcU1JE4-xZ7zSiVOEIoZmotNdqupc2eNPfZ_7aX76O3PPM3yovslNE3gZ38IzEdOV08kPGwOH2gsHplZo9r5QZrGtL57Qe_MOkDQFqam6BF-HSVA9VmB8scrZ4ffzfR3SGmi9XCeWygOB8fspYdqiTWDjWW23M56QVofcz54E7ZIB86jX6jyBpjA9KJzNbE21sX_4c0nKz88eS778QTlTEvPpfsQn2sM7GFdsNO33gczNcFxEekUTxXmiOKXkECNjpe8O4KcByTx2Ez3JKbm-ImpbI8JGWPV_gqRL3V5MMIMy3JgIIiW_YbfjIqO7WhkwPStS7s4BcyT-jVUwqGEwIIMHO2aAZtEVyyQ0ZFHatg24SvOw-EQHfOcXMFU2i6ezvOUYq4sjKibsNUy5-8OCG47j3yhgD4MXnVItr0PokMgzOxQ4WUR-_V3-VQGrQaaypUKA05t2qVk0w9s15pJtkwfcUbIu9DNIyrgU-j0e1Sw-wtSl8w8Ix_PX1oHQbkdgYqTZfQaOJCMVNJ0BzIWyED7sqBwgHx8VkHyPOtGjKRXwMb23oqAT9KS0hH8649D9J2mi3k5YiQg5slDuCih8VMPTosT38rIPLfJcrHQIcJm0q8OH4P9SFL2zC6IF4RtJgByKTTdtgJqICPWoSCqkuQTZKPHlMLJlzVJFX04aHikXpSGOuelAdPAGEGj5hnW-KBhxveLs0VMv8ADkgDX9cZVhBXdvFI9OgjnNFOPTDdKQsqU0OEZdjKs5oigOdaqIGc_hX94UV15uf6ssoGvfvpaXBklm6304ijGGGvtFWTw5vZ6-AlohEKeP9lNrSSnfEgsZD3JfPFPcvdI2jo0cGGD_KynjYCggxTwu8zB8GaxIZHlsRkSYXDLlaxv8F7NsiRx1ciNlxFKJenixXRiYUfms4XfAaDhQwrJjuMpdNgGKxgxeaVxnPJ6mh2LNyMgLLsb7jkwHbT_yQ0E_yJRW4ayWcmYVZWBe9Y97RX1RSTxdPpF3cO5BXZ2siCG37fw3tX50Bl-LBROaIzJqEesbB8xXm-Mqm4kvdIyF2qsShfoHGQAsiB4oIyQDFQmM1txlI8AlvmfJTKQOJIQWksCpg2PKE9iO9yoc-N3rqpvgl0mJhrNptisqGXDFVS6Zu3-zZTbWyZf-tpkz5d-0Ll5oO5vG-D8cxDTQ-vhCrJjMHyBhjyYzw2kraSji2mO1ooIwJWCiB-KTuVbXFNqVF_QtEkITCO5x98kcV_ovjo8v9vGNMFynz-lIAYpc9q-mvS28LDyK3X22wf3NCYJcVOZx3hpAyvmyNZz3iSG5rp8Dht6NfmSn84sMJRNUeagKmcmfPqXUmjBnvdEqxvK0kB8PpR9t1nYWc5vofPwQttxmpvE5I9D4NMj7vU00tcIWgHqzxRJMYx7i9soNsxyU5SpFRHGjHVXOpbO8L-DXa2PkDj1qHu91bbY7a0Ydt1BR4nH_YIyz_eZc9LD-vJtG5MGLWCsmDJcn3DvhVdzvGZDIFmgAlCk6CY6wiA_LqQIPmD90rJMRYXcDV1Ig7Yk-zkrT4cTHtjPXvi5gN_feqMYZBhOvNJSbKA4FEPGWTYx1_ca1lx8vymhT80BgyHlZjjl9pTb069T-Tv44C8QrKlqSYbpoZ17BXwBQvFKjFO0hqZZ6C2PMET7eAFj5cYHwkAdnAHwaeOikHBYof2HxhPLmOA7c1khXU1zTufexld4smGN5CFNoHq2UD_gw0CWIu-CEX5PZ8JA-DOqNcqL7YQjCJE4uLQTjELomFh8NqmDh5OCx65jktRzt9whxg&cid=CAQSSwDUE5ymuHIv-7LgktZ2daLfOnEztA_uDSjNDPz3tRVtVmTVIS3FLgxSYNQ-KQFedQvkHIVIV0oicbUBHeS4T59YmPTAkbmKZt9FSBgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.normaculta.com.br%2F&ds=l&xdt=1&iif=1&cor=7430210997166510000&adk=356101037&idt=251&cac=0&dtd=16

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b94a4f26290c155bf28e1fe9625e2c89a86b2b8294499e527d731f5c5579c558

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:33 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16911
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 1CBF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIofYQBLKv6gyKRqlWdfV9Y&google_cver=1

43 B
766 B

13ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIofYQBLKv6gyKRqlWdfV9Y&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI-DLxCv7fgBGMXf39MBMAE&v=APEucNWKfA-GbPJBJgRj7tI-wkB420sL-DcH_V-mBnebLwrDVi73lqnNL-3wMj64vW1_dKHQ16tk7P4CelxGk20XSjiB4xASqWaO2rLByT8qsq6y51rLRPTZfKKifLLpjcN6bYwqpJYm1NpW1t4dHmITMS2yLv187tnRky0kHGS8twUmt8Swy0E
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 02 Mar 2023 14:28:34 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:34 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIofYQBLKv6gyKRqlWdfV9Y&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 1CBF
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZACykvdTPwzYZBuhxfTOwAAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIofYQBLKv6gyKRqlWdfV9Y&google_cver=1

43 B
766 B

8ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIofYQBLKv6gyKRqlWdfV9Y&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI-DLxCv7fgBGMXf39MBMAE&v=APEucNWKfA-GbPJBJgRj7tI-wkB420sL-DcH_V-mBnebLwrDVi73lqnNL-3wMj64vW1_dKHQ16tk7P4CelxGk20XSjiB4xASqWaO2rLByT8qsq6y51rLRPTZfKKifLLpjcN6bYwqpJYm1NpW1t4dHmITMS2yLv187tnRky0kHGS8twUmt8Swy0E
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 02 Mar 2023 14:28:34 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=497
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:34 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEIofYQBLKv6gyKRqlWdfV9Y&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 1CBF
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEAccQIMdWzKRwH3eEG9fcXc&google_cver=1

43 B
1 KB

20ms
19ms

Image
image/gif

185.89.210.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEAccQIMdWzKRwH3eEG9fcXc&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CI-DLxCv7fgBGMXf39MBMAE&v=APEucNWKfA-GbPJBJgRj7tI-wkB420sL-DcH_V-mBnebLwrDVi73lqnNL-3wMj64vW1_dKHQ16tk7P4CelxGk20XSjiB4xASqWaO2rLByT8qsq6y51rLRPTZfKKifLLpjcN6bYwqpJYm1NpW1t4dHmITMS2yLv187tnRky0kHGS8twUmt8Swy0E

Protocol

HTTP/1.1

Server

185.89.210.244 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 02 Mar 2023 14:28:34 GMT
AN-X-Request-Uuid: d5093472-26f2-41fc-8af5-ba062b0ffa83
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 185.213.155.187; 185.213.155.187; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:34 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEAccQIMdWzKRwH3eEG9fcXc&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame 1CBF
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjMwOTgyMTA2NzIzOTc2NTUzMQ%3D%3D

170 B
243 B

45ms
44ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjMwOTgyMTA2NzIzOTc2NTUzMQ%3D%3D

Requested by

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:34 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 02 Mar 2023 14:28:34 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 185.213.155.187; 185.213.155.187; 946.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 1272802d-5372-4c22-b877-b83d561f9790
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MjMwOTgyMTA2NzIzOTc2NTUzMQ%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230227/r20110914/ Frame 4867 29 KB
11 KB 47ms
47ms Script
text/javascript 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230227/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Aya6Uk-OupwjqpIfq_pFXpS-7WHWSM1DJCAdnfZl7w_8WHLQAuq-ZLXSO6eIS14UUsCnZUssaJpzS5qg7jrvB1QGusmGolfTPgv54ELnQvRPyyNnRHXMLSoMNdwhgwOzz-auiG_Ew2VwoWSoQiRiOhvyj_HuGESZV0zl7PpAvkdLrUsA0&cry=1&dbm_d=AKAmf-AnG_I5uzeNz5g7MPXQef1rcm2leKDHmbLBTxleIajVdHiAIQA4WREuHN8RMsiKIbCho73IeXRBKqhJJGnIbSzI0ZNJrj4BtZ1OUy3PY-foLrl_5a-uBmNO8JWwzFGxVZM1upT9S_eXwIdT5Tzh-YQ9TcpjeitQXiUnRj-v_kAs--o29jaDidHLV2ciGzEBy5BCHdUmRD9kvOg0yD6sxw_up9G222JcBELUUdVDrAvFaZhQzzdJoqWzUW8TaDcGcszgM26oGxDLND0cs3Uv3Q5ehVIATZrR7AGB75Z8bUdQtuICY6xPrD9abY2yOI6vLY5MeLThv41yUUmTgFwESXXSNsTpQjCgltD34U5Lq4UlMFy0I13nj0a1iZHVAA6Wkd_GVSsnF_9qJKBA63dsJufPXs8h_qyJYei5X0TvK0rQc2n7l4ycQB-5nRxdkTA5NvqkEsyXdGBCwm6md2g70kPz167rPDHeXOHEZJWocg0U3d67Ldz3Kf_kqEmFQnJyFkbT0VswN_7u543P3zGsBtC8k3LDHtlMm1jbHRlM8Q-zwLZ8u_EPf_ljytXRPAgPHeJkRnOxI66c4vp4ULCibDqWKBtkkAAbwVYpBEbSpJkkqHc2GUJ6_u3osl0-dZa_W_cm18CMQLlvDsbf1cNysLatEloVoTmTj7w-671nFgT4VinAotJjvAa_SNNy4mR4mfmmN0830Xg-GRIBneBHDNDvaFJ4ey4_ncYhbNke6nsYR8JlI6ngZKlNobkYAarGUasSsjhoHaMK1wqX7qyUTnlahzVk7IUSgxLhUueIKBhdz03fq9ZxipNJGx7xZyYUseBqkZ-6CkwFlSjzMege_S9wfKtGoyBf67hCr8o-OsI7mEavablJgC7QkAmkN78--sBJLZJJd5BAonFT47RTVw75DMow0nNpFrvldtf_byfD9G1ucBVdGhK1uQnVIXYhWaXjly6PTdHusRoVU36xGsaXpyj5JL_GOfwb5Y4eNZTgTIL6R1Q7CiBdahBE11ay8dtWSuaieQdwQvXNve_1ibJ9mzFtoEBdwJPtK7vappGRieRzVsM-EISy3VN2DxEw9_rpKQNLGIfpou_RPZPvU7E3boVDbo6QpTUzSq7KwuuyZH4iOGDs-fhpaKxTMxJTlW3X15_oadMJTcWHXGC5qYb7vpGtzD0ecJXubugTvtVJcDAvk9eRNi3XDz2ILZ1oPq9zR_crN6UiLUJM6I00oi3kZK4KQon9TLu-cTzEbUn_yImF2ki5YlcCQEDlgyIy3Ms6hJOZ2bXgm78lK9Bpj3l3ssWyJqj7nei7lEfJscCxLNa8yd8TPfkVQ6o2cLFZgBqJImmNe9bWmlu47Q2-I9QA5BBDGUUF_am3zfOixmSk1ZN-ku2xvmDYMN1Qt-ZKPAiUcuZghCXBP0jTjjKmje5r5Kqo8DvUUsI-7RmncJWFxpH2E-YzXGxHcQYA3eBP2jNZOuc13PNmrTw4PyjhyHJ-3gDR0wKpNt7zEl6wdWQutgWXKreWgzdZU51MABoYmoJntlAs7PR1wcUx7Hub80boK0fz4A58MIzm_1UMPUb7-0cieNSzWaxNlL40PRfpzRiOF53nTiy8jj5FNcU1JE4-xZ7zSiVOEIoZmotNdqupc2eNPfZ_7aX76O3PPM3yovslNE3gZ38IzEdOV08kPGwOH2gsHplZo9r5QZrGtL57Qe_MOkDQFqam6BF-HSVA9VmB8scrZ4ffzfR3SGmi9XCeWygOB8fspYdqiTWDjWW23M56QVofcz54E7ZIB86jX6jyBpjA9KJzNbE21sX_4c0nKz88eS778QTlTEvPpfsQn2sM7GFdsNO33gczNcFxEekUTxXmiOKXkECNjpe8O4KcByTx2Ez3JKbm-ImpbI8JGWPV_gqRL3V5MMIMy3JgIIiW_YbfjIqO7WhkwPStS7s4BcyT-jVUwqGEwIIMHO2aAZtEVyyQ0ZFHatg24SvOw-EQHfOcXMFU2i6ezvOUYq4sjKibsNUy5-8OCG47j3yhgD4MXnVItr0PokMgzOxQ4WUR-_V3-VQGrQaaypUKA05t2qVk0w9s15pJtkwfcUbIu9DNIyrgU-j0e1Sw-wtSl8w8Ix_PX1oHQbkdgYqTZfQaOJCMVNJ0BzIWyED7sqBwgHx8VkHyPOtGjKRXwMb23oqAT9KS0hH8649D9J2mi3k5YiQg5slDuCih8VMPTosT38rIPLfJcrHQIcJm0q8OH4P9SFL2zC6IF4RtJgByKTTdtgJqICPWoSCqkuQTZKPHlMLJlzVJFX04aHikXpSGOuelAdPAGEGj5hnW-KBhxveLs0VMv8ADkgDX9cZVhBXdvFI9OgjnNFOPTDdKQsqU0OEZdjKs5oigOdaqIGc_hX94UV15uf6ssoGvfvpaXBklm6304ijGGGvtFWTw5vZ6-AlohEKeP9lNrSSnfEgsZD3JfPFPcvdI2jo0cGGD_KynjYCggxTwu8zB8GaxIZHlsRkSYXDLlaxv8F7NsiRx1ciNlxFKJenixXRiYUfms4XfAaDhQwrJjuMpdNgGKxgxeaVxnPJ6mh2LNyMgLLsb7jkwHbT_yQ0E_yJRW4ayWcmYVZWBe9Y97RX1RSTxdPpF3cO5BXZ2siCG37fw3tX50Bl-LBROaIzJqEesbB8xXm-Mqm4kvdIyF2qsShfoHGQAsiB4oIyQDFQmM1txlI8AlvmfJTKQOJIQWksCpg2PKE9iO9yoc-N3rqpvgl0mJhrNptisqGXDFVS6Zu3-zZTbWyZf-tpkz5d-0Ll5oO5vG-D8cxDTQ-vhCrJjMHyBhjyYzw2kraSji2mO1ooIwJWCiB-KTuVbXFNqVF_QtEkITCO5x98kcV_ovjo8v9vGNMFynz-lIAYpc9q-mvS28LDyK3X22wf3NCYJcVOZx3hpAyvmyNZz3iSG5rp8Dht6NfmSn84sMJRNUeagKmcmfPqXUmjBnvdEqxvK0kB8PpR9t1nYWc5vofPwQttxmpvE5I9D4NMj7vU00tcIWgHqzxRJMYx7i9soNsxyU5SpFRHGjHVXOpbO8L-DXa2PkDj1qHu91bbY7a0Ydt1BR4nH_YIyz_eZc9LD-vJtG5MGLWCsmDJcn3DvhVdzvGZDIFmgAlCk6CY6wiA_LqQIPmD90rJMRYXcDV1Ig7Yk-zkrT4cTHtjPXvi5gN_feqMYZBhOvNJSbKA4FEPGWTYx1_ca1lx8vymhT80BgyHlZjjl9pTb069T-Tv44C8QrKlqSYbpoZ17BXwBQvFKjFO0hqZZ6C2PMET7eAFj5cYHwkAdnAHwaeOikHBYof2HxhPLmOA7c1khXU1zTufexld4smGN5CFNoHq2UD_gw0CWIu-CEX5PZ8JA-DOqNcqL7YQjCJE4uLQTjELomFh8NqmDh5OCx65jktRzt9whxg&cid=CAQSSwDUE5ymuHIv-7LgktZ2daLfOnEztA_uDSjNDPz3tRVtVmTVIS3FLgxSYNQ-KQFedQvkHIVIV0oicbUBHeS4T59YmPTAkbmKZt9FSBgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.normaculta.com.br%2F&ds=l&xdt=1&iif=1&cor=7430210997166510000&adk=356101037&idt=251&cac=0&dtd=16

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

555cb911a280dae2e7ab778b5403e27a81533f7b53cfac255d67e175a96c6e86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:11:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 995
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11134
x-xss-protection: 0
server: cafe
etag: 11889138295710991679
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 16 Mar 2023 14:11:58 GMT

GET
H2 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 4867 41 KB
15 KB 36ms
36ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 13:44:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 89042
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 29 Feb 2024 13:44:31 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 7213 640 B
262 B 77ms
73ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNU3Uu9a1_M0HB8kPdmMTsAEmiI7EXFojQO_x_nTgfSw0XQUvl6kezt8UNcVUtN-ypFcPU1T7TQfaWdqwakE5MY9ZJ9awvOJAJhm9FyjsizHZrTW_v1kEgNe6EDi2nsgBydD3Ni3lZgT0pfdnXFXhzCSfIryGOqm4WGewh5LIWWsk4VLWuI

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 02 Mar 2023 14:28:34 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 6773 78 KB
27 KB 100ms
100ms Script
text/javascript 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

16b432ac8f43a6b2d8aa358f41ee60e2ef5923b2645bf2c37f3a06f8334b1557

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:34 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27790
x-xss-protection: 0
server: cafe
etag: 3677590245327912432
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 02 Mar 2023 14:28:34 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6773 42 B
63 B 81ms
79ms Image
image/gif 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-B5wVOSYMBBRlVrYfpWYsNnkFS4GqxjllDWt1gQCyxyNFwzoF3v_r2TfXOk7vjmOTjpqDxXbDXLG7eFrvFoYmrun9RmXDMa4A3uYggTsjEoFCLdleo

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6773 0
20 B 80ms
78ms Image
image/gif 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=5332606164574871522&x=1&ct=77

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230227/r20110914/client/ Frame 6773 3 KB
1 KB 37ms
35ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230227/r20110914/client/window_focus_fy2021.js

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 09:37:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17441
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 16 Mar 2023 09:37:53 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230227/r20110914/client/ Frame 6773 20 KB
8 KB 37ms
35ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230227/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a6c19d8875246d4def23e273e3c6d2887aeba815c80128b91c8b86dc35e38e25

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 19:26:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68536
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5959907985313552934
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Mar 2023 19:26:18 GMT

GET rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 6773 0
0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 8803 0
0 80ms
80ms Image
text/html 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2023022701&jk=3558250168591124&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame E6A5 22 KB
8 KB 35ms
35ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 184750
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 28 Feb 2023 11:09:24 GMT
expires: Wed, 28 Feb 2024 11:09:24 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK layout_renderer.php Show response
as.euw1.jivox.com/unit/ Frame 06A8 279 KB
51 KB 63ms
62ms Document
text/html 52.17.150.184
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://as.euw1.jivox.com/unit/layout_renderer.php?es_pId=29ba8ce&isDynamic=1&campaignId=159897&gdpr_consent=&dspId=DBM&bDim=300x600&ap_DataSignal1=18269839860&jvxVer=2&gdpr=&bUnitId=2200&r=1677767313119433&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCethXkbIAZImlB6Km3gP594L4CcW_pLtugKPL290Q99KivcABEAEglov5G2CV4pCCoAegAebj3ukCyAEJqQIBTfXXC9OxPqgDAaoE9QFP0FAy42Q5XqnzbLMfOD3A25XsrFM9Vqm4KiY9TqgjsRMVc6mC-ml_TUc_RDVzfGERZ2sdFpdkNhJWJvUBKUwBGHuok82JNe1SJAeV4UnbSALc51989DR7tLtLtCaU0qun_ArEhXIUJlQD-viRcteUgA_upAg-ulVMXlBVIkoSPGhqRS4OEisBdSU49R3hErotkSS6aR9qC7nSrCNRsod3CCGDe4x5_KefsPqzDui8FVazkHNV0KSAXJodiH-QpRFt9fkHKQUnqD-10krq3bf0pyGGf9CDQ0FSgKEvq0tVcW9lHXnnqpr9ueuLQ8JKcvKDct9ecsAEkdWLvZIE4AQDkAYBoAZNgAeCnKGWAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATrv_oEdATANgTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSSwDUE5ymuHIv-7LgktZ2daLfOnEztA_uDSjNDPz3tRVtVmTVIS3FLgxSYNQ-KQFedQvkHIVIV0oicbUBHeS4T59YmPTAkbmKZt9FSBgB%26sig%3DAOD64_0ti9CWBr5iyckF5ICZRzooWrls2g%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-AkC6NJc8SUnqcI3jQJGTXlTqCoZsM_7FjwMhVQ6uC1rys_3keXF7n4nN5bVEwWhKl6MG9OwsMXL1gON-y5EuPYjBo2Xyxi6Z9CPKeUEU2oksu7LNF0Unl7M34f0GFTDu5GjExRsPwIx1wrSmKIjBfVwPehP6Cab2bZUiGoW9YD59fFfdk%26cry%3D1%26dbm_d%3DAKAmf-Aa-pjgaw9NJCJ908QgMQFBAJBCXMCT_0XpDKtY2ObS4-wTQTjb2G9N1kLPdL4_WR2TDxX2gOYDpy2_iBj8DerP7pUanVmhzOOKy9nc8BPLghiZt98avrsCLK5dFtiX3mP-Q1TMUx6iEI7izrDPEqwNBFRFiEDNokhK7_y602cRSn-5U7LrRrbv_juJE1cCVJ0EZWm004gktzBN_hNRlz99jtjxhsQ6Uel7t7_y6gzDF4js2ki10yKpwMQMv6qImTsYbPkYVDCePRveADRHLa4BirF-n2SYHYjWY8ejFpnzYv3Jcq5xKNBONwF6JT7B8PA1qF0JyFYqwLkVtLenj2zf3etOsr3wAQZ0gWZ6FfJ1oTfjhR_7tKtq5jYLx2VUfdWqfC26U2gYGdlUk0cKh5B84T2q5E0cKQki4zNB2SFv6mroWe3u_rz39oK5gh8ijNhNJ3Obick6ygANrjI7aVAtvu-yatBbQ9JV4kMx_si1t2dHWgy9gUAArKoYYE9eok9Zp-z9bm1WW0EG01m5Ifzf9M2kUiCBXc28QD9Iusvs6MldYVw%26adurl%3D&us_privacy=%24%7BUS_PRIVACY%7D&ts_pId=29ba8ce&siteId=961ee94c58df6c&creativeUnitType=22&objectName=jvx_6400b291b0976&adUnitId=2200&jvxSessionId=1677767313.9651&base=1&creativeResolveBeginTime=1677767314000&omid=0&localTimeOffset=0&pageURL=https%3A%2F%2F07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Requested by: Host: as.euw1.jivox.com
URL: https://as.euw1.jivox.com/unit/unit_renderer.php?es_pId=29ba8ce&isDynamic=1&campaignId=159897&gdpr_consent=&dspId=DBM&bDim=300x600&ap_DataSignal1=18269839860&jvxVer=2&gdpr=&bUnitId=2200&r=1677767313119433&cMacro=https://googleads.g.doubleclick.net/dbm/clk%3Fsa%3DL%26ai%3DCethXkbIAZImlB6Km3gP594L4CcW_pLtugKPL290Q99KivcABEAEglov5G2CV4pCCoAegAebj3ukCyAEJqQIBTfXXC9OxPqgDAaoE9QFP0FAy42Q5XqnzbLMfOD3A25XsrFM9Vqm4KiY9TqgjsRMVc6mC-ml_TUc_RDVzfGERZ2sdFpdkNhJWJvUBKUwBGHuok82JNe1SJAeV4UnbSALc51989DR7tLtLtCaU0qun_ArEhXIUJlQD-viRcteUgA_upAg-ulVMXlBVIkoSPGhqRS4OEisBdSU49R3hErotkSS6aR9qC7nSrCNRsod3CCGDe4x5_KefsPqzDui8FVazkHNV0KSAXJodiH-QpRFt9fkHKQUnqD-10krq3bf0pyGGf9CDQ0FSgKEvq0tVcW9lHXnnqpr9ueuLQ8JKcvKDct9ecsAEkdWLvZIE4AQDkAYBoAZNgAeCnKGWAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATrv_oEdATANgTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSSwDUE5ymuHIv-7LgktZ2daLfOnEztA_uDSjNDPz3tRVtVmTVIS3FLgxSYNQ-KQFedQvkHIVIV0oicbUBHeS4T59YmPTAkbmKZt9FSBgB%26sig%3DAOD64_0ti9CWBr5iyckF5ICZRzooWrls2g%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-AkC6NJc8SUnqcI3jQJGTXlTqCoZsM_7FjwMhVQ6uC1rys_3keXF7n4nN5bVEwWhKl6MG9OwsMXL1gON-y5EuPYjBo2Xyxi6Z9CPKeUEU2oksu7LNF0Unl7M34f0GFTDu5GjExRsPwIx1wrSmKIjBfVwPehP6Cab2bZUiGoW9YD59fFfdk%26cry%3D1%26dbm_d%3DAKAmf-Aa-pjgaw9NJCJ908QgMQFBAJBCXMCT_0XpDKtY2ObS4-wTQTjb2G9N1kLPdL4_WR2TDxX2gOYDpy2_iBj8DerP7pUanVmhzOOKy9nc8BPLghiZt98avrsCLK5dFtiX3mP-Q1TMUx6iEI7izrDPEqwNBFRFiEDNokhK7_y602cRSn-5U7LrRrbv_juJE1cCVJ0EZWm004gktzBN_hNRlz99jtjxhsQ6Uel7t7_y6gzDF4js2ki10yKpwMQMv6qImTsYbPkYVDCePRveADRHLa4BirF-n2SYHYjWY8ejFpnzYv3Jcq5xKNBONwF6JT7B8PA1qF0JyFYqwLkVtLenj2zf3etOsr3wAQZ0gWZ6FfJ1oTfjhR_7tKtq5jYLx2VUfdWqfC26U2gYGdlUk0cKh5B84T2q5E0cKQki4zNB2SFv6mroWe3u_rz39oK5gh8ijNhNJ3Obick6ygANrjI7aVAtvu-yatBbQ9JV4kMx_si1t2dHWgy9gUAArKoYYE9eok9Zp-z9bm1WW0EG01m5Ifzf9M2kUiCBXc28QD9Iusvs6MldYVw%26adurl%3D&us_privacy=${US_PRIVACY}&ts_pId=29ba8ce&siteId=961ee94c58df6c&creativeUnitType=22
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.17.150.184 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-17-150-184.eu-west-1.compute.amazonaws.com
Software: Apache /
Resource Hash: efdb9edb7b7ab84fc09edc039ee9627e26fb3a1e284d8412695d7116ff013655

Request headers

Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache
Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
Date: Thu, 02 Mar 2023 14:28:34 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Pragma: no-cache
Server: Apache
Transfer-Encoding: chunked
Vary: Accept-Encoding

GET
DATA 200
OK truncated
/ Frame 4867 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 507660766f513506aae405cb573ef35733f3af0c57744e6263c722f434fd02ca

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 U1KVG_mJ4Y43Q94sC__L5Y27Ilp_TqM8IF3zBLVmW9g.js Show response
pagead2.googlesyndication.com/bg/ Frame D80C 36 KB
14 KB 58ms
57ms Script
text/javascript 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/U1KVG_mJ4Y43Q94sC__L5Y27Ilp_TqM8IF3zBLVmW9g.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5352951bf989e18e3743de2c0bffcbe58dbb225a7f4ea33c205df304b5665bd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 15:53:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81318
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14276
x-xss-protection: 0
last-modified: Thu, 23 Feb 2023 13:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 29 Feb 2024 15:53:16 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 7213
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEN18lK5wzLw9XhJ0uz1N14A&google_cver=1

43 B
114 B

21ms
20ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEN18lK5wzLw9XhJ0uz1N14A&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNU3Uu9a1_M0HB8kPdmMTsAEmiI7EXFojQO_x_nTgfSw0XQUvl6kezt8UNcVUtN-ypFcPU1T7TQfaWdqwakE5MY9ZJ9awvOJAJhm9FyjsizHZrTW_v1kEgNe6EDi2nsgBydD3Ni3lZgT0pfdnXFXhzCSfIryGOqm4WGewh5LIWWsk4VLWuI
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:34 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:34 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEN18lK5wzLw9XhJ0uz1N14A&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 7213 43 B
304 B 58ms
22ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNU3Uu9a1_M0HB8kPdmMTsAEmiI7EXFojQO_x_nTgfSw0XQUvl6kezt8UNcVUtN-ypFcPU1T7TQfaWdqwakE5MY9ZJ9awvOJAJhm9FyjsizHZrTW_v1kEgNe6EDi2nsgBydD3Ni3lZgT0pfdnXFXhzCSfIryGOqm4WGewh5LIWWsk4VLWuI
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:34 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 7213
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEIORxYD45mf7niMyWVsnEp8&google_cver=1

23 B
172 B

75ms
33ms

Image
image/gif

104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEIORxYD45mf7niMyWVsnEp8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNU3Uu9a1_M0HB8kPdmMTsAEmiI7EXFojQO_x_nTgfSw0XQUvl6kezt8UNcVUtN-ypFcPU1T7TQfaWdqwakE5MY9ZJ9awvOJAJhm9FyjsizHZrTW_v1kEgNe6EDi2nsgBydD3Ni3lZgT0pfdnXFXhzCSfIryGOqm4WGewh5LIWWsk4VLWuI
Protocol: H2
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

expires: Thu, 02 Mar 2023 14:28:34 GMT
pragma: no-cache
date: Thu, 02 Mar 2023 14:28:34 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:34 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEIORxYD45mf7niMyWVsnEp8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 7213 23 B
172 B 128ms
36ms Image
image/gif 104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CN-KGhDw3uOiAxjbobvGATAB&v=APEucNU3Uu9a1_M0HB8kPdmMTsAEmiI7EXFojQO_x_nTgfSw0XQUvl6kezt8UNcVUtN-ypFcPU1T7TQfaWdqwakE5MY9ZJ9awvOJAJhm9FyjsizHZrTW_v1kEgNe6EDi2nsgBydD3Ni3lZgT0pfdnXFXhzCSfIryGOqm4WGewh5LIWWsk4VLWuI
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

expires: Thu, 02 Mar 2023 14:28:34 GMT
pragma: no-cache
date: Thu, 02 Mar 2023 14:28:34 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

GET
H2 200 jquery-2.1.0.min.js Show response
playercdn.jivox.com/1651821427/unit/js/gz/ Frame 06A8 82 KB
29 KB 40ms
8ms Script
application/x-javascript 108.138.5.230
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://playercdn.jivox.com/1651821427/unit/js/gz/jquery-2.1.0.min.js
Requested by: Host: as.euw1.jivox.com
URL: https://as.euw1.jivox.com/unit/layout_renderer.php?es_pId=29ba8ce&isDynamic=1&campaignId=159897&gdpr_consent=&dspId=DBM&bDim=300x600&ap_DataSignal1=18269839860&jvxVer=2&gdpr=&bUnitId=2200&r=1677767313119433&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCethXkbIAZImlB6Km3gP594L4CcW_pLtugKPL290Q99KivcABEAEglov5G2CV4pCCoAegAebj3ukCyAEJqQIBTfXXC9OxPqgDAaoE9QFP0FAy42Q5XqnzbLMfOD3A25XsrFM9Vqm4KiY9TqgjsRMVc6mC-ml_TUc_RDVzfGERZ2sdFpdkNhJWJvUBKUwBGHuok82JNe1SJAeV4UnbSALc51989DR7tLtLtCaU0qun_ArEhXIUJlQD-viRcteUgA_upAg-ulVMXlBVIkoSPGhqRS4OEisBdSU49R3hErotkSS6aR9qC7nSrCNRsod3CCGDe4x5_KefsPqzDui8FVazkHNV0KSAXJodiH-QpRFt9fkHKQUnqD-10krq3bf0pyGGf9CDQ0FSgKEvq0tVcW9lHXnnqpr9ueuLQ8JKcvKDct9ecsAEkdWLvZIE4AQDkAYBoAZNgAeCnKGWAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATrv_oEdATANgTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSSwDUE5ymuHIv-7LgktZ2daLfOnEztA_uDSjNDPz3tRVtVmTVIS3FLgxSYNQ-KQFedQvkHIVIV0oicbUBHeS4T59YmPTAkbmKZt9FSBgB%26sig%3DAOD64_0ti9CWBr5iyckF5ICZRzooWrls2g%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-AkC6NJc8SUnqcI3jQJGTXlTqCoZsM_7FjwMhVQ6uC1rys_3keXF7n4nN5bVEwWhKl6MG9OwsMXL1gON-y5EuPYjBo2Xyxi6Z9CPKeUEU2oksu7LNF0Unl7M34f0GFTDu5GjExRsPwIx1wrSmKIjBfVwPehP6Cab2bZUiGoW9YD59fFfdk%26cry%3D1%26dbm_d%3DAKAmf-Aa-pjgaw9NJCJ908QgMQFBAJBCXMCT_0XpDKtY2ObS4-wTQTjb2G9N1kLPdL4_WR2TDxX2gOYDpy2_iBj8DerP7pUanVmhzOOKy9nc8BPLghiZt98avrsCLK5dFtiX3mP-Q1TMUx6iEI7izrDPEqwNBFRFiEDNokhK7_y602cRSn-5U7LrRrbv_juJE1cCVJ0EZWm004gktzBN_hNRlz99jtjxhsQ6Uel7t7_y6gzDF4js2ki10yKpwMQMv6qImTsYbPkYVDCePRveADRHLa4BirF-n2SYHYjWY8ejFpnzYv3Jcq5xKNBONwF6JT7B8PA1qF0JyFYqwLkVtLenj2zf3etOsr3wAQZ0gWZ6FfJ1oTfjhR_7tKtq5jYLx2VUfdWqfC26U2gYGdlUk0cKh5B84T2q5E0cKQki4zNB2SFv6mroWe3u_rz39oK5gh8ijNhNJ3Obick6ygANrjI7aVAtvu-yatBbQ9JV4kMx_si1t2dHWgy9gUAArKoYYE9eok9Zp-z9bm1WW0EG01m5Ifzf9M2kUiCBXc28QD9Iusvs6MldYVw%26adurl%3D&us_privacy=%24%7BUS_PRIVACY%7D&ts_pId=29ba8ce&siteId=961ee94c58df6c&creativeUnitType=22&objectName=jvx_6400b291b0976&adUnitId=2200&jvxSessionId=1677767313.9651&base=1&creativeResolveBeginTime=1677767314000&omid=0&localTimeOffset=0&pageURL=https%3A%2F%2F07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.5.230 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-5-230.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f284353a7cc4d97f6fe20a5155131bd43587a0f1c98a56eeaf52cff72910f47d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.euw1.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 05:14:17 GMT
content-encoding: gzip
via: 1.1 61c90c70feca5f532bf48bc0dc85d516.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 07:27:36 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P6
age: 33258
etag: "84642ab523899a6150af1489287de4de"
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: max-age=86400, s-maxage=86400
accept-ranges: bytes
content-length: 29294
x-amz-cf-id: TCjnw1GEMmQJr3tnfCSEeGsT9N4uWw3SQpsfx71QHC_EnYWp3WPNpA==

GET
H2 200 velocity-raf-disabled.min.js Show response
playercdn.jivox.com/1651821427/unit/js/gz/ Frame 06A8 34 KB
12 KB 45ms
14ms Script
application/x-javascript 108.138.5.230
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://playercdn.jivox.com/1651821427/unit/js/gz/velocity-raf-disabled.min.js
Requested by: Host: as.euw1.jivox.com
URL: https://as.euw1.jivox.com/unit/layout_renderer.php?es_pId=29ba8ce&isDynamic=1&campaignId=159897&gdpr_consent=&dspId=DBM&bDim=300x600&ap_DataSignal1=18269839860&jvxVer=2&gdpr=&bUnitId=2200&r=1677767313119433&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCethXkbIAZImlB6Km3gP594L4CcW_pLtugKPL290Q99KivcABEAEglov5G2CV4pCCoAegAebj3ukCyAEJqQIBTfXXC9OxPqgDAaoE9QFP0FAy42Q5XqnzbLMfOD3A25XsrFM9Vqm4KiY9TqgjsRMVc6mC-ml_TUc_RDVzfGERZ2sdFpdkNhJWJvUBKUwBGHuok82JNe1SJAeV4UnbSALc51989DR7tLtLtCaU0qun_ArEhXIUJlQD-viRcteUgA_upAg-ulVMXlBVIkoSPGhqRS4OEisBdSU49R3hErotkSS6aR9qC7nSrCNRsod3CCGDe4x5_KefsPqzDui8FVazkHNV0KSAXJodiH-QpRFt9fkHKQUnqD-10krq3bf0pyGGf9CDQ0FSgKEvq0tVcW9lHXnnqpr9ueuLQ8JKcvKDct9ecsAEkdWLvZIE4AQDkAYBoAZNgAeCnKGWAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATrv_oEdATANgTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSSwDUE5ymuHIv-7LgktZ2daLfOnEztA_uDSjNDPz3tRVtVmTVIS3FLgxSYNQ-KQFedQvkHIVIV0oicbUBHeS4T59YmPTAkbmKZt9FSBgB%26sig%3DAOD64_0ti9CWBr5iyckF5ICZRzooWrls2g%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-AkC6NJc8SUnqcI3jQJGTXlTqCoZsM_7FjwMhVQ6uC1rys_3keXF7n4nN5bVEwWhKl6MG9OwsMXL1gON-y5EuPYjBo2Xyxi6Z9CPKeUEU2oksu7LNF0Unl7M34f0GFTDu5GjExRsPwIx1wrSmKIjBfVwPehP6Cab2bZUiGoW9YD59fFfdk%26cry%3D1%26dbm_d%3DAKAmf-Aa-pjgaw9NJCJ908QgMQFBAJBCXMCT_0XpDKtY2ObS4-wTQTjb2G9N1kLPdL4_WR2TDxX2gOYDpy2_iBj8DerP7pUanVmhzOOKy9nc8BPLghiZt98avrsCLK5dFtiX3mP-Q1TMUx6iEI7izrDPEqwNBFRFiEDNokhK7_y602cRSn-5U7LrRrbv_juJE1cCVJ0EZWm004gktzBN_hNRlz99jtjxhsQ6Uel7t7_y6gzDF4js2ki10yKpwMQMv6qImTsYbPkYVDCePRveADRHLa4BirF-n2SYHYjWY8ejFpnzYv3Jcq5xKNBONwF6JT7B8PA1qF0JyFYqwLkVtLenj2zf3etOsr3wAQZ0gWZ6FfJ1oTfjhR_7tKtq5jYLx2VUfdWqfC26U2gYGdlUk0cKh5B84T2q5E0cKQki4zNB2SFv6mroWe3u_rz39oK5gh8ijNhNJ3Obick6ygANrjI7aVAtvu-yatBbQ9JV4kMx_si1t2dHWgy9gUAArKoYYE9eok9Zp-z9bm1WW0EG01m5Ifzf9M2kUiCBXc28QD9Iusvs6MldYVw%26adurl%3D&us_privacy=%24%7BUS_PRIVACY%7D&ts_pId=29ba8ce&siteId=961ee94c58df6c&creativeUnitType=22&objectName=jvx_6400b291b0976&adUnitId=2200&jvxSessionId=1677767313.9651&base=1&creativeResolveBeginTime=1677767314000&omid=0&localTimeOffset=0&pageURL=https%3A%2F%2F07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.5.230 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-5-230.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fa85a4366200f608a99ecf4b1b933babdd9c5662cbe5d518b3daa57e53dbd85b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.euw1.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 18:38:54 GMT
content-encoding: gzip
via: 1.1 61c90c70feca5f532bf48bc0dc85d516.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 07:27:53 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P6
age: 71380
etag: "6db08f58b76a3c4459a454a7acf752ca"
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: max-age=86400, s-maxage=86400
accept-ranges: bytes
content-length: 12405
x-amz-cf-id: QUVUrg1r3yeyzHUV1XGxYG6779k0Z_A9h6qaybAs3KONPQG3-E11UA==

GET
H2 200 jivoxWidgetApiV2.min.js Show response
playercdn.jivox.com/1651821427/widgets/jivoxWidgetApi/gz/ Frame 06A8 29 KB
6 KB 46ms
15ms Script
application/x-javascript 108.138.5.230
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://playercdn.jivox.com/1651821427/widgets/jivoxWidgetApi/gz/jivoxWidgetApiV2.min.js
Requested by: Host: as.euw1.jivox.com
URL: https://as.euw1.jivox.com/unit/layout_renderer.php?es_pId=29ba8ce&isDynamic=1&campaignId=159897&gdpr_consent=&dspId=DBM&bDim=300x600&ap_DataSignal1=18269839860&jvxVer=2&gdpr=&bUnitId=2200&r=1677767313119433&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCethXkbIAZImlB6Km3gP594L4CcW_pLtugKPL290Q99KivcABEAEglov5G2CV4pCCoAegAebj3ukCyAEJqQIBTfXXC9OxPqgDAaoE9QFP0FAy42Q5XqnzbLMfOD3A25XsrFM9Vqm4KiY9TqgjsRMVc6mC-ml_TUc_RDVzfGERZ2sdFpdkNhJWJvUBKUwBGHuok82JNe1SJAeV4UnbSALc51989DR7tLtLtCaU0qun_ArEhXIUJlQD-viRcteUgA_upAg-ulVMXlBVIkoSPGhqRS4OEisBdSU49R3hErotkSS6aR9qC7nSrCNRsod3CCGDe4x5_KefsPqzDui8FVazkHNV0KSAXJodiH-QpRFt9fkHKQUnqD-10krq3bf0pyGGf9CDQ0FSgKEvq0tVcW9lHXnnqpr9ueuLQ8JKcvKDct9ecsAEkdWLvZIE4AQDkAYBoAZNgAeCnKGWAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATrv_oEdATANgTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSSwDUE5ymuHIv-7LgktZ2daLfOnEztA_uDSjNDPz3tRVtVmTVIS3FLgxSYNQ-KQFedQvkHIVIV0oicbUBHeS4T59YmPTAkbmKZt9FSBgB%26sig%3DAOD64_0ti9CWBr5iyckF5ICZRzooWrls2g%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-AkC6NJc8SUnqcI3jQJGTXlTqCoZsM_7FjwMhVQ6uC1rys_3keXF7n4nN5bVEwWhKl6MG9OwsMXL1gON-y5EuPYjBo2Xyxi6Z9CPKeUEU2oksu7LNF0Unl7M34f0GFTDu5GjExRsPwIx1wrSmKIjBfVwPehP6Cab2bZUiGoW9YD59fFfdk%26cry%3D1%26dbm_d%3DAKAmf-Aa-pjgaw9NJCJ908QgMQFBAJBCXMCT_0XpDKtY2ObS4-wTQTjb2G9N1kLPdL4_WR2TDxX2gOYDpy2_iBj8DerP7pUanVmhzOOKy9nc8BPLghiZt98avrsCLK5dFtiX3mP-Q1TMUx6iEI7izrDPEqwNBFRFiEDNokhK7_y602cRSn-5U7LrRrbv_juJE1cCVJ0EZWm004gktzBN_hNRlz99jtjxhsQ6Uel7t7_y6gzDF4js2ki10yKpwMQMv6qImTsYbPkYVDCePRveADRHLa4BirF-n2SYHYjWY8ejFpnzYv3Jcq5xKNBONwF6JT7B8PA1qF0JyFYqwLkVtLenj2zf3etOsr3wAQZ0gWZ6FfJ1oTfjhR_7tKtq5jYLx2VUfdWqfC26U2gYGdlUk0cKh5B84T2q5E0cKQki4zNB2SFv6mroWe3u_rz39oK5gh8ijNhNJ3Obick6ygANrjI7aVAtvu-yatBbQ9JV4kMx_si1t2dHWgy9gUAArKoYYE9eok9Zp-z9bm1WW0EG01m5Ifzf9M2kUiCBXc28QD9Iusvs6MldYVw%26adurl%3D&us_privacy=%24%7BUS_PRIVACY%7D&ts_pId=29ba8ce&siteId=961ee94c58df6c&creativeUnitType=22&objectName=jvx_6400b291b0976&adUnitId=2200&jvxSessionId=1677767313.9651&base=1&creativeResolveBeginTime=1677767314000&omid=0&localTimeOffset=0&pageURL=https%3A%2F%2F07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.5.230 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-5-230.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f6c84a15873bbae73ff06857139327b85a6869fa0e21d36666aa2bb5d9bbb19b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.euw1.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 23:34:07 GMT
content-encoding: gzip
via: 1.1 61c90c70feca5f532bf48bc0dc85d516.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 07:29:25 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P6
age: 53667
etag: "2a0e0abd8f7f11fb012a534ea115a29a"
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: max-age=86400, s-maxage=86400
accept-ranges: bytes
content-length: 5987
x-amz-cf-id: evet6OEIILqBFu3IGFHKLZJ92X7SeVo3cwuPcM51aGHA2wemYF6gew==

GET
H3 200 U1KVG_mJ4Y43Q94sC__L5Y27Ilp_TqM8IF3zBLVmW9g.js Show response
pagead2.googlesyndication.com/bg/ Frame E6A5 36 KB
14 KB 48ms
47ms Script
text/javascript 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/U1KVG_mJ4Y43Q94sC__L5Y27Ilp_TqM8IF3zBLVmW9g.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5352951bf989e18e3743de2c0bffcbe58dbb225a7f4ea33c205df304b5665bd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 15:53:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81318
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14276
x-xss-protection: 0
last-modified: Thu, 23 Feb 2023 13:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 29 Feb 2024 15:53:16 GMT

GET
H2 200 pd Show response
google-bidout-d.openx.net/w/1.0/ Frame 6A95 0
176 B 60ms
22ms Document
text/html 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://google-bidout-d.openx.net/w/1.0/pd?plm=5
Requested by: Host: oa.openxcdn.net
URL: https://oa.openxcdn.net/esp.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.normaculta.com.br/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: gzip
content-length: 20
content-type: text/html
date: Thu, 02 Mar 2023 14:28:34 GMT
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
via: 1.1 google

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6773 0
20 B 80ms
79ms Ping
image/gif 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=9869534320818&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 6773 0
20 B 79ms
79ms Ping
image/gif 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=9869534320818&version=m202301230201&ct=77&x=1&cor=5332606164574872000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 6773 15 KB
11 KB 72ms
71ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A8gU321YLq-ZmEFWwfCCJbYi4og8BnTwQrPO7QOAG0EFr2M9crmaPASj0Vcma8nKopDP2e0nKTpOadYcqNsTfIGbJyjgx0MZORg51Cd0DtPSee8KJe-_mb3Re3voKPh7P3UpwLUEZATtOfbEb5EjIrLaXWqsatbMr-50CcaA8UuvrPjNw&cry=1&dbm_d=AKAmf-BqQfitokl6fUEBMGgufwpbuYPJQUgLYV6xgIqOrUNVj9RlzRgugghyys0nUse0V9IfMLjL7fYcNGcVjTq8oFcx6yATht-vm-_hIx4tqSS9nQQE_Ly7kT2Vz2vUMhHbOMrYyy8VEGHdGplyi6VUGWLIsl20k8qqjxNRdXWEBKMM18XViLTn2WfzwPqVerkAq--Ba1R97qJxiWknqhcuzMGCJVDUuLnGKRInxBF1Hg4_JAwu6xLyR4NjK8WsqMzNpPGYwvRFIOgfHeIT8GewBUxmb1kKMs51l6hDl7D8xzLniLvfx0TXeyYsDgTKt0qnflDZVR9x7I8WDfNektnE_jQrtkBs_TapjZLiuuPSJ3PZRvcaGi3vLHKqk2xDAjuUQ27TYu3MiadQd2QrhVKiG7PYWrUB2GjRVqAuK9L7ROhSNExLcNc1AIPIUq-ZR-QV2GkD7MPXaVQaYWrTH7HZ7JqDuxHwWIeKrEfKfaxvi8Xx43YK4VfJDLG9SgI0yOJ2V24AArP-oCz-PETp2g2A-LvxqmZhiZoNSwnKlYFFin4NX-1qybXk3fwfp5Lb5MQnAYDyqOfy4OI1ZLt8-R6WoBmeXamB2CiYlpTGx7799DQrsnDJt0Hz3CzR63WPhYJVy3Dl10SOkYLBDzraDdF6O_TiqVnB_H8wi54Ye-xxjGYaspuVsUjEfLU44RDdlUjztN1iKHZtYfI0e6ds8RSzCd0Suek_jFIewyEOJ6ZNAhRe9QK-DKP_bDdtzudSM2h_0Ae2r-T9FF2h-eDMWDJSg2S6KKLUl0w_rr9f7-ct7JkeODZeWJv9R1q8uahWmPHZNw7nuxVVhvaIFKdXV7V-9NSFgRMfcK8jKxsvnnyq2mzyEUtmQw4tLhPwUP580cUQB4RS1Exfz0J0IWoyCKnyi4E8AsXIBf6EQAF-Z8rj4hQQlgKB8r8NduvKl_O82tcUTpsfcDjQyLEfZerZb-wyUcedYynEvsLT69L_ALiuysJFMkEMuDVF2iE_z4NPLcJMTXH9iHYOAXdBhcyoA-OAsfivzhyjgOxwirmryb98JKZnSHdMU52v8alaXwz7dGbKQXVKF_Z30D5-55Iw7f6ira7cG_4Ij28W4XcUNYPc4k1oJoj-g1YKFwZNHSAJp10RXTH8wrHA16u0JsIyzR0FZcNdwhR6CpYiDrctxl2DqTnAVHN3Hx4ponPKldIMgzV80erIzy8o1ZxTI-mIymFIYRDlyUtfTnSnqh3g2x1DvXrdR7OBJdkNep4L-o2ORSQmwjAQzRrSH4clcokMeHQ96w7EFHbag3TJ3SYkZQOEOPR-Trmuy5K9f_n9FV_YgecXY2TELb29UqwLnIss3rNBVyPgU5Zzix-2V-jPeiCbHfvXHjulND3Nr7thOu9EMhAu-VCswbxKZz9YR5OtDErzc-RFtb8nThVLZvf99Q5jq2zpULQPIO7sVibzTS3Fz8n0l7vFsZItfcB6osHz8IzhK8-L7DFhyh1LcMfvTZLfIhRCQZGsbaj0puaVbWQoe8Ogr3dCA320HTzO5y96_AhQcsDb6hoaWwUvRuOOgXekwTTg9rYrpM4K5erAuW1v1z-zH3YVHg7LFnGapwP-Ay26Rf5qaS9t-0XHcp2P56YRMnGGlL4AzY8t2IMQ5c3S7Dit5tmAL1vUNDXZch4fMQq16tjIE6K_NsAn7C4gzR_Do-P6gRpXmqMoimC_I1E_BfH8DfRKyVJafMSZ1899f016oeBnK-_2FvdPXNfArBk2B_14pG2b3vgaLe7bAVW24I601EDEWpFmQOSWq6ZtLLqMPDa8BqHTPf03AZP8_XuAMFmKvWqUQL1DTpbsFHCg8f9AuS11aAqn3jVAIr0W4dlz0k1jHoePgv1HwaBCvtS1orCA1PMYV2T3NSMSLtd0195Y-wOaXs64qBVtOZG2q7tnMz87LegEy5LnVDLtPnuUc6KuIi7crYH99bQuMO3bgAhH5q0Fx5J_20o-UIxN9c8881ShsRWvit3CBqTIllao3l4BP4PTmQD72yCEPYmz_PqHf22-bbgleXW6F56M1a8X1MKW0WPQVrNumdc2Ly-wGVynL1SGG8I6VmanLIgA8gcE3Id2wsLGXyycQPzt7Gnvd1kufTp4aVbqOphM0x5hpu0J-yOxdBIw587Bf6633aGMi915YVnaKcuAgAF2mBdBm3DpmFjd0uUdPwmMvEAoNSSOk9N_tYk1veVePGWqgbzMsYZBaQCAzEAxQrV_jBrAIIOXzrzXQXcghFm6uE3HXQi9bv--wwKEu4z44GUiq8-2d8hn1RhjDZUvaKyP-iT_o7Iamwaed2-_9DV_2JRpfjy5AWrMzX-B001qN_bCgv0Ixpn_umJNVA7ENGZZ2dNYOOJ-OWMZlhxk5gV9q0k2QVlCQXdIlHX2BCuLkJsDtOJ2dZOgpB7VgWbasj_Zulvuq6TOE5bImJw9ge1_XWhhq7FFUDTEnjlK3V0dgGsGDPL6ovOJyFExU5r6hjRYBpRUfJOGUOcVaiVaMe_GfMwaaPJqZAbg5l2t8iPk11cP1FJ-edj8kEl3Tc-cnN8d-pXiwJiqRTA0fDipGByiMvemukvdJ5uWBCHAXUIGr5zC15VX3--wgLLfJ8RCMWdB42NDa1j7KNq1fAQIIwJTeizw1DDQz_aKOtJwVvoL_k5BSfB6SOvME_pX4xAWxsR6wxpqoCbzABa0vFgpc11anJVjcV5a_mI1xwctl4fj4uPQHMVsGCj1jfI0RSrKd9Kp_5aXrvcssb6c3CUa7wQnxJrcnzUi6PHEwUlpW8iFgN-3ollbP-XIICqn51HUjlS2Mwi9Ez-9mO7KZCZeYWbRHb9n4rwyp1CSIysD3EopDPFcDAX0hoRciI6KG4IYGRWGGB0gGtnYNtdW3J5TeEbyWpbNu_KXK3bhoEXdZBskcf2Co0Ke66LlO3sf-n0Cdk0xxqCnAGJg-xOFeGD__8ddzi3XGjr-PUKkQd692xIp1jD4RP4qpoxIjvn1sZzZ2_Ivr0mRvF2IrsyhExKWGMFu7yn6TmdBLuqxcMeKbTFiSM_sF_Rem_qMT-r5S35pen1WxxZ_6YMVYznSfXRr6WrUyJgWE0Ik_wK7cACJPipS6wT3G2S1G7iJMuUDwOE3vIMHDRVSuZzw2liWm0vH_6YOvU18QChM7Yq2gGcnmP705AcppgatcoOCltPJXwtqimF4Z6M8lqijtMIXT57cm1pB9OcyoGjSV82_YzkxFlDluxiqPWO3MSe3Sk4JqTxu-3PMVJY4NwZBT78pWy6SoxnPDZsHtoK9N6RZVbMmaG3CHWR3vohtyPs8G1pAdTCX7FVaSJw7noX425OkVfEPiPoUhBdNgaCnMnkCp5-F9yHn9CgKMbf_8rpk3OMc25fgG4daVd1GVYoLyg_tWmrJGRIRf5iHjSS3bsm7FlKo9xUcmvjaaC8AB_yy_wPobIjnaIGmnBhcUGEHDchwL6dCH51QOEfVXhMnvHAaSe5RVL7WvVhJGOdDJa91W4d50vWDqxRLJ4EQSqrJcozGBKYu97s_WT-XsnoDyXJYwGbl4kKFP9kL2L61C-z5dzVWXQwJ53H4JyPmyS7Q2U3WAZnyrHGpDa3Ih6tkFhtgw5U&cid=CAQSTADUE5ymtqRW3NKjQlof8F0--41KGCJmlHMZqCahStUSi9khsC1oNZ54Xfw4dga7pwORmAu1pSsZxQYBRxUIS3KUUk59EhmCNd7casMYAQ&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.normaculta.com.br%2F&ds=l&xdt=1&iif=1&cor=5332606164574872000&adk=250412560&idt=125&cac=0&dtd=5

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dec599a97ecda7d038ddf6f30ce746b99d37ac148799e453d9948fd8281922cc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:34 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11216
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 jivoxWidgetApiV2.min.js Show response
playercdn.jivox.com/1651821427/widgets/jivoxWidgetApi/gz/ Frame 283B 29 KB
6 KB 8ms
7ms Script
application/x-javascript 108.138.5.230
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://playercdn.jivox.com/1651821427/widgets/jivoxWidgetApi/gz/jivoxWidgetApiV2.min.js
Requested by: Host: as.euw1.jivox.com
URL: https://as.euw1.jivox.com/unit/layout_renderer.php?es_pId=29ba8ce&isDynamic=1&campaignId=159897&gdpr_consent=&dspId=DBM&bDim=300x600&ap_DataSignal1=18269839860&jvxVer=2&gdpr=&bUnitId=2200&r=1677767313119433&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCethXkbIAZImlB6Km3gP594L4CcW_pLtugKPL290Q99KivcABEAEglov5G2CV4pCCoAegAebj3ukCyAEJqQIBTfXXC9OxPqgDAaoE9QFP0FAy42Q5XqnzbLMfOD3A25XsrFM9Vqm4KiY9TqgjsRMVc6mC-ml_TUc_RDVzfGERZ2sdFpdkNhJWJvUBKUwBGHuok82JNe1SJAeV4UnbSALc51989DR7tLtLtCaU0qun_ArEhXIUJlQD-viRcteUgA_upAg-ulVMXlBVIkoSPGhqRS4OEisBdSU49R3hErotkSS6aR9qC7nSrCNRsod3CCGDe4x5_KefsPqzDui8FVazkHNV0KSAXJodiH-QpRFt9fkHKQUnqD-10krq3bf0pyGGf9CDQ0FSgKEvq0tVcW9lHXnnqpr9ueuLQ8JKcvKDct9ecsAEkdWLvZIE4AQDkAYBoAZNgAeCnKGWAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATrv_oEdATANgTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSSwDUE5ymuHIv-7LgktZ2daLfOnEztA_uDSjNDPz3tRVtVmTVIS3FLgxSYNQ-KQFedQvkHIVIV0oicbUBHeS4T59YmPTAkbmKZt9FSBgB%26sig%3DAOD64_0ti9CWBr5iyckF5ICZRzooWrls2g%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-AkC6NJc8SUnqcI3jQJGTXlTqCoZsM_7FjwMhVQ6uC1rys_3keXF7n4nN5bVEwWhKl6MG9OwsMXL1gON-y5EuPYjBo2Xyxi6Z9CPKeUEU2oksu7LNF0Unl7M34f0GFTDu5GjExRsPwIx1wrSmKIjBfVwPehP6Cab2bZUiGoW9YD59fFfdk%26cry%3D1%26dbm_d%3DAKAmf-Aa-pjgaw9NJCJ908QgMQFBAJBCXMCT_0XpDKtY2ObS4-wTQTjb2G9N1kLPdL4_WR2TDxX2gOYDpy2_iBj8DerP7pUanVmhzOOKy9nc8BPLghiZt98avrsCLK5dFtiX3mP-Q1TMUx6iEI7izrDPEqwNBFRFiEDNokhK7_y602cRSn-5U7LrRrbv_juJE1cCVJ0EZWm004gktzBN_hNRlz99jtjxhsQ6Uel7t7_y6gzDF4js2ki10yKpwMQMv6qImTsYbPkYVDCePRveADRHLa4BirF-n2SYHYjWY8ejFpnzYv3Jcq5xKNBONwF6JT7B8PA1qF0JyFYqwLkVtLenj2zf3etOsr3wAQZ0gWZ6FfJ1oTfjhR_7tKtq5jYLx2VUfdWqfC26U2gYGdlUk0cKh5B84T2q5E0cKQki4zNB2SFv6mroWe3u_rz39oK5gh8ijNhNJ3Obick6ygANrjI7aVAtvu-yatBbQ9JV4kMx_si1t2dHWgy9gUAArKoYYE9eok9Zp-z9bm1WW0EG01m5Ifzf9M2kUiCBXc28QD9Iusvs6MldYVw%26adurl%3D&us_privacy=%24%7BUS_PRIVACY%7D&ts_pId=29ba8ce&siteId=961ee94c58df6c&creativeUnitType=22&objectName=jvx_6400b291b0976&adUnitId=2200&jvxSessionId=1677767313.9651&base=1&creativeResolveBeginTime=1677767314000&omid=0&localTimeOffset=0&pageURL=https%3A%2F%2F07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 108.138.5.230 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-138-5-230.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f6c84a15873bbae73ff06857139327b85a6869fa0e21d36666aa2bb5d9bbb19b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.euw1.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 23:34:07 GMT
content-encoding: gzip
via: 1.1 61c90c70feca5f532bf48bc0dc85d516.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 07:29:25 GMT
server: AmazonS3
x-amz-cf-pop: FRA56-P6
age: 53667
etag: "2a0e0abd8f7f11fb012a534ea115a29a"
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: max-age=86400, s-maxage=86400
accept-ranges: bytes
content-length: 5987
x-amz-cf-id: 2Tg_bDFkRpCHfOoUgROYuZ6wVRKv03V2pZALzxrGlNja8f75plG6xw==

GET
H2 200 createjs.min.js Show response
code.createjs.com/1.0.0/ Frame 283B 236 KB
63 KB 114ms
15ms Script
text/javascript 2a02:26f0:3500:11::215:14cb
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://code.createjs.com/1.0.0/createjs.min.js
Requested by: Host: as.euw1.jivox.com
URL: https://as.euw1.jivox.com/unit/layout_renderer.php?es_pId=29ba8ce&isDynamic=1&campaignId=159897&gdpr_consent=&dspId=DBM&bDim=300x600&ap_DataSignal1=18269839860&jvxVer=2&gdpr=&bUnitId=2200&r=1677767313119433&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCethXkbIAZImlB6Km3gP594L4CcW_pLtugKPL290Q99KivcABEAEglov5G2CV4pCCoAegAebj3ukCyAEJqQIBTfXXC9OxPqgDAaoE9QFP0FAy42Q5XqnzbLMfOD3A25XsrFM9Vqm4KiY9TqgjsRMVc6mC-ml_TUc_RDVzfGERZ2sdFpdkNhJWJvUBKUwBGHuok82JNe1SJAeV4UnbSALc51989DR7tLtLtCaU0qun_ArEhXIUJlQD-viRcteUgA_upAg-ulVMXlBVIkoSPGhqRS4OEisBdSU49R3hErotkSS6aR9qC7nSrCNRsod3CCGDe4x5_KefsPqzDui8FVazkHNV0KSAXJodiH-QpRFt9fkHKQUnqD-10krq3bf0pyGGf9CDQ0FSgKEvq0tVcW9lHXnnqpr9ueuLQ8JKcvKDct9ecsAEkdWLvZIE4AQDkAYBoAZNgAeCnKGWAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATrv_oEdATANgTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSSwDUE5ymuHIv-7LgktZ2daLfOnEztA_uDSjNDPz3tRVtVmTVIS3FLgxSYNQ-KQFedQvkHIVIV0oicbUBHeS4T59YmPTAkbmKZt9FSBgB%26sig%3DAOD64_0ti9CWBr5iyckF5ICZRzooWrls2g%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-AkC6NJc8SUnqcI3jQJGTXlTqCoZsM_7FjwMhVQ6uC1rys_3keXF7n4nN5bVEwWhKl6MG9OwsMXL1gON-y5EuPYjBo2Xyxi6Z9CPKeUEU2oksu7LNF0Unl7M34f0GFTDu5GjExRsPwIx1wrSmKIjBfVwPehP6Cab2bZUiGoW9YD59fFfdk%26cry%3D1%26dbm_d%3DAKAmf-Aa-pjgaw9NJCJ908QgMQFBAJBCXMCT_0XpDKtY2ObS4-wTQTjb2G9N1kLPdL4_WR2TDxX2gOYDpy2_iBj8DerP7pUanVmhzOOKy9nc8BPLghiZt98avrsCLK5dFtiX3mP-Q1TMUx6iEI7izrDPEqwNBFRFiEDNokhK7_y602cRSn-5U7LrRrbv_juJE1cCVJ0EZWm004gktzBN_hNRlz99jtjxhsQ6Uel7t7_y6gzDF4js2ki10yKpwMQMv6qImTsYbPkYVDCePRveADRHLa4BirF-n2SYHYjWY8ejFpnzYv3Jcq5xKNBONwF6JT7B8PA1qF0JyFYqwLkVtLenj2zf3etOsr3wAQZ0gWZ6FfJ1oTfjhR_7tKtq5jYLx2VUfdWqfC26U2gYGdlUk0cKh5B84T2q5E0cKQki4zNB2SFv6mroWe3u_rz39oK5gh8ijNhNJ3Obick6ygANrjI7aVAtvu-yatBbQ9JV4kMx_si1t2dHWgy9gUAArKoYYE9eok9Zp-z9bm1WW0EG01m5Ifzf9M2kUiCBXc28QD9Iusvs6MldYVw%26adurl%3D&us_privacy=%24%7BUS_PRIVACY%7D&ts_pId=29ba8ce&siteId=961ee94c58df6c&creativeUnitType=22&objectName=jvx_6400b291b0976&adUnitId=2200&jvxSessionId=1677767313.9651&base=1&creativeResolveBeginTime=1677767314000&omid=0&localTimeOffset=0&pageURL=https%3A%2F%2F07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:3500:11::215:14cb Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: Apache /
Resource Hash: e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.euw1.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:34 GMT
content-encoding: gzip
server: Apache
vary: Accept-Encoding
content-type: text/javascript
cache-control: max-age=900
x-n: S
accept-ranges: bytes
expires: Thu, 02 Mar 2023 14:43:34 GMT

GET
H2 200 mazda_300x600_jvx.js Show response
assets.euw1.jivox.com/widgets/2023/1/a72798z63c7f6c6b5606/1/300x600_M2/ Frame 283B 26 KB
5 KB 59ms
7ms Script
application/x-javascript 13.32.99.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.euw1.jivox.com/widgets/2023/1/a72798z63c7f6c6b5606/1/300x600_M2/mazda_300x600_jvx.js
Requested by: Host: as.euw1.jivox.com
URL: https://as.euw1.jivox.com/unit/layout_renderer.php?es_pId=29ba8ce&isDynamic=1&campaignId=159897&gdpr_consent=&dspId=DBM&bDim=300x600&ap_DataSignal1=18269839860&jvxVer=2&gdpr=&bUnitId=2200&r=1677767313119433&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCethXkbIAZImlB6Km3gP594L4CcW_pLtugKPL290Q99KivcABEAEglov5G2CV4pCCoAegAebj3ukCyAEJqQIBTfXXC9OxPqgDAaoE9QFP0FAy42Q5XqnzbLMfOD3A25XsrFM9Vqm4KiY9TqgjsRMVc6mC-ml_TUc_RDVzfGERZ2sdFpdkNhJWJvUBKUwBGHuok82JNe1SJAeV4UnbSALc51989DR7tLtLtCaU0qun_ArEhXIUJlQD-viRcteUgA_upAg-ulVMXlBVIkoSPGhqRS4OEisBdSU49R3hErotkSS6aR9qC7nSrCNRsod3CCGDe4x5_KefsPqzDui8FVazkHNV0KSAXJodiH-QpRFt9fkHKQUnqD-10krq3bf0pyGGf9CDQ0FSgKEvq0tVcW9lHXnnqpr9ueuLQ8JKcvKDct9ecsAEkdWLvZIE4AQDkAYBoAZNgAeCnKGWAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATrv_oEdATANgTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSSwDUE5ymuHIv-7LgktZ2daLfOnEztA_uDSjNDPz3tRVtVmTVIS3FLgxSYNQ-KQFedQvkHIVIV0oicbUBHeS4T59YmPTAkbmKZt9FSBgB%26sig%3DAOD64_0ti9CWBr5iyckF5ICZRzooWrls2g%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-AkC6NJc8SUnqcI3jQJGTXlTqCoZsM_7FjwMhVQ6uC1rys_3keXF7n4nN5bVEwWhKl6MG9OwsMXL1gON-y5EuPYjBo2Xyxi6Z9CPKeUEU2oksu7LNF0Unl7M34f0GFTDu5GjExRsPwIx1wrSmKIjBfVwPehP6Cab2bZUiGoW9YD59fFfdk%26cry%3D1%26dbm_d%3DAKAmf-Aa-pjgaw9NJCJ908QgMQFBAJBCXMCT_0XpDKtY2ObS4-wTQTjb2G9N1kLPdL4_WR2TDxX2gOYDpy2_iBj8DerP7pUanVmhzOOKy9nc8BPLghiZt98avrsCLK5dFtiX3mP-Q1TMUx6iEI7izrDPEqwNBFRFiEDNokhK7_y602cRSn-5U7LrRrbv_juJE1cCVJ0EZWm004gktzBN_hNRlz99jtjxhsQ6Uel7t7_y6gzDF4js2ki10yKpwMQMv6qImTsYbPkYVDCePRveADRHLa4BirF-n2SYHYjWY8ejFpnzYv3Jcq5xKNBONwF6JT7B8PA1qF0JyFYqwLkVtLenj2zf3etOsr3wAQZ0gWZ6FfJ1oTfjhR_7tKtq5jYLx2VUfdWqfC26U2gYGdlUk0cKh5B84T2q5E0cKQki4zNB2SFv6mroWe3u_rz39oK5gh8ijNhNJ3Obick6ygANrjI7aVAtvu-yatBbQ9JV4kMx_si1t2dHWgy9gUAArKoYYE9eok9Zp-z9bm1WW0EG01m5Ifzf9M2kUiCBXc28QD9Iusvs6MldYVw%26adurl%3D&us_privacy=%24%7BUS_PRIVACY%7D&ts_pId=29ba8ce&siteId=961ee94c58df6c&creativeUnitType=22&objectName=jvx_6400b291b0976&adUnitId=2200&jvxSessionId=1677767313.9651&base=1&creativeResolveBeginTime=1677767314000&omid=0&localTimeOffset=0&pageURL=https%3A%2F%2F07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-43.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 48176b4cd9b6f90432e35af08c479c9ab95ad0d159408e55948c9e25f37bc57e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.euw1.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-amz-version-id: null
content-encoding: br
via: 1.1 d63ea68c8b7458d49fe25f66ef7f0a5e.cloudfront.net (CloudFront)
date: Thu, 02 Mar 2023 05:29:52 GMT
last-modified: Wed, 18 Jan 2023 13:40:25 GMT
server: AmazonS3
x-amz-cf-pop: FRA60-P3
age: 32323
x-amz-server-side-encryption: AES256
etag: W/"ac732fc3b19f3631082ddf3900b229b0"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
cache-control: max-age=86400, s-maxage=86400
x-amz-cf-id: ec_bxPBfAlcbAoRtiT-KjF6oKvPGnt6mf2zBeXnM052UeT002ArfmA==

GET
H2 200 es_encParams_L2FwX0RhdGFTaWduYWwxPTE4MjY5ODM5ODYwL2FkYjEta2V5PTgwMy9hZGIxLWlkX3ZlcnNpb249Mjk3MDBfMS9iRGltPTMwMHg2MDAvcj0wLjkxMDkzNzI2MTc2MjgyOTEvZXNfZXQ9MC9lc19jZ05hbWU9TU1ERV9NMiUzQURlZmF1bHRfbm8r...
evs.euw1.jivox.com/trk/66/205954/2200/159897/961ee94c58df6c/22/jvxSId_1677767313.9651/es_pId_29ba8ce/ Frame 06A8 43 B
230 B 95ms
26ms Image
image/gif 34.250.199.12
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://evs.euw1.jivox.com/trk/66/205954/2200/159897/961ee94c58df6c/22/jvxSId_1677767313.9651/es_pId_29ba8ce/es_encParams_L2FwX0RhdGFTaWduYWwxPTE4MjY5ODM5ODYwL2FkYjEta2V5PTgwMy9hZGIxLWlkX3ZlcnNpb249Mjk3MDBfMS9iRGltPTMwMHg2MDAvcj0wLjkxMDkzNzI2MTc2MjgyOTEvZXNfZXQ9MC9lc19jZ05hbWU9TU1ERV9NMiUzQURlZmF1bHRfbm8rbG9jYXRpb25fV2Vla2RheV9EYXlfQm9uZF93aGl0ZV92NS9lc19zZWdOYW1lPUdlbmVyaWNfV2Vla2RheV9EYXk=
Requested by: Host: as.euw1.jivox.com
URL: https://as.euw1.jivox.com/unit/layout_renderer.php?es_pId=29ba8ce&isDynamic=1&campaignId=159897&gdpr_consent=&dspId=DBM&bDim=300x600&ap_DataSignal1=18269839860&jvxVer=2&gdpr=&bUnitId=2200&r=1677767313119433&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCethXkbIAZImlB6Km3gP594L4CcW_pLtugKPL290Q99KivcABEAEglov5G2CV4pCCoAegAebj3ukCyAEJqQIBTfXXC9OxPqgDAaoE9QFP0FAy42Q5XqnzbLMfOD3A25XsrFM9Vqm4KiY9TqgjsRMVc6mC-ml_TUc_RDVzfGERZ2sdFpdkNhJWJvUBKUwBGHuok82JNe1SJAeV4UnbSALc51989DR7tLtLtCaU0qun_ArEhXIUJlQD-viRcteUgA_upAg-ulVMXlBVIkoSPGhqRS4OEisBdSU49R3hErotkSS6aR9qC7nSrCNRsod3CCGDe4x5_KefsPqzDui8FVazkHNV0KSAXJodiH-QpRFt9fkHKQUnqD-10krq3bf0pyGGf9CDQ0FSgKEvq0tVcW9lHXnnqpr9ueuLQ8JKcvKDct9ecsAEkdWLvZIE4AQDkAYBoAZNgAeCnKGWAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATrv_oEdATANgTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSSwDUE5ymuHIv-7LgktZ2daLfOnEztA_uDSjNDPz3tRVtVmTVIS3FLgxSYNQ-KQFedQvkHIVIV0oicbUBHeS4T59YmPTAkbmKZt9FSBgB%26sig%3DAOD64_0ti9CWBr5iyckF5ICZRzooWrls2g%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-AkC6NJc8SUnqcI3jQJGTXlTqCoZsM_7FjwMhVQ6uC1rys_3keXF7n4nN5bVEwWhKl6MG9OwsMXL1gON-y5EuPYjBo2Xyxi6Z9CPKeUEU2oksu7LNF0Unl7M34f0GFTDu5GjExRsPwIx1wrSmKIjBfVwPehP6Cab2bZUiGoW9YD59fFfdk%26cry%3D1%26dbm_d%3DAKAmf-Aa-pjgaw9NJCJ908QgMQFBAJBCXMCT_0XpDKtY2ObS4-wTQTjb2G9N1kLPdL4_WR2TDxX2gOYDpy2_iBj8DerP7pUanVmhzOOKy9nc8BPLghiZt98avrsCLK5dFtiX3mP-Q1TMUx6iEI7izrDPEqwNBFRFiEDNokhK7_y602cRSn-5U7LrRrbv_juJE1cCVJ0EZWm004gktzBN_hNRlz99jtjxhsQ6Uel7t7_y6gzDF4js2ki10yKpwMQMv6qImTsYbPkYVDCePRveADRHLa4BirF-n2SYHYjWY8ejFpnzYv3Jcq5xKNBONwF6JT7B8PA1qF0JyFYqwLkVtLenj2zf3etOsr3wAQZ0gWZ6FfJ1oTfjhR_7tKtq5jYLx2VUfdWqfC26U2gYGdlUk0cKh5B84T2q5E0cKQki4zNB2SFv6mroWe3u_rz39oK5gh8ijNhNJ3Obick6ygANrjI7aVAtvu-yatBbQ9JV4kMx_si1t2dHWgy9gUAArKoYYE9eok9Zp-z9bm1WW0EG01m5Ifzf9M2kUiCBXc28QD9Iusvs6MldYVw%26adurl%3D&us_privacy=%24%7BUS_PRIVACY%7D&ts_pId=29ba8ce&siteId=961ee94c58df6c&creativeUnitType=22&objectName=jvx_6400b291b0976&adUnitId=2200&jvxSessionId=1677767313.9651&base=1&creativeResolveBeginTime=1677767314000&omid=0&localTimeOffset=0&pageURL=https%3A%2F%2F07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.250.199.12 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-250-199-12.eu-west-1.compute.amazonaws.com
Software: akka-http/10.1.11 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.euw1.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 02 Mar 2023 14:28:34 GMT
access-control-allow-credentials: false
content-type: image/gif
server: akka-http/10.1.11
content-length: 43
p3p: CP='IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA'

GET
H2 200 es_encParams_L2FwX0RhdGFTaWduYWwxPTE4MjY5ODM5ODYwL2FkYjEta2V5PTgwMy9hZGIxLWlkX3ZlcnNpb249Mjk3MDBfMS9lc19jbGlja1VybD1odHRwcyUzQSUyRiUyRmdvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldCUyRmRibSUyRmNsayUzRnNhJTNE...
evs.euw1.jivox.com/trk/60/205954/2200/159897/961ee94c58df6c/22/jvxSId_1677767313.9651/es_pId_29ba8ce/ Frame 06A8 43 B
229 B 95ms
27ms Image
image/gif 34.250.199.12
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://evs.euw1.jivox.com/trk/60/205954/2200/159897/961ee94c58df6c/22/jvxSId_1677767313.9651/es_pId_29ba8ce/es_encParams_L2FwX0RhdGFTaWduYWwxPTE4MjY5ODM5ODYwL2FkYjEta2V5PTgwMy9hZGIxLWlkX3ZlcnNpb249Mjk3MDBfMS9lc19jbGlja1VybD1odHRwcyUzQSUyRiUyRmdvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldCUyRmRibSUyRmNsayUzRnNhJTNETCUyNmFpJTNEQ2V0aFhrYklBWkltbEI2S20zZ1A1OTRMNENjV19wTHR1Z0tQTDI5MFE5OUtpdmNBQkVBRWdsb3Y1RzJDVjRwQ0NvQWVnQWViajN1a0N5QUVKcVFJQlRmWFhDOU94UHFnREFhb0U5UUZQMEZBeTQyUTVYcW56YkxNZk9EM0EyNVhzckZNOVZxbTRLaVk5VHFnanNSTVZjNm1DLW1sX1RVY19SRFZ6ZkdFUloyc2RGcGRrTmhKV0p2VUJLVXdCR0h1b2s4MkpOZTFTSkFlVjRVbmJTQUxjNTE5ODlEUjd0THRMdENhVTBxdW5fQXJFaFhJVUpsUUQtdmlSY3RlVWdBX3VwQWctdWxWTVhsQlZJa29TUEdocVJTNE9FaXNCZFNVNDlSM2hFcm90a1NTNmFSOXFDN25TckNOUnNvZDNDQ0dEZTR4NV9LZWZzUHF6RHVpOEZWYXprSE5WMEtTQVhKb2RpSC1RcFJGdDlma0hLUVVucUQtMTBrcnEzYmYwcHlHR2Y5Q0RRMEZTZ0tFdnEwdFZjVzlsSFhubnFwcjl1ZXVMUThKS2N2S0RjdDllY3NBRWtkV0x2WklFNEFRRGtBWUJvQVpOZ0FlQ25LR1dBYWdIanM0YnFBZVQyQnVvQi02V3NRS29CXzZlc1FLb0I2U2pzUUtvQjlYSkc2Z0hwcjRicUFlYUJxZ0g4OUVicUFlVzJCdW9CNnFic1FLb0JfLWVzUUtvQjktZnNRTFlCd0RTQ0JFSWdPR0FFQkFCR0IweUFxb0NPZ0tBUUlBS0E1Z0xBY2dMQVlBTUFiQVRydl9vRWRBVEFOZ1REZGdVQWRBVkFmZ1dBWUFYQVElMjZhZSUzRDElMjZudW0lM0QxJTI2Y2lkJTNEQ0FRU1N3RFVFNXltdUhJdi03TGdrdFoyZGFMZk9uRXp0QV91RFNqTkRQejN0UlZ0Vm1UVklTM0ZMZ3hTWU5RLUtRRmVkUXZrSElWSVYwb2ljYlVCSGVTNFQ1OVltUFRBa2JtS1p0OUZTQmdCJTI2c2lnJTNEQU9ENjRfMHRpOUNXQnI1aXlja0Y1SUNaUnpvb1dybHMyZyUyNmNsaWVudCUzRGNhLXB1Yi03NjgzMzk1MjY4NTYyMTA4JTI2ZGJtX2MlM0RBS0FtZi1Ba0M2TkpjOFNVbnFjSTNqUUpHVFhsVHFDb1pzTV83Rmp3TWhWUTZ1QzFyeXNfM2tlWEY3bjRuTjViVkV3V2hLbDZNRzlPd3NNWEwxZ09OLXk1RXVQWWpCbzJYeXhpNlo5Q1BLZVVFVTJva3N1N0xORjBVbmw3TTM0ZjBHRlREdTVHakV4UnNQd0l4MXdyU21LSWpCZlZ3UGVoUDZDYWIyYlpVaUdvVzlZRDU5ZkZmZGslMjZjcnklM0QxJTI2ZGJtX2QlM0RBS0FtZi1BYS1wamdhdzlOSkNKOTA4UWdNUUZCQUpCQ1hNQ1RfMFhwREt0WTJPYlM0LXdUUVRqYjJHOU4xa0xQZEw0X1dSMlREeFgyZ09ZRHB5Ml9pQmo4RGVyUDdwVWFuVm1oek9PS3k5bmM4QlBMZ2hpWnQ5OGF2cnNDTEs1ZEZ0aVgzbVAtUTFUTVV4NmlFSTdpenJEUEVxd05CRlJGaUVETm9raEs3X3k2MDJjUlNuLTVVN0xyUnJidl9qdUpFMWNDVkowRVpXbTAwNGdrdHpCTl9oTlJsejk5anRqeGhzUTZVZWw3dDdfeTZnekRGNGpzMmtpMTB5S3B3TVFNdjZxSW1Uc1liUGtZVkRDZVBSdmVBRFJITGE0QmlyRi1uMlNZSFlqV1k4ZWpGcG56WXYzSmNxNXhLTkJPTndGNkpUN0I4UEExcUYwSnlGWXF3TGtWdExlbmoyemYzZXRPc3Izd0FRWjBnV1o2RmZKMW9UZmpoUl83dEt0cTVqWUx4MlZVZmRXcWZDMjZVMmdZR2RsVWswY0toNUI4NFQycTVFMGNLUWtpNHpOQjJTRnY2bXJvV2UzdV9yejM5b0s1Z2g4aWpOaE5KM09iaWNrNnlnQU5yakk3YVZBdHZ1LXlhdEJiUTlKVjRrTXhfc2kxdDJkSFdneTlnVUFBcktvWVlFOWVvazlacC16OWJtMVdXMEVHMDFtNUlmemY5TTJrVWlDQlhjMjhRRDlJdXN2czZNbGRZVnclMjZhZHVybCUzRGh0dHBzJTI1M0ElMjUyRiUyNTJGd3d3Lm1hemRhLmRlJTI1MkZtb2RlbGxlJTI1MkZtYXpkYS1jeC02MCUyNTJGJTI1M0Z1dG1fc291cmNlJTI1M0Rkb3VibGVjbGljayUyNTI2dXRtX21lZGl1bSUyNTNEZGlzcGxheSUyNTI2dXRtX2NhbXBhaWduJTI1M0RtbWRfYWx3YXlzX29uX2Rjb19jeDYwX3dlcmJlbWl0dGVsX2RlXzE1N18wOTIyJTI1MjZtb2RlbCUyNTNEbWF6ZGElMjUyNTIwY3gtNjAlMjUyNmJvZHklMjUzRDV3Z24lMjUyNmNhbXBhaWduX2ZvY3VzJTI1M0RtYXpkYWN4NjBfNXdnbiUyNTI2ZG1wX3NvdXJjZSUyNTNEbm8lMjUyNmRjb19zb3VyY2UlMjUzRHllcyUyNTI2Y2FtcGFpZ25jb2RlJTI1M0RtbWRfYWx3YXlzX29uX2Rjb19jeDYwX3dlcmJlbWl0dGVsX2RlXzE1N18wOTIyL2NtVXJsPWh0dHBzJTNBJTJGJTJGYXNzZXRzLmV1dzEuaml2b3guY29tJTJGd2lkZ2V0cyUyRjIwMjMlMkYxJTJGYTcyNzk4ejYzYzdmNmM2YjU2MDYlMkYxJTJGMzAweDYwMF9NMiUyRm1hemRhXzMwMHg2MDAuaHRtbC9iRGltPTMwMHg2MDAvcj0wLjg4MTU4NjYzNDY3Mzk1MjUvY2xpY2tNYWNybz1odHRwcyUzQSUyRiUyRmdvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldCUyRmRibSUyRmNsayUzRnNhJTNETCUyNmFpJTNEQ2V0aFhrYklBWkltbEI2S20zZ1A1OTRMNENjV19wTHR1Z0tQTDI5MFE5OUtpdmNBQkVBRWdsb3Y1RzJDVjRwQ0NvQWVnQWViajN1ay9jYWNoZU1hY3JvPTE2Nzc3NjczMTMxMTk0MzMvcGFnZVVybD1odHRwcyUzQSUyRiUyRjA3Y2Y2ZGU5ZDU2MGI2MTRkM2IzNDQ4OGU2ODRmNjc4LnNhZmVmcmFtZS5nb29nbGVzeW5kaWNhdGlvbi5jb20lMkZzYWZlZnJhbWUlMkYxLTAtNDAlMkZodG1sJTJGY29udGFpbmVyLmh0bWwvZXNfY2dOYW1lPU1NREVfTTIlM0FEZWZhdWx0X25vK2xvY2F0aW9uX1dlZWtkYXlfRGF5X0JvbmRfd2hpdGVfdjUvZXNfc2VnTmFtZT1HZW5lcmljX1dlZWtkYXlfRGF5
Requested by: Host: as.euw1.jivox.com
URL: https://as.euw1.jivox.com/unit/layout_renderer.php?es_pId=29ba8ce&isDynamic=1&campaignId=159897&gdpr_consent=&dspId=DBM&bDim=300x600&ap_DataSignal1=18269839860&jvxVer=2&gdpr=&bUnitId=2200&r=1677767313119433&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCethXkbIAZImlB6Km3gP594L4CcW_pLtugKPL290Q99KivcABEAEglov5G2CV4pCCoAegAebj3ukCyAEJqQIBTfXXC9OxPqgDAaoE9QFP0FAy42Q5XqnzbLMfOD3A25XsrFM9Vqm4KiY9TqgjsRMVc6mC-ml_TUc_RDVzfGERZ2sdFpdkNhJWJvUBKUwBGHuok82JNe1SJAeV4UnbSALc51989DR7tLtLtCaU0qun_ArEhXIUJlQD-viRcteUgA_upAg-ulVMXlBVIkoSPGhqRS4OEisBdSU49R3hErotkSS6aR9qC7nSrCNRsod3CCGDe4x5_KefsPqzDui8FVazkHNV0KSAXJodiH-QpRFt9fkHKQUnqD-10krq3bf0pyGGf9CDQ0FSgKEvq0tVcW9lHXnnqpr9ueuLQ8JKcvKDct9ecsAEkdWLvZIE4AQDkAYBoAZNgAeCnKGWAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATrv_oEdATANgTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSSwDUE5ymuHIv-7LgktZ2daLfOnEztA_uDSjNDPz3tRVtVmTVIS3FLgxSYNQ-KQFedQvkHIVIV0oicbUBHeS4T59YmPTAkbmKZt9FSBgB%26sig%3DAOD64_0ti9CWBr5iyckF5ICZRzooWrls2g%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-AkC6NJc8SUnqcI3jQJGTXlTqCoZsM_7FjwMhVQ6uC1rys_3keXF7n4nN5bVEwWhKl6MG9OwsMXL1gON-y5EuPYjBo2Xyxi6Z9CPKeUEU2oksu7LNF0Unl7M34f0GFTDu5GjExRsPwIx1wrSmKIjBfVwPehP6Cab2bZUiGoW9YD59fFfdk%26cry%3D1%26dbm_d%3DAKAmf-Aa-pjgaw9NJCJ908QgMQFBAJBCXMCT_0XpDKtY2ObS4-wTQTjb2G9N1kLPdL4_WR2TDxX2gOYDpy2_iBj8DerP7pUanVmhzOOKy9nc8BPLghiZt98avrsCLK5dFtiX3mP-Q1TMUx6iEI7izrDPEqwNBFRFiEDNokhK7_y602cRSn-5U7LrRrbv_juJE1cCVJ0EZWm004gktzBN_hNRlz99jtjxhsQ6Uel7t7_y6gzDF4js2ki10yKpwMQMv6qImTsYbPkYVDCePRveADRHLa4BirF-n2SYHYjWY8ejFpnzYv3Jcq5xKNBONwF6JT7B8PA1qF0JyFYqwLkVtLenj2zf3etOsr3wAQZ0gWZ6FfJ1oTfjhR_7tKtq5jYLx2VUfdWqfC26U2gYGdlUk0cKh5B84T2q5E0cKQki4zNB2SFv6mroWe3u_rz39oK5gh8ijNhNJ3Obick6ygANrjI7aVAtvu-yatBbQ9JV4kMx_si1t2dHWgy9gUAArKoYYE9eok9Zp-z9bm1WW0EG01m5Ifzf9M2kUiCBXc28QD9Iusvs6MldYVw%26adurl%3D&us_privacy=%24%7BUS_PRIVACY%7D&ts_pId=29ba8ce&siteId=961ee94c58df6c&creativeUnitType=22&objectName=jvx_6400b291b0976&adUnitId=2200&jvxSessionId=1677767313.9651&base=1&creativeResolveBeginTime=1677767314000&omid=0&localTimeOffset=0&pageURL=https%3A%2F%2F07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.250.199.12 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-250-199-12.eu-west-1.compute.amazonaws.com
Software: akka-http/10.1.11 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.euw1.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 02 Mar 2023 14:28:34 GMT
access-control-allow-credentials: false
content-type: image/gif
server: akka-http/10.1.11
content-length: 43
p3p: CP='IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA'

GET
H2 200 es_encParams_L2FwX0RhdGFTaWduYWwxPTE4MjY5ODM5ODYwL2FkYjEta2V5PTgwMy9hZGIxLWlkX3ZlcnNpb249Mjk3MDBfMS9lc19jbGlja1VybD1odHRwcyUzQSUyRiUyRmdvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldCUyRmRibSUyRmNsayUzRnNhJTNE...
evs.euw1.jivox.com/trk/77/205954/2200/159897/961ee94c58df6c/22/jvxSId_1677767313.9651/es_pId_29ba8ce/ Frame 06A8 43 B
229 B 96ms
28ms Image
image/gif 34.250.199.12
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://evs.euw1.jivox.com/trk/77/205954/2200/159897/961ee94c58df6c/22/jvxSId_1677767313.9651/es_pId_29ba8ce/es_encParams_L2FwX0RhdGFTaWduYWwxPTE4MjY5ODM5ODYwL2FkYjEta2V5PTgwMy9hZGIxLWlkX3ZlcnNpb249Mjk3MDBfMS9lc19jbGlja1VybD1odHRwcyUzQSUyRiUyRmdvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldCUyRmRibSUyRmNsayUzRnNhJTNETCUyNmFpJTNEQ2V0aFhrYklBWkltbEI2S20zZ1A1OTRMNENjV19wTHR1Z0tQTDI5MFE5OUtpdmNBQkVBRWdsb3Y1RzJDVjRwQ0NvQWVnQWViajN1a0N5QUVKcVFJQlRmWFhDOU94UHFnREFhb0U5UUZQMEZBeTQyUTVYcW56YkxNZk9EM0EyNVhzckZNOVZxbTRLaVk5VHFnanNSTVZjNm1DLW1sX1RVY19SRFZ6ZkdFUloyc2RGcGRrTmhKV0p2VUJLVXdCR0h1b2s4MkpOZTFTSkFlVjRVbmJTQUxjNTE5ODlEUjd0THRMdENhVTBxdW5fQXJFaFhJVUpsUUQtdmlSY3RlVWdBX3VwQWctdWxWTVhsQlZJa29TUEdocVJTNE9FaXNCZFNVNDlSM2hFcm90a1NTNmFSOXFDN25TckNOUnNvZDNDQ0dEZTR4NV9LZWZzUHF6RHVpOEZWYXprSE5WMEtTQVhKb2RpSC1RcFJGdDlma0hLUVVucUQtMTBrcnEzYmYwcHlHR2Y5Q0RRMEZTZ0tFdnEwdFZjVzlsSFhubnFwcjl1ZXVMUThKS2N2S0RjdDllY3NBRWtkV0x2WklFNEFRRGtBWUJvQVpOZ0FlQ25LR1dBYWdIanM0YnFBZVQyQnVvQi02V3NRS29CXzZlc1FLb0I2U2pzUUtvQjlYSkc2Z0hwcjRicUFlYUJxZ0g4OUVicUFlVzJCdW9CNnFic1FLb0JfLWVzUUtvQjktZnNRTFlCd0RTQ0JFSWdPR0FFQkFCR0IweUFxb0NPZ0tBUUlBS0E1Z0xBY2dMQVlBTUFiQVRydl9vRWRBVEFOZ1REZGdVQWRBVkFmZ1dBWUFYQVElMjZhZSUzRDElMjZudW0lM0QxJTI2Y2lkJTNEQ0FRU1N3RFVFNXltdUhJdi03TGdrdFoyZGFMZk9uRXp0QV91RFNqTkRQejN0UlZ0Vm1UVklTM0ZMZ3hTWU5RLUtRRmVkUXZrSElWSVYwb2ljYlVCSGVTNFQ1OVltUFRBa2JtS1p0OUZTQmdCJTI2c2lnJTNEQU9ENjRfMHRpOUNXQnI1aXlja0Y1SUNaUnpvb1dybHMyZyUyNmNsaWVudCUzRGNhLXB1Yi03NjgzMzk1MjY4NTYyMTA4JTI2ZGJtX2MlM0RBS0FtZi1Ba0M2TkpjOFNVbnFjSTNqUUpHVFhsVHFDb1pzTV83Rmp3TWhWUTZ1QzFyeXNfM2tlWEY3bjRuTjViVkV3V2hLbDZNRzlPd3NNWEwxZ09OLXk1RXVQWWpCbzJYeXhpNlo5Q1BLZVVFVTJva3N1N0xORjBVbmw3TTM0ZjBHRlREdTVHakV4UnNQd0l4MXdyU21LSWpCZlZ3UGVoUDZDYWIyYlpVaUdvVzlZRDU5ZkZmZGslMjZjcnklM0QxJTI2ZGJtX2QlM0RBS0FtZi1BYS1wamdhdzlOSkNKOTA4UWdNUUZCQUpCQ1hNQ1RfMFhwREt0WTJPYlM0LXdUUVRqYjJHOU4xa0xQZEw0X1dSMlREeFgyZ09ZRHB5Ml9pQmo4RGVyUDdwVWFuVm1oek9PS3k5bmM4QlBMZ2hpWnQ5OGF2cnNDTEs1ZEZ0aVgzbVAtUTFUTVV4NmlFSTdpenJEUEVxd05CRlJGaUVETm9raEs3X3k2MDJjUlNuLTVVN0xyUnJidl9qdUpFMWNDVkowRVpXbTAwNGdrdHpCTl9oTlJsejk5anRqeGhzUTZVZWw3dDdfeTZnekRGNGpzMmtpMTB5S3B3TVFNdjZxSW1Uc1liUGtZVkRDZVBSdmVBRFJITGE0QmlyRi1uMlNZSFlqV1k4ZWpGcG56WXYzSmNxNXhLTkJPTndGNkpUN0I4UEExcUYwSnlGWXF3TGtWdExlbmoyemYzZXRPc3Izd0FRWjBnV1o2RmZKMW9UZmpoUl83dEt0cTVqWUx4MlZVZmRXcWZDMjZVMmdZR2RsVWswY0toNUI4NFQycTVFMGNLUWtpNHpOQjJTRnY2bXJvV2UzdV9yejM5b0s1Z2g4aWpOaE5KM09iaWNrNnlnQU5yakk3YVZBdHZ1LXlhdEJiUTlKVjRrTXhfc2kxdDJkSFdneTlnVUFBcktvWVlFOWVvazlacC16OWJtMVdXMEVHMDFtNUlmemY5TTJrVWlDQlhjMjhRRDlJdXN2czZNbGRZVnclMjZhZHVybCUzRGh0dHBzJTI1M0ElMjUyRiUyNTJGd3d3Lm1hemRhLmRlJTI1MkZtb2RlbGxlJTI1MkZtYXpkYS1jeC02MCUyNTJGJTI1M0Z1dG1fc291cmNlJTI1M0Rkb3VibGVjbGljayUyNTI2dXRtX21lZGl1bSUyNTNEZGlzcGxheSUyNTI2dXRtX2NhbXBhaWduJTI1M0RtbWRfYWx3YXlzX29uX2Rjb19jeDYwX3dlcmJlbWl0dGVsX2RlXzE1N18wOTIyJTI1MjZtb2RlbCUyNTNEbWF6ZGElMjUyNTIwY3gtNjAlMjUyNmJvZHklMjUzRDV3Z24lMjUyNmNhbXBhaWduX2ZvY3VzJTI1M0RtYXpkYWN4NjBfNXdnbiUyNTI2ZG1wX3NvdXJjZSUyNTNEbm8lMjUyNmRjb19zb3VyY2UlMjUzRHllcyUyNTI2Y2FtcGFpZ25jb2RlJTI1M0RtbWRfYWx3YXlzX29uX2Rjb19jeDYwX3dlcmJlbWl0dGVsX2RlXzE1N18wOTIyL2NtVXJsPWh0dHBzJTNBJTJGJTJGYXNzZXRzLmV1dzEuaml2b3guY29tJTJGd2lkZ2V0cyUyRjIwMjMlMkYxJTJGYTcyNzk4ejYzYzdmNmM2YjU2MDYlMkYxJTJGMzAweDYwMF9NMiUyRm1hemRhXzMwMHg2MDAuaHRtbC9iRGltPTMwMHg2MDAvcj0wLjk3MTA4MjU2MDcyNjAxNTgvY2xpY2tNYWNybz1odHRwcyUzQSUyRiUyRmdvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldCUyRmRibSUyRmNsayUzRnNhJTNETCUyNmFpJTNEQ2V0aFhrYklBWkltbEI2S20zZ1A1OTRMNENjV19wTHR1Z0tQTDI5MFE5OUtpdmNBQkVBRWdsb3Y1RzJDVjRwQ0NvQWVnQWViajN1ay9jYWNoZU1hY3JvPTE2Nzc3NjczMTMxMTk0MzMvcGFnZVVybD1odHRwcyUzQSUyRiUyRjA3Y2Y2ZGU5ZDU2MGI2MTRkM2IzNDQ4OGU2ODRmNjc4LnNhZmVmcmFtZS5nb29nbGVzeW5kaWNhdGlvbi5jb20lMkZzYWZlZnJhbWUlMkYxLTAtNDAlMkZodG1sJTJGY29udGFpbmVyLmh0bWwvZXNfY2dOYW1lPU1NREVfTTIlM0FEZWZhdWx0X25vK2xvY2F0aW9uX1dlZWtkYXlfRGF5X0JvbmRfd2hpdGVfdjUvZXNfc2VnTmFtZT1HZW5lcmljX1dlZWtkYXlfRGF5
Requested by: Host: as.euw1.jivox.com
URL: https://as.euw1.jivox.com/unit/layout_renderer.php?es_pId=29ba8ce&isDynamic=1&campaignId=159897&gdpr_consent=&dspId=DBM&bDim=300x600&ap_DataSignal1=18269839860&jvxVer=2&gdpr=&bUnitId=2200&r=1677767313119433&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCethXkbIAZImlB6Km3gP594L4CcW_pLtugKPL290Q99KivcABEAEglov5G2CV4pCCoAegAebj3ukCyAEJqQIBTfXXC9OxPqgDAaoE9QFP0FAy42Q5XqnzbLMfOD3A25XsrFM9Vqm4KiY9TqgjsRMVc6mC-ml_TUc_RDVzfGERZ2sdFpdkNhJWJvUBKUwBGHuok82JNe1SJAeV4UnbSALc51989DR7tLtLtCaU0qun_ArEhXIUJlQD-viRcteUgA_upAg-ulVMXlBVIkoSPGhqRS4OEisBdSU49R3hErotkSS6aR9qC7nSrCNRsod3CCGDe4x5_KefsPqzDui8FVazkHNV0KSAXJodiH-QpRFt9fkHKQUnqD-10krq3bf0pyGGf9CDQ0FSgKEvq0tVcW9lHXnnqpr9ueuLQ8JKcvKDct9ecsAEkdWLvZIE4AQDkAYBoAZNgAeCnKGWAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATrv_oEdATANgTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSSwDUE5ymuHIv-7LgktZ2daLfOnEztA_uDSjNDPz3tRVtVmTVIS3FLgxSYNQ-KQFedQvkHIVIV0oicbUBHeS4T59YmPTAkbmKZt9FSBgB%26sig%3DAOD64_0ti9CWBr5iyckF5ICZRzooWrls2g%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-AkC6NJc8SUnqcI3jQJGTXlTqCoZsM_7FjwMhVQ6uC1rys_3keXF7n4nN5bVEwWhKl6MG9OwsMXL1gON-y5EuPYjBo2Xyxi6Z9CPKeUEU2oksu7LNF0Unl7M34f0GFTDu5GjExRsPwIx1wrSmKIjBfVwPehP6Cab2bZUiGoW9YD59fFfdk%26cry%3D1%26dbm_d%3DAKAmf-Aa-pjgaw9NJCJ908QgMQFBAJBCXMCT_0XpDKtY2ObS4-wTQTjb2G9N1kLPdL4_WR2TDxX2gOYDpy2_iBj8DerP7pUanVmhzOOKy9nc8BPLghiZt98avrsCLK5dFtiX3mP-Q1TMUx6iEI7izrDPEqwNBFRFiEDNokhK7_y602cRSn-5U7LrRrbv_juJE1cCVJ0EZWm004gktzBN_hNRlz99jtjxhsQ6Uel7t7_y6gzDF4js2ki10yKpwMQMv6qImTsYbPkYVDCePRveADRHLa4BirF-n2SYHYjWY8ejFpnzYv3Jcq5xKNBONwF6JT7B8PA1qF0JyFYqwLkVtLenj2zf3etOsr3wAQZ0gWZ6FfJ1oTfjhR_7tKtq5jYLx2VUfdWqfC26U2gYGdlUk0cKh5B84T2q5E0cKQki4zNB2SFv6mroWe3u_rz39oK5gh8ijNhNJ3Obick6ygANrjI7aVAtvu-yatBbQ9JV4kMx_si1t2dHWgy9gUAArKoYYE9eok9Zp-z9bm1WW0EG01m5Ifzf9M2kUiCBXc28QD9Iusvs6MldYVw%26adurl%3D&us_privacy=%24%7BUS_PRIVACY%7D&ts_pId=29ba8ce&siteId=961ee94c58df6c&creativeUnitType=22&objectName=jvx_6400b291b0976&adUnitId=2200&jvxSessionId=1677767313.9651&base=1&creativeResolveBeginTime=1677767314000&omid=0&localTimeOffset=0&pageURL=https%3A%2F%2F07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.250.199.12 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-250-199-12.eu-west-1.compute.amazonaws.com
Software: akka-http/10.1.11 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://as.euw1.jivox.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 02 Mar 2023 14:28:34 GMT
access-control-allow-credentials: false
content-type: image/gif
server: akka-http/10.1.11
content-length: 43
p3p: CP='IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA'

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
165 B 48ms
46ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.normaculta.com.br

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
165 B 45ms
44ms Script
application/javascript 2a00:1450:4001:829::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.normaculta.com.br

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 6773 41 KB
15 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A8gU321YLq-ZmEFWwfCCJbYi4og8BnTwQrPO7QOAG0EFr2M9crmaPASj0Vcma8nKopDP2e0nKTpOadYcqNsTfIGbJyjgx0MZORg51Cd0DtPSee8KJe-_mb3Re3voKPh7P3UpwLUEZATtOfbEb5EjIrLaXWqsatbMr-50CcaA8UuvrPjNw&cry=1&dbm_d=AKAmf-BqQfitokl6fUEBMGgufwpbuYPJQUgLYV6xgIqOrUNVj9RlzRgugghyys0nUse0V9IfMLjL7fYcNGcVjTq8oFcx6yATht-vm-_hIx4tqSS9nQQE_Ly7kT2Vz2vUMhHbOMrYyy8VEGHdGplyi6VUGWLIsl20k8qqjxNRdXWEBKMM18XViLTn2WfzwPqVerkAq--Ba1R97qJxiWknqhcuzMGCJVDUuLnGKRInxBF1Hg4_JAwu6xLyR4NjK8WsqMzNpPGYwvRFIOgfHeIT8GewBUxmb1kKMs51l6hDl7D8xzLniLvfx0TXeyYsDgTKt0qnflDZVR9x7I8WDfNektnE_jQrtkBs_TapjZLiuuPSJ3PZRvcaGi3vLHKqk2xDAjuUQ27TYu3MiadQd2QrhVKiG7PYWrUB2GjRVqAuK9L7ROhSNExLcNc1AIPIUq-ZR-QV2GkD7MPXaVQaYWrTH7HZ7JqDuxHwWIeKrEfKfaxvi8Xx43YK4VfJDLG9SgI0yOJ2V24AArP-oCz-PETp2g2A-LvxqmZhiZoNSwnKlYFFin4NX-1qybXk3fwfp5Lb5MQnAYDyqOfy4OI1ZLt8-R6WoBmeXamB2CiYlpTGx7799DQrsnDJt0Hz3CzR63WPhYJVy3Dl10SOkYLBDzraDdF6O_TiqVnB_H8wi54Ye-xxjGYaspuVsUjEfLU44RDdlUjztN1iKHZtYfI0e6ds8RSzCd0Suek_jFIewyEOJ6ZNAhRe9QK-DKP_bDdtzudSM2h_0Ae2r-T9FF2h-eDMWDJSg2S6KKLUl0w_rr9f7-ct7JkeODZeWJv9R1q8uahWmPHZNw7nuxVVhvaIFKdXV7V-9NSFgRMfcK8jKxsvnnyq2mzyEUtmQw4tLhPwUP580cUQB4RS1Exfz0J0IWoyCKnyi4E8AsXIBf6EQAF-Z8rj4hQQlgKB8r8NduvKl_O82tcUTpsfcDjQyLEfZerZb-wyUcedYynEvsLT69L_ALiuysJFMkEMuDVF2iE_z4NPLcJMTXH9iHYOAXdBhcyoA-OAsfivzhyjgOxwirmryb98JKZnSHdMU52v8alaXwz7dGbKQXVKF_Z30D5-55Iw7f6ira7cG_4Ij28W4XcUNYPc4k1oJoj-g1YKFwZNHSAJp10RXTH8wrHA16u0JsIyzR0FZcNdwhR6CpYiDrctxl2DqTnAVHN3Hx4ponPKldIMgzV80erIzy8o1ZxTI-mIymFIYRDlyUtfTnSnqh3g2x1DvXrdR7OBJdkNep4L-o2ORSQmwjAQzRrSH4clcokMeHQ96w7EFHbag3TJ3SYkZQOEOPR-Trmuy5K9f_n9FV_YgecXY2TELb29UqwLnIss3rNBVyPgU5Zzix-2V-jPeiCbHfvXHjulND3Nr7thOu9EMhAu-VCswbxKZz9YR5OtDErzc-RFtb8nThVLZvf99Q5jq2zpULQPIO7sVibzTS3Fz8n0l7vFsZItfcB6osHz8IzhK8-L7DFhyh1LcMfvTZLfIhRCQZGsbaj0puaVbWQoe8Ogr3dCA320HTzO5y96_AhQcsDb6hoaWwUvRuOOgXekwTTg9rYrpM4K5erAuW1v1z-zH3YVHg7LFnGapwP-Ay26Rf5qaS9t-0XHcp2P56YRMnGGlL4AzY8t2IMQ5c3S7Dit5tmAL1vUNDXZch4fMQq16tjIE6K_NsAn7C4gzR_Do-P6gRpXmqMoimC_I1E_BfH8DfRKyVJafMSZ1899f016oeBnK-_2FvdPXNfArBk2B_14pG2b3vgaLe7bAVW24I601EDEWpFmQOSWq6ZtLLqMPDa8BqHTPf03AZP8_XuAMFmKvWqUQL1DTpbsFHCg8f9AuS11aAqn3jVAIr0W4dlz0k1jHoePgv1HwaBCvtS1orCA1PMYV2T3NSMSLtd0195Y-wOaXs64qBVtOZG2q7tnMz87LegEy5LnVDLtPnuUc6KuIi7crYH99bQuMO3bgAhH5q0Fx5J_20o-UIxN9c8881ShsRWvit3CBqTIllao3l4BP4PTmQD72yCEPYmz_PqHf22-bbgleXW6F56M1a8X1MKW0WPQVrNumdc2Ly-wGVynL1SGG8I6VmanLIgA8gcE3Id2wsLGXyycQPzt7Gnvd1kufTp4aVbqOphM0x5hpu0J-yOxdBIw587Bf6633aGMi915YVnaKcuAgAF2mBdBm3DpmFjd0uUdPwmMvEAoNSSOk9N_tYk1veVePGWqgbzMsYZBaQCAzEAxQrV_jBrAIIOXzrzXQXcghFm6uE3HXQi9bv--wwKEu4z44GUiq8-2d8hn1RhjDZUvaKyP-iT_o7Iamwaed2-_9DV_2JRpfjy5AWrMzX-B001qN_bCgv0Ixpn_umJNVA7ENGZZ2dNYOOJ-OWMZlhxk5gV9q0k2QVlCQXdIlHX2BCuLkJsDtOJ2dZOgpB7VgWbasj_Zulvuq6TOE5bImJw9ge1_XWhhq7FFUDTEnjlK3V0dgGsGDPL6ovOJyFExU5r6hjRYBpRUfJOGUOcVaiVaMe_GfMwaaPJqZAbg5l2t8iPk11cP1FJ-edj8kEl3Tc-cnN8d-pXiwJiqRTA0fDipGByiMvemukvdJ5uWBCHAXUIGr5zC15VX3--wgLLfJ8RCMWdB42NDa1j7KNq1fAQIIwJTeizw1DDQz_aKOtJwVvoL_k5BSfB6SOvME_pX4xAWxsR6wxpqoCbzABa0vFgpc11anJVjcV5a_mI1xwctl4fj4uPQHMVsGCj1jfI0RSrKd9Kp_5aXrvcssb6c3CUa7wQnxJrcnzUi6PHEwUlpW8iFgN-3ollbP-XIICqn51HUjlS2Mwi9Ez-9mO7KZCZeYWbRHb9n4rwyp1CSIysD3EopDPFcDAX0hoRciI6KG4IYGRWGGB0gGtnYNtdW3J5TeEbyWpbNu_KXK3bhoEXdZBskcf2Co0Ke66LlO3sf-n0Cdk0xxqCnAGJg-xOFeGD__8ddzi3XGjr-PUKkQd692xIp1jD4RP4qpoxIjvn1sZzZ2_Ivr0mRvF2IrsyhExKWGMFu7yn6TmdBLuqxcMeKbTFiSM_sF_Rem_qMT-r5S35pen1WxxZ_6YMVYznSfXRr6WrUyJgWE0Ik_wK7cACJPipS6wT3G2S1G7iJMuUDwOE3vIMHDRVSuZzw2liWm0vH_6YOvU18QChM7Yq2gGcnmP705AcppgatcoOCltPJXwtqimF4Z6M8lqijtMIXT57cm1pB9OcyoGjSV82_YzkxFlDluxiqPWO3MSe3Sk4JqTxu-3PMVJY4NwZBT78pWy6SoxnPDZsHtoK9N6RZVbMmaG3CHWR3vohtyPs8G1pAdTCX7FVaSJw7noX425OkVfEPiPoUhBdNgaCnMnkCp5-F9yHn9CgKMbf_8rpk3OMc25fgG4daVd1GVYoLyg_tWmrJGRIRf5iHjSS3bsm7FlKo9xUcmvjaaC8AB_yy_wPobIjnaIGmnBhcUGEHDchwL6dCH51QOEfVXhMnvHAaSe5RVL7WvVhJGOdDJa91W4d50vWDqxRLJ4EQSqrJcozGBKYu97s_WT-XsnoDyXJYwGbl4kKFP9kL2L61C-z5dzVWXQwJ53H4JyPmyS7Q2U3WAZnyrHGpDa3Ih6tkFhtgw5U&cid=CAQSTADUE5ymtqRW3NKjQlof8F0--41KGCJmlHMZqCahStUSi9khsC1oNZ54Xfw4dga7pwORmAu1pSsZxQYBRxUIS3KUUk59EhmCNd7casMYAQ&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.normaculta.com.br%2F&ds=l&xdt=1&iif=1&cor=5332606164574872000&adk=250412560&idt=125&cac=0&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 13:44:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 89043
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 29 Feb 2024 13:44:31 GMT

GET
H/1.1 200
OK iju9wczm8trb Show response
hal9000.redintelligence.net/zone/ Frame 6773 11 KB
4 KB 47ms
12ms Script
text/html 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/iju9wczm8trb?subid=&gdpr=-1&gdpr_consent=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCs2PxkbIAZKfAHYPT3gOJ-JYQpuW9oGmtlZynyQ_wLhABIJaL-RtgleKQgqAHyAEJqQIg2X_MoNixPqgDAaoE8gFP0E85c8SvIpwVsjYF-QoYx0SPoWb4KH4k1oGXky6jvjOK_ZVsY-bX0OOm1DXHIpo4NX_O94UTVDt4iSMBRGu1aSUxseJjcN35XFidn7VzvOZAL0R-go-FCTO1wq-VjETezsgDUsEwnhYyRr-H7SqAntB2a28fZnn3_WDlo1pVY8mQZ21Zb0gvO_TPK9-J29NrDirpYD7ZdH4gp4EEA7-kK9atvEvY9AHotSOMMBtCS3n0kgdZZcB9tSHLZiohg7xQHwq_lrC4XE4GkbKwdS4RivqdTUzfAwsxKFIhgURcajtuVF7NSTGe79GZxbT-zNjOWMAE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATj7XRDtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTADUE5ymtqRW3NKjQlof8F0--41KGCJmlHMZqCahStUSi9khsC1oNZ54Xfw4dga7pwORmAu1pSsZxQYBRxUIS3KUUk59EhmCNd7casMYAQ%26sig%3DAOD64_0wvjlwPpm4T4hL68bJeTRGG-sFxA%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-DiykL71Oqe417cwi5nZ-hADxOMDNp5KNDGhHn0v5DI6QKZbAH_2s__ywLvgHQbQMRxDHL0QhaZofltHhdpMUGYVI28pVZ02Gsw40PL1VcKkTcU_q0Oqlpen8P-hLuXce7pkUIjQfCwk0fUtvCrPua6ytAxMje4AnjLzkfChjshtx8ynq4%26cry%3D1%26dbm_d%3DAKAmf-A33lq2C9xf4FSueoNjcuUfkyQENSYmR7Ens0BD8tOunXghay5Ylz1Gii_gwuMVk72EaXicECwNqLerL4Jk9ISyuNNBwYde2S6AS6yl3n_7Z_TY0R8IGwcG2i69_gL-KONVsWXKi0aMFPGag92lHnas7sqV0BRxIDZV17sKnAAw8DjuZvgXvXMcxlIzfb4awrvoNMwR5Ot2l0odw1oryFgyHMuGNKdC2uSDDMElzuYWXoSx-ZOiNR19AIFGegpgkbOvVSyAI_szsV0c1cyujxn1y3dlYiqiDVvdTn_3LSP2Y9p9Bq4U0efGjs5pmcZrevAYq6oWRDwm6Uf_NgIWAMIrO9PKAmTDS7dOmgSM4yiDTE5o0zxkfJhTv9mhReiVjhKEOh5SmyEyL3omGkTDpw1dwVe9JZNkSuYm2OthIbXVwWuOrD81QWbljYUev87DqCTJCU6KKITj0M-fd-sd5U3gXTGF7U3mV7AhDRcbjL00kIiiwQEKiJy5HdhahpAfZhoM0ku87-GqxRbIGOP8ffRuZQ78PsFFhqwvwFM9iMYHo5x_tWw%26adurl%3D
Requested by: Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 Böblingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 5c78aed223c405387b6c0a2fa82d37767245c0c312bba1004a80052a0e80eb39

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Thu, 02 Mar 2023 14:28:34 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 4091
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 107 KB
35 KB 588ms
588ms XHR
text/plain 2a00:1450:400d:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3558250168591124&correlator=1754910346345620&eid=31072562&output=ldjh&gdfp_req=1&vrg=2023022701&ptt=17&impl=fif&iu_parts=1062898%2CNORMACULTA_BR_HOME_SIDEBAR_TOP&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250%7C250x250%7C200x200%7C300x100&ifi=3&adks=754213437&sfv=1-0-40&ris=1&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&sc=1&cookie=ID%3Dae111f7e377b2eaf%3AT%3D1677767313%3AS%3DALNI_MZaUCPqE2ZqMEcDl_8r7tlPpaJmDg&gpic=UID%3D00000bbd9e765c96%3AT%3D1677767313%3ART%3D1677767313%3AS%3DALNI_MZ_dojrHNq95Cq1EpRNo0RZGMDHDg&abxe=1&dt=1677767314326&lmt=1677767314&dlt=1677767312493&idt=468&adxs=963&adys=157&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.normaculta.com.br%2F&frm=20&vis=1&psz=335x11708&msz=336x300&fws=0&ohw=0&ga_vid=574628834.1677767313&ga_sid=1677767313&ga_hid=1305819003&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYipHmleowSABSAghkEhkKCnB1YmNpZC5vcmcYtJHmleowSABSAghqEh0KDmVzcC5jcml0ZW8uY29tGIqR5pXqMEgAUgIIZBLCAQoIcnRiaG91c2USrAExMDgrR2VJQmRxSEhabVd0bFhaTHkzYUd1Y0JjaG02R1IrbzhPOXNZRytSOWdLU2xlS2RYUkdlTzE2d2FOY1hseUtqb2RpbXRHK1RsYXdFdUNteXZ0V0lEYTlqeU9PaStlWE1DZWFsNGhhaUV0T3VoaWsyaFpEZ2ZzR0JRMzBvaGdqdXAvWEQvUWlUL1FjY2pvMU9KVUVsbjZ6OGJRL05zak51N1NBQ0NHN0k9GLGS5pXqMEgAEj4KBW9wZW54EixleUpwSWpvaWMzSk1ZbVpuYW1KVFdVZERSSHBoWlUxRWFIQk9aejA5SW4wPRjrleaV6jBIABIZCgp1aWRhcGkuY29tGIqR5pXqMEgAUgIIZBIbCgxpZDUtc3luYy5jb20YhpLmleowSABSAghq

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80c::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e85be7479b3bc59f663e96f1c2023088136b177312f07a58f2e3d8e8f6eb0803

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:34 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35676
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.normaculta.com.br
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 18 KB
8 KB 817ms
816ms XHR
text/plain 2a00:1450:400d:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3558250168591124&correlator=1754910346345620&eid=31072562&output=ldjh&gdfp_req=1&vrg=2023022701&ptt=17&impl=fif&iu_parts=1062898%2CNORMACULTA_BR_HOME_SIDEBARSTICKY&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x600%7C240x400%7C160x600%7C300x250%7C120x600%7C250x250%7C200x200%7C300x100&ifi=4&adks=4170589126&sfv=1-0-40&ris=1&rcs=1&prev_scp=amznbid%3D2%26amznp%3D2&eri=1&sc=1&cookie=ID%3Dae111f7e377b2eaf%3AT%3D1677767313%3AS%3DALNI_MZaUCPqE2ZqMEcDl_8r7tlPpaJmDg&gpic=UID%3D00000bbd9e765c96%3AT%3D1677767313%3ART%3D1677767313%3AS%3DALNI_MZ_dojrHNq95Cq1EpRNo0RZGMDHDg&abxe=1&dt=1677767314333&lmt=1677767314&dlt=1677767312493&idt=468&adxs=945&adys=2884&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=2&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&nvt=1&url=https%3A%2F%2Fwww.normaculta.com.br%2F&frm=20&vis=1&psz=335x11708&msz=336x620&fws=512&ohw=0&ga_vid=574628834.1677767313&ga_sid=1677767313&ga_hid=1305819003&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYipHmleowSABSAghkEhkKCnB1YmNpZC5vcmcYtJHmleowSABSAghqEh0KDmVzcC5jcml0ZW8uY29tGIqR5pXqMEgAUgIIZBLCAQoIcnRiaG91c2USrAExMDgrR2VJQmRxSEhabVd0bFhaTHkzYUd1Y0JjaG02R1IrbzhPOXNZRytSOWdLU2xlS2RYUkdlTzE2d2FOY1hseUtqb2RpbXRHK1RsYXdFdUNteXZ0V0lEYTlqeU9PaStlWE1DZWFsNGhhaUV0T3VoaWsyaFpEZ2ZzR0JRMzBvaGdqdXAvWEQvUWlUL1FjY2pvMU9KVUVsbjZ6OGJRL05zak51N1NBQ0NHN0k9GLGS5pXqMEgAEj4KBW9wZW54EixleUpwSWpvaWMzSk1ZbVpuYW1KVFdVZERSSHBoWlUxRWFIQk9aejA5SW4wPRjrleaV6jBIABIZCgp1aWRhcGkuY29tGIqR5pXqMEgAUgIIZBIbCgxpZDUtc3luYy5jb20YhpLmleowSABSAghq

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80c::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ecd33326e6c852c157131a8b2a4ee4ec3431368299cedeefe9858905d4fcc52c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:35 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8602
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.normaculta.com.br
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame F5AC 22 KB
8 KB 36ms
35ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 184750
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 28 Feb 2023 11:09:24 GMT
expires: Wed, 28 Feb 2024 11:09:24 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1

200
OK

request.php Show response
hal900029.redintelligence.net/ Frame 6773
Redirect Chain

https://hal900029.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=4d04425c1e&subid=&uid=03193bfd0c76275f&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900029.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=4d04425c1e&subid=&uid=03193bfd0c76275f&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

105ms
83ms

Script
application/x-javascript

88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900029.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=4d04425c1e&subid=&uid=03193bfd0c76275f&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCs2PxkbIAZKfAHYPT3gOJ-JYQpuW9oGmtlZynyQ_wLhABIJaL-RtgleKQgqAHyAEJqQIg2X_MoNixPqgDAaoE8gFP0E85c8SvIpwVsjYF-QoYx0SPoWb4KH4k1oGXky6jvjOK_ZVsY-bX0OOm1DXHIpo4NX_O94UTVDt4iSMBRGu1aSUxseJjcN35XFidn7VzvOZAL0R-go-FCTO1wq-VjETezsgDUsEwnhYyRr-H7SqAntB2a28fZnn3_WDlo1pVY8mQZ21Zb0gvO_TPK9-J29NrDirpYD7ZdH4gp4EEA7-kK9atvEvY9AHotSOMMBtCS3n0kgdZZcB9tSHLZiohg7xQHwq_lrC4XE4GkbKwdS4RivqdTUzfAwsxKFIhgURcajtuVF7NSTGe79GZxbT-zNjOWMAE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATj7XRDtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTADUE5ymtqRW3NKjQlof8F0--41KGCJmlHMZqCahStUSi9khsC1oNZ54Xfw4dga7pwORmAu1pSsZxQYBRxUIS3KUUk59EhmCNd7casMYAQ%26sig%3DAOD64_0wvjlwPpm4T4hL68bJeTRGG-sFxA%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-DiykL71Oqe417cwi5nZ-hADxOMDNp5KNDGhHn0v5DI6QKZbAH_2s__ywLvgHQbQMRxDHL0QhaZofltHhdpMUGYVI28pVZ02Gsw40PL1VcKkTcU_q0Oqlpen8P-hLuXce7pkUIjQfCwk0fUtvCrPua6ytAxMje4AnjLzkfChjshtx8ynq4%26cry%3D1%26dbm_d%3DAKAmf-A33lq2C9xf4FSueoNjcuUfkyQENSYmR7Ens0BD8tOunXghay5Ylz1Gii_gwuMVk72EaXicECwNqLerL4Jk9ISyuNNBwYde2S6AS6yl3n_7Z_TY0R8IGwcG2i69_gL-KONVsWXKi0aMFPGag92lHnas7sqV0BRxIDZV17sKnAAw8DjuZvgXvXMcxlIzfb4awrvoNMwR5Ot2l0odw1oryFgyHMuGNKdC2uSDDMElzuYWXoSx-ZOiNR19AIFGegpgkbOvVSyAI_szsV0c1cyujxn1y3dlYiqiDVvdTn_3LSP2Y9p9Bq4U0efGjs5pmcZrevAYq6oWRDwm6Uf_NgIWAMIrO9PKAmTDS7dOmgSM4yiDTE5o0zxkfJhTv9mhReiVjhKEOh5SmyEyL3omGkTDpw1dwVe9JZNkSuYm2OthIbXVwWuOrD81QWbljYUev87DqCTJCU6KKITj0M-fd-sd5U3gXTGF7U3mV7AhDRcbjL00kIiiwQEKiJy5HdhahpAfZhoM0ku87-GqxRbIGOP8ffRuZQ78PsFFhqwvwFM9iMYHo5x_tWw%26adurl%3D&documentReferer=https%3A%2F%2Fwww.normaculta.com.br%2F&ancestorOrigins=https%3A%2F%2Fwww.normaculta.com.br&random=5634855285187&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: b27feaf47307fa976572b4971c5813b756fc309036e40ed77aa4f4ae27aee3f4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 02 Mar 2023 14:28:34 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 10184700101160304444554012251029
Connection: close
Content-Length: 1303
Expires: Thu, 02 Mar 2023 14:28:34 +0100

Redirect headers

Pragma: no-cache
Date: Thu, 02 Mar 2023 14:28:34 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=4d04425c1e&subid=&uid=03193bfd0c76275f&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCs2PxkbIAZKfAHYPT3gOJ-JYQpuW9oGmtlZynyQ_wLhABIJaL-RtgleKQgqAHyAEJqQIg2X_MoNixPqgDAaoE8gFP0E85c8SvIpwVsjYF-QoYx0SPoWb4KH4k1oGXky6jvjOK_ZVsY-bX0OOm1DXHIpo4NX_O94UTVDt4iSMBRGu1aSUxseJjcN35XFidn7VzvOZAL0R-go-FCTO1wq-VjETezsgDUsEwnhYyRr-H7SqAntB2a28fZnn3_WDlo1pVY8mQZ21Zb0gvO_TPK9-J29NrDirpYD7ZdH4gp4EEA7-kK9atvEvY9AHotSOMMBtCS3n0kgdZZcB9tSHLZiohg7xQHwq_lrC4XE4GkbKwdS4RivqdTUzfAwsxKFIhgURcajtuVF7NSTGe79GZxbT-zNjOWMAE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATj7XRDtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTADUE5ymtqRW3NKjQlof8F0--41KGCJmlHMZqCahStUSi9khsC1oNZ54Xfw4dga7pwORmAu1pSsZxQYBRxUIS3KUUk59EhmCNd7casMYAQ%26sig%3DAOD64_0wvjlwPpm4T4hL68bJeTRGG-sFxA%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-DiykL71Oqe417cwi5nZ-hADxOMDNp5KNDGhHn0v5DI6QKZbAH_2s__ywLvgHQbQMRxDHL0QhaZofltHhdpMUGYVI28pVZ02Gsw40PL1VcKkTcU_q0Oqlpen8P-hLuXce7pkUIjQfCwk0fUtvCrPua6ytAxMje4AnjLzkfChjshtx8ynq4%26cry%3D1%26dbm_d%3DAKAmf-A33lq2C9xf4FSueoNjcuUfkyQENSYmR7Ens0BD8tOunXghay5Ylz1Gii_gwuMVk72EaXicECwNqLerL4Jk9ISyuNNBwYde2S6AS6yl3n_7Z_TY0R8IGwcG2i69_gL-KONVsWXKi0aMFPGag92lHnas7sqV0BRxIDZV17sKnAAw8DjuZvgXvXMcxlIzfb4awrvoNMwR5Ot2l0odw1oryFgyHMuGNKdC2uSDDMElzuYWXoSx-ZOiNR19AIFGegpgkbOvVSyAI_szsV0c1cyujxn1y3dlYiqiDVvdTn_3LSP2Y9p9Bq4U0efGjs5pmcZrevAYq6oWRDwm6Uf_NgIWAMIrO9PKAmTDS7dOmgSM4yiDTE5o0zxkfJhTv9mhReiVjhKEOh5SmyEyL3omGkTDpw1dwVe9JZNkSuYm2OthIbXVwWuOrD81QWbljYUev87DqCTJCU6KKITj0M-fd-sd5U3gXTGF7U3mV7AhDRcbjL00kIiiwQEKiJy5HdhahpAfZhoM0ku87-GqxRbIGOP8ffRuZQ78PsFFhqwvwFM9iMYHo5x_tWw%26adurl%3D&documentReferer=https%3A%2F%2Fwww.normaculta.com.br%2F&ancestorOrigins=https%3A%2F%2Fwww.normaculta.com.br&random=5634855285187&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Content-Type: text/html; charset=UTF-8
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Length: 0
Expires: Thu, 02 Mar 2023 14:28:34 +0100

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame D80C 0
10 B 36ms
35ms Image
text/plain 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?JHQYIw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:34 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 2021_CX-60_GER_LHD_C117_EXT_FQ_White_High_Japanese_Premium_WhiteLeather_City_till20240131.JPG
cdn.euw1.jivox.com/files/72839/Template2_FinalVersion_DE_V3/300x600/Frame1/ Frame 283B 175 KB
176 KB 58ms
8ms Image
image/jpeg 99.86.4.17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.euw1.jivox.com/files/72839/Template2_FinalVersion_DE_V3/300x600/Frame1/2021_CX-60_GER_LHD_C117_EXT_FQ_White_High_Japanese_Premium_WhiteLeather_City_till20240131.JPG
Requested by: Host: as.euw1.jivox.com
URL: https://as.euw1.jivox.com/unit/layout_renderer.php?es_pId=29ba8ce&isDynamic=1&campaignId=159897&gdpr_consent=&dspId=DBM&bDim=300x600&ap_DataSignal1=18269839860&jvxVer=2&gdpr=&bUnitId=2200&r=1677767313119433&cMacro=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCethXkbIAZImlB6Km3gP594L4CcW_pLtugKPL290Q99KivcABEAEglov5G2CV4pCCoAegAebj3ukCyAEJqQIBTfXXC9OxPqgDAaoE9QFP0FAy42Q5XqnzbLMfOD3A25XsrFM9Vqm4KiY9TqgjsRMVc6mC-ml_TUc_RDVzfGERZ2sdFpdkNhJWJvUBKUwBGHuok82JNe1SJAeV4UnbSALc51989DR7tLtLtCaU0qun_ArEhXIUJlQD-viRcteUgA_upAg-ulVMXlBVIkoSPGhqRS4OEisBdSU49R3hErotkSS6aR9qC7nSrCNRsod3CCGDe4x5_KefsPqzDui8FVazkHNV0KSAXJodiH-QpRFt9fkHKQUnqD-10krq3bf0pyGGf9CDQ0FSgKEvq0tVcW9lHXnnqpr9ueuLQ8JKcvKDct9ecsAEkdWLvZIE4AQDkAYBoAZNgAeCnKGWAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATrv_oEdATANgTDdgUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSSwDUE5ymuHIv-7LgktZ2daLfOnEztA_uDSjNDPz3tRVtVmTVIS3FLgxSYNQ-KQFedQvkHIVIV0oicbUBHeS4T59YmPTAkbmKZt9FSBgB%26sig%3DAOD64_0ti9CWBr5iyckF5ICZRzooWrls2g%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-AkC6NJc8SUnqcI3jQJGTXlTqCoZsM_7FjwMhVQ6uC1rys_3keXF7n4nN5bVEwWhKl6MG9OwsMXL1gON-y5EuPYjBo2Xyxi6Z9CPKeUEU2oksu7LNF0Unl7M34f0GFTDu5GjExRsPwIx1wrSmKIjBfVwPehP6Cab2bZUiGoW9YD59fFfdk%26cry%3D1%26dbm_d%3DAKAmf-Aa-pjgaw9NJCJ908QgMQFBAJBCXMCT_0XpDKtY2ObS4-wTQTjb2G9N1kLPdL4_WR2TDxX2gOYDpy2_iBj8DerP7pUanVmhzOOKy9nc8BPLghiZt98avrsCLK5dFtiX3mP-Q1TMUx6iEI7izrDPEqwNBFRFiEDNokhK7_y602cRSn-5U7LrRrbv_juJE1cCVJ0EZWm004gktzBN_hNRlz99jtjxhsQ6Uel7t7_y6gzDF4js2ki10yKpwMQMv6qImTsYbPkYVDCePRveADRHLa4BirF-n2SYHYjWY8ejFpnzYv3Jcq5xKNBONwF6JT7B8PA1qF0JyFYqwLkVtLenj2zf3etOsr3wAQZ0gWZ6FfJ1oTfjhR_7tKtq5jYLx2VUfdWqfC26U2gYGdlUk0cKh5B84T2q5E0cKQki4zNB2SFv6mroWe3u_rz39oK5gh8ijNhNJ3Obick6ygANrjI7aVAtvu-yatBbQ9JV4kMx_si1t2dHWgy9gUAArKoYYE9eok9Zp-z9bm1WW0EG01m5Ifzf9M2kUiCBXc28QD9Iusvs6MldYVw%26adurl%3D&us_privacy=%24%7BUS_PRIVACY%7D&ts_pId=29ba8ce&siteId=961ee94c58df6c&creativeUnitType=22&objectName=jvx_6400b291b0976&adUnitId=2200&jvxSessionId=1677767313.9651&base=1&creativeResolveBeginTime=1677767314000&omid=0&localTimeOffset=0&pageURL=https%3A%2F%2F07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&allowExp=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-17.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 81add3742c54a791043675d23ad01902a6a01ff315be71619232284ef0a45278

Request headers

Referer: https://as.euw1.jivox.com/
Origin: https://as.euw1.jivox.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-amz-version-id: null
date: Thu, 02 Mar 2023 10:46:47 GMT
via: 1.1 507b5edb20d0e1a0b73c8687f53defa8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
age: 13308
x-cache: Hit from cloudfront
content-length: 179211
last-modified: Thu, 25 Aug 2022 16:13:28 GMT
server: AmazonS3
etag: "4b24c692030a2da6048f6b73ac87593d"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: image/jpeg
access-control-allow-origin: https://as.euw1.jivox.com
access-control-expose-headers: Content-Range
cache-control: max-age=86400, s-maxage=86400
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
accept-ranges: bytes
x-amz-cf-id: f-Wofeh-Zu0uT4uac2cuqUJWQGMrbCWEOxFjGLvDS8FMP7URzVb4Qw==

GET
H2 200 es_encParams_L2FwX0RhdGFTaWduYWwxPTE4MjY5ODM5ODYwL2FkYjEta2V5PTgwMy9hZGIxLWlkX3ZlcnNpb249Mjk3MDBfMS9lc19ldD0wL2JEaW09MzAweDYwMC9qdnhSYW5kb209MC4yMjYyMDU2NDk2MTI3NjAwMi9lc19jZ05hbWU9TU1ERV9NMiUzQURl...
evs.euw1.jivox.com/trk/72/205954/2200/159897/961ee94c58df6c/22/jvxSId_1677767313.9651/es_pId_29ba8ce/ Frame 4867 43 B
229 B 29ms
28ms Image
image/gif 34.250.199.12
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://evs.euw1.jivox.com/trk/72/205954/2200/159897/961ee94c58df6c/22/jvxSId_1677767313.9651/es_pId_29ba8ce/es_encParams_L2FwX0RhdGFTaWduYWwxPTE4MjY5ODM5ODYwL2FkYjEta2V5PTgwMy9hZGIxLWlkX3ZlcnNpb249Mjk3MDBfMS9lc19ldD0wL2JEaW09MzAweDYwMC9qdnhSYW5kb209MC4yMjYyMDU2NDk2MTI3NjAwMi9lc19jZ05hbWU9TU1ERV9NMiUzQURlZmF1bHRfbm8rbG9jYXRpb25fV2Vla2RheV9EYXlfQm9uZF93aGl0ZV92NS9lc19zZWdOYW1lPUdlbmVyaWNfV2Vla2RheV9EYXk=
Requested by: Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.250.199.12 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-250-199-12.eu-west-1.compute.amazonaws.com
Software: akka-http/10.1.11 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 02 Mar 2023 14:28:34 GMT
access-control-allow-credentials: false
content-type: image/gif
server: akka-http/10.1.11
content-length: 43
p3p: CP='IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA'

GET
H3 200 U1KVG_mJ4Y43Q94sC__L5Y27Ilp_TqM8IF3zBLVmW9g.js Show response
pagead2.googlesyndication.com/bg/ Frame F5AC 36 KB
14 KB 48ms
48ms Script
text/javascript 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/U1KVG_mJ4Y43Q94sC__L5Y27Ilp_TqM8IF3zBLVmW9g.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5352951bf989e18e3743de2c0bffcbe58dbb225a7f4ea33c205df304b5665bd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 15:53:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81318
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14276
x-xss-protection: 0
last-modified: Thu, 23 Feb 2023 13:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 29 Feb 2024 15:53:16 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame E6A5 0
20 B 82ms
82ms Image
image/gif 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bc5YQkbIAZNmJOIiZ-gbU2ZHwCQAAAAA4AeAEAg&bg=!goGlgdXNAAbK-VRH6vk7ADkAdvg8Wrf-OyWIFFh7o4ILgLshAWPfZD8N0E_OH1tZs3t2fetPsOQ-TKZMjs3xw2Hida2MyhL3VO8CAAAA0VIAAAACaAEHCgAgrR6zKcaUjvGAM3GEo-vlQ5_IsvVuNM8w4utMjXV8UgqZAvSReIxdWKenAxhoHDs7TajSTCMOL7YRCB99aCm5c4JmRJSvoQvCxfZhYz1DMJMANUI3o-qXKmWNtduXPaqQC2K-psk2QKgRM_C--lNwJ7IJa4nWtuG87adFrnEQUYpJzRsa5qw1YIbLJxXIdFqeKgemP7uHgUfiTTRIV_x07ZWDskcC7Y0lcNS6FzRuTadEtyb-sXwNwUFrg6hhqkw0--spFTCFZBGfCQNRrX_TNArtOnhir4cevPmGR-qFS_YGJnX9qkHphEdeXlf1Z3o7yXvetLuxSj-oe6WHWV-LatgoG4TVtWY-GVv6xkWImmD3zkflIjiVtOU57xnMsGkntzhSPfb2PYjVddKRx1ARc0J_CKyiqSEX7y73gryg9V-yUbbi5O7O0VN8WeuQb9mD4WU7e4rZunZ1uDrujtwHYDn2-W5hWiD4DHy-mm_o0Ok9EdEA-Bv2XbIAXZRlVey1fK05j7SZRHWdUHLYFZOv4td0l94KpN234LAM9rMG1ElI_Sr4vMSfs1HG6uRJUnPf0wtebH8H5cxYNxv2H8KzLvemo3pwqnrV7nZlF5D1YuvSAq-7-4YMcPw6nBqrVP22mPSHHjGsfy9-2Sfci-2e_AwHX5KXpNWHRf-WMudfX5588a2vVDWsf3HQWz4fBWzDScP7F05X3gxETfs4xyyBigFso3zCl4IaYNY39QmqlAxFY6iizwsQV29pWOSiTidpO9D_eO-E8MTeaO2TMQiVmJg5PxhC5KAJdy9CyT7t6knsHJEKxHOd6CPs7r394nG6obi5nSMTdxPneVIXKl9i65huODtoh90u8qyiJ0HneoWf0tBZV2b7A_Pz7G-QIT4z0b_oZzezk6RNEqSNhY8Kw9bn6uNHBlTdsvcl11XIJmaEjxkolpPHVD7FCXIGF1fPxsP1shsXtUUoDZK3oPpqTQ7zANcmh5kiTDrnIhnFdRZHmCrLKFSAk98P6mlY9d9prmYWn_Q6DmcHCX64--tMgUuvMcjzvJ4

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 Mazda_CX-60_CraftedInJapan_Sideshot_39_RGB_5000x3750_2022_Eur_Engl.jpg
cdn.euw1.jivox.com/files/72839/Template2_FinalVersion_DE_V3/300x600/Frame2/ Frame 283B 669 KB
670 KB 8ms
8ms Image
image/jpeg 99.86.4.17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.euw1.jivox.com/files/72839/Template2_FinalVersion_DE_V3/300x600/Frame2/Mazda_CX-60_CraftedInJapan_Sideshot_39_RGB_5000x3750_2022_Eur_Engl.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-17.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ca199d670e9700f62005dda1da358a1aa8a4f1ad39f1f28e3eb4f18de8e2b26f

Request headers

Referer: https://as.euw1.jivox.com/
Origin: https://as.euw1.jivox.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-amz-version-id: null
date: Thu, 02 Mar 2023 07:14:29 GMT
via: 1.1 507b5edb20d0e1a0b73c8687f53defa8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
age: 26046
x-cache: Hit from cloudfront
content-length: 684954
last-modified: Thu, 25 Aug 2022 16:13:28 GMT
server: AmazonS3
etag: "2f758078ee3a80b8264e65dcb0468e21"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: image/jpeg
access-control-allow-origin: https://as.euw1.jivox.com
access-control-expose-headers: Content-Range
cache-control: max-age=86400, s-maxage=86400
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
accept-ranges: bytes
x-amz-cf-id: DsYlKUTYsuOfm0z0Vhz5iK32m2RKp1ftO_U6Ia2QBW5vKtwJnxX97Q==

GET
H2 200 Mazda_CX-60_CraftedInJapan_Sideshot_49_RGB_5000x3750_2022_Eur_Engl.jpg
cdn.euw1.jivox.com/files/72839/Template2_FinalVersion_DE_V3/300x600/Frame3/ Frame 283B 193 KB
194 KB 8ms
8ms Image
image/jpeg 99.86.4.17
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.euw1.jivox.com/files/72839/Template2_FinalVersion_DE_V3/300x600/Frame3/Mazda_CX-60_CraftedInJapan_Sideshot_49_RGB_5000x3750_2022_Eur_Engl.jpg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.17 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-17.fra6.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c2dc5f2387711224548e2799ac64bd3c3fb1c8ea66dce66a8a567f679e747e8e

Request headers

Referer: https://as.euw1.jivox.com/
Origin: https://as.euw1.jivox.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-amz-version-id: null
date: Thu, 02 Mar 2023 07:55:03 GMT
via: 1.1 507b5edb20d0e1a0b73c8687f53defa8.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA6-C1
age: 23612
x-cache: Hit from cloudfront
content-length: 197438
last-modified: Thu, 25 Aug 2022 16:13:28 GMT
server: AmazonS3
etag: "1445ed1da3122c02c104532a10d3a3fe"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: image/jpeg
access-control-allow-origin: https://as.euw1.jivox.com
access-control-expose-headers: Content-Range
cache-control: max-age=86400, s-maxage=86400
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
accept-ranges: bytes
x-amz-cf-id: GBeagfATyhHpvo50PRDAEZtr1cMFrKCl7Uh0v9uFNIkxMOSMFI4vbw==

GET
H2 200 logo.png
assets.euw1.jivox.com/widgets/2023/1/a72798z63c7f6c6b5606/1/300x600_M2/images/ Frame 283B 16 KB
16 KB 23ms
7ms Image
image/png 13.32.99.43
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://assets.euw1.jivox.com/widgets/2023/1/a72798z63c7f6c6b5606/1/300x600_M2/images/logo.png?1660821814549
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-43.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e38423b55ffa87c8d9803d8c50f28bbb28086658b6ca3973d9849bcbd29fe45e

Request headers

Referer: https://as.euw1.jivox.com/
Origin: https://as.euw1.jivox.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-amz-version-id: null
date: Thu, 02 Mar 2023 05:29:18 GMT
via: 1.1 c43915e0cad14ee7685e5f74a99ce93c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
age: 32357
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 16349
last-modified: Wed, 18 Jan 2023 13:40:25 GMT
server: AmazonS3
etag: "7f0160e79867e7360cc692e067174aeb"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: image/png
access-control-allow-origin: *
cache-control: max-age=86400, s-maxage=86400
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
accept-ranges: bytes
x-amz-cf-id: KXoqVct0F61HZPtRx8JkSWCPPvARRk5hVJQnUwaiauL8G8lcn0-wOQ==

GET
H2

200

view.aspx Show response
pb.media01.eu/ Frame 786A
Redirect Chain

https://pv.medialead.de/trck/epv/e99aace94e6e5873881d3400993e1e7e?subid=10184700101160304444554012251029&t=htlp
https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=10184700101160304444554012251029&actionid=981741&produktid=&dt_url=

0
628 B

118ms
52ms

Document
text/html

88.198.250.30
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=10184700101160304444554012251029&actionid=981741&produktid=&dt_url=

Requested by

Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=4d04425c1e&subid=&uid=03193bfd0c76275f&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCs2PxkbIAZKfAHYPT3gOJ-JYQpuW9oGmtlZynyQ_wLhABIJaL-RtgleKQgqAHyAEJqQIg2X_MoNixPqgDAaoE8gFP0E85c8SvIpwVsjYF-QoYx0SPoWb4KH4k1oGXky6jvjOK_ZVsY-bX0OOm1DXHIpo4NX_O94UTVDt4iSMBRGu1aSUxseJjcN35XFidn7VzvOZAL0R-go-FCTO1wq-VjETezsgDUsEwnhYyRr-H7SqAntB2a28fZnn3_WDlo1pVY8mQZ21Zb0gvO_TPK9-J29NrDirpYD7ZdH4gp4EEA7-kK9atvEvY9AHotSOMMBtCS3n0kgdZZcB9tSHLZiohg7xQHwq_lrC4XE4GkbKwdS4RivqdTUzfAwsxKFIhgURcajtuVF7NSTGe79GZxbT-zNjOWMAE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATj7XRDtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTADUE5ymtqRW3NKjQlof8F0--41KGCJmlHMZqCahStUSi9khsC1oNZ54Xfw4dga7pwORmAu1pSsZxQYBRxUIS3KUUk59EhmCNd7casMYAQ%26sig%3DAOD64_0wvjlwPpm4T4hL68bJeTRGG-sFxA%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-DiykL71Oqe417cwi5nZ-hADxOMDNp5KNDGhHn0v5DI6QKZbAH_2s__ywLvgHQbQMRxDHL0QhaZofltHhdpMUGYVI28pVZ02Gsw40PL1VcKkTcU_q0Oqlpen8P-hLuXce7pkUIjQfCwk0fUtvCrPua6ytAxMje4AnjLzkfChjshtx8ynq4%26cry%3D1%26dbm_d%3DAKAmf-A33lq2C9xf4FSueoNjcuUfkyQENSYmR7Ens0BD8tOunXghay5Ylz1Gii_gwuMVk72EaXicECwNqLerL4Jk9ISyuNNBwYde2S6AS6yl3n_7Z_TY0R8IGwcG2i69_gL-KONVsWXKi0aMFPGag92lHnas7sqV0BRxIDZV17sKnAAw8DjuZvgXvXMcxlIzfb4awrvoNMwR5Ot2l0odw1oryFgyHMuGNKdC2uSDDMElzuYWXoSx-ZOiNR19AIFGegpgkbOvVSyAI_szsV0c1cyujxn1y3dlYiqiDVvdTn_3LSP2Y9p9Bq4U0efGjs5pmcZrevAYq6oWRDwm6Uf_NgIWAMIrO9PKAmTDS7dOmgSM4yiDTE5o0zxkfJhTv9mhReiVjhKEOh5SmyEyL3omGkTDpw1dwVe9JZNkSuYm2OthIbXVwWuOrD81QWbljYUev87DqCTJCU6KKITj0M-fd-sd5U3gXTGF7U3mV7AhDRcbjL00kIiiwQEKiJy5HdhahpAfZhoM0ku87-GqxRbIGOP8ffRuZQ78PsFFhqwvwFM9iMYHo5x_tWw%26adurl%3D&documentReferer=https%3A%2F%2Fwww.normaculta.com.br%2F&ancestorOrigins=https%3A%2F%2Fwww.normaculta.com.br&random=5634855285187&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

88.198.250.30 , Germany, ASN24940 (HETZNER-AS, DE),

Reverse DNS

static.88-198-250-30.clients.your-server.de

Software

Microsoft-IIS/10.0 / ASP.NET

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
access-control-allow-methods: GET,POST
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
date: Thu, 02 Mar 2023 14:28:34 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
last-modified: Thu, 02 Mar 2023 03:28:34 GMT
p3p: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
pragma: no-cache
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-powered-by: ASP.NET
x-xss-protection: 1; mode=block

Redirect headers

Content-Length: 0
Content-Type: application/javascript
Date: Thu, 02 Mar 2023 14:28:34 GMT
Host: pv.medialead.de
Keep-Alive: timeout=20
Location: https://pb.media01.eu/view.aspx?trackid=529D4F146E3238B0FD87AE72E1190AD4&dt_subid1=52180&dt_subid2=10184700101160304444554012251029&actionid=981741&produktid=&dt_url=
Proxy-Host: pv.medialead.de
Server: nginx/1.17.5
Strict-Transport-Security: max-age=15768000
X-IPLB-Instance: 40028
X-IPLB-Request-ID: B9D59BBB:B4C2_91EFC182:01BB_6400B292_79C1C8D:C02D

GET
H2 200 / Show response
adv.office-partner.de/ Frame 86F1 930 B
931 B 98ms
17ms Document
text/html 2a0b:4d07:401::1
PROINITY PROINITY

General

Check archive.org

Show headers Download Go to

Full URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by: Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=4d04425c1e&subid=&uid=03193bfd0c76275f&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCs2PxkbIAZKfAHYPT3gOJ-JYQpuW9oGmtlZynyQ_wLhABIJaL-RtgleKQgqAHyAEJqQIg2X_MoNixPqgDAaoE8gFP0E85c8SvIpwVsjYF-QoYx0SPoWb4KH4k1oGXky6jvjOK_ZVsY-bX0OOm1DXHIpo4NX_O94UTVDt4iSMBRGu1aSUxseJjcN35XFidn7VzvOZAL0R-go-FCTO1wq-VjETezsgDUsEwnhYyRr-H7SqAntB2a28fZnn3_WDlo1pVY8mQZ21Zb0gvO_TPK9-J29NrDirpYD7ZdH4gp4EEA7-kK9atvEvY9AHotSOMMBtCS3n0kgdZZcB9tSHLZiohg7xQHwq_lrC4XE4GkbKwdS4RivqdTUzfAwsxKFIhgURcajtuVF7NSTGe79GZxbT-zNjOWMAE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATj7XRDtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTADUE5ymtqRW3NKjQlof8F0--41KGCJmlHMZqCahStUSi9khsC1oNZ54Xfw4dga7pwORmAu1pSsZxQYBRxUIS3KUUk59EhmCNd7casMYAQ%26sig%3DAOD64_0wvjlwPpm4T4hL68bJeTRGG-sFxA%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-DiykL71Oqe417cwi5nZ-hADxOMDNp5KNDGhHn0v5DI6QKZbAH_2s__ywLvgHQbQMRxDHL0QhaZofltHhdpMUGYVI28pVZ02Gsw40PL1VcKkTcU_q0Oqlpen8P-hLuXce7pkUIjQfCwk0fUtvCrPua6ytAxMje4AnjLzkfChjshtx8ynq4%26cry%3D1%26dbm_d%3DAKAmf-A33lq2C9xf4FSueoNjcuUfkyQENSYmR7Ens0BD8tOunXghay5Ylz1Gii_gwuMVk72EaXicECwNqLerL4Jk9ISyuNNBwYde2S6AS6yl3n_7Z_TY0R8IGwcG2i69_gL-KONVsWXKi0aMFPGag92lHnas7sqV0BRxIDZV17sKnAAw8DjuZvgXvXMcxlIzfb4awrvoNMwR5Ot2l0odw1oryFgyHMuGNKdC2uSDDMElzuYWXoSx-ZOiNR19AIFGegpgkbOvVSyAI_szsV0c1cyujxn1y3dlYiqiDVvdTn_3LSP2Y9p9Bq4U0efGjs5pmcZrevAYq6oWRDwm6Uf_NgIWAMIrO9PKAmTDS7dOmgSM4yiDTE5o0zxkfJhTv9mhReiVjhKEOh5SmyEyL3omGkTDpw1dwVe9JZNkSuYm2OthIbXVwWuOrD81QWbljYUev87DqCTJCU6KKITj0M-fd-sd5U3gXTGF7U3mV7AhDRcbjL00kIiiwQEKiJy5HdhahpAfZhoM0ku87-GqxRbIGOP8ffRuZQ78PsFFhqwvwFM9iMYHo5x_tWw%26adurl%3D&documentReferer=https%3A%2F%2Fwww.normaculta.com.br%2F&ancestorOrigins=https%3A%2F%2Fwww.normaculta.com.br&random=5634855285187&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a0b:4d07:401::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software: keycdn-engine /
Resource Hash: 384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
cache-control: max-age=604800
content-encoding: gzip
content-length: 552
content-type: text/html
date: Thu, 02 Mar 2023 14:28:34 GMT
etag: "3a2-5c1ab16b3be00-gzip"
expires: Thu, 09 Mar 2023 14:28:34 GMT
last-modified: Thu, 06 May 2021 15:37:28 GMT
link: <https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server: keycdn-engine
vary: Accept-Encoding
x-accel-version: 0.01
x-cache: HIT
x-edge-location: atvi

GET
H2

200

htlp Show response
futalis.de/ Frame ABE4
Redirect Chain

https://cdn.retailads.net/tb.php?t=150337V2172132532M&subid=10184700101160304444554012251029&ra_cnt_active=1&ra_cnt=1
https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=2342307533

350 B
401 B

68ms
12ms

Document
text/html

49.12.22.42
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=2342307533
Requested by: Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=4d04425c1e&subid=&uid=03193bfd0c76275f&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCs2PxkbIAZKfAHYPT3gOJ-JYQpuW9oGmtlZynyQ_wLhABIJaL-RtgleKQgqAHyAEJqQIg2X_MoNixPqgDAaoE8gFP0E85c8SvIpwVsjYF-QoYx0SPoWb4KH4k1oGXky6jvjOK_ZVsY-bX0OOm1DXHIpo4NX_O94UTVDt4iSMBRGu1aSUxseJjcN35XFidn7VzvOZAL0R-go-FCTO1wq-VjETezsgDUsEwnhYyRr-H7SqAntB2a28fZnn3_WDlo1pVY8mQZ21Zb0gvO_TPK9-J29NrDirpYD7ZdH4gp4EEA7-kK9atvEvY9AHotSOMMBtCS3n0kgdZZcB9tSHLZiohg7xQHwq_lrC4XE4GkbKwdS4RivqdTUzfAwsxKFIhgURcajtuVF7NSTGe79GZxbT-zNjOWMAE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATj7XRDtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTADUE5ymtqRW3NKjQlof8F0--41KGCJmlHMZqCahStUSi9khsC1oNZ54Xfw4dga7pwORmAu1pSsZxQYBRxUIS3KUUk59EhmCNd7casMYAQ%26sig%3DAOD64_0wvjlwPpm4T4hL68bJeTRGG-sFxA%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-DiykL71Oqe417cwi5nZ-hADxOMDNp5KNDGhHn0v5DI6QKZbAH_2s__ywLvgHQbQMRxDHL0QhaZofltHhdpMUGYVI28pVZ02Gsw40PL1VcKkTcU_q0Oqlpen8P-hLuXce7pkUIjQfCwk0fUtvCrPua6ytAxMje4AnjLzkfChjshtx8ynq4%26cry%3D1%26dbm_d%3DAKAmf-A33lq2C9xf4FSueoNjcuUfkyQENSYmR7Ens0BD8tOunXghay5Ylz1Gii_gwuMVk72EaXicECwNqLerL4Jk9ISyuNNBwYde2S6AS6yl3n_7Z_TY0R8IGwcG2i69_gL-KONVsWXKi0aMFPGag92lHnas7sqV0BRxIDZV17sKnAAw8DjuZvgXvXMcxlIzfb4awrvoNMwR5Ot2l0odw1oryFgyHMuGNKdC2uSDDMElzuYWXoSx-ZOiNR19AIFGegpgkbOvVSyAI_szsV0c1cyujxn1y3dlYiqiDVvdTn_3LSP2Y9p9Bq4U0efGjs5pmcZrevAYq6oWRDwm6Uf_NgIWAMIrO9PKAmTDS7dOmgSM4yiDTE5o0zxkfJhTv9mhReiVjhKEOh5SmyEyL3omGkTDpw1dwVe9JZNkSuYm2OthIbXVwWuOrD81QWbljYUev87DqCTJCU6KKITj0M-fd-sd5U3gXTGF7U3mV7AhDRcbjL00kIiiwQEKiJy5HdhahpAfZhoM0ku87-GqxRbIGOP8ffRuZQ78PsFFhqwvwFM9iMYHo5x_tWw%26adurl%3D&documentReferer=https%3A%2F%2Fwww.normaculta.com.br%2F&ancestorOrigins=https%3A%2F%2Fwww.normaculta.com.br&random=5634855285187&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 49.12.22.42 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: lb-3.futalis.de
Software: /
Resource Hash: 582e283baa4cce4006055beb2eb8fe257c1ec5ef573a40f173b880636089e8cd

Request headers

Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 350
content-type: text/html; charset=utf-8

Redirect headers

content-length: 0
content-type: text/html; charset=utf-8
date: Thu, 02 Mar 2023 14:28:34 GMT
location: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=2342307533
p3p: policyref="https://www.retailads.net/w3c/p3p.xml",CP="NOI CUR OUR STP"
server: Apache
xphp81: true

GET
H2 200 link.html Show response
track.webgains.com/ Frame 6773 2 KB
2 KB 154ms
93ms Script
text/html 18.169.231.46
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=10184700101160304444554012251029&nw=1
Requested by: Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.169.231.46 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-169-231-46.eu-west-2.compute.amazonaws.com
Software: nginx / PHP/7.4.26
Resource Hash: f828f9aa145926e786a54b994e2ddeb13175a1acb3060e72a826920f60ebcce1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:34 GMT
last-modified: Thu, 02 Mar 2023 14:28:34 GMT
server: nginx
x-powered-by: PHP/7.4.26
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=60
access-control-allow-headers: Authorization
expires: Thu, 02 Mar 2023 14:29:34 GMT

GET
H2

200

activityi;dc_pre=CISsvqa6vf0CFbnKOwIdw6ULrA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8384233870674.873 Show response
5994599.fls.doubleclick.net/ Frame 0D0C
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8384233870674.873?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CISsvqa6vf0CFbnKOwIdw6ULrA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8384233870674.873?

391 B
326 B

80ms
79ms

Document
text/html

142.250.184.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CISsvqa6vf0CFbnKOwIdw6ULrA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8384233870674.873?

Requested by

Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f6.1e100.net

Software

cafe /

Resource Hash

ce4224272da97f558fcead92a3165258758489a8807aa1f5e9a617c6055cbbc1

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 217
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 02 Mar 2023 14:28:34 GMT
expires: Thu, 02 Mar 2023 14:28:34 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 02 Mar 2023 14:28:34 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CISsvqa6vf0CFbnKOwIdw6ULrA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8384233870674.873?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK request_content.php Show response
hal900029.redintelligence.net/ Frame 4183 7 KB
2 KB 34ms
12ms Document
text/html 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900029.redintelligence.net/request_content.php?s=10184700101160304444554012251029&a=487b44c1
Requested by: Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request.php?zone=iju9wczm8trb&nw=20&renderingType=javascript&namespace=4d04425c1e&subid=&uid=03193bfd0c76275f&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=300x250&scrollPos=0x0&extData[]=&envData=&gdpr=-1&gdpr_consent=&ud=&redirectClick=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCs2PxkbIAZKfAHYPT3gOJ-JYQpuW9oGmtlZynyQ_wLhABIJaL-RtgleKQgqAHyAEJqQIg2X_MoNixPqgDAaoE8gFP0E85c8SvIpwVsjYF-QoYx0SPoWb4KH4k1oGXky6jvjOK_ZVsY-bX0OOm1DXHIpo4NX_O94UTVDt4iSMBRGu1aSUxseJjcN35XFidn7VzvOZAL0R-go-FCTO1wq-VjETezsgDUsEwnhYyRr-H7SqAntB2a28fZnn3_WDlo1pVY8mQZ21Zb0gvO_TPK9-J29NrDirpYD7ZdH4gp4EEA7-kK9atvEvY9AHotSOMMBtCS3n0kgdZZcB9tSHLZiohg7xQHwq_lrC4XE4GkbKwdS4RivqdTUzfAwsxKFIhgURcajtuVF7NSTGe79GZxbT-zNjOWMAE64_8jvcD4AQDkAYBoAZNgAesrfWfA6gHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB_-esQKoB9-fsQLYBwDSCBEIgOGAEBABGB0yAqoCOgKAQIAKA5gLAcgLAYAMAbATj7XRDtATANgTA9gUAdAVAfgWAYAXAQ%26ae%3D1%26num%3D1%26cid%3DCAQSTADUE5ymtqRW3NKjQlof8F0--41KGCJmlHMZqCahStUSi9khsC1oNZ54Xfw4dga7pwORmAu1pSsZxQYBRxUIS3KUUk59EhmCNd7casMYAQ%26sig%3DAOD64_0wvjlwPpm4T4hL68bJeTRGG-sFxA%26client%3Dca-pub-7683395268562108%26dbm_c%3DAKAmf-DiykL71Oqe417cwi5nZ-hADxOMDNp5KNDGhHn0v5DI6QKZbAH_2s__ywLvgHQbQMRxDHL0QhaZofltHhdpMUGYVI28pVZ02Gsw40PL1VcKkTcU_q0Oqlpen8P-hLuXce7pkUIjQfCwk0fUtvCrPua6ytAxMje4AnjLzkfChjshtx8ynq4%26cry%3D1%26dbm_d%3DAKAmf-A33lq2C9xf4FSueoNjcuUfkyQENSYmR7Ens0BD8tOunXghay5Ylz1Gii_gwuMVk72EaXicECwNqLerL4Jk9ISyuNNBwYde2S6AS6yl3n_7Z_TY0R8IGwcG2i69_gL-KONVsWXKi0aMFPGag92lHnas7sqV0BRxIDZV17sKnAAw8DjuZvgXvXMcxlIzfb4awrvoNMwR5Ot2l0odw1oryFgyHMuGNKdC2uSDDMElzuYWXoSx-ZOiNR19AIFGegpgkbOvVSyAI_szsV0c1cyujxn1y3dlYiqiDVvdTn_3LSP2Y9p9Bq4U0efGjs5pmcZrevAYq6oWRDwm6Uf_NgIWAMIrO9PKAmTDS7dOmgSM4yiDTE5o0zxkfJhTv9mhReiVjhKEOh5SmyEyL3omGkTDpw1dwVe9JZNkSuYm2OthIbXVwWuOrD81QWbljYUev87DqCTJCU6KKITj0M-fd-sd5U3gXTGF7U3mV7AhDRcbjL00kIiiwQEKiJy5HdhahpAfZhoM0ku87-GqxRbIGOP8ffRuZQ78PsFFhqwvwFM9iMYHo5x_tWw%26adurl%3D&documentReferer=https%3A%2F%2Fwww.normaculta.com.br%2F&ancestorOrigins=https%3A%2F%2Fwww.normaculta.com.br&random=5634855285187&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: 9d8e1d2eec113e3ac567f140791f2e1edfdecd337d6f1c2d1b88e6cf02fbfa45

Request headers

Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Encoding: gzip
Content-Length: 2022
Content-Type: text/html; charset=utf-8
Date: Thu, 02 Mar 2023 14:28:34 GMT
Expires: Thu, 02 Mar 2023 14:28:34 +0100
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding

GET

native.png
ad-server.eu/wm/pb/ Frame 6773
Redirect Chain

https://medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=10184700101160304444554012251029
https://pv.medialead.de/trck/eview/e99aace94e6e5873881d3400993e1e7e?subid=10184700101160304444554012251029
https://ad-server.eu/wm/pb/native.png

0
0

GET
DATA 200
OK truncated
/ Frame 6773 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: da91c22ef0e3ffa33eeaaf1c8e02e6cea1bcb2e5b528d241f124cb8f9692a2ef

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 css
fonts.googleapis.com/ Frame 4183 4 KB
1 KB 125ms
45ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Requested by

Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request_content.php?s=10184700101160304444554012251029&a=487b44c1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

dfa1ecdb69b9ee93e87159bfcd4ad2b1248a7de0d6346fd42e0b600723ae7b6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900029.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 02 Mar 2023 14:28:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 02 Mar 2023 13:30:03 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 02 Mar 2023 14:28:34 GMT

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 4183 16 KB
16 KB 35ms
12ms Image
image/png 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/postbank_pool_privatkredit_1200x627.jpg
Requested by: Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request_content.php?s=10184700101160304444554012251029&a=487b44c1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 Böblingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 864e9021d1e3a740cd4eeeb54780f760d700fd7872aef0dd86dc0ee89304bccf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900029.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Thu, 02 Mar 2023 14:28:34 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16267
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 4183 16 KB
16 KB 35ms
12ms Image
image/png 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by: Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request_content.php?s=10184700101160304444554012251029&a=487b44c1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 Böblingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: 22ed2553e089d92f4f8b247db2a514102f1a26692795cb87bca7ddfb882ed33c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900029.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Thu, 02 Mar 2023 14:28:34 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 16551
Vary: Accept-Encoding
Content-Type: image/png

GET
H/1.1 200
OK /
hal9000.redintelligence.net/scale/ Frame 4183 13 KB
13 KB 36ms
12ms Image
image/png 138.201.63.164
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/55487/creativesup/1200x627.jpg
Requested by: Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request_content.php?s=10184700101160304444554012251029&a=487b44c1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 138.201.63.164 Böblingen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.164.63.201.138.clients.your-server.de
Software: Apache /
Resource Hash: dae29a286c727823c9cf97e26297b00095f7f10bcfecf1706a1d6182975e5b54

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900029.redintelligence.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Thu, 02 Mar 2023 14:28:34 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 13010
Vary: Accept-Encoding
Content-Type: image/png

GET
H2 200 MazdaType150-Regular.woff2
assets.euw1.jivox.com/widgets/2023/1/a72798z63c7f6c6b5606/1/300x600_M2/fonts/MazdaType150Regular/ Frame 283B 42 KB
42 KB 8ms
7ms Font
application/octet-stream 13.32.99.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.euw1.jivox.com/widgets/2023/1/a72798z63c7f6c6b5606/1/300x600_M2/fonts/MazdaType150Regular/MazdaType150-Regular.woff2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-43.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 678b3cae19452e95842bebedd844ab5491a4fe873ba5b3e5bca522cc4e45c3fd

Request headers

Referer: https://as.euw1.jivox.com/
Origin: https://as.euw1.jivox.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-amz-version-id: null
date: Thu, 02 Mar 2023 04:45:45 GMT
via: 1.1 c43915e0cad14ee7685e5f74a99ce93c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
age: 35010
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 42740
last-modified: Wed, 18 Jan 2023 13:40:24 GMT
server: AmazonS3
etag: "3f2a9073b5b7460866937e4cd2251bb8"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=86400, s-maxage=86400
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
accept-ranges: bytes
x-amz-cf-id: FnzZ1DiL82yAeirPOm-SKpqpApN00BguMNV0NcvNod-mBqN-AsWMWA==

GET
H2 200 MazdaType150-Bold.woff2
assets.euw1.jivox.com/widgets/2023/1/a72798z63c7f6c6b5606/1/300x600_M2/fonts/MazdaType150/ Frame 283B 42 KB
43 KB 8ms
7ms Font
application/octet-stream 13.32.99.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.euw1.jivox.com/widgets/2023/1/a72798z63c7f6c6b5606/1/300x600_M2/fonts/MazdaType150/MazdaType150-Bold.woff2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-43.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f933d95c0e31a6f637a994c9d1190c55a62758799419dc3a464f06696017a720

Request headers

Referer: https://as.euw1.jivox.com/
Origin: https://as.euw1.jivox.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-amz-version-id: null
date: Thu, 02 Mar 2023 06:34:34 GMT
via: 1.1 c43915e0cad14ee7685e5f74a99ce93c.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
age: 28441
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-length: 43052
last-modified: Wed, 18 Jan 2023 13:40:24 GMT
server: AmazonS3
etag: "fd0d058ad8ef32b77a0a2c6e7dd389b7"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=86400, s-maxage=86400
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
accept-ranges: bytes
x-amz-cf-id: dY-WMczMGYOGX5RMPy9g8oaAFQ0IvNYvBDBjXZgxU00eLYOwT94EdA==

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ Frame 86F1 104 KB
40 KB 69ms
68ms Script
application/javascript 2a00:1450:400d:80c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF

Requested by

Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80c::2008 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8cf3379d6a84a090f526563d51857481e15f489f751f744d8bfed76ec6189719

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://adv.office-partner.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:34 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41153
x-xss-protection: 0
last-modified: Thu, 02 Mar 2023 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 02 Mar 2023 14:28:34 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame F5AC 0
20 B 82ms
82ms Image
image/gif 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=Bw4OdkrIAZIuKDM2Y-gb2z6noCgAAAAA4AeAEAg&bg=!trWlteHNAAbK-VRH6vk7ADkAdvg8WpunrGOccw2f4mKNTvnKQbgPrprnVSRaJgrx_b1-CUw8k1bvS-9dN6C0Z5xlmzKOwLlFgeoCAAAAh1IAAAACaAEHCgA44TWNX9prx1q7HvFIrJgP2BWuyplSyFWbgney92389tz2-FziuFFOdFdJinYJODkJRpJKK8h8y7aZAvUOgJYKj_qdKMzvZshnEYZnBQGgB59hJ8IHk6hPiwP86RqNng9aaa16zomU9s_4HhRSEYhj1jbgdYGsxKYiQEzCfFhKrrcsVr-L1au6vftLwdgchOjln-mgE-pj7hhXseKT4i8eEzJhQsSxTsgVYpOJxbihMo1i7sORzHiSVVFv11aMp7a5V-iAoBCAFP7Z0Y_d9VvuVkdu7lr60BBskIv3g5LvlCD20X8AH4nlTvgqVKtI4BPZnuJFjek2hsI9P35thkMj5doElj-K0qV8yYyELZPpcghtmh8OH-olLgaENBDXsRx65q4dk2a7F5L6e0wDYpZW6NBu63OGGAd-9u1H6HBi17jqpwnaW0FAxhWy_yxSmL_YvqDhfBSt4nnAo08_tvHZdGOYJtqVgvBLsJmC6Ka5yI_GFjmIuaAJeMNF-A6naah0-aCqfLIjuZeh7Eng2DyQPxgIBi1UuMjt4MOWXLXqQrZg_CdUkJsBXmCtILf-6j00DI6fOMTuQlbCZWIxuEcPH3l5ADqEfVtcj2q7rwPGLtreZGlu3bMkRsosXXYw22pVk25WjzLIAI6g__zsJv61eziW_mOMmONYfTArCENLxDIHSP8E13DS_-7HqsjQsEEDAaUgKsf1F_14lf5UJ2WKJ_A-mqSyjDMOmr-iHOIezd-yVt7IANfji-Kru1ABr8eZ4_GpuJgPN24Ws_eVqZA51TfD5FkNQ7VOxIsqTRx8ybozKfN6tg6-pqqdrrEViLQbdifsmrc1xOC49Z1ayjVbw1WnG-Uwx_w6z7U9B5Ah4ZmM6Z5Hlr5p985um5xSrbwM0bzeCtXHUEMXKBYxlfOuWluD5mLOzc2i6_0A8IuQ9CfcqgUnN8d7cl9JmYgFqUG8GL3FTMeaAgAHl-9GjCD7cledY8xmVbXdwQLeXOucoHicVeAvfn1uz9dWgr1qRmMqkzo_jPCrXEhiMaV1LX3YUw96FyvbQ2f-jDgZksHMI5rdwL1hi0bKJ84NKfVEEjap

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:34 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ts.js Show response
cdn.retailads.net/ Frame ABE4 5 KB
5 KB 10ms
10ms Script
application/javascript 2a01:4f8:d0a:2321::2
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.retailads.net/ts.js
Requested by: Host: futalis.de
URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=2342307533
Protocol: H2
Security: TLS 1.3, , CHACHA20_POLY1305
Server: 2a01:4f8:d0a:2321::2 Gunzenhausen, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software: Apache /
Resource Hash: c45a84e5e0ff6ed83afd426788be38a5cbc442dc6cce4631bfd5c22fdd1fc8df

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://futalis.de/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:34 GMT
last-modified: Fri, 21 Jan 2022 14:35:51 GMT
server: Apache
etag: "14aa-5d6188919baaa"
content-type: application/javascript
xphp81: true
accept-ranges: bytes
content-length: 5290

GET
H2 200 pvClk.min.js Show response
analytics.webgains.io/ Frame 6773 85 KB
31 KB 99ms
21ms Script
application/javascript 18.66.15.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/pvClk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=10184700101160304444554012251029&nw=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.15.100 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-15-100.vie50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: f031d0330fa0902ad02a7158a8b4aa01cefacc0f4743ab7b78f4ed517723d130

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 02:08:31 GMT
content-encoding: gzip
via: 1.1 3e0d912790c2cd730e222487cbb10f98.cloudfront.net (CloudFront)
last-modified: Fri, 09 Dec 2022 10:53:01 GMT
server: AmazonS3
x-amz-cf-pop: VIE50-P1
age: 44406
etag: W/"0d5045593d14c9612a5d5576928a5209"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: IMiqPSu6lH-QPlgQTgSVKcLY-ounsj1hXKPrSyK-N1ApH4majUehGg==

GET
H2 200 1x1_0.png
cdn.track.production.webgains.team/7121/ Frame 6773 3 KB
3 KB 41ms
7ms Image
image/png 13.225.78.118
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.track.production.webgains.team/7121/1x1_0.png?Expires=1677767614&Signature=B-DjLvRuU4ai0S2HnP3JlLdY0c6z2G5YKKafySM6IJJLmZ2dP~UWorr~gDrxR-8YgPoEwAGauRaoHI2cqoaGR29lSN2UROkL3Fo9Spo77gv7x5GDVb6PjetbQ~f727xz7DqVTkRQlPTG5-5cCR9DPdvV86e76xezRrFX00oVOBRzhoM8KVLkRPeNFOimuYt-kzX6ITA4KMPwvHweuFRAHkyAMb3x2f-bkyvE5~5AVdp-aW7tJ59pjTPRwAkS2ZZN0xdZND3uBqNUJarTfmC~pJV3vdRPQWc-RmsyDREJHttKx4t9xr2NSbvj64naXXJ~5jf2B7KGK2oWTka6R1R0Bw__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by: Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.78.118 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-118.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

x-amz-version-id: null
date: Thu, 02 Mar 2023 03:47:23 GMT
via: 1.1 58b222ebbb6cc6c8c8c9a46127ae3a3e.cloudfront.net (CloudFront)
last-modified: Fri, 06 May 2022 11:40:06 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C2
age: 60615
etag: "4e57de0506fbdb487ffcd53b450caee1"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 2808
x-amz-cf-id: BFUWnRN4xkzuq8Ras8n_UxUN4WFG9QUawizcFz2PFO7Cw4403mSGOA==

GET
H/1.1 200
OK viewability Show response
hal900029.redintelligence.net/ Frame 4183 0
150 B 34ms
12ms Script
text/html 88.99.219.174
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900029.redintelligence.net/viewability?s=10184700101160304444554012251029&a=a236b432&vb=m
Requested by: Host: hal900029.redintelligence.net
URL: https://hal900029.redintelligence.net/request_content.php?s=10184700101160304444554012251029&a=487b44c1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 88.99.219.174 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.174.219.99.88.clients.your-server.de
Software: Apache /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://hal900029.redintelligence.net/request_content.php?s=10184700101160304444554012251029&a=487b44c1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Thu, 02 Mar 2023 14:28:34 GMT
Server: Apache
Connection: close
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 4183 8 KB
0 127ms
43ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdu.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900029.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 23 Feb 2023 15:41:23 GMT
x-content-type-options: nosniff
age: 600431
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13052
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:09:03 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 23 Feb 2024 15:41:23 GMT

GET
H2 200 6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2
fonts.gstatic.com/s/sourcesanspro/v21/ Frame 4183 13 KB
13 KB 120ms
36ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/sourcesanspro/v21/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7l.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://hal900029.redintelligence.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 00:28:56 GMT
x-content-type-options: nosniff
age: 50378
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13036
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:04:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 01 Mar 2024 00:28:56 GMT

GET dc_pre=CISsvqa6vf0CFbnKOwIdw6ULrA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8384233870674.873
adservice.google.com/ddm/fls/z/ Frame 0D0C 0
0

GET
H3 200 container.html Show response
07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 4DCB 6 KB
3 KB 47ms
47ms Document
text/html 2a00:1450:400d:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80c::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.normaculta.com.br/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 02 Mar 2023 14:28:33 GMT
expires: Fri, 01 Mar 2024 14:28:33 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css
fonts.googleapis.com/ Frame 4DCB 4 KB
717 B 46ms
45ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

46d1791d45e9e6840842ef90f192c2c6f1f4247baa7c1f32f2da75d3a05c0de2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 02 Mar 2023 14:28:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 02 Mar 2023 13:28:34 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 02 Mar 2023 14:28:35 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230227/r20110914/client/ Frame 4DCB 2 KB
765 B 35ms
34ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230227/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f50e59fa7a264b1674e5f94591375a26e9aea318036b2a629e5ba182df01b54f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 19:26:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68537
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 738
x-xss-protection: 0
server: cafe
etag: 1394486882873449110
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Mar 2023 19:26:18 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame 4DCB 0
0 88ms
88ms Fetch
text/html 2a00:1450:400d:80c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CVkHjkrIAZI2sGIjz3gOj0Z-ABvnk6sVtgtSDmNMMzMeapv0IEAEglov5G2CV4pCCoAegAbC6odcDyAEJqQKuL8_2r86xPuACAKgDAcgDywSqBOgBT9AwsdM3fGE3yAHz485hCoP1ROc_Rm4C7jPkIZUTg_z9sSRucRIgyN1AidITxulwknmyF65No-Ingm_2UE7FJrypIL0zETp-BcoOrySC2m3xD01F3SNsDap90KIzoAAdxLeatYh1IqQtqpqpWSep3V8GWGeYtfkeRg75hRn64hPQH9a5h_rS72DkzQRrq-xD0BQjb5uetLFTDXac9euCRxT92GSVdVFGipHVYpPdW41PR0jKPTx0nMPIwuzboXZvGALBqaZcM2A1mC9MFjmsQaTXMDF5GSWJHpcxYTou9OptazDWTEJyicAEkav95KID4AQBkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBi6AB7_ZvWCoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAemvhvYBwDyBwQQhscE0ggRCIDhgBAQARgdMgKqAjoCgECACgPICwHYEwyIFALQFQGAFwGyFx4KHAgAEhRwdWItNzY4MzM5NTI2ODU2MjEwOBjo7gY&sigh=rpRaOil-m88&uach_m=[UACH]&cid=CAQSPADUE5ymgca9udiAqQKIadf3pp5L27zpvzWlyEkZx8Zfrg4sZsXuvGrBnb3-AgXwSo5NCuesnc6h3IOZWhgB&template_id=494
Requested by: Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:400d:80c::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230227/r20110914/ Frame 4DCB 22 KB
9 KB 35ms
35ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230227/r20110914/abg_lite_fy2021.js

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f53b2103abffed07c86a43ad48a3a064677134cc7b52c0bdf9ff4f3b20d14656

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 13:19:25 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4150
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9122
x-xss-protection: 0
server: cafe
etag: 6330344511044705610
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 16 Mar 2023 13:19:25 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230227/r20110914/client/ Frame 4DCB 3 KB
1 KB 35ms
35ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230227/r20110914/client/window_focus_fy2021.js

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 09:37:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17442
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 16 Mar 2023 09:37:53 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230227/r20110914/client/ Frame 4DCB 20 KB
8 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230227/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a6c19d8875246d4def23e273e3c6d2887aeba815c80128b91c8b86dc35e38e25

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 19:26:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68537
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5959907985313552934
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Mar 2023 19:26:18 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 4DCB 0
0 45ms
44ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTzCxH-fPVvNaesSbJoEyXwlW8qoKp0_mVJOyMxwstcrZe_jWT5LOG_Ar7E4zTfWREdQHE_PvLd7qkv-G1EoBMk_UPpXQ
Requested by: Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 4DCB 158 KB
48 KB 153ms
152ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04e8409a13fe19247cf7c55cda100bb4097f3fe49e326a04302a30ba4ccb0333

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1677673803517815"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 02 Mar 2023 14:28:35 GMT

GET
H2 200 3d1f1376e308865cf68987b0ba581d94.js Show response
www.gstatic.com/mysidia/ Frame 4DCB 34 KB
14 KB 122ms
38ms Script
text/javascript 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/3d1f1376e308865cf68987b0ba581d94.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

38935741f6939baa18b56370cf3e8a1b20e1e52439ded7d8dd4c5e39a5ca2672

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Fri, 24 Feb 2023 05:29:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 550752
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14319
x-xss-protection: 0
last-modified: Fri, 24 Feb 2023 04:57:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Thu, 25 May 2023 05:29:23 GMT

GET
DATA 200
OK truncated
/ Frame 4DCB 287 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 605b14697226eeb0be6b2c11db8206b70f4c8681c3f921e4ceca4793ce1a95ce

Request headers

Referer
Origin: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3

200

4091503581208051288
tpc.googlesyndication.com/simgad/ Frame 4DCB
Redirect Chain

https://tpc.googlesyndication.com/pageadimg/imgad?id=CICAgKDnj86ZywEQ9AMY9AMyCGN8MsJOAEwL
https://tpc.googlesyndication.com/simgad/4091503581208051288

107 KB
107 KB

36ms
35ms

Image
image/png

2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4091503581208051288

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fcab803c6d01082f69e5510655ca566241f3a4fd3ee7aa1506b1308e2d069ccb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 20:03:47 GMT
x-content-type-options: nosniff
age: 66288
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 109931
x-xss-protection: 0
last-modified: Wed, 23 Oct 2019 12:45:40 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 29 Feb 2024 20:03:47 GMT

Redirect headers

date: Wed, 01 Mar 2023 19:26:59 GMT
x-content-type-options: nosniff
server: cafe
age: 68496
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://tpc.googlesyndication.com/simgad/4091503581208051288
content-type: text/html; charset=UTF-8
cache-control: public, max-age=2592000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 31 Mar 2023 19:26:59 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 83ms
82ms Image
text/html 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2023022701&jk=3558250168591124&bg=!vr2lvenNAAbK-VRH6vk7ADkAdvg8WkKdCWQf0YQSXVhFQ-4JNWQarA4SFQEbl78G4JHSCVCYrQjHF2N4OrPcWuu_y5uUjO3xSBoCAAABLVIAAAACaAEHCgDP_rrm78YpJxIXW6IWFTvkKj-q9PxE-BjhJh1Q-UtpTLuuAyyz3z6SdoNWXeEM6WEHGy8Y0yQHcN_vRGm4ROgp6UpenxgrFCtwrOhe6XQHEYOGJi2wTul8EkZ-RxaH1Vb2vMh9a5UcuCkLzROTjrUECh3CMNJb9-tFCjj5BY6exkUH9ZpVTC2qBB0c2zTjuOtlShll4vtMGR_r-ZbwZQU7gvJYrLQkNPhNI9JEr4PKSbKiIfjz44cs0o7FHHHWJT49WLgkOQCg6ntJ-w2wtKDRmQKc1SK2JXdiKT9A6gHvIcT6KBza0nWc60X_IiNyQ-8o6yP98vIu6B4qhtH0vpBNsetdySsSai5Vq-Q9pzNBHtkhUVlzcAjuQZOLq1QY_t5YebmKMpJijOo5s8m7ePULMxx3gwHlPJrTttvfl0Yf7A2jCj5o9SbqF9ty2HE9Kmbi6JmlMz1geHMXTaY9c5QrR-jHw2iJyWJPYtZVwJnhDAruGR2MiB3d_peQkUTrg-5w6pzVRNeEWSptIQPz96IVTXA4MA1JhfOR28Hh8_HujzeIGBkJMTnRXN4HVAWELw1p4hZVG2HWjM6siJXBdBnnHmfQprwzbFGeH7viU6vZXKGSt-oabDCyVUJLrg6oet0Cp7zhxXyuWZgDyU57Iq4GZ7tBMqKhscaOsl07yNrkgixwwOZm7cpLq64RjjWZcFClOGnEU5MGyr7NwErfUYugjD2ol2c3sWLiV9ldJTiKYbLImZDhJwfc3mDvYQh0qkCWQ1t9K3uZctCD0YfhcJvin-CvMiUsWkSRxgVQGwKmCqTwThmkH8JLI5bKv6iotiQVS6UCt7_bQQ0glPgQDdwDVbpOIWVl8nQYrdgr-U5BEAYGbKQj8OZU7kDYf1LpuAxdsb6cNv05jjedhMkgBRTBsLJVm2TNfrzmENeiKiSBA8ZsSTsPpBc2-L1125NBPHZ1mRuVhurPXbuimHgfYo4avJTYzrT_AjREadLRwBZrqUkP09p0wzXdas0S2-5heYnh_IPgJnXTAk4FCXhg8ibum6AMJ_0BiLwCHZoogdTa9fXsKwYRXgPPfwUkO1_y8n3mWsarjqLSqw0MeiQ6k-vYxSqMqf5tzqqAp-F-8qijj4taRmi1wnjvN2yo7WQKIwXQkKMHejI0MExcmwCzUpI
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.normaculta.com.br/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 93FD 1 KB
643 B 48ms
47ms Document
text/html 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 997
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 02 Mar 2023 14:11:58 GMT
etag: 48472445140208031
expires: Fri, 03 Mar 2023 14:11:58 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 4DCB 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 367f4b8863eaa327e490017b3eb82175be95cf35bde4fa19d670f9707d4dda2e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 93FD 0
104 B 214ms
69ms Image
text/plain 2a02:fa8:8806:16::1370
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESECcDneMntQo5y_TlFsMcGPQ&google_cver=1&google_push=Aa02lx-ZqT4yOqzIoWzx9BS3vb7jXODoetGtasZSTcMtPFbsWgGTTTEUpEbUZ2mTKXQ12zvBWl1ou0mPkpCua6J1_WlI1hy80Yk
Requested by: Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:16::1370 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 93FD
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEIep6N6mMozirpwAjNU5sYo&google_cver=1&google_push=Aa02lx9mppZI-VUnR5VTlpJHEUmvjs3WYYErnWUaScgf4cUQ1kYXnvvgt6E-fWb6JJt_v0T5akUUTs7EGyi1LobxRb_viPdIJogB&...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEIep6N6mMozirpwAjNU5sYo&google_cver=1&google_push=Aa02lx9mppZI-VUnR5VTlpJHEUmvjs3WYYErnWUaScgf4cUQ1kYXnvvgt6E-fWb6JJt_v0T5akUUTs7EGyi1LobxRb_viPdIJog...

43 B
413 B

176ms
162ms

Image
image/gif

2606:4700::6812:19ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEIep6N6mMozirpwAjNU5sYo&google_cver=1&google_push=Aa02lx9mppZI-VUnR5VTlpJHEUmvjs3WYYErnWUaScgf4cUQ1kYXnvvgt6E-fWb6JJt_v0T5akUUTs7EGyi1LobxRb_viPdIJogB&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAa02lx9mppZI-VUnR5VTlpJHEUmvjs3WYYErnWUaScgf4cUQ1kYXnvvgt6E-fWb6JJt_v0T5akUUTs7EGyi1LobxRb_viPdIJogB%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Protocol: H2
Server: 2606:4700::6812:19ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7a1a53bba90dbb5c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 48
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEIep6N6mMozirpwAjNU5sYo&google_cver=1&google_push=Aa02lx9mppZI-VUnR5VTlpJHEUmvjs3WYYErnWUaScgf4cUQ1kYXnvvgt6E-fWb6JJt_v0T5akUUTs7EGyi1LobxRb_viPdIJogB&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAa02lx9mppZI-VUnR5VTlpJHEUmvjs3WYYErnWUaScgf4cUQ1kYXnvvgt6E-fWb6JJt_v0T5akUUTs7EGyi1LobxRb_viPdIJogB%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7a1a53b7eb26bb5c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 93FD 70 B
265 B 111ms
32ms Image
image/gif 3.33.220.150
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESECPFFRmSqG6b7RfPFlPdO_8&google_cver=1&google_push=Aa02lx_-44-rPSdulI6dJfpTbcJjTQ1Db1zy7J2Xmd8OmeXTpCDyIKw9hbh9GLmn0oMe4xiUtkvzziqa2Etq-c3T8iW1H2yOLljj
Requested by: Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.33.220.150 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 93FD
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEH5S714_2UN6yFhGgSQ7hkk&google_cver=1&google_push=Aa02lx_Hrluj04Zq9elh3Ypx2vIywOvL8sDGdvLexlHg3cqo1MFhRA5Agt5QMwN_3oEkbmDWD4kn_8Yn...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEH5S714_2UN6yFhGgSQ7hkk&google_cver=1&google_push=Aa02lx_Hrluj04Zq9elh3Ypx2vIywOvL8sDGdvLexlHg3cqo1MFhRA5Agt5QMwN_3oEkbmDWD4k...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjgwNzkyNzcwNTcxNTk3OTMyOQ&google_push=Aa02lx_Hrluj04Zq9elh3Ypx2vIywOvL8sDGdvLexlHg3cqo1MFhRA5Agt5QMwN_3oEkbmDWD4kn_8...

170 B
188 B

49ms
49ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjgwNzkyNzcwNTcxNTk3OTMyOQ&google_push=Aa02lx_Hrluj04Zq9elh3Ypx2vIywOvL8sDGdvLexlHg3cqo1MFhRA5Agt5QMwN_3oEkbmDWD4kn_8YnVCT5ABrtcJjEjLb7vfo

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjgwNzkyNzcwNTcxNTk3OTMyOQ&google_push=Aa02lx_Hrluj04Zq9elh3Ypx2vIywOvL8sDGdvLexlHg3cqo1MFhRA5Agt5QMwN_3oEkbmDWD4kn_8YnVCT5ABrtcJjEjLb7vfo
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 dds
rtb.openx.net/sync/ Frame 93FD 43 B
350 B 94ms
20ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEMB1T-HZmLVd83mdWi11RN4&google_cver=1&google_push=Aa02lx9EhrYVWjwu-XPoj4MG6rAf_AvHyxwtp6Q72JuaQ7_U5wU6h31FIfRV7n5DKfYlRzBRcCMKZwKnN30xoH-FZ_kXN2SZ-bIh
Requested by: Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:34 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: m52s2rca5emt1kj1lbitoc61vumd1ula

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 93FD
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEKyzhR0M1JsBNRABexzFm9Q&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEKyzhR0M1JsBNRABexzFm9Q&google_hm=ZACykvdTPwzYZBuhxfTOwAAACLkAAAAB&google_nid=index&google_push=Aa02lx_e9tbLPl-N2bcLo8tYV47IvtOY7b6zC...

170 B
188 B

48ms
48ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEKyzhR0M1JsBNRABexzFm9Q&google_hm=ZACykvdTPwzYZBuhxfTOwAAACLkAAAAB&google_nid=index&google_push=Aa02lx_e9tbLPl-N2bcLo8tYV47IvtOY7b6zCl1w66XEmDdxOdNbMq8U_OkZj3nx8pykkQQv4uqFneQRRFxUFa59TG2u3IAjh1yp

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 02 Mar 2023 14:28:35 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEKyzhR0M1JsBNRABexzFm9Q&google_hm=ZACykvdTPwzYZBuhxfTOwAAACLkAAAAB&google_nid=index&google_push=Aa02lx_e9tbLPl-N2bcLo8tYV47IvtOY7b6zCl1w66XEmDdxOdNbMq8U_OkZj3nx8pykkQQv4uqFneQRRFxUFa59TG2u3IAjh1yp
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 93FD
Redirect Chain

https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEDSDFPY_MRfA0Vgg5FO0wcw&google_cver=1&google_push=Aa02lx9L06x5xtFTt7LqCtLQsWYGoQrH0GaO3LagEiGJGq6YRtBuaNajiCtYHFUYiN8zT-1K0F167mNj6IE67hrts_nMjFwCoeB9
https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=Aa02lx9L06x5xtFTt7LqCtLQsWYGoQrH0GaO3LagEiGJGq6YRtBuaNajiCtYHFUYiN8zT-1K0F167mNj6IE67hrts_nMjFwCoeB...
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMxODA5NTI0MDE5MTA2MTg4MjQxMA%3D%3D&google_push=Aa02lx9L06x5xtFTt7LqCtLQsWYGoQrH0GaO3LagEiGJGq6YRtBuaNaj...

170 B
188 B

48ms
47ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMxODA5NTI0MDE5MTA2MTg4MjQxMA%3D%3D&google_push=Aa02lx9L06x5xtFTt7LqCtLQsWYGoQrH0GaO3LagEiGJGq6YRtBuaNajiCtYHFUYiN8zT-1K0F167mNj6IE67hrts_nMjFwCoeB9

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzMxODA5NTI0MDE5MTA2MTg4MjQxMA%3D%3D&google_push=Aa02lx9L06x5xtFTt7LqCtLQsWYGoQrH0GaO3LagEiGJGq6YRtBuaNajiCtYHFUYiN8zT-1K0F167mNj6IE67hrts_nMjFwCoeB9
date: Thu, 02 Mar 2023 14:28:35 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 93FD 0
12 B 46ms
45ms Image
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Lgpx_jzuyaA7kgnxJRjJt9fVmXou78OnP5FT0iOuwF9vNcjxNp6Y747YhJEgL2zmruGWaV

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:35 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET activeview
pagead2.googlesyndication.com/pcs/ Frame 4867 0
0

GET
H3 200 container.html Show response
07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame D576 6 KB
3 KB 47ms
47ms Document
text/html 2a00:1450:400d:80c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2023022701.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80c::2001 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.normaculta.com.br/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 02 Mar 2023 14:28:33 GMT
expires: Fri, 01 Mar 2024 14:28:33 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame CD20 466 B
235 B 75ms
73ms Document
text/html 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGOnz9uABMAE&v=APEucNVXrF7NK1w4W1xv8Vg74PlJ15S6XW90jhg50WOnBVXdWcZ58XVK_KbLElgOUHufAQ-LRjT6ZG3tJqQo7DIorLdrv7b1Yuz_0rD-b6JhKY-NoSHtzCrWPKtbAAuX38rYdB_U3pPanoYv8-AMMbjMQZ_KZ6qJiGjqwcdfbZ9cGfPO9wl6A4E

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37ab5c060ae53ccda75b8bd212d874a17650f7954b11c4e31f568990ab40196b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 215
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 02 Mar 2023 14:28:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame D576 78 KB
27 KB 100ms
99ms Script
text/javascript 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

16b432ac8f43a6b2d8aa358f41ee60e2ef5923b2645bf2c37f3a06f8334b1557

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:35 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 27790
x-xss-protection: 0
server: cafe
etag: 3677590245327912432
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 02 Mar 2023 14:28:35 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame D576 42 B
63 B 82ms
81ms Image
image/gif 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DWiPJNBLfO4Ye0ORg0TDSD7V7dgiLYktl2npwKpxr32RuZYOXP58EdSt42rd8Evq8KwvioxGRg1qdjzu2-dvc0IZeu5ERsj3H4oxcH2nIRXXO5rJE

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D576 0
20 B 81ms
80ms Image
image/gif 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=10339288850308588781&x=1&ct=76

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230227/r20110914/client/ Frame D576 3 KB
1 KB 36ms
34ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230227/r20110914/client/window_focus_fy2021.js

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 09:37:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 17442
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 16 Mar 2023 09:37:53 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230227/r20110914/client/ Frame D576 20 KB
8 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230227/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a6c19d8875246d4def23e273e3c6d2887aeba815c80128b91c8b86dc35e38e25

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 19:26:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 68537
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8581
x-xss-protection: 0
server: cafe
etag: 5959907985313552934
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 15 Mar 2023 19:26:18 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame D576 0
0 44ms
43ms Image
text/html 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS9wGEXsP-fvAdcYNYHhJ4SE-6FskPentheDUQDAb48xmaDDhm6D5fgB5y7OezXVop2FkVH6eTZad6qwC8Ty70lL6uNYw
Requested by: Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame D576 158 KB
48 KB 48ms
48ms Script
text/javascript 2a00:1450:4001:831::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

04e8409a13fe19247cf7c55cda100bb4097f3fe49e326a04302a30ba4ccb0333

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49545
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1677673803517815"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Thu, 02 Mar 2023 14:28:35 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame 4DCB 16 KB
16 KB 35ms
35ms Font
font/woff2 2a00:1450:4001:80f::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 05:21:08 GMT
x-content-type-options: nosniff
age: 32847
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 01 Mar 2024 05:21:08 GMT

GET
H3 200 U1KVG_mJ4Y43Q94sC__L5Y27Ilp_TqM8IF3zBLVmW9g.js Show response
pagead2.googlesyndication.com/bg/ Frame 2D83 36 KB
14 KB 48ms
47ms Script
text/javascript 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/U1KVG_mJ4Y43Q94sC__L5Y27Ilp_TqM8IF3zBLVmW9g.js

Requested by

Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5352951bf989e18e3743de2c0bffcbe58dbb225a7f4ea33c205df304b5665bd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 15:53:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81319
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14276
x-xss-protection: 0
last-modified: Thu, 23 Feb 2023 13:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 29 Feb 2024 15:53:16 GMT

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame CD20
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEDRlhRUFXCpF6j2X4xuVFyQ&google_cver=1
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEDRlhRUFXCpF6j2X4xuVFyQ&google_cver=1&__user_check__=1&sync_id=8416c18b-b906-11ed-a34e-16821cb20306

43 B
548 B

17ms
17ms

Image
image/gif

185.94.180.126
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEDRlhRUFXCpF6j2X4xuVFyQ&google_cver=1&__user_check__=1&sync_id=8416c18b-b906-11ed-a34e-16821cb20306
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGOnz9uABMAE&v=APEucNVXrF7NK1w4W1xv8Vg74PlJ15S6XW90jhg50WOnBVXdWcZ58XVK_KbLElgOUHufAQ-LRjT6ZG3tJqQo7DIorLdrv7b1Yuz_0rD-b6JhKY-NoSHtzCrWPKtbAAuX38rYdB_U3pPanoYv8-AMMbjMQZ_KZ6qJiGjqwcdfbZ9cGfPO9wl6A4E
Protocol: HTTP/1.1
Server: 185.94.180.126 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Date: Thu, 02 Mar 2023 14:28:35 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 88
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Thu, 02 Mar 2023 14:28:35 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Location: /partner?adv_id=7025&uid=CAESEDRlhRUFXCpF6j2X4xuVFyQ&google_cver=1&__user_check__=1&sync_id=8416c18b-b906-11ed-a34e-16821cb20306
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 60
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CD20
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_i...
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=ODQxNjkwNjEtYjkwNi0xMWVkLTg5NTUtMTg5MWZhZDIwNTA2

170 B
188 B

48ms
47ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=ODQxNjkwNjEtYjkwNi0xMWVkLTg5NTUtMTg5MWZhZDIwNTA2

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CIvVChCpn9ACGOnz9uABMAE&v=APEucNVXrF7NK1w4W1xv8Vg74PlJ15S6XW90jhg50WOnBVXdWcZ58XVK_KbLElgOUHufAQ-LRjT6ZG3tJqQo7DIorLdrv7b1Yuz_0rD-b6JhKY-NoSHtzCrWPKtbAAuX38rYdB_U3pPanoYv8-AMMbjMQZ_KZ6qJiGjqwcdfbZ9cGfPO9wl6A4E

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 02 Mar 2023 14:28:35 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Location: https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=ODQxNjkwNjEtYjkwNi0xMWVkLTg5NTUtMTg5MWZhZDIwNTA2
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 52
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame CD20
Redirect Chain

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true
https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true&verify=true
https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1MbnE2cnUxRTJ1SDQ4c3RXdkZ1MklnbHRfanJVd3V4UH5B

170 B
188 B

48ms
47ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1MbnE2cnUxRTJ1SDQ4c3RXdkZ1MklnbHRfanJVd3V4UH5B

Requested by

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1MbnE2cnUxRTJ1SDQ4c3RXdkZ1MklnbHRfanJVd3V4UH5B
date: Thu, 02 Mar 2023 14:28:35 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.25
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D576 0
20 B 81ms
81ms Ping
image/gif 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=5192501137555&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D576 0
20 B 81ms
80ms Ping
image/gif 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=5192501137555&version=m202301230201&ct=76&x=1&cor=10339288850308590000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame D576 83 KB
35 KB 71ms
70ms Script
text/javascript 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bm5tKvIrT9YFToLJc_N4I8ZYNsrjyUyQCxEtTle3U86bOOAu_kZUbka1vFap8Bd9IpTjDgeKEYP0wAd-d05ISfikJ5JA&cry=1&dbm_d=AKAmf-BbfdP_gFDPD33VJ3u7zO6h-F80CDtIKXX_6akzwhbERS_YHZeo-1LAE7Pl9X1nWRXjUc-Ed7FzUOyKnM5H5UO1fLf4G9FXJ-G0ERWYtKtjahBE6nEZgIid_apJQ-BTy1mbstr10LOvjjVxOWbfHkXpkxZN_FEl29ul8-6ELBtAW-yVo150Nba-rn5Q6-rSG8QwT-dJSGsw9MNIpQPUlBhiB7JgdTAHRxG_wahzJQr28ZkQB4tO3xoiu2oJBm_bpn5ysehMZjKxb_8SZVKmAXGn82-envoFKjUQeemZcqDz0SIEbeHJaF9at8ZVHk_tczG5NY2CCbC1MuWP_DYSwm6UGhW1dG5mM6wwmKjssfoEmbQiXA9aKNIGicbPTUEbApkxoyq4n6OW4Hor1daBDS78SRXIz5QCoDHEZY3O0WabWiviF-ASIvq-qotbXsSXdXYryoGed3W4u4liiJjzN7c0gO__QwSDg-7Xig0YDBU2ahpUjMnXBhRVZGd15oVSNSVsjdydXYdkDt_bSiIXqMwSbdR0IjzrkIWAatSV8wXQM-OW4Azkp9tzdwixp6gFlFxJdFsvJkb1mqWqmdXsmyjvyuO8N007sQ5yBJTGZop7TfqIE8xYp0KcybGGKjCeaqfOq8YQ0YwfHsWBUuZdeSdm0cZfi4aYcadZoR0a-lyt0p8s3-B9CJP6eLsTekgCxNPSshwQgOldqGje-8nSWajSVWmXWuBMBJkOFsBFkIMC8gzxjsyLS4QnSZU6FnaFjBOKEc_61P16EKsi53WUG2b_lqTIBF_DVYXOmCQ8sUVggizw09K8dpRl1XN-ZpHLmCghPWkZAQrE-ZChVjauUNSyTeS20O-pdwCHFwF93aFZ6srcWS8OmgpM2IC7kap3zrvsNAZn9JkhpUfA-iCQV6tJNYgLPtJ5RTrU_priWuhfTVYZFVz5iO7k26BK2qIEIwOVkZ1W5cIIUd_jPgoBFyawOi5z4v4_GyA_XJvMsMdQU2GnKJ7cM9LTnlrRWDNWgpZ1mocK6k-JqBhuwOiBiGDoQ2R7PKRCnFrDUnTk8IuBNiqcEr71HFjA0sIu8nR-NIbjLGO3KBtymf8VXvI5Pru6kkCxl4XTTvWRDmdNeqnjC5gxFiVfOxA-nZIfSsvL0k68eb3_dVwUWRsQu1z7D1g-A-A1IL9Urn5JcMplaIpFGHGF9kPvA1FgeVV05Ogh3SXP9DR8Gu7NwYq5aYrRp3KnbkkdFBw27YnrbXzw7Qx9ykqYac_0MGytm1c5XRmZrwT3EsAbkNAt35_CU5NSEbfq1Xwu1wcdEUTLVVy2YdfmQJlgdrmce2xxthNl3h_vZGHKFKxYAkA0LKNoMSQO8JhreMg4g9qPPJi9M2l2Q3tRu1n127dljaf91vOIjpBnBLQjq6MfR_jP7yJLKHQQ_gvzfLV2h08MyuJbBj4pShf3AyGX_ox5p874iTDqLsluHoKUsnW2QTMMyjoyPwfZZxsbVCeKYd5mRzv88WlpMnq38b7S_3ziyCUH1c7lI7oPGjOYUbMEfbFffMfup1hhLvLUquRmqIFb_mtzIzQeD3ep21ET35ALYH16v0C8DXJrXw5e5EeSrWwlppNeNZf5kiDjJJLgHiJVhnvR_ERHXBVOMh3zToel3Yzotd8BzuwKo_APPYkjIF3UrVR6I5PXh7F6K04tOxeVStav1SinawCuA4yfJ6RiW4a7awitw-qy9tC1_hh2plVQgFKJEvQbvAnohNeU73Z-sFez7rt3eFc9KoqiwqNmxvyRNukaYoIpEl910sEylH9ocVzaH6Q1rCXsfT3bpttuaAp72hSp34bR8KZHDnuduSkUOsyDNlKBrvNTYJibpdBKMk4EEeJGPdn0Pwl4dz6EIaQpOlWJPT6ENM4w8fAIj-gvtVyjwIeDwUqYpSIC0Z1QtizyOZelTIKcCLK4T2oXk5R7kdUPBVtdAOukAqWYNDg7eCwCpbd_SU0nmpZV2OQHa0ffhQpPy3QFi1H6BXG-8VHxwLNODwfFK31EHmUTZHImHi2_Ky74-idV40QAVOgKOBc0Rcb47gboUJEdEjclGd5QWnifSPPwtn3-jEvl4LyXxk22PUcWhCLb5VikI9pizEXxcEYHRoDMim31BD_sdjLFOZt6aJ-lcDvDdeTKKtRuJCOIqBBZkQPbmpm49KNTeqeTn5UlAGl-swHU_nj_IfmHWhNkChFqUOUScqhW0g3yKcEltNMXVpOdomEXAvZqmY2EBA1kMkJXM3ykMJKQSO9fU0T2na6LDsh1ycLjbufcdlmIeI8QxYCRREvST36eGYW76YA0n20-r2WSG7DojXqTFGvARVEZEjYX0QkfdsWkYboh3NwVQyWF9qVeTsGhGqLVrGlRgczHmn8bfWfBaCWV0xvqCAQrwmREg2-T-4IIlZ3_YVHiBMbcMny7gIs8gBzCqCymBNodEBjTsHSbT_7F_bg7B8fyQvL_RcdMc5bLdl9Ti0Yt6q_gf0RvIx28n6qbRMtYRK3KvN3DUnOVDdgLpTjiOAH1cKYy34kbmOJhWxVjTtrSYnIJNZGqRUMCQPeIG35nds-liXZKIuHN55TySfmLnLkr97M0cqsIx5Yy6QeA7LlOA_rwz408gvsbK2ilh6xEBoATFBRfoBq5KZobzcZfnR4MCzBva8dQOdx0hRSuxK7wAxUa71J3cMQIknCFFAoiEP8Na2bzi2mFfUeej6mZ46sRcD3g00rfr4iPauZnqBaz9GUoN52_kpbkQJay8AnMEg6lQPUeOzZUWA6tjKYZfwOlz7SBkJS9kMr_l9FJ26FZPHaMkYzAIrxqNwHEKbBCDiWiLkO-bMdwmJZahqCDidyUDmOK6VTdE1nq9CeenEsXB8fnAKYe__TPMks7IaN_c2khZmDDdHYJsQ_ej6k3-I90HQm_doLGMP93VXt4dPBzOothROTXRe8zQbIvouLJyyzGLrY6STtDq9_q-U8ba2DfxSntLpf3iXxo-dE4FfFivK3jD8YONtTY_NVTvOwy0GLhB65MD2Cld6buNNYpzfpGjh6K-NULmXg3Een4wBWyXSUlgJhfOebRHNU2Uzh31SbO41qezzPk7d0irTW78Ac3BvNMmlNhtOWZARRVNR7aqknck8vWASIoCupWzO0dwsWvPvqXk0wuOQYfbL27FmcG4RM6LWdfiQRoGXLm3kmyMvV3UpeUdUNoGW6jA3ik8Bo8mJA_DBh6mYoEyLFI6RLzbwQNzTC2tvGpXkgofiK6LNh5EMnzeho8dR8Yq1Z8dK_--GiV9d7VfS0mAiOi7FcZuZLU7GMqRJQsekTpqBORMq-Ib-TMm8GCB3QJqUkx9VaKxAQwFXEtlLuGuNXUv99NMydDKXrGnqlSl_XWyKuihxM0VmjlZC5BAzUD5SNCLsRR1TEGOAxF1kwLi7xhGF36I7dHVk6IOBXlsjoBciTyBwq6IBTc&cid=CAQSPADUE5ym0ck_V5maZnbz1Y5q4mvlqywoDN8JIgopc2V8edkBSeQKbeUgR0bApBz-LF8P2mN0pSgzvXt-vhgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.normaculta.com.br%2F&ds=l&xdt=1&iif=1&cor=10339288850308590000&adk=2228999115&idt=112&cac=0&dtd=3

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b793fc4feec6ffb10adc40b1d91965aa1413fa7b0d597c7a1c7b18c8e9705253

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35773
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame D576 106 KB
37 KB 159ms
38ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
Origin: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 11:09:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11964
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 03 Mar 2023 11:09:11 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230227/r20110914/elements/html/ Frame D576 8 KB
3 KB 47ms
47ms Script
text/javascript 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230227/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Bm5tKvIrT9YFToLJc_N4I8ZYNsrjyUyQCxEtTle3U86bOOAu_kZUbka1vFap8Bd9IpTjDgeKEYP0wAd-d05ISfikJ5JA&cry=1&dbm_d=AKAmf-BbfdP_gFDPD33VJ3u7zO6h-F80CDtIKXX_6akzwhbERS_YHZeo-1LAE7Pl9X1nWRXjUc-Ed7FzUOyKnM5H5UO1fLf4G9FXJ-G0ERWYtKtjahBE6nEZgIid_apJQ-BTy1mbstr10LOvjjVxOWbfHkXpkxZN_FEl29ul8-6ELBtAW-yVo150Nba-rn5Q6-rSG8QwT-dJSGsw9MNIpQPUlBhiB7JgdTAHRxG_wahzJQr28ZkQB4tO3xoiu2oJBm_bpn5ysehMZjKxb_8SZVKmAXGn82-envoFKjUQeemZcqDz0SIEbeHJaF9at8ZVHk_tczG5NY2CCbC1MuWP_DYSwm6UGhW1dG5mM6wwmKjssfoEmbQiXA9aKNIGicbPTUEbApkxoyq4n6OW4Hor1daBDS78SRXIz5QCoDHEZY3O0WabWiviF-ASIvq-qotbXsSXdXYryoGed3W4u4liiJjzN7c0gO__QwSDg-7Xig0YDBU2ahpUjMnXBhRVZGd15oVSNSVsjdydXYdkDt_bSiIXqMwSbdR0IjzrkIWAatSV8wXQM-OW4Azkp9tzdwixp6gFlFxJdFsvJkb1mqWqmdXsmyjvyuO8N007sQ5yBJTGZop7TfqIE8xYp0KcybGGKjCeaqfOq8YQ0YwfHsWBUuZdeSdm0cZfi4aYcadZoR0a-lyt0p8s3-B9CJP6eLsTekgCxNPSshwQgOldqGje-8nSWajSVWmXWuBMBJkOFsBFkIMC8gzxjsyLS4QnSZU6FnaFjBOKEc_61P16EKsi53WUG2b_lqTIBF_DVYXOmCQ8sUVggizw09K8dpRl1XN-ZpHLmCghPWkZAQrE-ZChVjauUNSyTeS20O-pdwCHFwF93aFZ6srcWS8OmgpM2IC7kap3zrvsNAZn9JkhpUfA-iCQV6tJNYgLPtJ5RTrU_priWuhfTVYZFVz5iO7k26BK2qIEIwOVkZ1W5cIIUd_jPgoBFyawOi5z4v4_GyA_XJvMsMdQU2GnKJ7cM9LTnlrRWDNWgpZ1mocK6k-JqBhuwOiBiGDoQ2R7PKRCnFrDUnTk8IuBNiqcEr71HFjA0sIu8nR-NIbjLGO3KBtymf8VXvI5Pru6kkCxl4XTTvWRDmdNeqnjC5gxFiVfOxA-nZIfSsvL0k68eb3_dVwUWRsQu1z7D1g-A-A1IL9Urn5JcMplaIpFGHGF9kPvA1FgeVV05Ogh3SXP9DR8Gu7NwYq5aYrRp3KnbkkdFBw27YnrbXzw7Qx9ykqYac_0MGytm1c5XRmZrwT3EsAbkNAt35_CU5NSEbfq1Xwu1wcdEUTLVVy2YdfmQJlgdrmce2xxthNl3h_vZGHKFKxYAkA0LKNoMSQO8JhreMg4g9qPPJi9M2l2Q3tRu1n127dljaf91vOIjpBnBLQjq6MfR_jP7yJLKHQQ_gvzfLV2h08MyuJbBj4pShf3AyGX_ox5p874iTDqLsluHoKUsnW2QTMMyjoyPwfZZxsbVCeKYd5mRzv88WlpMnq38b7S_3ziyCUH1c7lI7oPGjOYUbMEfbFffMfup1hhLvLUquRmqIFb_mtzIzQeD3ep21ET35ALYH16v0C8DXJrXw5e5EeSrWwlppNeNZf5kiDjJJLgHiJVhnvR_ERHXBVOMh3zToel3Yzotd8BzuwKo_APPYkjIF3UrVR6I5PXh7F6K04tOxeVStav1SinawCuA4yfJ6RiW4a7awitw-qy9tC1_hh2plVQgFKJEvQbvAnohNeU73Z-sFez7rt3eFc9KoqiwqNmxvyRNukaYoIpEl910sEylH9ocVzaH6Q1rCXsfT3bpttuaAp72hSp34bR8KZHDnuduSkUOsyDNlKBrvNTYJibpdBKMk4EEeJGPdn0Pwl4dz6EIaQpOlWJPT6ENM4w8fAIj-gvtVyjwIeDwUqYpSIC0Z1QtizyOZelTIKcCLK4T2oXk5R7kdUPBVtdAOukAqWYNDg7eCwCpbd_SU0nmpZV2OQHa0ffhQpPy3QFi1H6BXG-8VHxwLNODwfFK31EHmUTZHImHi2_Ky74-idV40QAVOgKOBc0Rcb47gboUJEdEjclGd5QWnifSPPwtn3-jEvl4LyXxk22PUcWhCLb5VikI9pizEXxcEYHRoDMim31BD_sdjLFOZt6aJ-lcDvDdeTKKtRuJCOIqBBZkQPbmpm49KNTeqeTn5UlAGl-swHU_nj_IfmHWhNkChFqUOUScqhW0g3yKcEltNMXVpOdomEXAvZqmY2EBA1kMkJXM3ykMJKQSO9fU0T2na6LDsh1ycLjbufcdlmIeI8QxYCRREvST36eGYW76YA0n20-r2WSG7DojXqTFGvARVEZEjYX0QkfdsWkYboh3NwVQyWF9qVeTsGhGqLVrGlRgczHmn8bfWfBaCWV0xvqCAQrwmREg2-T-4IIlZ3_YVHiBMbcMny7gIs8gBzCqCymBNodEBjTsHSbT_7F_bg7B8fyQvL_RcdMc5bLdl9Ti0Yt6q_gf0RvIx28n6qbRMtYRK3KvN3DUnOVDdgLpTjiOAH1cKYy34kbmOJhWxVjTtrSYnIJNZGqRUMCQPeIG35nds-liXZKIuHN55TySfmLnLkr97M0cqsIx5Yy6QeA7LlOA_rwz408gvsbK2ilh6xEBoATFBRfoBq5KZobzcZfnR4MCzBva8dQOdx0hRSuxK7wAxUa71J3cMQIknCFFAoiEP8Na2bzi2mFfUeej6mZ46sRcD3g00rfr4iPauZnqBaz9GUoN52_kpbkQJay8AnMEg6lQPUeOzZUWA6tjKYZfwOlz7SBkJS9kMr_l9FJ26FZPHaMkYzAIrxqNwHEKbBCDiWiLkO-bMdwmJZahqCDidyUDmOK6VTdE1nq9CeenEsXB8fnAKYe__TPMks7IaN_c2khZmDDdHYJsQ_ej6k3-I90HQm_doLGMP93VXt4dPBzOothROTXRe8zQbIvouLJyyzGLrY6STtDq9_q-U8ba2DfxSntLpf3iXxo-dE4FfFivK3jD8YONtTY_NVTvOwy0GLhB65MD2Cld6buNNYpzfpGjh6K-NULmXg3Een4wBWyXSUlgJhfOebRHNU2Uzh31SbO41qezzPk7d0irTW78Ac3BvNMmlNhtOWZARRVNR7aqknck8vWASIoCupWzO0dwsWvPvqXk0wuOQYfbL27FmcG4RM6LWdfiQRoGXLm3kmyMvV3UpeUdUNoGW6jA3ik8Bo8mJA_DBh6mYoEyLFI6RLzbwQNzTC2tvGpXkgofiK6LNh5EMnzeho8dR8Yq1Z8dK_--GiV9d7VfS0mAiOi7FcZuZLU7GMqRJQsekTpqBORMq-Ib-TMm8GCB3QJqUkx9VaKxAQwFXEtlLuGuNXUv99NMydDKXrGnqlSl_XWyKuihxM0VmjlZC5BAzUD5SNCLsRR1TEGOAxF1kwLi7xhGF36I7dHVk6IOBXlsjoBciTyBwq6IBTc&cid=CAQSPADUE5ym0ck_V5maZnbz1Y5q4mvlqywoDN8JIgopc2V8edkBSeQKbeUgR0bApBz-LF8P2mN0pSgzvXt-vhgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fwww.normaculta.com.br%2F&ds=l&xdt=1&iif=1&cor=10339288850308590000&adk=2228999115&idt=112&cac=0&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

855e15fcdc7a729b06238328936629eac46e2251d9d3d71a5d65510451f4e7c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:11:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 997
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3023
x-xss-protection: 0
server: cafe
etag: 4221495933888618527
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 16 Mar 2023 14:11:58 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230227/r20110914/ Frame D576 29 KB
11 KB 47ms
47ms Script
text/javascript 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230227/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

555cb911a280dae2e7ab778b5403e27a81533f7b53cfac255d67e175a96c6e86

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:11:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 997
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11134
x-xss-protection: 0
server: cafe
etag: 11889138295710991679
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 16 Mar 2023 14:11:58 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame D576 41 KB
15 KB 35ms
35ms Script
text/javascript 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 13:44:31 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 89044
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 29 Feb 2024 13:44:31 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2973 1 KB
643 B 47ms
47ms Document
text/html 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 997
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 02 Mar 2023 14:11:58 GMT
etag: 48472445140208031
expires: Fri, 03 Mar 2023 14:11:58 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame D576 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3bb0e4f92dae3ccfd096903a2335f5382836eaad725e64e28390c30e094de193

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame D968 22 KB
8 KB 35ms
35ms Document
text/html 2a00:1450:4001:827::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 184751
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 28 Feb 2023 11:09:24 GMT
expires: Wed, 28 Feb 2024 11:09:24 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame 2973
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESELabp1IMKfSa6A-9lgUQAdg&google_cver=1&google_push=Aa02lx9T7WAbVPktpWLrCZ0YhkVn_7vwO3XuopP-AFOyMsIE-yaaWYjVEsQQhR8eF4pcWVDPip7aaCjaKqgxzM9DKxwwFfsZOH0
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MjY1ODY2MTkzNzEyMTUyNzY0Ng==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESELabp1IMKfSa6A-9lgUQAdg&google_cver=1

43 B
398 B

54ms
14ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESELabp1IMKfSa6A-9lgUQAdg&google_cver=1
Requested by: Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESELabp1IMKfSa6A-9lgUQAdg&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 2973 0
103 B 17ms
14ms Image
text/plain 2a02:fa8:8806:16::1370
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESECcDneMntQo5y_TlFsMcGPQ&google_cver=1&google_push=Aa02lx-hXuztXtOE4FUncjsF5k4UHjYtgLiJx1NO4vStblVmQoEehGyqUASMy5YQrPV-QaQMkNt52HGGj0WFZ2EBP-YNqlZHl3oq
Requested by: Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:16::1370 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2973
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEDU5TXVOFgBWvPKKFM3yMb8&google_cver=1&google_push=Aa02lx9b_ge63lBx7ult2rBnMAK9rKeS6LM2E92rC3ybk2ela-cYJ9wqLwvp2MEqz0oFlGJchB4c8B_6OoHvgwpNS3O3...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEDU5TXVOFgBWvPKKFM3yMb8&google_cver=1&google_push=Aa02lx9b_ge63lBx7ult2rBnMAK9rKeS6LM2E92rC3ybk2ela-cYJ9wqLwvp2MEqz0oFlGJchB4c8B_6OoHvgw...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=Aa02lx9b_ge63lBx7ult2rBnMAK9rKeS6LM2E92rC3ybk2ela-cYJ9wqLwvp2MEqz0oFlGJchB4c8B_6OoHvgwpNS3O3GKa6VxI&google_hm=tj8K5AcVTZmIIc_zhOAmTA==

170 B
188 B

48ms
47ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=Aa02lx9b_ge63lBx7ult2rBnMAK9rKeS6LM2E92rC3ybk2ela-cYJ9wqLwvp2MEqz0oFlGJchB4c8B_6OoHvgwpNS3O3GKa6VxI&google_hm=tj8K5AcVTZmIIc_zhOAmTA==

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=Aa02lx9b_ge63lBx7ult2rBnMAK9rKeS6LM2E92rC3ybk2ela-cYJ9wqLwvp2MEqz0oFlGJchB4c8B_6OoHvgwpNS3O3GKa6VxI&google_hm=tj8K5AcVTZmIIc_zhOAmTA==
date: Thu, 02 Mar 2023 14:28:35 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2973
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEJiaySUEgcoRavbcx6MO6rg&google_cver=1&google_push=Aa02lx_uUjNVZO5VdRW89Dwd7aralSEv7Duej7FiSDyS1l-yThBB0-gOwvhTW-BWgvki0wAY2jZBr0ENNIQai-vu...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=Aa02lx_uUjNVZO5VdRW89Dwd7aralSEv7Duej7FiSDyS1l-yThBB0-gOwvhTW-BWgvki0wAY2jZBr0ENNIQai-vuB5E6PQr62RwO

170 B
188 B

48ms
48ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=Aa02lx_uUjNVZO5VdRW89Dwd7aralSEv7Duej7FiSDyS1l-yThBB0-gOwvhTW-BWgvki0wAY2jZBr0ENNIQai-vuB5E6PQr62RwO

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 02 Mar 2023 14:28:35 GMT
via: 1.1 bfa7dfbe8ca6d4eb3690c4c82ca6c0fa.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-C2
x-cache: GeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=Aa02lx_uUjNVZO5VdRW89Dwd7aralSEv7Duej7FiSDyS1l-yThBB0-gOwvhTW-BWgvki0wAY2jZBr0ENNIQai-vuB5E6PQr62RwO
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: oLo7n_JnuwXu7RV-pXlCjwKDv2L_4hEUsoIEgAbzHYFvPFIBQ8Nv5w==

GET
H/1.1 200
OK sync
ssbsync.smartadserver.com/api/ Frame 2973 0
75 B 190ms
17ms Image
text/plain 185.86.138.152
SMARTADSERVER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ssbsync.smartadserver.com/api/sync?callerId=3&google_gid=CAESENqmscuIWtCGQRC90jT3NKk&google_cver=1&google_push=Aa02lx9PspvCuzNNHoBFjDRLbRhOinmWqbKDb22MzieSGQRMfOMq-C-i7ecSsLHZLZfH07tX8q4sg9a6RvMO6eSH4qrqa88w00c
Requested by: Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.86.138.152 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:35 GMT
content-length: 0

GET
H2

200

report
sync.teads.tv/um/ Frame 2973
Redirect Chain

https://sync.teads.tv/um?eid=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESELMWvXvIyzy_1cdeQI7-uPM&...
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=Aa02lx90D_aYnano6OF68w6VSeaDZ9-vbkyiKU8ujhu9sprebg2bGMyHHkS1NVGcAzFD39gtxmn1-7drX74E9LTv7HahAA1-MzHl
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab

23 B
172 B

32ms
32ms

Image
image/gif

104.111.217.42
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by: Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Server: 104.111.217.42 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-42.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.9 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

expires: Thu, 02 Mar 2023 14:28:35 GMT
pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.9
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 260
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2973
Redirect Chain

https://secure.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=${BASE64_UID_ENC}&google_gid=CAESENgn2mvQ3jI3_VRLbQTC_Y4&google_cver=1&google_push=Aa02lx8bsFPXSNwfd...
https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MjMwOTgyMTA2NzIzOTc2NTUzMQ%3D%3D&google_gid=CAESENgn2mvQ3jI3_VRLbQTC_Y4&google_cver=1&google_push=Aa02lx8bsFPXSNwfdirNWoFdw5s-IUgbMO...

170 B
188 B

48ms
47ms

Image
image/png

142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MjMwOTgyMTA2NzIzOTc2NTUzMQ%3D%3D&google_gid=CAESENgn2mvQ3jI3_VRLbQTC_Y4&google_cver=1&google_push=Aa02lx8bsFPXSNwfdirNWoFdw5s-IUgbMOxiDtohykMNxgorlD7Yvk5ZtYcOan4GInCOax8Pt3SWUbCO2ukoqpw576Rnnn1nOEcmiw

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 02 Mar 2023 14:28:35 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 185.213.155.187; 185.213.155.187; 942.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: e507adb4-45d6-4ab8-bd1a-3c17b7e76654
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=xandr_eb&google_hm=MjMwOTgyMTA2NzIzOTc2NTUzMQ%3D%3D&google_gid=CAESENgn2mvQ3jI3_VRLbQTC_Y4&google_cver=1&google_push=Aa02lx8bsFPXSNwfdirNWoFdw5s-IUgbMOxiDtohykMNxgorlD7Yvk5ZtYcOan4GInCOax8Pt3SWUbCO2ukoqpw576Rnnn1nOEcmiw
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 2973 0
12 B 46ms
45ms Image
text/html 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13K8JV83qUAmoe0Qn1pE6rppVdxJuKpxf9srKS9d7PUpxpPcvrH67-y1WKMv2tBgXhc6aDzdJbA

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:35 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 U1KVG_mJ4Y43Q94sC__L5Y27Ilp_TqM8IF3zBLVmW9g.js Show response
pagead2.googlesyndication.com/bg/ Frame D968 36 KB
14 KB 47ms
47ms Script
text/javascript 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/U1KVG_mJ4Y43Q94sC__L5Y27Ilp_TqM8IF3zBLVmW9g.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5352951bf989e18e3743de2c0bffcbe58dbb225a7f4ea33c205df304b5665bd8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 15:53:16 GMT
content-encoding: br
x-content-type-options: nosniff
age: 81319
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14276
x-xss-protection: 0
last-modified: Thu, 23 Feb 2023 13:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 29 Feb 2024 15:53:16 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/11308741736642966965/ Frame BB88 8 KB
3 KB 115ms
38ms Document
text/html 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11308741736642966965/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1e5a5f350ec7929124bd28e7ba9d74b60ed4603a8027a15b39396f91c84e8684

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 362381
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 2845
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Sun, 26 Feb 2023 09:48:54 GMT
expires: Mon, 26 Feb 2024 09:48:54 GMT
last-modified: Thu, 09 Feb 2023 09:18:48 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame D576 0
0 181ms
82ms Fetch
image/gif 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsubNCRva7S_Yas0CbO-M5yPv5V4U8uMNY4qG1JJ6jn-K4-QQSZtY4VHqBk8N0LB1Oe5f21Sno74j22o37HVcTaUcjYw6UYi986XOqQre46tLGuT_rBTHcLnF2KUYMPuxaMjCZb_oUxxmmt1Uygt09DnseGUmIz5m83pxvMipU2LIUUf9DV9PyeTk2ABoiO-qAnby1KdGHai7CUsgCNdOVV2iXKQz44J-7R_tHbG_jidhJsWpdOsY7IE1yMcyFPIcN6CbXxOHESrcQ92trdkOxGAzRn94X0yyeH1iuyUt62g4EfqWExk87ANJJm3ZWzJuPMiGXq_8b3h7MA40FtKGVqF1xteOamfI-NW1kaG62aeLLYYUeX4APbZYJQR1ud9iWFzfOHadaot-P3caw-G3wx9sz28xlpbnCDtIpq9Y0I7ZmctnC4zblV3d_bslSI7FXd_FOZhRzC6Yq7GsOgt_CQdk3FEbGFbVVB3haSHRQqqDDkhhAD6A3kSsOIJu_j1EACxL-J-mrpT-gs-jtGwoM5HtJydgjf2i6wygec4p2eEW1CqAHNT2VaVEQAz9RODq--zoT_1Q03msWq1QgJMFMqYi5a6vCgr30icvbar3-E7nWhbSHEtPcCSNe0MtZ6WWYSTdAJkDsY21znpL1yRGLGfAu2AcB_eW4px7NHrmrqyoPqGGejWK1_bkZHUU-tU8jcGO8WkyAx_fM7x-3FrV8MDoelHpM-etP4jPRNvqwPwxV_PQGRUr560s-gjrkvphQ6qfMr9J76eYDKCihsRz-sqJENQdTmMiPWYVWnB6Az7u5r5tBVh94kAHu5WcmpZcgVTIPdsiLGBejq_S0S6WUM1mUFqAWoyZ8yO0t_L-j21TjdfnxhtbdZ1YX42HHi4mxubGJyrwqTz_6GeMt0Yry0IasGQIAAdgLUuC8sdXgT1wDyCVMXrNbOUOxPSpy-5v4b0ujGG-VlJSowm39XCRqV0VJgibDZIR0by_qTefzcnuhC3itVHs5KkgA-0ZAp7fjb3EjGVF2KrU5Bj-RYPNwuCG7PtK3Pl5wuUVKZJvghJa7LB98LSaUd-mycRf1AkC4oDRbxAuFR8YbXctp1PMex3Bgc9_g1sj9TkWID6t3vXvllqxLue4eraTKds-SxmY4jI-fxF72AFwZRrTwY0kU55wAahjZLZOv4vBdr62F5GVyy3yk3Z4sGOi0xAoAj9Jc3g7N96QVlCiMJ7lrUvWIPXU0JrsVKrPjrQ8zs9l0PjjcicJTR8Kzb6NfA&sai=AMfl-YT3x9BmAq31VD9FALSecNdKBnnUcUUDLDpSa6e0FNJRtx5GRqgv0o6l4tVXeb_9zZnLubqFOB8PSRfKAd_Ipvi_IEZ-xgI4AwyMuAUBOUGP4YNPuIZ1k4vN_F14agMK-Nyk1a-glzcxWZKYFovvydFojQAFvCk9gjRoo24Os_d2o5A62S0a0662fgNBQtnsACb-MiK5Jq8MMKYvLNjO0kvqeqijMCvbF6I5uZmyM9Nz7TZWcXa77oyT2RMW0jVYWoMCB1o&sig=Cg0ArKJSzFG9ieh62XXnEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=227&cbvp=1&cstd=223&cisv=r20230227.81077&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 02 Mar 2023 14:28:35 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 02 Mar 2023 14:28:35 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D968 0
20 B 82ms
82ms Image
image/gif 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BqIvwk7IAZMTvGpLox_APrsmM6AkAAAAAOAHgBAI&bg=!g4ClgNTNAAbK-VRH6vk7ADkAdvg8WtArKJVMigjWLEVluQSgLw-0UlawR7537TdFF5kX-ai7Mri0iG5sb9i-OvOmSxCNdqsEQlgCAAAAbFIAAAACaAEHmQL2sDA_miSmEXLUR07RC36UdQ2KyQb1hIdOPJwPdh8b-q8JJMcMPiFAU39mbb1IdQDFG81lBHXbnBzmo9HG62Cmx_iWcq-M_aiYFqsUCLzpt8DINYcSjk3s-ueG_WXYv96grRDSliv8gqd05Z9uss9i_XSYAPhq_cNbjiTEeRrvTYWzysB3323OWWzktRY7yqHO1z64PlxpTwhKi5gnKEQanNQQ2AwVArKKHt5a3lIiJvymJ2aU8Grxv0qaMb41VZkyMxyOdW6y-gHjxEyrNDmpvpy81nm73RM5dYPHS5DWdGcicc3yIEIa08VOWW_YIomhlXxHjGxs_eYQALdzCgCyYxGjpTc5PVjUSESF6Fu0n5DkY7RCkvg9_HqpDmqTav_u3BPNyc6RtnAlerLzGnaaDRJlUsK-eUYWgKUrcVwfX97u8NjBZhgFQP7rZr1f55hflkq6j5vJovnMQPRlk-GRLNfVwtbSMccvNxsnxkFqTBS2biOEDM21TFB_3A86ZbAVP8lV9T6QL03dPSKspBZvkX5AQBuVA_Cam3IS6GiwjhdoQdPuKsglDYzLmaDAybuCbxOfBrrfwJ0yZNZxmurn-00B__I4lRnHhPIzz9X5c3DunhVzZRcGBXhF3DLyvE5oSUavudquD5yO17Wf36Ycg7UjxEv1Bs6g2KD0-DXqXevoZV8m9NOMc60LYVRqJVkhGKJcqeNudcxRCmSDM2OVWh7etoMj0IMBJDtSrDa21e0YXPLPkugwHkzYxNa_5UA8bU1RidHGftFYMRpAJzfjjEE3uN53VzfAQmaPPSx6ocZYlEKHZQMTAqCJLcN-UEvFji4KLNsehtbTyjwOyDqFNbC6Z3T4oXviLYEnHpsS5cqCXWnIoREJvC_cmwE8lGK5YTSHmGe4DeM3YTyb0dYnMRjaGH0SZUGXgOH2UwenA1UIQGs8HrAdbGqVPML1YWDkySvBCCN8F72jrZ-qSWZ9LnoMuPHBS0-guXLKAPKLC-Ug7hY9TgE

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:35 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 createjs_2019.11.15_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame BB88 236 KB
63 KB 47ms
47ms Script
text/javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/createjs_2019.11.15_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11308741736642966965/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11308741736642966965/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 64275
x-xss-protection: 0
last-modified: Fri, 15 Nov 2019 19:16:20 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 02 Mar 2023 14:28:35 GMT

GET
H3 200 TEF_o2Business_23-01_01-Relaunch-2023_04_traffic_300x600.js Show response
s0.2mdn.net/sadbundle/11308741736642966965/ Frame BB88 14 KB
3 KB 39ms
39ms Script
application/x-javascript 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/11308741736642966965/TEF_o2Business_23-01_01-Relaunch-2023_04_traffic_300x600.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11308741736642966965/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

57ae6de65dc48906164390e330e58ae4db8bf0b49dd9bf35d756ee8e07b82696

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11308741736642966965/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Mon, 27 Feb 2023 05:01:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 293250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3456
x-xss-protection: 0
last-modified: Thu, 09 Feb 2023 09:18:48 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 27 Feb 2024 05:01:05 GMT

GET
H3 200 bg.jpg
s0.2mdn.net/sadbundle/11308741736642966965/ Frame BB88 40 KB
40 KB 40ms
38ms Image
image/jpeg 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11308741736642966965/bg.jpg

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

40c9365e2c340112806b241cc5dc9ac8010ae7f37da360f25178234c2a1391e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11308741736642966965/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Mon, 27 Feb 2023 05:01:05 GMT
x-content-type-options: nosniff
age: 293251
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41142
x-xss-protection: 0
last-modified: Thu, 09 Feb 2023 09:18:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 27 Feb 2024 05:01:05 GMT

GET
H3 200 bubblespritesheettiny.png
s0.2mdn.net/sadbundle/11308741736642966965/ Frame BB88 24 KB
24 KB 50ms
45ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11308741736642966965/bubblespritesheettiny.png

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

54ecfa572990e94acedaa3f98412b668277d09a314d645d0e4be182f3ae5a47c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11308741736642966965/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Sun, 26 Feb 2023 09:48:54 GMT
x-content-type-options: nosniff
age: 362382
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24762
x-xss-protection: 0
last-modified: Thu, 09 Feb 2023 09:18:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Mon, 26 Feb 2024 09:48:54 GMT

GET
H3 200 cta.png
s0.2mdn.net/sadbundle/11308741736642966965/ Frame BB88 2 KB
2 KB 64ms
58ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11308741736642966965/cta.png

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e6fa9ee9b49b33f24469d853dd907a7523a585bf691d7435e926a630d8ee6e73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11308741736642966965/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 05:00:05 GMT
x-content-type-options: nosniff
age: 34111
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2044
x-xss-protection: 0
last-modified: Thu, 09 Feb 2023 09:18:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 01 Mar 2024 05:00:05 GMT

GET
H3 200 hl_01.png
s0.2mdn.net/sadbundle/11308741736642966965/ Frame BB88 7 KB
7 KB 55ms
50ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11308741736642966965/hl_01.png

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0794c90783ffa6d9c0494967141efe8804be2fbaf8e8c11ed373070a83d39ddd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11308741736642966965/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 05:19:41 GMT
x-content-type-options: nosniff
age: 32935
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6896
x-xss-protection: 0
last-modified: Thu, 09 Feb 2023 09:18:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 01 Mar 2024 05:19:41 GMT

GET
H3 200 hl_02.png
s0.2mdn.net/sadbundle/11308741736642966965/ Frame BB88 11 KB
11 KB 59ms
55ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11308741736642966965/hl_02.png

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f9bc17b3690110e44e81df920357159c94e5ece61cbcd6345dbf88158aed428c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11308741736642966965/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Wed, 01 Mar 2023 08:41:06 GMT
x-content-type-options: nosniff
age: 107250
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10862
x-xss-protection: 0
last-modified: Thu, 09 Feb 2023 09:18:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 29 Feb 2024 08:41:06 GMT

GET
H3 200 label.png
s0.2mdn.net/sadbundle/11308741736642966965/ Frame BB88 3 KB
3 KB 56ms
52ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11308741736642966965/label.png

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

268a87a3230dcdb6446dcbc78b3dad03d43d79625aeee098ece1838a1f9d691e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11308741736642966965/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 23 Feb 2023 15:08:25 GMT
x-content-type-options: nosniff
age: 602411
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3395
x-xss-protection: 0
last-modified: Thu, 09 Feb 2023 09:18:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 23 Feb 2024 15:08:25 GMT

GET
H3 200 logo.png
s0.2mdn.net/sadbundle/11308741736642966965/ Frame BB88 5 KB
5 KB 57ms
53ms Image
image/png 2a00:1450:4001:812::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/11308741736642966965/logo.png

Requested by

Host: 07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
URL: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

391c6e20c89b0783f26b58e6df64f9665f29b25284d165639837022d29e6d0dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/11308741736642966965/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Mon, 27 Feb 2023 05:01:05 GMT
x-content-type-options: nosniff
age: 293251
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4831
x-xss-protection: 0
last-modified: Thu, 09 Feb 2023 09:18:48 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 27 Feb 2024 05:01:05 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame D576 0
0 79ms
76ms Fetch
image/gif 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsubNCRva7S_Yas0CbO-M5yPv5V4U8uMNY4qG1JJ6jn-K4-QQSZtY4VHqBk8N0LB1Oe5f21Sno74j22o37HVcTaUcjYw6UYi986XOqQre46tLGuT_rBTHcLnF2KUYMPuxaMjCZb_oUxxmmt1Uygt09DnseGUmIz5m83pxvMipU2LIUUf9DV9PyeTk2ABoiO-qAnby1KdGHai7CUsgCNdOVV2iXKQz44J-7R_tHbG_jidhJsWpdOsY7IE1yMcyFPIcN6CbXxOHESrcQ92trdkOxGAzRn94X0yyeH1iuyUt62g4EfqWExk87ANJJm3ZWzJuPMiGXq_8b3h7MA40FtKGVqF1xteOamfI-NW1kaG62aeLLYYUeX4APbZYJQR1ud9iWFzfOHadaot-P3caw-G3wx9sz28xlpbnCDtIpq9Y0I7ZmctnC4zblV3d_bslSI7FXd_FOZhRzC6Yq7GsOgt_CQdk3FEbGFbVVB3haSHRQqqDDkhhAD6A3kSsOIJu_j1EACxL-J-mrpT-gs-jtGwoM5HtJydgjf2i6wygec4p2eEW1CqAHNT2VaVEQAz9RODq--zoT_1Q03msWq1QgJMFMqYi5a6vCgr30icvbar3-E7nWhbSHEtPcCSNe0MtZ6WWYSTdAJkDsY21znpL1yRGLGfAu2AcB_eW4px7NHrmrqyoPqGGejWK1_bkZHUU-tU8jcGO8WkyAx_fM7x-3FrV8MDoelHpM-etP4jPRNvqwPwxV_PQGRUr560s-gjrkvphQ6qfMr9J76eYDKCihsRz-sqJENQdTmMiPWYVWnB6Az7u5r5tBVh94kAHu5WcmpZcgVTIPdsiLGBejq_S0S6WUM1mUFqAWoyZ8yO0t_L-j21TjdfnxhtbdZ1YX42HHi4mxubGJyrwqTz_6GeMt0Yry0IasGQIAAdgLUuC8sdXgT1wDyCVMXrNbOUOxPSpy-5v4b0ujGG-VlJSowm39XCRqV0VJgibDZIR0by_qTefzcnuhC3itVHs5KkgA-0ZAp7fjb3EjGVF2KrU5Bj-RYPNwuCG7PtK3Pl5wuUVKZJvghJa7LB98LSaUd-mycRf1AkC4oDRbxAuFR8YbXctp1PMex3Bgc9_g1sj9TkWID6t3vXvllqxLue4eraTKds-SxmY4jI-fxF72AFwZRrTwY0kU55wAahjZLZOv4vBdr62F5GVyy3yk3Z4sGOi0xAoAj9Jc3g7N96QVlCiMJ7lrUvWIPXU0JrsVKrPjrQ8zs9l0PjjcicJTR8Kzb6NfA&sai=AMfl-YT3x9BmAq31VD9FALSecNdKBnnUcUUDLDpSa6e0FNJRtx5GRqgv0o6l4tVXeb_9zZnLubqFOB8PSRfKAd_Ipvi_IEZ-xgI4AwyMuAUBOUGP4YNPuIZ1k4vN_F14agMK-Nyk1a-glzcxWZKYFovvydFojQAFvCk9gjRoo24Os_d2o5A62S0a0662fgNBQtnsACb-MiK5Jq8MMKYvLNjO0kvqeqijMCvbF6I5uZmyM9Nz7TZWcXa77oyT2RMW0jVYWoMCB1o&sig=Cg0ArKJSzFG9ieh62XXnEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=480&vt=11&dtpt=253&dett=3&cstd=223&cisv=r20230227.81077&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&arae=0&ftch=1&adurl=

Requested by

Host: www.normaculta.com.br
URL: https://www.normaculta.com.br/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

date: Thu, 02 Mar 2023 14:28:36 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 02 Mar 2023 14:28:36 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4DCB 42 B
64 B 88ms
88ms Fetch
image/gif 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuZqUVPB9RByCg1ut4ZoBf5gv4nJPDDggy23i2GCgVCv3fEKtthIyPyU7Htnqq5gEjIAFZUdGxT4PjZNZe4X2MWmdsx77tNitp2hWWedh3yoLn2YO0Qi6lrcZoSB4EhTjzF3pMvMWpbzIkqfos_pCX4L-d6lnmtX9l-&sai=AMfl-YTCFZxMBJGte08y8AaoJXydNb2pfHYKLjoyI6qb1N1V9rk3l0q8dxBwCizRUkTxUiMfT3q7cJROp6VY3M6-5DXLUJer7RjLZJoPprZWL1GzPtGPDxk_Qgn9viZE&sig=Cg0ArKJSzIzFlir0euiyEAE&cid=CAQSPADUE5ymgca9udiAqQKIadf3pp5L27zpvzWlyEkZx8Zfrg4sZsXuvGrBnb3-AgXwSo5NCuesnc6h3IOZWhgB&id=lidar2&mcvt=1000&p=157,963,407,1263&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230301&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=22&adk=754213437&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=4&r=v&rst=1677767314965&rpt=310&isd=0&lsd=0&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:36 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame D576 0
20 B 79ms
79ms Ping
image/gif 2a00:1450:400d:80a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=5192501137555&version=m202301230201&ct=76&x=1&cor=10339288850308590000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400d:80a::2002 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.177 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Mar 2023 14:28:37 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Domain: ad-server.eu
URL: https://ad-server.eu/wm/pb/native.png

Domain: adservice.google.com
URL: https://adservice.google.com/ddm/fls/z/dc_pre=CISsvqa6vf0CFbnKOwIdw6ULrA;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=8384233870674.873

Domain: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssPNd8IP2d8qCql2vSrVG316gvIKYpBY3OUiYWmYae4rE38WXLf34P2jAdp3Mi6jT8-qrEzKmtaeYOrezpAAgRJZZ2bny6TMTygI-2eiSAy7EvrsS_YcjlL5ZNDbGIOjO17leYJ2g&sai=AMfl-YTWFlRHY6_3iHMxKxI-4viMWZgyVQyYDFK5mXBGyqd8Wi8EM_x3jxuISRE0fBAK0cIS3oGIvZ38u8xmVD0vkweb78aZi8XRGUAHoBVfyb90VSKreTNADzt0VlScTLuagPhQ3T91VLWAOdfo&sig=Cg0ArKJSzPBh_DwHe3CpEAE&cid=CAQSSwDUE5ymuHIv-7LgktZ2daLfOnEztA_uDSjNDPz3tRVtVmTVIS3FLgxSYNQ-KQFedQvkHIVIV0oicbUBHeS4T59YmPTAkbmKZt9FSBgB&id=lidartos&mcvt=0&p=2884,963,3484,1263&mtos=0,0,0,0,0&tos=0,0,0,0,0&v=20230301&bin=7&avms=nio&bs=0,0&mc=0&if=1&app=0&itpl=20&adk=4170589126&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLGZhbHNlLG51bGwsIiIsW10sZmFsc2Vd&vs=3&r=b&rst=1677767313558&rpt=541&isd=0&lsd=0&ec=1&met=mue&wmsd=0&pbe=0&vae=0&spb=0

Verdicts & Comments Add Verdict or Comment

161 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

37 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.normaculta.com.br/	1970-01-20 19:38:47	Name: _ga_0D2VJ191CX Value: GS1.1.1677767313.1.0.1677767313.60.0.0
www.normaculta.com.br/	1970-01-20 10:04:13	Name: _lr_geo_location Value: DE
.normaculta.com.br/	1970-01-20 10:02:50	Name: AMP_TOKEN Value: %24NOT_FOUND
.normaculta.com.br/	1970-01-20 19:38:47	Name: _ga Value: GA1.3.574628834.1677767313
.normaculta.com.br/	1970-01-20 10:04:13	Name: _gid Value: GA1.3.652557325.1677767313
.normaculta.com.br/	1970-01-20 10:02:47	Name: _gat_UA-10605777-55 Value: 1
.normaculta.com.br/	1970-01-20 10:02:47	Name: lotame_domain_check Value: normaculta.com.br
.criteo.com/	1970-01-20 19:24:23	Name: uid Value: 16de25f7-7888-4c84-a13d-716b20502b29
.jivox.com/	1970-01-20 12:12:23	Name: jvxsync Value: txmcFmz8VjnN
.normaculta.com.br/	1970-01-20 19:24:23	Name: __gads Value: ID=ae111f7e377b2eaf:T=1677767313:S=ALNI_MZaUCPqE2ZqMEcDl_8r7tlPpaJmDg
.normaculta.com.br/	1970-01-20 19:24:23	Name: __gpi Value: UID=00000bbd9e765c96:T=1677767313:RT=1677767313:S=ALNI_MZ_dojrHNq95Cq1EpRNo0RZGMDHDg
.doubleclick.net/	1970-01-20 19:24:23	Name: IDE Value: AHWqTUls6jp4bz_EW1pFyuU6M7VjapRIDPRDEYvMOUO1LD_CAt8lkESsV0vaM0kD
.openx.net/	1970-01-20 18:48:23	Name: i Value: b2b2db7e-08db-4981-820f-369e30386936\|1677767313
.normaculta.com.br/	1970-01-20 19:24:23	Name: cto_bundle Value: S3c-0V9PM0djVjhNb2lwaHQlMkZyU29JayUyRjEzU0ViUFBzTUV2UTRhMXNQZ2swRXV5czc5dmFoJTJCaUJkVjlUJTJCMVZnZ0FTNkNFMzlta3lyd1F3bWs1VGxhd3BRODJaUiUyQks4d1UyRk5GREx0Uk45Y1kzcHBaaklZTyUyRm9QUXdFcFU3TU1Zb1dFNXpYelRiQ1Z6ZzJZZ25LTm9laVhyJTJGR2VwJTJGSUlmVzVsaDhmJTJCdXQ4QlZMWjglM0Q
.adnxs.com/	1970-01-20 12:12:23	Name: uuid2 Value: 2309821067239765531
.casalemedia.com/	1970-01-20 18:48:23	Name: CMID Value: ZACykvdTPwzYZBuhxfTOwAAA
.casalemedia.com/	1970-01-20 12:12:23	Name: CMPS Value: 2233
.casalemedia.com/	1970-01-20 12:12:23	Name: CMPRO Value: 2233
.adnxs.com/	1970-01-20 12:12:23	Name: anj Value: dTM7k!M41.D>6NRF']wIg2GVK@=oU.!@wnfH8K6pQK`!5=E<*L5?%K96FBM<5cU/_72lwT6:_V<4.gP4Acba/ZCPhO%nugO%v4VB%nmDJ)s%(c
.redintelligence.net/	1970-01-20 12:12:23	Name: 8lcfmzhxc8d6_uid Value: 0c8c44c90488f250
.retailads.net/	1970-01-20 10:45:59	Name: ppb2172 Value: 2342307533
.futalis.de/	1970-01-20 11:29:11	Name: raSIDb Value: 2342307533
.office-partner.de/	1970-01-20 19:38:47	Name: source Value: {"webgains_webgains":{"timestamp":1677767314845,"clickCookie":false}}
pb.media01.eu/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: ivgf005qouiw3pibxs0whllg
pb.media01.eu/	1970-01-20 19:38:47	Name: DTU Value: 1B4E41149DC305596473EB592D711074
.3lift.com/	1970-01-20 12:12:23	Name: tluid Value: 3318095240191061882410
.adform.net/	1970-01-20 10:47:25	Name: C Value: 1
.adform.net/	1970-01-20 11:29:11	Name: uid Value: 2807927705715979329
.yahoo.com/	1970-01-20 18:48:44	Name: A3 Value: d=AQABBJOyAGQCEKwWrSm0CZ3L5d3FeG0idRcFEgEBAQEEAmQKZAAAAAAA_eMAAA&S=AQAAAoRzRyQuI6E-1AiEeVqAxew
.analytics.yahoo.com/	1970-01-20 18:48:23	Name: IDSYNC Value: 18yl~2aae
.spotxchange.com/	1970-01-20 10:43:06	Name: audience Value: 8416c142-b906-11ed-a34e-16821cb20306
.bidswitch.net/	1970-01-20 18:48:23	Name: tuuid Value: b63f0ae4-0715-4d99-8821-cff384e0264c
.bidswitch.net/	1970-01-20 18:48:23	Name: c Value: 1677767315
.bidswitch.net/	1970-01-20 18:48:23	Name: tuuid_lu Value: 1677767315
.bidswitch.net/	1970-01-20 10:02:47	Name: google_push Value: Aa02lx9b_ge63lBx7ult2rBnMAK9rKeS6LM2E92rC3ybk2ela-cYJ9wqLwvp2MEqz0oFlGJchB4c8B_6OoHvgwpNS3O3GKa6VxI
.turn.com/	1970-01-20 14:21:59	Name: uid Value: 2658661937121527646
.tribalfusion.com/	1970-01-20 12:12:23	Name: ANON_ID Value: asnseFxZduB6RApTrruFfhgunM0FtRJa6Qov8nZbMar5hImsn312sWHCRoCUewp31CgqMUkr2VHU5hrGhXhkZcZc

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://www.normaculta.com.br/(Line 12) Message: <link rel=preload> must have a valid `as` value

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

07cf6de9d560b614d3b34488e684f678.safeframe.googlesyndication.com
5994599.fls.doubleclick.net
7gra.us
a.tribalfusion.com
aax-dtb-cf.amazon-adsystem.com
ad-server.eu
ad.turn.com
adservice.google.com
adservice.google.de
adv.office-partner.de
ampcid.google.com
ampcid.google.de
analytics.webgains.io
as.euw1.jivox.com
assets.euw1.jivox.com
ats.rlcdn.com
bcp.crwdcntrl.net
c.amazon-adsystem.com
c1.adform.net
cdn.euw1.jivox.com
cdn.id5-sync.com
cdn.jsdelivr.net
cdn.prod.uidapi.com
cdn.retailads.net
cdn.track.production.webgains.team
cm.g.doubleclick.net
code.createjs.com
dclk-match.dotomi.com
dsum-sec.casalemedia.com
eb2.3lift.com
esp.rtbhouse.com
eu.7gra.us
evs.euw1.jivox.com
fonts.googleapis.com
fonts.gstatic.com
futalis.de
geo.privacymanager.io
google-bidout-d.openx.net
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
gum.criteo.com
hal9000.redintelligence.net
hal900029.redintelligence.net
ib.adnxs.com
id5-sync.com
invstatic101.creativecdn.com
lb.eu-1-id5-sync.com
match.adsrvr.org
mug.criteo.com
normaculta.com.br
oa.openxcdn.net
oajs.openx.net
pagead2.googlesyndication.com
pb.media01.eu
playercdn.jivox.com
prod.us-east-1.cxm-bcn.publisher-services.amazon.dev
pv.medialead.de
r.turn.com
region1.analytics.google.com
rtb.openx.net
s.ad.smaato.net
s.tribalfusion.com
s0.2mdn.net
secure.adnxs.com
secure.cdn.fastclick.net
securepubads.g.doubleclick.net
ssbsync.smartadserver.com
ssum-sec.casalemedia.com
static.criteo.net
static.normaculta.com.br
stats.g.doubleclick.net
sync.search.spotxchange.com
sync.teads.tv
tags.crwdcntrl.net
tpc.googlesyndication.com
track.webgains.com
unpkg.com
ups.analytics.yahoo.com
us-u.openx.net
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.normaculta.com.br
x.bidswitch.net
ad-server.eu
adservice.google.com
pagead2.googlesyndication.com
www.googletagservices.com
104.111.217.42
104.86.47.65
108.138.4.10
108.138.4.150
108.138.5.230
13.225.78.118
13.225.78.128
13.248.245.213
13.32.110.123
13.32.99.43
138.201.63.164
141.95.33.111
142.250.184.230
142.250.185.162
142.250.185.66
143.204.89.24
145.239.193.130
146.19.95.66
158.69.248.161
162.19.138.82
167.114.90.133
178.250.0.157
18.169.231.46
18.66.15.100
185.80.39.216
185.86.138.152
185.89.210.212
185.89.210.244
185.94.180.126
2001:4860:4802:32::36
2001:4860:4802:34::178
2001:678:cb4:bbbb::11
2600:9000:211e:b800:1b:5138:8a40:93a1
2600:9000:2250:f600:a:e047:752:b361
2606:4700:10::6816:3456
2606:4700::6810:5914
2606:4700::6810:7aaf
2606:4700::6812:19ad
2a00:1450:4001:806::2002
2a00:1450:4001:80e::2002
2a00:1450:4001:80f::2003
2a00:1450:4001:810::200e
2a00:1450:4001:812::2006
2a00:1450:4001:827::2001
2a00:1450:4001:827::2004
2a00:1450:4001:828::200a
2a00:1450:4001:829::2002
2a00:1450:4001:831::2002
2a00:1450:400c:c06::9a
2a00:1450:400d:805::2003
2a00:1450:400d:80a::2002
2a00:1450:400d:80c::2001
2a00:1450:400d:80c::2002
2a00:1450:400d:80c::2008
2a00:1450:400d:80d::200e
2a01:4f8:d0a:2321::2
2a02:2638:3::3
2a02:2638:3::c
2a02:26f0:3500:11::215:14cb
2a02:fa8:8806:16::1370
2a0b:4d07:401::1
3.124.88.238
3.33.220.150
3.75.62.37
34.102.146.192
34.120.107.143
34.250.199.12
34.96.70.87
34.98.64.218
35.190.39.111
35.227.252.103
37.157.5.142
49.12.22.42
52.17.150.184
52.20.67.201
54.72.237.23
88.198.250.30
88.99.219.174
99.86.4.17
04e8409a13fe19247cf7c55cda100bb4097f3fe49e326a04302a30ba4ccb0333
05e77dab19940dd457e00282837faecc886434cc8cc5f631575a5e6c386de774
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
0794c90783ffa6d9c0494967141efe8804be2fbaf8e8c11ed373070a83d39ddd
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
106fd3bc4b54a13bc9f2200fd4a940cc41e92ec0b1d188c078a7497cf94d8806
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
16b432ac8f43a6b2d8aa358f41ee60e2ef5923b2645bf2c37f3a06f8334b1557
1e5a5f350ec7929124bd28e7ba9d74b60ed4603a8027a15b39396f91c84e8684
22ed2553e089d92f4f8b247db2a514102f1a26692795cb87bca7ddfb882ed33c
232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98
23bc1d893ce2d2f30b68e549aa3cb991c2a7b7dd87e3df67d9fbb6a8dd113bf8
268a87a3230dcdb6446dcbc78b3dad03d43d79625aeee098ece1838a1f9d691e
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
367f4b8863eaa327e490017b3eb82175be95cf35bde4fa19d670f9707d4dda2e
37ab5c060ae53ccda75b8bd212d874a17650f7954b11c4e31f568990ab40196b
384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7
38935741f6939baa18b56370cf3e8a1b20e1e52439ded7d8dd4c5e39a5ca2672
391c6e20c89b0783f26b58e6df64f9665f29b25284d165639837022d29e6d0dc
3b4dcce6674aac1bcea6aaae2155b49630758b1663aaa9d38fdcca58cb55ba4a
3bb0e4f92dae3ccfd096903a2335f5382836eaad725e64e28390c30e094de193
3c5ae596988bc5f95f8a3b7f05c6ecf6336c81b7ba42827c7dcb70ae2dacb77e
40c9365e2c340112806b241cc5dc9ac8010ae7f37da360f25178234c2a1391e6
43f804d38a294c6df1ce8ee64fb95ad0ff5a8d6d5685d9537df02212668a1dff
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
46d1791d45e9e6840842ef90f192c2c6f1f4247baa7c1f32f2da75d3a05c0de2
48176b4cd9b6f90432e35af08c479c9ab95ad0d159408e55948c9e25f37bc57e
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4ea737ac05e8ee5e490220d97b820834c18cd7c6f1da7d85007a51a5c64425df
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
507660766f513506aae405cb573ef35733f3af0c57744e6263c722f434fd02ca
5352951bf989e18e3743de2c0bffcbe58dbb225a7f4ea33c205df304b5665bd8
544c55ca9f05d425f3beb90f287308d7a408b1f60d17728eff5c605a494bc1b9
54ecfa572990e94acedaa3f98412b668277d09a314d645d0e4be182f3ae5a47c
555cb911a280dae2e7ab778b5403e27a81533f7b53cfac255d67e175a96c6e86
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
56fbe1e9450b6913ffcbc41b5c3c86c6ee69b179f93db5bacdfc738f5e45f433
57ae6de65dc48906164390e330e58ae4db8bf0b49dd9bf35d756ee8e07b82696
582e283baa4cce4006055beb2eb8fe257c1ec5ef573a40f173b880636089e8cd
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5ae0a7e2181324bc3ed556098999fa578b6f2366515f40ae8fed1470016c03d6
5b1546ae8f493de03b1ca99f9f955a20785679be18625354b363f2f8311f421b
5c78aed223c405387b6c0a2fa82d37767245c0c312bba1004a80052a0e80eb39
605b14697226eeb0be6b2c11db8206b70f4c8681c3f921e4ceca4793ce1a95ce
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
624192f38816b2c0cf3a0598c9e7c8ed5fd58b8615923a0684cd251590439816
678b3cae19452e95842bebedd844ab5491a4fe873ba5b3e5bca522cc4e45c3fd
6b3c5cf30cf066f9f275b3b4bf5d424a4542ea94a27754fd5a147705b63387e5
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6bfdd85aebca39401548d957a4864ccc151f82f693d28cc0134a8d2b3bd26378
71fc1599035adc6bc34df2117b8631285905f97737ba730af28644ee6a0d8dde
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
78ecfb0f50f7c8d4ed3cdb4c0d2dec199d3819a68f6fe089a1b852ce8058bae5
81add3742c54a791043675d23ad01902a6a01ff315be71619232284ef0a45278
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
855e15fcdc7a729b06238328936629eac46e2251d9d3d71a5d65510451f4e7c1
864e9021d1e3a740cd4eeeb54780f760d700fd7872aef0dd86dc0ee89304bccf
8cf3379d6a84a090f526563d51857481e15f489f751f744d8bfed76ec6189719
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8f9d5fc23afcdea9f10879170e361a914b5c9f60aea4f988c87ffc6c14d25c71
94e0db1d92e7f7bca01cc07a16abb8c2e9bf762e9742100be5103daa4603539c
97d67f8c2575e19d30ae28a32bad7610849e0e56c81ca66e51178124a5c5eed2
983fca2440516aa2e81dfbbfd3c5b86b3dc61fb2418ecc5722a187c844a9358b
991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9c658e100e7c9318e87faf238e3244996feef4ef46852ab83951f573a62458d9
9d8e1d2eec113e3ac567f140791f2e1edfdecd337d6f1c2d1b88e6cf02fbfa45
9dd295f1b8047318855e74e81dbeb02d463452670f2997dd64764a6ad88f3884
9fac063a7ee926d334e43ef8b68a43064d60cd49ee7c48200a8732624ab44f88
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a333febc7175daba5bcc74ef22756fbb160b1e6b71dd2ab004e44452a7864fcf
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5230196df9a4e9f6382c504668862efc8e25c1ec093c7dc997fbedb4b3ec54e
a547e30016e39719bcadef4902ffc69cf2fd4afdffca78bf34a3f5e712da0471
a63f6ee7811c95c619d7c10da51d3cfcfd5cf3ae067428df7f49f63ea3e3c99e
a6c19d8875246d4def23e273e3c6d2887aeba815c80128b91c8b86dc35e38e25
a7166e62648587b6b8175e203f08c67db89012ba802d413fc478dbac0b03f9a8
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b27feaf47307fa976572b4971c5813b756fc309036e40ed77aa4f4ae27aee3f4
b793fc4feec6ffb10adc40b1d91965aa1413fa7b0d597c7a1c7b18c8e9705253
b94a4f26290c155bf28e1fe9625e2c89a86b2b8294499e527d731f5c5579c558
bc12347103da4da2ac30f8b4defd567679284e0bad691a54fad78ad804fc9c27
c124c88ca4fcb4336e97617647ef0d32441329371120c8eabaea0fea226560b0
c1b270636454553dee6d0b5f117a8d4fa16d93ffbe98e38cae9452cef394b735
c2dc5f2387711224548e2799ac64bd3c3fb1c8ea66dce66a8a567f679e747e8e
c45a84e5e0ff6ed83afd426788be38a5cbc442dc6cce4631bfd5c22fdd1fc8df
c6265a847e8ef645ae49eefb6efdd0659672dd17c55167c74bb067750daa399f
c7fc8dae04703101d705fac5268f8900d96149d6b2d3fdd6c1fac249ed16cf1b
ca199d670e9700f62005dda1da358a1aa8a4f1ad39f1f28e3eb4f18de8e2b26f
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ce4224272da97f558fcead92a3165258758489a8807aa1f5e9a617c6055cbbc1
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
d3ee25f194ba40c1f0c7e98ab4103f6e526425d69fe1b95326b374bbec6b34a6
d9467d95786b03f066eef98f39be104de6c31d9eb4983f80e4a7ca730017534c
da91c22ef0e3ffa33eeaaf1c8e02e6cea1bcb2e5b528d241f124cb8f9692a2ef
dae29a286c727823c9cf97e26297b00095f7f10bcfecf1706a1d6182975e5b54
dec599a97ecda7d038ddf6f30ce746b99d37ac148799e453d9948fd8281922cc
dfa1ecdb69b9ee93e87159bfcd4ad2b1248a7de0d6346fd42e0b600723ae7b6b
e257df7266563e157bb7df93fd09c6d13afb1c9554468b21c7378e09a94d3250
e38423b55ffa87c8d9803d8c50f28bbb28086658b6ca3973d9849bcbd29fe45e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73
e439bebf8de2df0582273906d2c1dceff2387c661efb2152ef1c28420ce4e7e5
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e6fa9ee9b49b33f24469d853dd907a7523a585bf691d7435e926a630d8ee6e73
e796bbf820b6c82c648fc30c1ef0936de768c4236715b40c938faa67175f8eb5
e85be7479b3bc59f663e96f1c2023088136b177312f07a58f2e3d8e8f6eb0803
ea0efdafd9030543e048a32e3dd9991fa78066196248811a19e4f1e3301688a9
eb46dbd7570018a67837c6a7394b64096c629071dd4806ba6fc98aae57417761
ecd33326e6c852c157131a8b2a4ee4ec3431368299cedeefe9858905d4fcc52c
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efdb9edb7b7ab84fc09edc039ee9627e26fb3a1e284d8412695d7116ff013655
f031d0330fa0902ad02a7158a8b4aa01cefacc0f4743ab7b78f4ed517723d130
f284353a7cc4d97f6fe20a5155131bd43587a0f1c98a56eeaf52cff72910f47d
f50e59fa7a264b1674e5f94591375a26e9aea318036b2a629e5ba182df01b54f
f53b2103abffed07c86a43ad48a3a064677134cc7b52c0bdf9ff4f3b20d14656
f6c84a15873bbae73ff06857139327b85a6869fa0e21d36666aa2bb5d9bbb19b
f828f9aa145926e786a54b994e2ddeb13175a1acb3060e72a826920f60ebcce1
f933d95c0e31a6f637a994c9d1190c55a62758799419dc3a464f06696017a720
f9bc17b3690110e44e81df920357159c94e5ece61cbcd6345dbf88158aed428c
fa85a4366200f608a99ecf4b1b933babdd9c5662cbe5d518b3daa57e53dbd85b
faed2d77bd3a93640d5a252972fdd969c711af44be66a41ccc76f85d5d6b35f2
fcab803c6d01082f69e5510655ca566241f3a4fd3ee7aa1506b1308e2d069ccb

www.normaculta.com.br Open in urlscan Pro 146.19.95.66 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

217 Requests

88 %HTTPS

41 %IPv6

55 Domains

87 Subdomains

73 IPs

12 Countries

2981 kBTransfer

6095 kBSize

37 Cookies

1 Outgoing links

Page URL History

Redirected requests

217 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.normaculta.com.br Open in urlscan Pro
146.19.95.66 Public Scan

Screenshot
Live screenshot

Full Image

217
Requests

88 %
HTTPS

41 %
IPv6

55
Domains

87
Subdomains

73
IPs

12
Countries

2981 kB
Transfer

6095 kB
Size

37
Cookies

217 HTTP transactions
5 data transactions