www.educationmoney.com Open in urlscan Pro
2600:3c03::f03c:92ff:fe05:debc Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://www.educationmoney.com/
Effective URL:
https://www.educationmoney.com/
Submission Tags: falconsandbox
Submission: On May 25 via api (May 25th 2022, 7:25:26 pm UTC) from US — Scanned from DE

Summary HTTP 150 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 31 IPs in 6 countries across 25 domains to perform 150 HTTP transactions. The main IP is 2600:3c03::f03c:92ff:fe05:debc, located in Cedar Knolls, United States and belongs to LINODE-AP Linode, LLC, US. The main domain is www.educationmoney.com.
TLS certificate: Issued by R3 on April 10th 2022. Valid for: 3 months.

This is the only time www.educationmoney.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 55	2600:3c03::f0... 2600:3c03::f03c:92ff:fe05:debc	63949 (LINODE-AP...) (LINODE-AP Linode)
1 20	2a00:1450:400... 2a00:1450:4001:810::2002	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
9	2a00:1450:400... 2a00:1450:4001:813::200e	15169 (GOOGLE) (GOOGLE)
2	104.20.228.67 104.20.228.67	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80e::2006	15169 (GOOGLE) (GOOGLE)
1	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:813::2002	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:829::200a	15169 (GOOGLE) (GOOGLE)
1 4	2a00:1450:400... 2a00:1450:4001:811::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:803::2001	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:803::2016	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
1	2a02:2638::2 2a02:2638::2	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2a02:2638::b 2a02:2638::b	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
10	2a00:1450:400... 2a00:1450:4001:828::2001	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
7	2a02:2638:1::3 2a02:2638:1::3	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2600:9000:206... 2600:9000:206f:fe00:1e:a43d:b640:93a1	16509 (AMAZON-02) (AMAZON-02)
1	178.250.0.160 178.250.0.160	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
8	178.250.2.135 178.250.2.135	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
2	178.250.2.150 178.250.2.150	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1	2a00:1450:400... 2a00:1450:4001:828::200a	15169 (GOOGLE) (GOOGLE)
1	2620:116:800d... 2620:116:800d:21:c5a4:625:6563:a5bb	16509 (AMAZON-02) (AMAZON-02)
2 2	69.192.160.219 69.192.160.219	16625 (AKAMAI-AS) (AKAMAI-AS)
5	142.250.184.194 142.250.184.194	15169 (GOOGLE) (GOOGLE)
1	35.186.253.211 35.186.253.211	15169 (GOOGLE) (GOOGLE)
2 2	192.82.242.209 192.82.242.209	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 1	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
2 2	2.20.157.55 2.20.157.55	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a05:d01c:1d8... 2a05:d01c:1d8:8100:a0fe:f5a6:9720:1a18	16509 (AMAZON-02) (AMAZON-02)
150	31

55 2600:3c03::f03c:92ff:fe05:debc (Cedar Knolls, United States) 1 redirects

ASN63949 (LINODE-AP Linode, LLC, US)

www.educationmoney.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a00:1450:4001:810::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:813::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.20.228.67 (None, )

ASN13335 (CLOUDFLARENET, US)

secure.statcounter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.statcounter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2006 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

static.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

partner.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

jnn-pa.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:811::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

yt3.ggpht.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2016 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

i.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638::2 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

rtb.fr.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:2638::b (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

ads.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:828::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a02:2638:1::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:206f:fe00:1e:a43d:b640:93a1 (United States)

ASN16509 (AMAZON-02, US)

secure-gl.imrworldwide.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.0.160 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

cat.fr.eu.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 178.250.2.135 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
PTR: pix.am5.vip.prod.criteo.com

pix.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.250.2.150 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

csm.eu.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:828::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:116:800d:21:c5a4:625:6563:a5bb (United States)

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 69.192.160.219 (Frankfurt am Main, Germany) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a69-192-160-219.deploy.static.akamaitechnologies.com

e.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.250.184.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.253.211 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 211.253.186.35.bc.googleusercontent.com

rtb.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.82.242.209 (United States) 2 redirects

ASN62713 (AS-PUBMATIC, US)

image6.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.165 (Frankfurt am Main, Germany) 1 redirects

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.20.157.55 (Milan, Italy) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-20-157-55.deploy.static.akamaitechnologies.com

ssum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d01c:1d8:8100:a0fe:f5a6:9720:1a18 (London, United Kingdom)

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
55	educationmoney.com 1 redirects www.educationmoney.com	250 KB
19	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 90 tpc.googlesyndication.com — Cisco Umbrella Rank: 136	286 KB
17	criteo.net static.criteo.net — Cisco Umbrella Rank: 578 pix.eu.criteo.net — Cisco Umbrella Rank: 7369 csm.eu.criteo.net — Cisco Umbrella Rank: 7618	30 KB
16	doubleclick.net 1 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 40 static.doubleclick.net — Cisco Umbrella Rank: 338 cm.g.doubleclick.net — Cisco Umbrella Rank: 191	49 KB
9	youtube.com www.youtube.com — Cisco Umbrella Rank: 91	738 KB
7	gstatic.com fonts.gstatic.com www.gstatic.com	80 KB
6	google.com 1 redirects adservice.google.com — Cisco Umbrella Rank: 70 www.google.com — Cisco Umbrella Rank: 2	15 KB
5	googleapis.com jnn-pa.googleapis.com — Cisco Umbrella Rank: 275 fonts.googleapis.com — Cisco Umbrella Rank: 42	30 KB
3	criteo.com rtb.fr.eu.criteo.com — Cisco Umbrella Rank: 13804 ads.eu.criteo.com — Cisco Umbrella Rank: 7606 cat.fr.eu.criteo.com — Cisco Umbrella Rank: 9295	55 KB
2	casalemedia.com 2 redirects ssum-sec.casalemedia.com — Cisco Umbrella Rank: 494	2 KB
2	pubmatic.com 2 redirects image6.pubmatic.com — Cisco Umbrella Rank: 564	1 KB
2	addthis.com 2 redirects e.dlx.addthis.com — Cisco Umbrella Rank: 1735	1 KB
2	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 163	84 KB
2	google.de adservice.google.de — Cisco Umbrella Rank: 8526	914 B
2	statcounter.com secure.statcounter.com — Cisco Umbrella Rank: 14563 c.statcounter.com — Cisco Umbrella Rank: 7856	15 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 144	84 KB
1	innovid.com ag.innovid.com — Cisco Umbrella Rank: 1375	297 B
1	rubiconproject.com 1 redirects pixel.rubiconproject.com — Cisco Umbrella Rank: 306	456 B
1	openx.net rtb.openx.net — Cisco Umbrella Rank: 1376	351 B
1	quantserve.com cms.quantserve.com — Cisco Umbrella Rank: 936	463 B
1	imrworldwide.com secure-gl.imrworldwide.com — Cisco Umbrella Rank: 1303	690 B
1	ytimg.com i.ytimg.com — Cisco Umbrella Rank: 111	2 KB
1	ggpht.com yt3.ggpht.com — Cisco Umbrella Rank: 213	3 KB
1	googleadservices.com partner.googleadservices.com — Cisco Umbrella Rank: 768	649 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 97	3 KB
150	25

	Domain	Requested by
55	www.educationmoney.com	1 redirects www.educationmoney.com
10	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
10	googleads.g.doubleclick.net	1 redirects pagead2.googlesyndication.com www.youtube.com www.educationmoney.com googleads.g.doubleclick.net
9	www.youtube.com	www.educationmoney.com www.youtube.com
9	pagead2.googlesyndication.com	www.educationmoney.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
8	pix.eu.criteo.net	ads.eu.criteo.com
7	static.criteo.net	ads.eu.criteo.com
5	cm.g.doubleclick.net	googleads.g.doubleclick.net
5	www.gstatic.com	www.youtube.com www.gstatic.com googleads.g.doubleclick.net
4	www.google.com	1 redirects www.youtube.com googleads.g.doubleclick.net tpc.googlesyndication.com
4	jnn-pa.googleapis.com	www.youtube.com
2	ssum-sec.casalemedia.com	2 redirects
2	image6.pubmatic.com	2 redirects
2	e.dlx.addthis.com	2 redirects
2	csm.eu.criteo.net	ads.eu.criteo.com
2	www.googletagservices.com	googleads.g.doubleclick.net
2	adservice.google.com	pagead2.googlesyndication.com
2	adservice.google.de	pagead2.googlesyndication.com
2	fonts.gstatic.com	www.youtube.com fonts.googleapis.com
2	connect.facebook.net	www.educationmoney.com connect.facebook.net
1	ag.innovid.com	googleads.g.doubleclick.net
1	pixel.rubiconproject.com	1 redirects
1	rtb.openx.net	googleads.g.doubleclick.net
1	cms.quantserve.com	googleads.g.doubleclick.net
1	fonts.googleapis.com	googleads.g.doubleclick.net
1	cat.fr.eu.criteo.com	ads.eu.criteo.com
1	secure-gl.imrworldwide.com	ads.eu.criteo.com
1	ads.eu.criteo.com	googleads.g.doubleclick.net
1	rtb.fr.eu.criteo.com	www.educationmoney.com
1	i.ytimg.com	www.youtube.com
1	yt3.ggpht.com	www.youtube.com
1	partner.googleadservices.com	pagead2.googlesyndication.com
1	static.doubleclick.net	www.youtube.com
1	www.facebook.com	connect.facebook.net
1	c.statcounter.com	secure.statcounter.com
1	secure.statcounter.com	www.educationmoney.com
150	36

This site contains links to these domains. Also see Links.

Domain
www.fafsa.ed.gov
alcorehab.org
collegescorecard.ed.gov

Subject Issuer	Validity	Valid
www.educationmoney.com R3	`2022-04-10` - `2022-07-09`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-03-04` - `2022-06-02`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
us-dallas.statcounter.com Sectigo RSA Domain Validation Secure Server CA	`2021-11-06` - `2022-12-06`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.googleusercontent.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
edgestatic.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.fr.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-05-18` - `2022-08-13`	3 months	crt.sh
*.eu.criteo.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-19` - `2022-06-18`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2022-05-04` - `2022-07-27`	3 months	crt.sh
*.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-04-11` - `2022-07-13`	3 months	crt.sh
*.imrworldwide.com DigiCert TLS RSA SHA256 2020 CA1	`2022-01-04` - `2023-02-03`	a year	crt.sh
*.eu.criteo.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-04-10` - `2022-07-04`	3 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-22` - `2022-09-21`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
*.innovid.com RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1	`2022-03-15` - `2023-04-15`	a year	crt.sh

This page contains 12 frames:

Primary Page: https://www.educationmoney.com/
Frame ID: 8C4215574A5058B6BEB601CF9C4F1744
Requests: 69 HTTP requests in this frame

Frame: https://www.youtube.com/embed/U45lizyqIic
Frame ID: A3FCC583848B774A77CBD1E3A59E8A20
Requests: 20 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df32f1f82400be8%26domain%3Dwww.educationmoney.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.educationmoney.com%252Ff1464cdf47451a8%26relation%3Dparent.parent&container_width=462&href=https%3A%2F%2Fwww.educationmoney.com%2F&locale=en_US&sdk=joey&send=false&show_faces=false&width=450
Frame ID: 59CEEF0E635B52687F7285A71A9936C7
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20190131/zrt_lookup.html
Frame ID: 0E85099EFDB1A61BB945557865740949
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8258884324894592&output=html&adk=1812271804&adf=3025194257&lmt=1613484948&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1048576%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.educationmoney.com%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653506721454&bpp=3&bdt=273&idt=188&shv=r20220523&mjsv=m202205190101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8708985192171&frm=20&pv=2&ga_vid=357035125.1653506722&ga_sid=1653506722&ga_hid=938181054&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44763505&oid=2&pvsid=12748678052473&pem=482&tmod=451745296&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=204
Frame ID: 51DC9119FC5DB210F5DF180E78136609
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8258884324894592&output=html&h=280&adk=165795807&adf=2670469432&pi=t.aa~a.2653543905~i.48~rp.4&w=464&fwrn=4&fwrnh=100&lmt=1613484948&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1352714303&psa=0&ad_type=text_image&format=464x280&url=https%3A%2F%2Fwww.educationmoney.com%2F&fwr=0&pra=3&rh=116&rw=464&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653506722048&bpp=3&bdt=867&idt=4&shv=r20220523&mjsv=m202205190101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D536cd7643b953d41-220186ee9ccd0048%3AT%3D1653506721%3ART%3D1653506721%3AS%3DALNI_MYV85VBjifRcZC15pkUYEAu36FWXg&prev_fmts=0x0&nras=2&correlator=8708985192171&frm=20&pv=1&ga_vid=357035125.1653506722&ga_sid=1653506722&ga_hid=938181054&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=571&ady=1434&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44763505&oid=2&pvsid=12748678052473&pem=482&tmod=451745296&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=sQMeTpJVus&p=https%3A//www.educationmoney.com&dtd=13
Frame ID: 09123FB4B70840D010A4797A10AC1EB9
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1
Frame ID: 5BD08C85A9965C462974289DAB248647
Requests: 8 HTTP requests in this frame

Frame: https://ads.eu.criteo.com/delivery/r/afr.php?z=Yo6CoQAKeW8H_YWkAAywbL8FiDrsUICGdWwf8Q&u=%7CgEf3kSjTfA4LZCDhY0OwlnxNSvTlESbyyf8xbJnflCc%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC862NRkYVe1lShsTMfENGp8o7-1QPzIesGukueJmXMZQnDJhAeRZlmbJKsZndfQB7R-6LIklqclvVfF7SKlQ6gxrUI8MflWUC4krGdKgBpu_5gmuBgdu1q8u4FIRwBFZNSkinol13CatFPV_zheaa1vVjgOVIkcqnT9HzBedfMCVNAUVNvtaOWL6e3e_jLOOpdXLYLK9qfgg8jD_04oLP7UbXfpxVVotK5ben8WyPExn5FPRmvU3O_wAwbPj11TF4Dz2CCm4qDMNudvQ-smbapu_2APVm53FJvK-dkTfQKsEayriZ1_6-6BMAYsk-J3-eZ5gZ1Ax9lVrSTcix7CnyoxLt3ijmOVYNZRP-__macsWGrCJU3CJtxYWDNqMyCgBWLBOr6BAZAG61s148d-iHQhthKpyIXV9bEpw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCiSN6oYKOYu_yKaSL9u8P7OCyOMme0rFc1Z2R93DAjbcBEAEgAGCV0qGCsAeCARdjYS1wdWItODI1ODg4NDMyNDg5NDU5MqAB1bbS6gPIAQmpAmhDbbxq4LE-qAMBqgTLAU_Q4Ymmbc3f6PcQqtsUcqrMU5UCeTHE5K12gm5lcs25UhYiEePEONgdIfpjA_u-QODEtVt82tQ--X_bvdLbTaY1dXlq4_x_mhurzXo0hIlX8pvevQUSJvn_D6IwZw3bI-df3hPgv11_1ykbkXf0aTqWwYKh6b59Bhc4a9G6nEVaj3F5TV-5UghhusY8_J7tNKIl4SVtRSDs03iXvRn9riDORQb1z34A6kCXQB3lTp7ggK7VoSSAkDhhfWE2H2_YHqQy-GCcRllrVRtHgAbUoIrLpJuoo2ygBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3kuTsaQm6t7Kz6DXYAqAe6NT7nIQ%26client%3Dca-pub-8258884324894592%26adurl%3D
Frame ID: 1226F300413BA81BEB5A6FE806CA6C02
Requests: 20 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 5397B9C476F6F8E5CE740D2E1BDAFDD1
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: E44865DF486BD44BB56C574188654C33
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 85C50FD85E90A5A1B31A727761F9C36A
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: BD18BE230F0758C68E8120DCBF1499A3
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

An Insider's Guide to Outsmarting College Costs and Getting Free Scholarships and Grants!

Page URL History Show full URLs

http://www.educationmoney.com/ HTTP 301
https://www.educationmoney.com/ Page URL

Detected technologies

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Statcounter (Analytics) Expand

Overall confidence: 100%
Detected patterns

statcounter\.com/counter/counter

Page Statistics

150
Requests

97 %
HTTPS

68 %
IPv6

25
Domains

36
Subdomains

31
IPs

6
Countries

1728 kB
Transfer

4940 kB
Size

26
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: http://www.fafsa.ed.gov/

Search URL Search Domain Scan URL

URL: https://alcorehab.org/scholarship/
Title: AlcoRehab.org

Search URL Search Domain Scan URL

URL: https://collegescorecard.ed.gov/
Title: The College Scorecard

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://www.educationmoney.com/ HTTP 301
https://www.educationmoney.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 67

https://googleads.g.doubleclick.net/pagead/id HTTP 302
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

Request Chain 132

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKQo5CafRpEov9-thEa3SjhA6b0_y9bkFD_1pHltD60t0ZxAd0JgCpAMCguAhGKONTcVco4y345N6e53MBRVrWvOnkc9A&google_gid=CAESEPJrhktQLJ6VtmuevNdfnOc&google_cver=1 HTTP 302
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKQo5CafRpEov9-thEa3SjhA6b0_y9bkFD_1pHltD60t0ZxAd0JgCpAMCguAhGKONTcVco4y345N6e53MBRVrWvOnkc9A&google_gid=CAESEPJrhktQLJ6VtmuevNdfnOc&google_cver=1&rd=Y HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA1MjUxOTI1MjMwMDAxMDY0OTgxMDEzOQ%3D%3D&google_push=AYg5qPKQo5CafRpEov9-thEa3SjhA6b0_y9bkFD_1pHltD60t0ZxAd0JgCpAMCguAhGKONTcVco4y345N6e53MBRVrWvOnkc9A

Request Chain 134

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEM0vH4SsIN7D5fVo-LNZSkU&google_cver=1&google_push=AYg5qPK9N1KFvYtN31V__NoY-vgzohTtuAyIdVqst6MSBixYrK-aSaLf54MshSoJ52l3s2t4B4JLlom_ghzAAdOyhizKe0nRJjE HTTP 302
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEM0vH4SsIN7D5fVo-LNZSkU&google_cver=1&google_push=AYg5qPK9N1KFvYtN31V__NoY-vgzohTtuAyIdVqst6MSBixYrK-aSaLf54MshSoJ52l3s2t4B4JLlom_ghzAAdOyhizKe0nRJjE&rdf=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=hvTN7Zt6T4Ship3WehA35w%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK9N1KFvYtN31V__NoY-vgzohTtuAyIdVqst6MSBixYrK-aSaLf54MshSoJ52l3s2t4B4JLlom_ghzAAdOyhizKe0nRJjE

Request Chain 135

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDlFR7wLklrqFPx5YUtgyt0&google_cver=1&google_push=AYg5qPJHiKFFdrW9MdMrQWgkldLQr47s10T_ejWDYL7ITb-Q19DG2f60wBZp_oa9HRgmboXq9fKCNzb2nZA2j4Yb6VsN2Ni1XTs HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDNMWjdMMFctMS1NQlU0&google_push=AYg5qPJHiKFFdrW9MdMrQWgkldLQr47s10T_ejWDYL7ITb-Q19DG2f60wBZp_oa9HRgmboXq9fKCNzb2nZA2j4Yb6VsN2Ni1XTs

Request Chain 136

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEC6uCKQfmNzvLQwTQ80zTjQ&google_cver=1&google_push=AYg5qPLRarWF8w43W3EYsrpY3H9yreaFmcK4k9Gsoj9ApYGYGQELSCvyLkxeSIT6CXNAewxUbM_PoyptwH7c2tV_jRXX3ICgKAc HTTP 302
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEC6uCKQfmNzvLQwTQ80zTjQ&google_push=AYg5qPLRarWF8w43W3EYsrpY3H9yreaFmcK4k9Gsoj9ApYGYGQELSCvyLkxeSIT6CXNAewxUbM_PoyptwH7c2tV_jRXX3ICgKAc&s=184023&C=1 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yo6Co-NypYdnE8zz08HFHQAABGMAAAAB&google_gid=CAESEC6uCKQfmNzvLQwTQ80zTjQ&google_push=AYg5qPLRarWF8w43W3EYsrpY3H9yreaFmcK4k9Gsoj9ApYGYGQELSCvyLkxeSIT6CXNAewxUbM_PoyptwH7c2tV_jRXX3ICgKAc&google_cver=1

Request Chain 139

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

150 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.educationmoney.com/
Redirect Chain

http://www.educationmoney.com/
https://www.educationmoney.com/

25 KB
7 KB

287ms
94ms

Document
text/html

2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

d575fc14116b00adea0b06a786b3079d2fb3d7174804142b214d491e0afaa98a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Wed, 25 May 2022 19:25:20 GMT
etag: W/"602bd394-6511"
last-modified: Tue, 16 Feb 2021 14:15:48 GMT
server: nginx
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

Redirect headers

Connection: keep-alive
Content-Length: 169
Content-Type: text/html
Date: Wed, 25 May 2022 19:25:20 GMT
Location: https://www.educationmoney.com/
Server: nginx/1.18.0

GET
H2 200 0.homepage.js Show response
www.educationmoney.com/ 3 KB
845 B 95ms
95ms Script
application/javascript 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://www.educationmoney.com/0.homepage.js

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

bc0cc0e8efb7b2d2672900ebfde33fa1d7e1b6ef15e1bad166de8bf1289b592c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"6025605e-daa"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-xss-protection: 1; mode=block

GET
H2 200 0.bookMark.js Show response
www.educationmoney.com/ 499 B
516 B 96ms
95ms Script
application/javascript 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to

Full URL

https://www.educationmoney.com/0.bookMark.js

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

e3be22d0d23fb10fdad928bdec027daf49e22f548a351b5cb703d710425656de

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"6025605e-1f3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-xss-protection: 1; mode=block

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 160 KB
56 KB 137ms
100ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

66d02bbda60bd1f2e566716cab3ffcfd5dd3efa2c2de745404ad764783908e66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 56708
x-xss-protection: 0
server: cafe
etag: 16037965786116774410
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 25 May 2022 19:25:21 GMT

GET
H2 200 thurs_logo.gif
www.educationmoney.com/states/graphics/ 7 KB
7 KB 94ms
94ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/states/graphics/thurs_logo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

2c4980aefdce4dd6696edffc695f48187ce84a685af9be8cdd610111561a3283

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-1a43"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 6723
x-xss-protection: 1; mode=block

GET
H2 200 red.spacer.gif
www.educationmoney.com/mouseovers/ 49 B
240 B 94ms
88ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/red.spacer.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

51bad96ab4260d466d16c758a6e88c08d6a5d3d153592c2b0212bac3d29b59d3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-31"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 49
x-xss-protection: 1; mode=block

GET
H2 200 home.rollo.gif
www.educationmoney.com/mouseovers/ 616 B
808 B 100ms
92ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/home.rollo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

819a7a475f6efb187a017babc236aeacd90fe602c4ce06c96f38d428ed67b3ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-268"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 616
x-xss-protection: 1; mode=block

GET
H2 200 state.mny.menu.gif
www.educationmoney.com/mouseovers/ 946 B
1 KB 100ms
93ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/state.mny.menu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

f43a2715c9ebde2ad7cf51d297378f038f1d04f42c58ae1a5046b186ea4335e8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-3b2"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 946
x-xss-protection: 1; mode=block

GET
H2 200 fed.mny.menu.gif
www.educationmoney.com/mouseovers/ 1 KB
1 KB 101ms
93ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fed.mny.menu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

9bd229de4fcf0740584ff821ab4a0ca438fdd3da94c34ccf31b76617aa70d0b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-406"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1030
x-xss-protection: 1; mode=block

GET
H2 200 private.mny.menu.gif
www.educationmoney.com/mouseovers/ 1 KB
2 KB 187ms
179ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/private.mny.menu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

1cd57716e44061e27878c07dbf5c3711aa08f97f0d03a3814a6439297ea72c7d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-585"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1413
x-xss-protection: 1; mode=block

GET
H2 200 low.cc.menu.gif
www.educationmoney.com/mouseovers/ 1 KB
1 KB 188ms
179ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/low.cc.menu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

2bb40a4ce957c08c50ab1ca4e0cdbf1572a6c368971e05d628c2193b29f35487

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-49e"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1182
x-xss-protection: 1; mode=block

GET
H2 200 bookmark.gif
www.educationmoney.com/graphics/ 2 KB
2 KB 188ms
180ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/bookmark.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

2380ad2259685cc9eaff048bfb6d79f5648b772e30f204d4427e42df680f0268

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-880"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 2176
x-xss-protection: 1; mode=block

GET
H2 200 link2us.gif
www.educationmoney.com/graphics/ 2 KB
2 KB 188ms
180ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/link2us.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

9594a2cd5ec38f47e385e1ee4a9eb2b50b15ea47c6f9d0c2cc695b3600393f82

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-7a5"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1957
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_blu.gif
www.educationmoney.com/mouseovers/ 7 KB
7 KB 188ms
180ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_blu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

d01c3e1094da8e50d8246859ef5cf0214734464c43e3ead4e4922d47661e9b95

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-1c74"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 7284
x-xss-protection: 1; mode=block

GET
H2 200 stdnt.lns_blu.gif
www.educationmoney.com/graphics/ 5 KB
5 KB 191ms
183ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/stdnt.lns_blu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

dcbebae72894d33bdf61d3110d1beabad6463ff6bf48b0ef5ab6e8602da1dd4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-123d"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 4669
x-xss-protection: 1; mode=block

GET
H2 200 state.mny_blu.gif
www.educationmoney.com/graphics/ 3 KB
3 KB 191ms
183ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/state.mny_blu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

203b18a2629a2ef035deb07d8c9e51424ca98f9315543e4acce3f08361c9ac76

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-b8d"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 2957
x-xss-protection: 1; mode=block

GET
H2 200 fed.mny_blu.gif
www.educationmoney.com/graphics/ 3 KB
3 KB 277ms
270ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/fed.mny_blu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

8d2941546f89de0e1186029a4610caa720bd0c48783c8da44c4427e80112cc32

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-c1f"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 3103
x-xss-protection: 1; mode=block

GET
H2 200 prvte.mny_blu.gif
www.educationmoney.com/graphics/ 3 KB
3 KB 278ms
271ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/prvte.mny_blu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

c562ef70e7efe0e28cda98045bb466fe5ecee28ec8cd9cd53b4d515a1b0d48d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-c34"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 3124
x-xss-protection: 1; mode=block

GET
H2 200 low.cost_blu.gif
www.educationmoney.com/graphics/ 3 KB
4 KB 278ms
271ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/low.cost_blu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

e844d9167fa2e6ff40c446e1e3563004d1bafe3026dbe4453d3878c9c9349a00

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-df5"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 3573
x-xss-protection: 1; mode=block

GET
H2 200 copyright.gif
www.educationmoney.com/graphics/ 2 KB
2 KB 278ms
271ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/copyright.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

c7a9eedb197611dee3c7e4b95d2e0216741ba965ccf68fab86176ad405a177be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-779"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1913
x-xss-protection: 1; mode=block

GET
H2 200 mondy_logo.gif
www.educationmoney.com/graphics/ 6 KB
7 KB 279ms
271ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/mondy_logo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

6b52d060a408513eeeb99563d13d1230a241fd18a7c9e3280ba644652d6ecec8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-19dd"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 6621
x-xss-protection: 1; mode=block

GET
H2 200 tues_logo.gif
www.educationmoney.com/graphics/ 6 KB
6 KB 279ms
272ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/tues_logo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

6da3b4e91f69d7289094f5e91fe7da56ec159fb61a26e9c05c7fa593b4eb76a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-18d6"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 6358
x-xss-protection: 1; mode=block

GET
H2 200 weds_logo.gif
www.educationmoney.com/graphics/ 6 KB
7 KB 280ms
272ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/weds_logo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

0fd5cf764972d1df9f1fb87a8bdd9e48787d890b2cb9661e55289923a6639e8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-195e"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 6494
x-xss-protection: 1; mode=block

GET
H2 200 thurs_logo.gif
www.educationmoney.com/graphics/ 7 KB
7 KB 282ms
275ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/thurs_logo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

2c4980aefdce4dd6696edffc695f48187ce84a685af9be8cdd610111561a3283

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-1a43"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 6723
x-xss-protection: 1; mode=block

GET
H2 200 fridy_logo.gif
www.educationmoney.com/graphics/ 5 KB
5 KB 282ms
275ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/fridy_logo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

ce1e23eec62ea3c1b52e354a842e51ea07bedb24ee5ed6be100339dcdb1a9b22

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-1412"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 5138
x-xss-protection: 1; mode=block

GET
H2 200 satdy_logo.gif
www.educationmoney.com/graphics/ 6 KB
7 KB 282ms
275ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/satdy_logo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

b4a584c3f5e03eeb8a22223ee5eaa8a8792573062da9dc58ba8bfc0675804eeb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-19e9"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 6633
x-xss-protection: 1; mode=block

GET
H2 200 sundy_logo.gif
www.educationmoney.com/graphics/ 6 KB
6 KB 283ms
276ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/graphics/sundy_logo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

d6932842cb870f04e9e0069ff3bbd90b815679065bf754735e56a4893ec12c66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-18d7"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 6359
x-xss-protection: 1; mode=block

GET
H2 200 home.menu.gif
www.educationmoney.com/mouseovers/ 559 B
751 B 283ms
276ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/home.menu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

eb6bed8efafdc53a3c9b83d2e304419557c82e244b3b8e0448ee13ec4ac8b24f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-22f"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 559
x-xss-protection: 1; mode=block

GET
H2 200 state.mny.rollo.gif
www.educationmoney.com/mouseovers/ 1 KB
1 KB 283ms
276ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/state.mny.rollo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

396ca7f0dc5bc00a42de219e42e23267e49b5c22f84decccaeb717b84497b146

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-442"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1090
x-xss-protection: 1; mode=block

GET
H2 200 fed.mny.rollo.gif
www.educationmoney.com/mouseovers/ 1 KB
1 KB 283ms
276ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fed.mny.rollo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

3b8886cb966a435c04bc978344dc4509d9eb1882b6b59d7a36b161163c2befc1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-4a3"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1187
x-xss-protection: 1; mode=block

GET
H2 200 private.mny.rollo.gif
www.educationmoney.com/mouseovers/ 2 KB
2 KB 283ms
276ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/private.mny.rollo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

6f62a5aeb2c0209a6e4572098e112e00ce17c5f434de670e753388886804ffcb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-660"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1632
x-xss-protection: 1; mode=block

GET
H2 200 low.cc.rollo.gif
www.educationmoney.com/mouseovers/ 1 KB
2 KB 283ms
277ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/low.cc.rollo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

1b862a2ccbdafde414ca637050b73ab11f0a98c3572f890c0f84127846d517f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-565"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1381
x-xss-protection: 1; mode=block

GET
H2 200 edu.store.menu.gif
www.educationmoney.com/mouseovers/ 1 KB
2 KB 283ms
277ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/edu.store.menu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

a517663dd344f46e553c1c881ee6b2b0cfb16541238b12cca5510c4ffe38e4f8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-593"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1427
x-xss-protection: 1; mode=block

GET
H2 200 edu.store.rollo.gif
www.educationmoney.com/mouseovers/ 2 KB
2 KB 283ms
277ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/edu.store.rollo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

fc271185d48164cc6a67d2e55037fc22c2d5c65437f2a3e0e362b51e47099d47

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-773"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1907
x-xss-protection: 1; mode=block

GET
H2 404 site.search.gif
www.educationmoney.com/ 25 B
25 B 286ms
280ms Image
text/html 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.educationmoney.com/site.search.gif
Requested by: Host: www.educationmoney.com
URL: https://www.educationmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
Software: nginx /
Resource Hash: a9aa9ec7ef3ec92e7eb52220a9f0cb578ff2ba0a71cb3e9c1a0b828857529fcc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H2 404 site.search.grn.gif
www.educationmoney.com/ 25 B
25 B 286ms
281ms Image
text/html 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.educationmoney.com/site.search.grn.gif
Requested by: Host: www.educationmoney.com
URL: https://www.educationmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
Software: nginx /
Resource Hash: a9aa9ec7ef3ec92e7eb52220a9f0cb578ff2ba0a71cb3e9c1a0b828857529fcc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H2 404 site.search.red.gif
www.educationmoney.com/ 25 B
25 B 286ms
281ms Image
text/html 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.educationmoney.com/site.search.red.gif
Requested by: Host: www.educationmoney.com
URL: https://www.educationmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),
Reverse DNS
Software: nginx /
Resource Hash: a9aa9ec7ef3ec92e7eb52220a9f0cb578ff2ba0a71cb3e9c1a0b828857529fcc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H2 200 fafsa_lght.blu.gif
www.educationmoney.com/mouseovers/ 8 KB
8 KB 283ms
277ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_lght.blu.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

8497625687f46314eb285ba0f713e79b03056ad26e17b3edd7be97f29ad7397b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-2115"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 8469
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_lght.blu2.gif
www.educationmoney.com/mouseovers/ 10 KB
10 KB 283ms
277ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_lght.blu2.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

cfb757fb5c0e5e55aafab2aa9a594ee667086b03cbbf6f33dafc3541843ea34b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-292e"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 10542
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_red.gif
www.educationmoney.com/mouseovers/ 10 KB
10 KB 283ms
278ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_red.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

975d333fe6a57fff1e0875a64b30e0697c13c159a6609972209bb2ae264c0349

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-28a7"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 10407
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_red2.gif
www.educationmoney.com/mouseovers/ 10 KB
10 KB 283ms
278ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_red2.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

ba22d8ee62e97778c8f91bd8c598092ac232cc6b71fe65f7f1dc7ad5fe9ef079

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-265e"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 9822
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_red3.gif
www.educationmoney.com/mouseovers/ 9 KB
9 KB 283ms
278ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_red3.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

4d7bedaacd206864014c516e46f0a43e83eb0c2df67f4e29f965398bb43dc383

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-249d"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 9373
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_grn.gif
www.educationmoney.com/mouseovers/ 10 KB
10 KB 283ms
278ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_grn.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

8b6a66805f21df2ad98b78a86e55ff06b295b0cfb3472196c8817edcd4c07da6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-2692"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 9874
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_lght.grn.gif
www.educationmoney.com/mouseovers/ 10 KB
11 KB 283ms
278ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_lght.grn.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

13842c351abcc3de5eafbf9b334afe1dde5ecfb9e3cc99d947bd06117af75ffc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-29b8"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 10680
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_grn2.gif
www.educationmoney.com/mouseovers/ 11 KB
11 KB 283ms
278ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_grn2.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

e95053b46c1a265698f234740eeb15e8866d8861207d1dd5477dea9f18c07fb6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-2aaf"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 10927
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_lght.grn2.gif
www.educationmoney.com/mouseovers/ 10 KB
11 KB 283ms
279ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_lght.grn2.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

1728900dc776f9294dcb18eb8134bcc76b01e254ee5bf7787aedb0600ba8c768

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-29cd"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 10701
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_xmas.gif
www.educationmoney.com/mouseovers/ 10 KB
10 KB 283ms
279ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_xmas.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

3ea373e48512da0b7e630f00010bd25678b227c5a8ab3f63d521982beb4434f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-2855"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 10325
x-xss-protection: 1; mode=block

GET
H2 200 fafsa_xmas2.gif
www.educationmoney.com/mouseovers/ 10 KB
10 KB 283ms
279ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/fafsa_xmas2.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

77c1f2a9b939c40689d8ee0e8a75be3a426c9341148251a18e1f5a4d62070781

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-285f"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 10335
x-xss-protection: 1; mode=block

GET
H2 200 help.undstnd.gif
www.educationmoney.com/mouseovers/ 3 KB
4 KB 283ms
279ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/help.undstnd.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

8570444d2e7c1cc2987f60d037acbcc97c7880e46c506af990083ac0114f6c6f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-d40"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 3392
x-xss-protection: 1; mode=block

GET
H2 200 help.undstnd2.gif
www.educationmoney.com/mouseovers/ 3 KB
3 KB 283ms
279ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/help.undstnd2.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

10134df69ad2394f6374d310f19bb368937289afeb6e81c73ac2268a6f6dd4e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-c94"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 3220
x-xss-protection: 1; mode=block

GET
H2 200 wrte.fedprpsl.gif
www.educationmoney.com/mouseovers/ 4 KB
4 KB 283ms
279ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/wrte.fedprpsl.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

894762fd1d25c68a85c57d69af7e567456d50188a41a729cb3f066c398cb339c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-e7e"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 3710
x-xss-protection: 1; mode=block

GET
H2 200 wrte.fedprpsl2.gif
www.educationmoney.com/mouseovers/ 3 KB
3 KB 283ms
280ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/wrte.fedprpsl2.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

adf4fb6407c8b87973b5192907086d7c20d550747cdbdefa8948614107701172

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-d2d"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 3373
x-xss-protection: 1; mode=block

GET
H2 200 contact_info.gif
www.educationmoney.com/mouseovers/ 2 KB
2 KB 283ms
280ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/contact_info.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

cce1b1c09bc6bd319b474f4a09df3f00d1793fe32dd150723aa1b420314a5a58

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-72d"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1837
x-xss-protection: 1; mode=block

GET
H2 200 contact_info.rollo.gif
www.educationmoney.com/mouseovers/ 2 KB
2 KB 283ms
280ms Image
image/gif 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/mouseovers/contact_info.rollo.gif

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

0edefdbb2d9960f296b516b9217645a1c71416db3052c4c458d3c6526ef11f87

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-6d8"
x-frame-options: SAMEORIGIN
content-type: image/gif
accept-ranges: bytes
content-length: 1752
x-xss-protection: 1; mode=block

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 3 KB
2 KB 26ms
8ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

168b63c31d23fb4316b04f53a91acfb2efbe2a350ead9d890c671ffe96aad9db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: vY7JYHLyHWELhRlksV1OEg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
expires: Wed, 25 May 2022 19:36:26 GMT
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 1684
x-fb-rlafr: 0
x-fb-debug: HYEIFmkgIBhoUSytfWAQWrzsWbAUxThZ7rEggnrOxU374yMYRC/B2WML+jrxBBWqzAETSV9qx7SjLOhAdMKXvg==
x-fb-trip-id: 2050670934
x-fb-content-md5: 243f8a1da207412b079570d65fb56569
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Wed, 25 May 2022 19:25:21 GMT
x-frame-options: DENY
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "a98bda11eade07b0dd9162460ea28011"
timing-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5

GET
H2 200 wednesday.jpg
www.educationmoney.com/ 13 KB
13 KB 279ms
279ms Image
image/jpeg 2600:3c03::f03c:92ff:fe05:debc
LINODE-AP Linode

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.educationmoney.com/wednesday.jpg

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:3c03::f03c:92ff:fe05:debc Cedar Knolls, United States, ASN63949 (LINODE-AP Linode, LLC, US),

Reverse DNS

Software

nginx /

Resource Hash

2a1f6923acbeae8fe2795044d52ed5f67b0b5fea5edd0d86703556a3c64a80b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
last-modified: Thu, 11 Feb 2021 16:50:38 GMT
server: nginx
etag: "6025605e-3347"
x-frame-options: SAMEORIGIN
content-type: image/jpeg
accept-ranges: bytes
content-length: 13127
x-xss-protection: 1; mode=block

GET
H2 200 U45lizyqIic Show response
www.youtube.com/embed/ Frame A3FC 62 KB
27 KB 98ms
62ms Document
text/html 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/U45lizyqIic

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e644d9cc4ed795003d3e8cec3360628550651d769afa0971925facc2fbb4e6ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.educationmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: br
content-type: text/html; charset=utf-8
critical-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
date: Wed, 25 May 2022 19:25:21 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
pragma: no-cache
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
server: ESF
strict-transport-security: max-age=31536000
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 counter.js Show response
secure.statcounter.com/counter/ 42 KB
14 KB 56ms
24ms Script
application/x-javascript 104.20.228.67
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.statcounter.com/counter/counter.js
Requested by: Host: www.educationmoney.com
URL: https://www.educationmoney.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.228.67 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a0bd9bfaf4def6656a9233d93df518c01be681326e72cd9e00aa73fd29702b83

Request headers

Referer: https://www.educationmoney.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Mon, 14 Mar 2022 09:58:11 GMT
server: cloudflare
age: 32869
etag: W/"622f11b3-a7ae"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=43200
cf-ray: 7110a810484e90b2-FRA
expires: Wed, 25 May 2022 22:17:32 GMT

GET
H3 200 all.js Show response
connect.facebook.net/en_US/ 289 KB
82 KB 18ms
8ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js?hash=ae681b00dbba5e9a98d38e2f242e20ee

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

2718b494ae8d6907d39dd26df60394b5beedd56d1bbad695dbd452a91d0f4ce4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://www.educationmoney.com/
Origin: https://www.educationmoney.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: YOBdt30K/2XPAiBXYPRwnw==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 83880
x-fb-rlafr: 0
x-fb-debug: z7F7zvAlNK0/85AlEEsA5/6jl8nv4fN2rUCWPcG0+bD/1kdb9+kpxXeskMkdvm2G9aqhPUKz+S3P9/zJ5fQjdA==
x-fb-content-md5: 22fd8394ef385636d0426042951acfcd
x-frame-options: DENY
date: Wed, 25 May 2022 19:25:21 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "84d3eec23c9b23f825b59284225ab81f"
timing-allow-origin: *
priority: u=3,i
expires: Thu, 25 May 2023 17:11:38 GMT

GET
H2 200 t.php Show response
c.statcounter.com/ 192 B
573 B 152ms
139ms XHR
application/json 104.20.228.67
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.statcounter.com/t.php?sc_project=11275568&u1=9FBCCAA759FB4FBC78D9267250A3645E&java=1&security=317a7536&sc_snum=1&sess=5e022a&p=0&rcat=d&rdom=d&rdomg=new&bb=1&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1600&h=1200&camefrom=&u=https%3A//www.educationmoney.com/&t=An%20Insider%27s%20Guide%20to%20Outsmarting%20College%20Costs%20and%20Getting%20Free%20Scholarships%20and%20Grants!&invisible=1&sc_rum_e_s=1006&sc_rum_e_e=1010&sc_rum_f_s=0&sc_rum_f_e=1003&get_config=true
Requested by: Host: secure.statcounter.com
URL: https://secure.statcounter.com/counter/counter.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.20.228.67 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: eb2697b60c526a1d4980e0874700e7c2b4f43bb9292770f71bb4bb972506e415

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 7110a81098aa90b2-FRA
p3p: policyref="http://www.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
access-control-allow-origin: https://www.educationmoney.com
access-control-allow-credentials: true
content-type: application/json
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 like.php Show response
www.facebook.com/plugins/ Frame 59CE 0
3 KB 125ms
109ms Document
text/html 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/like.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df32f1f82400be8%26domain%3Dwww.educationmoney.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fwww.educationmoney.com%252Ff1464cdf47451a8%26relation%3Dparent.parent&container_width=462&href=https%3A%2F%2Fwww.educationmoney.com%2F&locale=en_US&sdk=joey&send=false&show_faces=false&width=450

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=ae681b00dbba5e9a98d38e2f242e20ee

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.educationmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cache-control: private, no-cache, no-store, must-revalidate
content-length: 0
content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
content-type: text/html;charset=utf-8
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 25 May 2022 19:25:21 GMT
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
priority: u=3,i
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
x-content-type-options: nosniff
x-fb-debug: Gd9nPR9wPGpSqFXu7AcAcLzFNIXrDJwhkvDFs6NC+zSSR79XNSRFoGjVjiPfmRvsYR7E0FUEeJgIpCgUWEvfEQ==
x-xss-protection: 0

GET
H3 200 www-player.css
www.youtube.com/s/player/c5a4daa1/ Frame A3FC 336 KB
46 KB 43ms
14ms Stylesheet
text/css 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/c5a4daa1/www-player.css

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/U45lizyqIic

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ddd57e7b851403a2d93d4a6ca6ee8a4532b87a58097df03ed57fa3d0ebe04440

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/U45lizyqIic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 09:53:08 GMT
content-encoding: br
x-content-type-options: nosniff
age: 34333
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 47318
x-xss-protection: 0
last-modified: Mon, 23 May 2022 00:14:54 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 25 May 2023 09:53:08 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame A3FC 15 KB
16 KB 59ms
13ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/U45lizyqIic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
Origin: https://www.youtube.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Tue, 24 May 2022 11:18:05 GMT
x-content-type-options: nosniff
age: 115636
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Wed, 24 May 2023 11:18:05 GMT

GET
H3 200 www-embed-player.js Show response
www.youtube.com/s/player/c5a4daa1/www-embed-player.vflset/ Frame A3FC 284 KB
87 KB 58ms
35ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/c5a4daa1/www-embed-player.vflset/www-embed-player.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/U45lizyqIic

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aad53fa60291be42db5c16ecf53ca8f72101ae6b89d6e599aacbfa0e3ba506d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/U45lizyqIic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 23 May 2022 14:56:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 188951
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 89299
x-xss-protection: 0
last-modified: Mon, 23 May 2022 00:14:54 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Tue, 23 May 2023 14:56:10 GMT

GET
H3 200 base.js Show response
www.youtube.com/s/player/c5a4daa1/player_ias.vflset/de_DE/ Frame A3FC 2 MB
530 KB 51ms
28ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/c5a4daa1/player_ias.vflset/de_DE/base.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/U45lizyqIic

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

becb55a378354595181e220f9a4440e873872a4baabc8b147f4fbf53634408b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/U45lizyqIic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 23 May 2022 14:56:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 188951
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 542446
x-xss-protection: 0
last-modified: Mon, 23 May 2022 00:14:54 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Tue, 23 May 2023 14:56:10 GMT

GET
H3 200 fetch-polyfill.js Show response
www.youtube.com/s/player/c5a4daa1/fetch-polyfill.vflset/ Frame A3FC 9 KB
3 KB 36ms
13ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/c5a4daa1/fetch-polyfill.vflset/fetch-polyfill.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/U45lizyqIic

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

498b3f2a0357fbd50a80eb18b23ab4b461b791d640e5560b799f08ed960748a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/U45lizyqIic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 14:48:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16591
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2786
x-xss-protection: 0
last-modified: Mon, 23 May 2022 00:14:54 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 25 May 2023 14:48:50 GMT

GET
H3 200 show_ads_impl_with_ama_fy2019.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202205190101/ 316 KB
113 KB 77ms
44ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202205190101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8258884324894592&plah=www.educationmoney.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

67b843c53f3a6cfa86187c1b9b76f400f14bde8455aa20641ea65fc509e28599

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 115459
x-xss-protection: 0
server: cafe
etag: 13894580909922640740
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 25 May 2022 19:25:21 GMT

GET
H2 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220523/r20190131/ Frame 0E85 10 KB
5 KB 18ms
17ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220523/r20190131/zrt_lookup.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7339fe12f332ac7ecd6e0ef04bb7a48fad9e74be887d67f458548ff33ea4db65

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.educationmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 63466
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4404
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 May 2022 01:47:35 GMT
etag: 3347421328414474149
expires: Wed, 08 Jun 2022 01:47:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

id Show response
googleads.g.doubleclick.net/pagead/ Frame A3FC
Redirect Chain

https://googleads.g.doubleclick.net/pagead/id
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

100 B
146 B

27ms
27ms

XHR
application/json

2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/U45lizyqIic

Protocol

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

200ac470905f2c3b01a217be41297cbbe4c80ee4ee0087a92e9d7657169610d7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 120
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 25 May 2022 19:25:21 GMT
x-content-type-options: nosniff
access-control-allow-origin: https://www.youtube.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad_status.js Show response
static.doubleclick.net/instream/ Frame A3FC 29 B
587 B 55ms
14ms Script
text/javascript 2a00:1450:4001:80e::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.doubleclick.net/instream/ad_status.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/c5a4daa1/www-embed-player.vflset/www-embed-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:24:57 GMT
x-content-type-options: nosniff
age: 24
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29
x-xss-protection: 0
last-modified: Thu, 12 Dec 2013 23:40:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 25 May 2022 19:39:57 GMT

GET
H2 200 cookie.js Show response
partner.googleadservices.com/gampad/ 222 B
649 B 96ms
22ms Script
text/javascript 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://partner.googleadservices.com/gampad/cookie.js?domain=www.educationmoney.com&callback=_gfp_s_&client=ca-pub-8258884324894592

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202205190101/show_ads_impl_with_ama_fy2019.js?client=ca-pub-8258884324894592&plah=www.educationmoney.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

cafe /

Resource Hash

fa26d6529d8f4d669a1f2c6a5a101bb859064bf82a76b9b6de22a52b2e6c07c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: text/javascript; charset=UTF-8
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 205
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 67ms
24ms Script
application/javascript 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.educationmoney.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 25 May 2022 19:25:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 78ms
23ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.educationmoney.com

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 25 May 2022 19:25:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 51DC 42 KB
14 KB 168ms
167ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8258884324894592&output=html&adk=1812271804&adf=3025194257&lmt=1613484948&plat=9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1048576%2C32%3A32&format=0x0&url=https%3A%2F%2Fwww.educationmoney.com%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653506721454&bpp=3&bdt=273&idt=188&shv=r20220523&mjsv=m202205190101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=8708985192171&frm=20&pv=2&ga_vid=357035125.1653506722&ga_sid=1653506722&ga_hid=938181054&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44763505&oid=2&pvsid=12748678052473&pem=482&tmod=451745296&uas=0&nvt=1&eae=2&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&ifi=1&uci=a!1&fsb=1&dtd=204

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

38958459ac54077235bec3f9f59cfccb70e1fb34f120e83221bd5236dc33c010

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.educationmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 13889
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 May 2022 19:25:21 GMT
expires: Wed, 25 May 2022 19:25:21 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 200 Create
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 0
0 85ms
24ms Preflight
text/html 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-goog-api-key,x-user-agent
Access-Control-Request-Method: POST
Origin: https://www.youtube.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-goog-api-key,x-user-agent
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://www.youtube.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
content-type: text/html
date: Wed, 25 May 2022 19:25:21 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

POST
H3 200 Create Show response
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame A3FC 63 KB
29 KB 61ms
32ms XHR
application/json+protobuf 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/c5a4daa1/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

572548cc6fe475bde1e1f0bc1a6f15819805ae423a6788cf41e4804e4bb1b9ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-User-Agent: grpc-web-javascript/0.1
Referer: https://www.youtube.com/
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: application/json+protobuf

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/json+protobuf; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
vary: Origin, X-Origin, Referer
content-length: 29503
x-xss-protection: 0

GET
H3 200 remote.js Show response
www.youtube.com/s/player/c5a4daa1/player_ias.vflset/de_DE/ Frame A3FC 119 KB
37 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/c5a4daa1/player_ias.vflset/de_DE/remote.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/c5a4daa1/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6c458c529c6dbfc574fd6b7a80af5faf8077cb8e35810f722a0469046678a23e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/U45lizyqIic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 23 May 2022 14:56:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 188951
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37798
x-xss-protection: 0
last-modified: Mon, 23 May 2022 00:14:54 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Tue, 23 May 2023 14:56:10 GMT

GET
H2 200 _dR6-cQdUOWBmJLukezzayRozGrIW7pPDuH4VC_rm7g.js Show response
www.google.com/js/th/ Frame A3FC 35 KB
14 KB 49ms
14ms Script
text/javascript 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/th/_dR6-cQdUOWBmJLukezzayRozGrIW7pPDuH4VC_rm7g.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/c5a4daa1/player_ias.vflset/de_DE/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

fdd47af9c41d50e5819892ee91ecf36b2468cc6ac85bba4f0ee1f8542feb9bb8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 14:50:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 16463
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13552
x-xss-protection: 0
last-modified: Tue, 17 May 2022 14:00:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 May 2023 14:50:58 GMT

GET
H3 200 embed.js Show response
www.youtube.com/s/player/c5a4daa1/player_ias.vflset/de_DE/ Frame A3FC 27 KB
8 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/c5a4daa1/player_ias.vflset/de_DE/embed.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/c5a4daa1/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c6e1d4c278ea9167a2babd7993354ccefc90296eb580b29e186eb493ad309ca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/U45lizyqIic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Mon, 23 May 2022 14:56:10 GMT
content-encoding: br
x-content-type-options: nosniff
age: 188951
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8033
x-xss-protection: 0
last-modified: Mon, 23 May 2022 00:14:54 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Tue, 23 May 2023 14:56:10 GMT

GET
DATA 200
OK truncated
/ Frame A3FC 175 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 AKedOLRI9aRExOV6rupkeb_DzRKGVQi4LFp3IrlQj9V7WA=s68-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ytc/ Frame A3FC 2 KB
3 KB 68ms
13ms Image
image/jpeg 2a00:1450:4001:803::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yt3.ggpht.com/ytc/AKedOLRI9aRExOV6rupkeb_DzRKGVQi4LFp3IrlQj9V7WA=s68-c-k-c0x00ffffff-no-rj

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/U45lizyqIic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

fife /

Resource Hash

b3da98f42adfeb19d9c8fb50881c70c0969317d30e33fc7f2f643952ee7d929b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:18 GMT
x-content-type-options: nosniff
age: 3
content-disposition: inline;filename="unnamed.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2378
x-xss-protection: 0
server: fife
etag: "v8c"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Thu, 26 May 2022 19:25:18 GMT

GET
H2 200 default.webp
i.ytimg.com/vi_webp/U45lizyqIic/ Frame A3FC 2 KB
2 KB 57ms
15ms Image
image/webp 2a00:1450:4001:803::2016
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.ytimg.com/vi_webp/U45lizyqIic/default.webp

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/U45lizyqIic

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2016 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

444bec6366aeb81167594870416b55b59036c9152d9f4e2c2ddd1a22ff191713

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:17 GMT
x-content-type-options: nosniff
age: 4
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1734
x-xss-protection: 0
server: sffe
etag: "1443621475"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/webp
cache-control: public, max-age=7200
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Wed, 25 May 2022 21:25:17 GMT

GET
H2 200 cast_sender.js Show response
www.gstatic.com/cv/js/sender/v1/ Frame A3FC 4 KB
3 KB 78ms
33ms Script
text/javascript 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/c5a4daa1/player_ias.vflset/de_DE/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2007
x-xss-protection: 0
last-modified: Tue, 16 Feb 2021 23:57:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="cloudview"
vary: Accept-Encoding
report-to: {"group":"cloudview","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 25 May 2022 19:25:21 GMT

GET
H3 204 generate_204
www.youtube.com/ Frame A3FC 0
9 B 14ms
13ms Image
text/plain 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.youtube.com/generate_204?1UXINA
Requested by: Host: www.youtube.com
URL: https://www.youtube.com/embed/U45lizyqIic
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/U45lizyqIic
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 cast_sender.js Show response
www.gstatic.com/eureka/clank/102/ Frame A3FC 52 KB
15 KB 44ms
14ms Script
text/javascript 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/eureka/clank/102/cast_sender.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c0bc3be07587388188143cb937f57c41c1921c60d0ad0c1a278c9099b6fc26a6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 07:35:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 42610
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview-release
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15092
x-xss-protection: 0
last-modified: Mon, 04 Apr 2022 15:13:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="cloudview-release"
vary: Accept-Encoding
report-to: {"group":"cloudview-release","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview-release"}]}
content-type: text/javascript
cache-control: public, max-age=86400
accept-ranges: bytes
expires: Thu, 26 May 2022 07:35:11 GMT

POST
H3 200 GenerateIT Show response
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame A3FC 98 B
142 B 25ms
25ms XHR
application/json+protobuf 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/c5a4daa1/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a639b8370162244cb6e3ffaa62d1ffb5ee70ed5171d75698ce5e80b223ef4cb0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

X-User-Agent: grpc-web-javascript/0.1
Referer: https://www.youtube.com/
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: application/json+protobuf

Response headers

date: Wed, 25 May 2022 19:25:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: ESF
x-frame-options: SAMEORIGIN
content-type: application/json+protobuf; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
access-control-allow-credentials: true
vary: Origin, X-Origin, Referer
content-length: 118
x-xss-protection: 0

OPTIONS
H3 200 GenerateIT
jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/ Frame 0
0 22ms
21ms Preflight
text/html 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,x-goog-api-key,x-user-agent
Access-Control-Request-Method: POST
Origin: https://www.youtube.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-goog-api-key,x-user-agent
access-control-allow-methods: DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT
access-control-allow-origin: https://www.youtube.com
access-control-max-age: 3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
content-type: text/html
date: Wed, 25 May 2022 19:25:21 GMT
server: ESF
vary: origin referer x-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 0

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202205190101/ 147 KB
52 KB 32ms
32ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202205190101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

abaede74cce736979cb2cb78eabefa6c654384f3cedb61f5d4b2675c6229bfd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53476
x-xss-protection: 0
server: cafe
etag: 2108330973124272077
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 25 May 2022 19:25:22 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 52ms
22ms Script
application/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.educationmoney.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 25 May 2022 19:25:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 51ms
22ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.educationmoney.com

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 25 May 2022 19:25:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 0912 77 KB
25 KB 930ms
930ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8258884324894592&output=html&h=280&adk=165795807&adf=2670469432&pi=t.aa~a.2653543905~i.48~rp.4&w=464&fwrn=4&fwrnh=100&lmt=1613484948&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1352714303&psa=0&ad_type=text_image&format=464x280&url=https%3A%2F%2Fwww.educationmoney.com%2F&fwr=0&pra=3&rh=116&rw=464&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653506722048&bpp=3&bdt=867&idt=4&shv=r20220523&mjsv=m202205190101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D536cd7643b953d41-220186ee9ccd0048%3AT%3D1653506721%3ART%3D1653506721%3AS%3DALNI_MYV85VBjifRcZC15pkUYEAu36FWXg&prev_fmts=0x0&nras=2&correlator=8708985192171&frm=20&pv=1&ga_vid=357035125.1653506722&ga_sid=1653506722&ga_hid=938181054&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=571&ady=1434&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44763505&oid=2&pvsid=12748678052473&pem=482&tmod=451745296&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=sQMeTpJVus&p=https%3A//www.educationmoney.com&dtd=13

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

44a77b26b27b71dec40322d6d72419c8c2d73e1e4cbf15b1b2c0764e06725c27

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.educationmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: br
content-length: 25402
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 May 2022 19:25:22 GMT
expires: Wed, 25 May 2022 19:25:22 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup.html Show response
googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/ Frame 5BD0 10 KB
4 KB 14ms
14ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7339fe12f332ac7ecd6e0ef04bb7a48fad9e74be887d67f458548ff33ea4db65

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.educationmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 63963
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=1209600
content-encoding: gzip
content-length: 4404
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 May 2022 01:39:19 GMT
etag: 3347421328414474149
expires: Wed, 08 Jun 2022 01:39:19 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 5BD0 0
0 57ms
56ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=C54ahoYKOYu_yKaSL9u8P7OCyOMme0rFc1Z2R93DAjbcBEAEgAGCV0qGCsAeCARdjYS1wdWItODI1ODg4NDMyNDg5NDU5MqAB1bbS6gPIAQmpAmhDbbxq4LE-qAMBqgTIAU_Q4Ymmbc3f6PcQqtsUcqrMU5UCeTHE5K12gm5lcs25UhYiEePEONgdIfpjA_u-QODEtVt82tQ--X_bvdLbTaY1dXlq4_x_mhurzXo0hIlX8pvevQUSJvn_D6IwZw3bI-df3hPgv11_1ykbkXf0aTqWwYKh6b59Bhc4a9G6nEVaj3F5TV-5UghhusY8_J7tNKIl4SVtRSDs03iXvRn9riDORUT37uyHZdyE_4Hx7U7dJlbctS42mhZ5_9X-Iskqoboe4OU2wkrUgAbUoIrLpJuoo2ygBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAYAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi04MjU4ODg0MzI0ODk0NTkyGAA&sigh=RK3UE7d-dqM&uach_m=[UACH]&cid=CAQSGwCNIrLMSZBOsfQfw20P3kp-YF5_QEdbYOu4FBgB

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 25 May 2022 19:25:22 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Wed, 25 May 2022 19:25:22 GMT

GET
H2 200 notify
rtb.fr.eu.criteo.com/google/auction/ Frame 5BD0 0
0 61ms
16ms Fetch 2a02:2638::2
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://rtb.fr.eu.criteo.com/google/auction/notify?profile=14&payload=kOb8EMz6RO0HfJ2DYgICAAAAN7fIexUEIi4QoYKOYjQkGmqsAMZpPdsCABIAAA&wp=Yo6CoQAKeW8H_YWkAAywbL8FiDrsUICGdWwf8Q

Requested by

Host: www.educationmoney.com
URL: https://www.educationmoney.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::2 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
server: Kestrel
server-processing-duration-in-ticks: 302834
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 afr.php Show response
ads.eu.criteo.com/delivery/r/ Frame 1226 175 KB
55 KB 423ms
139ms Document
text/html 2a02:2638::b
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://ads.eu.criteo.com/delivery/r/afr.php?z=Yo6CoQAKeW8H_YWkAAywbL8FiDrsUICGdWwf8Q&u=%7CgEf3kSjTfA4LZCDhY0OwlnxNSvTlESbyyf8xbJnflCc%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC862NRkYVe1lShsTMfENGp8o7-1QPzIesGukueJmXMZQnDJhAeRZlmbJKsZndfQB7R-6LIklqclvVfF7SKlQ6gxrUI8MflWUC4krGdKgBpu_5gmuBgdu1q8u4FIRwBFZNSkinol13CatFPV_zheaa1vVjgOVIkcqnT9HzBedfMCVNAUVNvtaOWL6e3e_jLOOpdXLYLK9qfgg8jD_04oLP7UbXfpxVVotK5ben8WyPExn5FPRmvU3O_wAwbPj11TF4Dz2CCm4qDMNudvQ-smbapu_2APVm53FJvK-dkTfQKsEayriZ1_6-6BMAYsk-J3-eZ5gZ1Ax9lVrSTcix7CnyoxLt3ijmOVYNZRP-__macsWGrCJU3CJtxYWDNqMyCgBWLBOr6BAZAG61s148d-iHQhthKpyIXV9bEpw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCiSN6oYKOYu_yKaSL9u8P7OCyOMme0rFc1Z2R93DAjbcBEAEgAGCV0qGCsAeCARdjYS1wdWItODI1ODg4NDMyNDg5NDU5MqAB1bbS6gPIAQmpAmhDbbxq4LE-qAMBqgTLAU_Q4Ymmbc3f6PcQqtsUcqrMU5UCeTHE5K12gm5lcs25UhYiEePEONgdIfpjA_u-QODEtVt82tQ--X_bvdLbTaY1dXlq4_x_mhurzXo0hIlX8pvevQUSJvn_D6IwZw3bI-df3hPgv11_1ykbkXf0aTqWwYKh6b59Bhc4a9G6nEVaj3F5TV-5UghhusY8_J7tNKIl4SVtRSDs03iXvRn9riDORQb1z34A6kCXQB3lTp7ggK7VoSSAkDhhfWE2H2_YHqQy-GCcRllrVRtHgAbUoIrLpJuoo2ygBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3kuTsaQm6t7Kz6DXYAqAe6NT7nIQ%26client%3Dca-pub-8258884324894592%26adurl%3D

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638::b , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

da6a122e6ec365a084b69a701c08a52c3a39ed957124b6a8d38f8e50311baedb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1000
cache-control: private, max-age=0, no-cache
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
date: Wed, 25 May 2022 19:25:22 GMT
expires: Mon, 26 Jul 1997 05:00:00 GMT
link: <pix.eu.criteo.net>; rel=preconnect; crossorigin, <static.criteo.net>; rel=preconnect; crossorigin
p3p: CP='CUR ADM OUR NOR STA NID'
pragma: no-cache
report-to: {"endpoints":[{"url":"https://csm.eu.criteo.net/heavyad?cppv=3&cpp=3yWPmM4cGcIF6CGs1XmRHa1zom-i4EI1TuEXomlDJWcPIOvR5ic2U7osQXw0C1pWXlVXbWXMOWRYy-liCIra8oIgAIYFq99UAj4PNBM6rK4zH7FXFcS1H3VDCYbr0hMfuVjMNoPaOS1UHP7tMZ_u8zjgE0S_a9MPisf-Y2d9mw71VFrn1rPDq-LslLMgJRr6bCy6lUfJKjw4fXowbN_eMU8FIZAKacKW7QVouLqQYVuKkY0swCEa52Gbo-rAvNLs3NfNmg"}], "max_age": 86400}
server: Kestrel
server-processing-duration-in-ticks: 117375515
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame 5BD0 3 KB
1 KB 51ms
15ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/window_focus_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:18:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 385
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Jun 2022 19:18:57 GMT

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5BD0 136 KB
42 KB 83ms
37ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ecfc5a4d72d8f9fc774268cda69765e8578cd3a3859b229288b10c36acb0b35

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42522
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1653305577626270"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 25 May 2022 19:25:22 GMT

GET
H2 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame 5BD0 17 KB
8 KB 48ms
13ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20220523/r20110914/zrt_lookup.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ced80dc0b36469ade9a5e4a3c86bde068904125a1162f712f20629eeadb8e53a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:24:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 47
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7308
x-xss-protection: 0
server: cafe
etag: 5721884612586531857
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Jun 2022 19:24:35 GMT

GET
DATA 200
OK truncated
/ Frame 5BD0 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5295ea6c0fb7b9c63dba351ba43a2e6833bc396e8a56f1be1d5db7d6603d69fd

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 privacy_small.svg
static.criteo.net/flash/icon/ Frame 1226 2 KB
1 KB 45ms
15ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy_small.svg

Requested by

Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Yo6CoQAKeW8H_YWkAAywbL8FiDrsUICGdWwf8Q&u=%7CgEf3kSjTfA4LZCDhY0OwlnxNSvTlESbyyf8xbJnflCc%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC862NRkYVe1lShsTMfENGp8o7-1QPzIesGukueJmXMZQnDJhAeRZlmbJKsZndfQB7R-6LIklqclvVfF7SKlQ6gxrUI8MflWUC4krGdKgBpu_5gmuBgdu1q8u4FIRwBFZNSkinol13CatFPV_zheaa1vVjgOVIkcqnT9HzBedfMCVNAUVNvtaOWL6e3e_jLOOpdXLYLK9qfgg8jD_04oLP7UbXfpxVVotK5ben8WyPExn5FPRmvU3O_wAwbPj11TF4Dz2CCm4qDMNudvQ-smbapu_2APVm53FJvK-dkTfQKsEayriZ1_6-6BMAYsk-J3-eZ5gZ1Ax9lVrSTcix7CnyoxLt3ijmOVYNZRP-__macsWGrCJU3CJtxYWDNqMyCgBWLBOr6BAZAG61s148d-iHQhthKpyIXV9bEpw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCiSN6oYKOYu_yKaSL9u8P7OCyOMme0rFc1Z2R93DAjbcBEAEgAGCV0qGCsAeCARdjYS1wdWItODI1ODg4NDMyNDg5NDU5MqAB1bbS6gPIAQmpAmhDbbxq4LE-qAMBqgTLAU_Q4Ymmbc3f6PcQqtsUcqrMU5UCeTHE5K12gm5lcs25UhYiEePEONgdIfpjA_u-QODEtVt82tQ--X_bvdLbTaY1dXlq4_x_mhurzXo0hIlX8pvevQUSJvn_D6IwZw3bI-df3hPgv11_1ykbkXf0aTqWwYKh6b59Bhc4a9G6nEVaj3F5TV-5UghhusY8_J7tNKIl4SVtRSDs03iXvRn9riDORQb1z34A6kCXQB3lTp7ggK7VoSSAkDhhfWE2H2_YHqQy-GCcRllrVRtHgAbUoIrLpJuoo2ygBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3kuTsaQm6t7Kz6DXYAqAe6NT7nIQ%26client%3Dca-pub-8258884324894592%26adurl%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:22 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:30:28 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42ba84-6aa"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 May 2023 19:25:22 GMT

GET
H2 200 adchoices_de.svg
static.criteo.net/flash/icon/ Frame 1226 2 KB
1 KB 46ms
17ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/adchoices_de.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:22 GMT
content-encoding: gzip
last-modified: Tue, 11 Feb 2020 14:27:58 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e42b9ee-763"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 May 2023 19:25:22 GMT

GET
H2 200 close_button.svg
static.criteo.net/flash/icon/ Frame 1226 308 B
637 B 41ms
14ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/close_button.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:22 GMT
last-modified: Fri, 14 Feb 2020 13:51:32 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "5e46a5e4-134"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 308
expires: Sat, 20 May 2023 19:25:22 GMT

GET
H2 200 back_button2.svg
static.criteo.net/flash/icon/ Frame 1226 293 B
621 B 43ms
16ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/back_button2.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:22 GMT
last-modified: Thu, 28 Apr 2022 09:09:48 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: "626a59dc-125"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
timing-allow-origin: *
content-length: 293
expires: Sat, 20 May 2023 19:25:22 GMT

GET
H2 200 m
secure-gl.imrworldwide.com/cgi-bin/ Frame 1226 0
690 B 156ms
99ms Image
text/plain 2600:9000:206f:fe00:1e:a43d:b640:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://secure-gl.imrworldwide.com/cgi-bin/m?ca=nlsn184820&cr=crtve&ce=criteo&pc=criteo_plc0001&ci=nlsnci162&am=3&at=view&rt=banner&st=image&r=1653506721
Requested by: Host: ads.eu.criteo.com
URL: https://ads.eu.criteo.com/delivery/r/afr.php?z=Yo6CoQAKeW8H_YWkAAywbL8FiDrsUICGdWwf8Q&u=%7CgEf3kSjTfA4LZCDhY0OwlnxNSvTlESbyyf8xbJnflCc%3D%7C&c1=0n2XosTo5ckbeNFvq0zVIcsyhyT3WKD0PIixkNz--ZUG2JILUkurhSkBmqMNl2IWHL9APLQJ6z1MiR3q3hC862NRkYVe1lShsTMfENGp8o7-1QPzIesGukueJmXMZQnDJhAeRZlmbJKsZndfQB7R-6LIklqclvVfF7SKlQ6gxrUI8MflWUC4krGdKgBpu_5gmuBgdu1q8u4FIRwBFZNSkinol13CatFPV_zheaa1vVjgOVIkcqnT9HzBedfMCVNAUVNvtaOWL6e3e_jLOOpdXLYLK9qfgg8jD_04oLP7UbXfpxVVotK5ben8WyPExn5FPRmvU3O_wAwbPj11TF4Dz2CCm4qDMNudvQ-smbapu_2APVm53FJvK-dkTfQKsEayriZ1_6-6BMAYsk-J3-eZ5gZ1Ax9lVrSTcix7CnyoxLt3ijmOVYNZRP-__macsWGrCJU3CJtxYWDNqMyCgBWLBOr6BAZAG61s148d-iHQhthKpyIXV9bEpw&ct0=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCiSN6oYKOYu_yKaSL9u8P7OCyOMme0rFc1Z2R93DAjbcBEAEgAGCV0qGCsAeCARdjYS1wdWItODI1ODg4NDMyNDg5NDU5MqAB1bbS6gPIAQmpAmhDbbxq4LE-qAMBqgTLAU_Q4Ymmbc3f6PcQqtsUcqrMU5UCeTHE5K12gm5lcs25UhYiEePEONgdIfpjA_u-QODEtVt82tQ--X_bvdLbTaY1dXlq4_x_mhurzXo0hIlX8pvevQUSJvn_D6IwZw3bI-df3hPgv11_1ykbkXf0aTqWwYKh6b59Bhc4a9G6nEVaj3F5TV-5UghhusY8_J7tNKIl4SVtRSDs03iXvRn9riDORQb1z34A6kCXQB3lTp7ggK7VoSSAkDhhfWE2H2_YHqQy-GCcRllrVRtHgAbUoIrLpJuoo2ygBiGoB4qYsQKoB6a-G6gHltgbqAeqm7ECqAffn7EC2AcA0ggHCIDhgBAQAfoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3kuTsaQm6t7Kz6DXYAqAe6NT7nIQ%26client%3Dca-pub-8258884324894592%26adurl%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:fe00:1e:a43d:b640:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 May 2022 19:25:22 GMT
via: 1.1 f358cf5f46d10c349187abd5e20e06ce.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: FRA56-C1
access-control-allow-methods: POST, OPTIONS
p3p: P3P policyref="http://secure-gl.imrworldwide.com/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM"
access-control-allow-origin: *
cache-control: no-cache
cross-origin-resource-policy: cross-origin
x-cache: Miss from cloudfront
accept-ch: Sec-CH-Save-Data, Sec-CH-DPR, Sec-CH-Width, Sec-CH-Viewport-Width, Sec-CH-Viewport-Height, Sec-CH-Device-Memory, Sec-CH-RTT, Sec-CH-Downlink, Sec-CH-ECT, Sec-CH-Prefers-Color-Scheme, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version
content-length: 0
x-amz-cf-id: 7gGbjkQvYUEpvGalj6FgluE5dtCDvpItUk3KPhjUaNXpvZk5arOE4w==
expires: Thu, 01 Dec 1994 16:00:00 GMT

GET
H2 200 lg.php
cat.fr.eu.criteo.com/delivery/ Frame 1226 43 B
348 B 63ms
18ms Image
image/gif 178.250.0.160
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cat.fr.eu.criteo.com/delivery/lg.php?cppv=3&cpp=bNmF3vEQXosB4o_DSZQa_qdMyZ4JJ3l2c-tpK_Bsw0HOnz7dgXNcWTp-6Vu-3naXZx28yHuWwI6h2ZoZGPaRYj8TW9oc8Qi7jXshHs-Jgdpgbo1tFXFJMEexeZv7bsFBmzDNH5XPHPhy1Qm0FDQQxk_hI_Dxbe0mO1ghqmEkXdvae3BLw50y2ElhoIcYOZi48-3gz_nPc8kCi0WVYA8r4TNW5o3GvyzU5uZYyNXnbnUKdW5WiW22rdUY_9H23aSp0AKuhldsVftdrYieoK7iVCPI0bxnEblnIROFYyZ7Sggo9Dfl23SQW67SkWwmNjGuTaefOfcg3XAL0rapRB0SxGsoTkgwBqL2QKLjalNFLLVzxP7tdO6BcSoplwYWF5oYxLCqDJPlIRXSAZTioLqotqjp2Kwkcngc-jp7PzoxTm7maNkAHWAtXibyv-mk1ZhU8XLyAQ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.0.160 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 May 2022 19:25:22 GMT
server: Kestrel
strict-transport-security: max-age=31536000; preload;
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 2682400
content-type: image/gif
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 animejs.js Show response
static.criteo.net/animejs/ Frame 1226 12 KB
6 KB 42ms
26ms Script
text/javascript 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.criteo.net/animejs/animejs.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:22 GMT
content-encoding: gzip
last-modified: Tue, 26 Mar 2019 17:44:11 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5c9a64eb-3181"
strict-transport-security: max-age=31536000; preload;
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 May 2023 19:25:22 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 1226 5 KB
5 KB 61ms
12ms Image
image/png 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?h=244&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fstatic.fr.eu.criteo.net%2Fdesign%2Fdt%2F2861%2F190124%2F8d6bc06124f044d4973e0db21c495799_logo.png&v=3&w=196&s=1VjkrEGz0-tU4Tlj32yh-jEc

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

080069b2dce01872cbc2bfcc0b6a2cd9b9a5b9fbb22fc1683ece0cea17aac96f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:22 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/png
cache-control: public, max-age=30866303
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 5106
expires: Thu, 18 May 2023 01:23:46 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 1226 1 KB
1 KB 61ms
13ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FB%2FlogoBKA_Bundeskriminalamt_4558DE.gif%3Feb%3D1&v=3&w=400&s=GVnKI3ywx2pDN-sz0JRgKSSP&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

e4b58a351151e4da3ebfac8c923fc7c19c7bbbd6696d716a2f3465bf869f1138

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:22 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=983928
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 1266
expires: Mon, 06 Jun 2022 04:44:10 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 1226 1 KB
2 KB 62ms
14ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F8%2FlogoZenjob-GmbH-Extern-253922DE-2205131531.gif%3Feb%3D1&v=3&w=400&s=lp0pCR0WxEkaS3DzcFeHomIL&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

8ab72c25d71e12f99d7b3588afdbf14c8766294a33871a3484698cfe05605b97

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:22 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=1556816
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 1480
expires: Sun, 12 Jun 2022 19:52:19 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 1226 3 KB
3 KB 71ms
23ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FD%2FlogoConcentrix-Germany-169413DE.gif%3Feb%3D1&v=3&w=400&s=MLCPOuNtUjk_FrjlqcdavKOt&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

c38e076da21dc997a97ba46c2464b656b9ab308a34318c250fb42b77e0588172

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=1686379
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 3064
expires: Tue, 14 Jun 2022 07:51:42 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 1226 1 KB
1 KB 71ms
23ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FJ%2FlogoJS_Deutschland_GmbH_24984DE.gif%3Feb%3D1&v=3&w=400&s=t5TW_8UYa2eFuuuPo_Q7nmQe&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

639665b9e97aad7d30114d5b9b4d4b391d1ee6e870fd4515ec28e5a24c22863a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=2159203
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 1100
expires: Sun, 19 Jun 2022 19:12:06 GMT

GET
H2 404 img
pix.eu.criteo.net/img/ Frame 1226 43 B
243 B 61ms
13ms Image
image/gif 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F%3Feb%3D1&v=3&w=400&s=NIvm77xmry_g62aq4_FPS5A1&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:22 GMT
server: Finatra
vary: Origin
content-type: image/gif
cache-control: private, max-age=0
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 43
expires: -1

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 1226 2 KB
2 KB 21ms
21ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2FM%2FlogoMonster-Energy-Europe-Limited-146403DE.gif%3Feb%3D1&v=3&w=400&s=DVmltW13WHthgOkGHdbpCIcu&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

f061964e05339fd4e8614c885e1cd9d33830b14e2481b70c100f9ba4d1cb5bf4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:21 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=1887345
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 1634
expires: Thu, 16 Jun 2022 15:41:08 GMT

GET
H2 200 img
pix.eu.criteo.net/img/ Frame 1226 3 KB
3 KB 16ms
16ms Image
image/webp 178.250.2.135
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F1%2FlogoAURELIUS-Wachstumskapital-SE-Co-KG-204508DE.gif%3Feb%3D1&v=3&w=400&s=-WwxvwNJBL-hGadOscvhb2tj&b=400

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.135 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

pix.am5.vip.prod.criteo.com

Software

Finatra /

Resource Hash

27410d49020a061b06d17ede9b0f749f49610fa19ee823ec6f8ad25b363928b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:22 GMT
last-modified: Wed, 4 Jun 2008 06:06:06 GMT
server: Finatra
vary: Origin
content-type: image/webp
cache-control: public, max-age=3118
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload;
timing-allow-origin: *
content-length: 2668
expires: Wed, 25 May 2022 20:17:21 GMT

POST
H2 200 all
csm.eu.criteo.net/ Frame 1226 0
128 B 54ms
13ms Ping
text/plain 178.250.2.150
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://csm.eu.criteo.net/all?cppv=3&cpp=3yWPmM4cGcIF6CGs1XmRHa1zom-i4EI1TuEXomlDJWcPIOvR5ic2U7osQXw0C1pWXlVXbWXMOWRYy-liCIra8oIgAIYFq99UAj4PNBM6rK4zH7FXFcS1H3VDCYbr0hMfuVjMNoPaOS1UHP7tMZ_u8zjgE0S_a9MPisf-Y2d9mw71VFrn1rPDq-LslLMgJRr6bCy6lUfJKjw4fXowbN_eMU8FIZAKacKW7QVouLqQYVuKkY0swCEa52Gbo-rAvNLs3NfNmg&sds=2&rev=81571&sendBeacon=true

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.150 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 25 May 2022 19:25:22 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H2 200 criteo_logo_2021.svg
static.criteo.net/flash/icon/ Frame 1226 2 KB
1 KB 22ms
21ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/criteo_logo_2021.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:22 GMT
content-encoding: gzip
last-modified: Thu, 27 May 2021 13:21:59 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"60af9cf7-891"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 May 2023 19:25:22 GMT

GET
H2 200 privacy.svg
static.criteo.net/flash/icon/ Frame 1226 2 KB
1 KB 16ms
15ms Image
image/svg+xml 2a02:2638:1::3
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://static.criteo.net/flash/icon/privacy.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

nginx /

Resource Hash

095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ads.eu.criteo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:22 GMT
content-encoding: gzip
last-modified: Wed, 19 Feb 2020 10:57:21 GMT
server: nginx
cross-origin-embedder-policy: require-corp
etag: W/"5e4d1491-646"
strict-transport-security: max-age=31536000; preload;
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31104000, public
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
expires: Sat, 20 May 2023 19:25:22 GMT

GET
H3 200 d621b03a35f4c7525d5f66bc0317e797.js Show response
www.gstatic.com/mysidia/ Frame 0912 9 KB
4 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/d621b03a35f4c7525d5f66bc0317e797.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8258884324894592&output=html&h=280&adk=165795807&adf=2670469432&pi=t.aa~a.2653543905~i.48~rp.4&w=464&fwrn=4&fwrnh=100&lmt=1613484948&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1352714303&psa=0&ad_type=text_image&format=464x280&url=https%3A%2F%2Fwww.educationmoney.com%2F&fwr=0&pra=3&rh=116&rw=464&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653506722048&bpp=3&bdt=867&idt=4&shv=r20220523&mjsv=m202205190101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D536cd7643b953d41-220186ee9ccd0048%3AT%3D1653506721%3ART%3D1653506721%3AS%3DALNI_MYV85VBjifRcZC15pkUYEAu36FWXg&prev_fmts=0x0&nras=2&correlator=8708985192171&frm=20&pv=1&ga_vid=357035125.1653506722&ga_sid=1653506722&ga_hid=938181054&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=571&ady=1434&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44763505&oid=2&pvsid=12748678052473&pem=482&tmod=451745296&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=sQMeTpJVus&p=https%3A//www.educationmoney.com&dtd=13

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cba179f85e06c1302fec3484afc33d4e658aa2841564b64f31dc81dff33300ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 08:13:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40296
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3695
x-xss-protection: 0
last-modified: Mon, 23 May 2022 17:08:23 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 23 Aug 2022 08:13:47 GMT

GET
H3 200 084bb25c91fc73679f62a829a32ca187.js Show response
www.gstatic.com/mysidia/ Frame 0912 8 KB
4 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/084bb25c91fc73679f62a829a32ca187.js?tag=text/vanilla_highlight

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

59ab594e0d935b3bd15e4d696041dfbfcbab78af973a6efa6be27ba8bf10e128

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 08:13:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40296
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3685
x-xss-protection: 0
last-modified: Thu, 12 May 2022 07:58:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 23 Aug 2022 08:13:47 GMT

GET
H2 200 css
fonts.googleapis.com/ Frame 0912 8 KB
1 KB 81ms
24ms Stylesheet
text/css 2a00:1450:4001:828::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8393b0f49cbaac879bc0a89a8d6fc918081a21fd4b13e5ae4416d2c1afbcca92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 25 May 2022 18:02:21 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 25 May 2022 19:25:23 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 25 May 2022 19:25:23 GMT

GET
H3 200 load_preloaded_resource_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame 0912 2 KB
904 B 32ms
18ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/load_preloaded_resource_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:18:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 442
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 877
x-xss-protection: 0
server: cafe
etag: 13035868154101442325
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Jun 2022 19:18:01 GMT

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/ Frame 0912 21 KB
8 KB 46ms
14ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/abg_lite_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a3e6b838865eecbe0ee045e938c1d6900646ccdd8a832cdd6cbe1a407a49df1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:16:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 506
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8674
x-xss-protection: 0
server: cafe
etag: 5611795670272045494
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Jun 2022 19:16:57 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame 0912 3 KB
1 KB 32ms
18ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/window_focus_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:18:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 386
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Jun 2022 19:18:57 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/ Frame 0912 17 KB
7 KB 47ms
15ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220523/r20110914/client/qs_click_protection_fy2019.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ced80dc0b36469ade9a5e4a3c86bde068904125a1162f712f20629eeadb8e53a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:24:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 48
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 7308
x-xss-protection: 0
server: cafe
etag: 5721884612586531857
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 08 Jun 2022 19:24:35 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 0912 0
0 73ms
21ms Image
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS8yhf_gAqzeOo_StdQIr6AMhbC6J8moeuHooEUa5ozFha1HVwi3ULcxP2-4hoRxqH5h-qo8oWStZ4WZFOyff4i-mO9uA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8258884324894592&output=html&h=280&adk=165795807&adf=2670469432&pi=t.aa~a.2653543905~i.48~rp.4&w=464&fwrn=4&fwrnh=100&lmt=1613484948&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1352714303&psa=0&ad_type=text_image&format=464x280&url=https%3A%2F%2Fwww.educationmoney.com%2F&fwr=0&pra=3&rh=116&rw=464&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653506722048&bpp=3&bdt=867&idt=4&shv=r20220523&mjsv=m202205190101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D536cd7643b953d41-220186ee9ccd0048%3AT%3D1653506721%3ART%3D1653506721%3AS%3DALNI_MYV85VBjifRcZC15pkUYEAu36FWXg&prev_fmts=0x0&nras=2&correlator=8708985192171&frm=20&pv=1&ga_vid=357035125.1653506722&ga_sid=1653506722&ga_hid=938181054&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=571&ady=1434&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44763505&oid=2&pvsid=12748678052473&pem=482&tmod=451745296&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=sQMeTpJVus&p=https%3A//www.educationmoney.com&dtd=13
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 0912 136 KB
42 KB 146ms
95ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ecfc5a4d72d8f9fc774268cda69765e8578cd3a3859b229288b10c36acb0b35

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42522
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1653305577626270"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 25 May 2022 19:25:23 GMT

GET
H3 200 937d951ae0167fdfcf48a5545b1fd715.js Show response
www.gstatic.com/mysidia/ Frame 0912 30 KB
12 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/937d951ae0167fdfcf48a5545b1fd715.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b84c26fc972d527005b6353058ff181ca9dfbb9047bed018e6b019f965d3cdc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 08:13:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 40296
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 12375
x-xss-protection: 0
last-modified: Mon, 23 May 2022 17:08:23 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 23 Aug 2022 08:13:47 GMT

GET
H3 200 downsize_200k_v1
tpc.googlesyndication.com/simgad/2243966778616467962/ Frame 0912 3 KB
3 KB 30ms
20ms Image
image/png 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/2243966778616467962/downsize_200k_v1?w=100&h=100

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6359eace8c50b983f2e52c14c265a66014e7543d318556eb3ba85f945422c22f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Tue, 24 May 2022 06:07:00 GMT
x-content-type-options: nosniff
age: 134303
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2720
x-xss-protection: 0
last-modified: Fri, 07 Jan 2022 09:42:57 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 24 May 2023 06:07:00 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 0912 0
0 58ms
57ms Fetch
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=Cqdl0ooKOYsyREcmMpt8Pyuab6ATk6_HaaZLY7dryD7rwwObmLhABIMvmxj9gldKhgrAHoAHojoaMA8gBAakCHusP_FWzSz6oAwGqBO8BT9B_Yut-M8n08esSUPj0l-cZSa2b3Wi_xupnp3qjbpi4exEaqR0TuL9E5DjLAcO6bh4TURlivIJbVxW6grc4xfcSZC4Ythbi_-MgeoUVFImnp53yMnIzSICEpA8BW_hAIx-dj90D788ts-9rdTjiVou0-Qzg7bMVqxbjMn976bxG67mSr3t1oB3f0uscouNLyZdMKOCqEq-bAtGTC6cpnCD42jpJHNbSgFyOA6E0CJkfNStSDX1pzBuDAfI9H0KY2aeK8HYmCQL1CLwEOVrC4koAg7gJTx39FjX67Zu9InnmzDN05JNa45XNEoaDJUPABIaHjeqHBJIFBAgEGAGSBQQIBRgEgAeA8flzqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhvYBwHyBwQQgsBh0ggJCIDhgBAQARgfgAoByAsB2BMN0BUBmBYBgBcBshccChoIABIUcHViLTgyNTg4ODQzMjQ4OTQ1OTIYAA&sigh=GBBMAfO7d6s&uach_m=[UACH]&template_id=5001

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8258884324894592&output=html&h=280&adk=165795807&adf=2670469432&pi=t.aa~a.2653543905~i.48~rp.4&w=464&fwrn=4&fwrnh=100&lmt=1613484948&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1352714303&psa=0&ad_type=text_image&format=464x280&url=https%3A%2F%2Fwww.educationmoney.com%2F&fwr=0&pra=3&rh=116&rw=464&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653506722048&bpp=3&bdt=867&idt=4&shv=r20220523&mjsv=m202205190101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D536cd7643b953d41-220186ee9ccd0048%3AT%3D1653506721%3ART%3D1653506721%3AS%3DALNI_MYV85VBjifRcZC15pkUYEAu36FWXg&prev_fmts=0x0&nras=2&correlator=8708985192171&frm=20&pv=1&ga_vid=357035125.1653506722&ga_sid=1653506722&ga_hid=938181054&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=571&ady=1434&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44763505&oid=2&pvsid=12748678052473&pem=482&tmod=451745296&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=sQMeTpJVus&p=https%3A//www.educationmoney.com&dtd=13
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Wed, 25 May 2022 19:25:23 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 5397 143 B
163 B 14ms
14ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8258884324894592&output=html&h=280&adk=165795807&adf=2670469432&pi=t.aa~a.2653543905~i.48~rp.4&w=464&fwrn=4&fwrnh=100&lmt=1613484948&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1352714303&psa=0&ad_type=text_image&format=464x280&url=https%3A%2F%2Fwww.educationmoney.com%2F&fwr=0&pra=3&rh=116&rw=464&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653506722048&bpp=3&bdt=867&idt=4&shv=r20220523&mjsv=m202205190101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D536cd7643b953d41-220186ee9ccd0048%3AT%3D1653506721%3ART%3D1653506721%3AS%3DALNI_MYV85VBjifRcZC15pkUYEAu36FWXg&prev_fmts=0x0&nras=2&correlator=8708985192171&frm=20&pv=1&ga_vid=357035125.1653506722&ga_sid=1653506722&ga_hid=938181054&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=571&ady=1434&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44763505&oid=2&pvsid=12748678052473&pem=482&tmod=451745296&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=sQMeTpJVus&p=https%3A//www.educationmoney.com&dtd=13
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 12
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
date: Wed, 25 May 2022 19:25:11 GMT
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame E448 1 KB
749 B 15ms
14ms Document
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 48699
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 25 May 2022 05:53:44 GMT
etag: 48472445140208031
expires: Thu, 26 May 2022 05:53:44 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 0912 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fb15a03f8543138646e42ab366659b79101b536ccae3b5ae059c422dd73c50ee

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 dpixel
cms.quantserve.com/ Frame E448 35 B
463 B 35ms
9ms Image
image/gif 2620:116:800d:21:c5a4:625:6563:a5bb
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEAmrjgeBgsa4EKdvHBErdG4&google_cver=1&google_push=AYg5qPJCB_EBQvNIhsPSPyjxh8104L0cMiFfAOKOV9v41yTyJiqACkYvQumDOT4tfXjs_XO9vMCZjcwHZmPz1KoRydTHxEn3uWM

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:c5a4:625:6563:a5bb , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 May 2022 19:25:23 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E448
Redirect Chain

https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKQo5Ca...
https://e.dlx.addthis.com/e/a-1189/s-3614?redirect_provider_id=3614&ru=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Ddatalogix_dmp%26google_hm%3D%3CNA_ID%3E%26google_push%3DAYg5qPKQo5Ca...
https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA1MjUxOTI1MjMwMDAxMDY0OTgxMDEzOQ%3D%3D&google_push=AYg5qPKQo5CafRpEov9-thEa3SjhA6b0_y9bkFD_1pHltD60t0ZxAd0JgCpAMCguAhGKON...

170 B
188 B

22ms
22ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA1MjUxOTI1MjMwMDAxMDY0OTgxMDEzOQ%3D%3D&google_push=AYg5qPKQo5CafRpEov9-thEa3SjhA6b0_y9bkFD_1pHltD60t0ZxAd0JgCpAMCguAhGKONTcVco4y345N6e53MBRVrWvOnkc9A

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 May 2022 19:25:24 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=datalogix_dmp&google_hm=MjAyMjA1MjUxOTI1MjMwMDAxMDY0OTgxMDEzOQ%3D%3D&google_push=AYg5qPKQo5CafRpEov9-thEa3SjhA6b0_y9bkFD_1pHltD60t0ZxAd0JgCpAMCguAhGKONTcVco4y345N6e53MBRVrWvOnkc9A
pragma: no-cache
date: Wed, 25 May 2022 19:25:24 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Wed, 25 May 2022 19:25:24 GMT

GET
H2 200 dds
rtb.openx.net/sync/ Frame E448 43 B
351 B 65ms
27ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESECNp5_DcZobQwotGxSeGiYE&google_cver=1&google_push=AYg5qPKTxUp7x8NiOA5bqk-JyJwkNT3MVIhEnbyLqwmzrNfQddQhfWW5oYfgi_CIXxiL8AEm0G65LSB2_L3hZjet_Wr0eoJggWo
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8258884324894592&output=html&h=280&adk=165795807&adf=2670469432&pi=t.aa~a.2653543905~i.48~rp.4&w=464&fwrn=4&fwrnh=100&lmt=1613484948&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1352714303&psa=0&ad_type=text_image&format=464x280&url=https%3A%2F%2Fwww.educationmoney.com%2F&fwr=0&pra=3&rh=116&rw=464&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653506722048&bpp=3&bdt=867&idt=4&shv=r20220523&mjsv=m202205190101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D536cd7643b953d41-220186ee9ccd0048%3AT%3D1653506721%3ART%3D1653506721%3AS%3DALNI_MYV85VBjifRcZC15pkUYEAu36FWXg&prev_fmts=0x0&nras=2&correlator=8708985192171&frm=20&pv=1&ga_vid=357035125.1653506722&ga_sid=1653506722&ga_hid=938181054&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=571&ady=1434&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44763505&oid=2&pvsid=12748678052473&pem=482&tmod=451745296&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=sQMeTpJVus&p=https%3A//www.educationmoney.com&dtd=13
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 May 2022 19:25:22 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: virgg6depi14bqn3hoicgpduj3l0hbmh

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E448
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=hvTN7Zt6T4Ship3WehA35w%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

24ms
24ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=hvTN7Zt6T4Ship3WehA35w%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK9N1KFvYtN31V__NoY-vgzohTtuAyIdVqst6MSBixYrK-aSaLf54MshSoJ52l3s2t4B4JLlom_ghzAAdOyhizKe0nRJjE

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 May 2022 19:25:23 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=hvTN7Zt6T4Ship3WehA35w%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPK9N1KFvYtN31V__NoY-vgzohTtuAyIdVqst6MSBixYrK-aSaLf54MshSoJ52l3s2t4B4JLlom_ghzAAdOyhizKe0nRJjE
date: Wed, 25 May 2022 19:25:23 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame E448
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDlFR7wLklrqFPx5YUtgyt0&google_cver=1&google_push=AYg5qPJHiKFFdrW9MdMrQWgkldLQr47s10T_ejWDYL7ITb-Q19DG2f60wBZp_oa9HRgmboXq9fK...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDNMWjdMMFctMS1NQlU0&google_push=AYg5qPJHiKFFdrW9MdMrQWgkldLQr47s10T_ejWDYL7ITb-Q19DG2f60wBZp_oa9HRgmboXq9fKCNzb2nZA2j4Yb6VsN2Ni1XTs

170 B
329 B

23ms
23ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDNMWjdMMFctMS1NQlU0&google_push=AYg5qPJHiKFFdrW9MdMrQWgkldLQr47s10T_ejWDYL7ITb-Q19DG2f60wBZp_oa9HRgmboXq9fKCNzb2nZA2j4Yb6VsN2Ni1XTs

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 May 2022 19:25:23 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TDNMWjdMMFctMS1NQlU0&google_push=AYg5qPJHiKFFdrW9MdMrQWgkldLQr47s10T_ejWDYL7ITb-Q19DG2f60wBZp_oa9HRgmboXq9fKCNzb2nZA2j4Yb6VsN2Ni1XTs
Cache-Control: no-cache,no-store,must-revalidate
Content-Type: text/html
content-length: 0
X-RPHost: de8527bfa1ccfd6c1590da0d3b6cff52
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame E448
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEC6uCKQfmNzvLQwTQ80zTjQ&google_cver=1&googl...
https://ssum-sec.casalemedia.com/usermatchredir?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_cver=1&google_gid=CAESEC6uCKQfmNzvLQwTQ80zTjQ&google_push=AY...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yo6Co-NypYdnE8zz08HFHQAABGMAAAAB&google_gid=CAESEC6uCKQfmNzvLQwTQ80zTjQ&google_push=AYg5qPLRarWF8w43W3EYsrpY3H9yreaFmcK4k9Gsoj9ApYGYGQE...

170 B
188 B

52ms
25ms

Image
image/png

142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yo6Co-NypYdnE8zz08HFHQAABGMAAAAB&google_gid=CAESEC6uCKQfmNzvLQwTQ80zTjQ&google_push=AYg5qPLRarWF8w43W3EYsrpY3H9yreaFmcK4k9Gsoj9ApYGYGQELSCvyLkxeSIT6CXNAewxUbM_PoyptwH7c2tV_jRXX3ICgKAc&google_cver=1

Requested by

Protocol

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 May 2022 19:25:23 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 25 May 2022 19:25:23 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=Yo6Co-NypYdnE8zz08HFHQAABGMAAAAB&google_gid=CAESEC6uCKQfmNzvLQwTQ80zTjQ&google_push=AYg5qPLRarWF8w43W3EYsrpY3H9yreaFmcK4k9Gsoj9ApYGYGQELSCvyLkxeSIT6CXNAewxUbM_PoyptwH7c2tV_jRXX3ICgKAc&google_cver=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 459
Expires: Wed, 25 May 2022 19:25:23 GMT

GET
H2 200 trk
ag.innovid.com/ Frame E448 43 B
297 B 159ms
21ms Image
image/gif 2a05:d01c:1d8:8100:a0fe:f5a6:9720:1a18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ag.innovid.com/trk?tid=11711&google_gid=CAESEAodXRvP8K9VBwx5ENPa6Sk&google_cver=1&google_push=AYg5qPID5Qf-D8-INk9tJrTRA1hjMFPkLp5MjeYlP-xR6ccnUnvqqrUqyC0wr-T7PJPTCsTPH4FQrQ9FTvpvqqyNuM6iyJaOQQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-8258884324894592&output=html&h=280&adk=165795807&adf=2670469432&pi=t.aa~a.2653543905~i.48~rp.4&w=464&fwrn=4&fwrnh=100&lmt=1613484948&num_ads=1&rafmt=1&armr=3&sem=mc&pwprc=1352714303&psa=0&ad_type=text_image&format=464x280&url=https%3A%2F%2Fwww.educationmoney.com%2F&fwr=0&pra=3&rh=116&rw=464&rpe=1&resp_fmts=3&wgl=1&fa=27&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&dt=1653506722048&bpp=3&bdt=867&idt=4&shv=r20220523&mjsv=m202205190101&ptt=9&saldr=aa&abxe=1&cookie=ID%3D536cd7643b953d41-220186ee9ccd0048%3AT%3D1653506721%3ART%3D1653506721%3AS%3DALNI_MYV85VBjifRcZC15pkUYEAu36FWXg&prev_fmts=0x0&nras=2&correlator=8708985192171&frm=20&pv=1&ga_vid=357035125.1653506722&ga_sid=1653506722&ga_hid=938181054&ga_fc=0&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=571&ady=1434&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759875%2C44759926%2C44759842%2C44763505&oid=2&pvsid=12748678052473&pem=482&tmod=451745296&uas=0&nvt=1&eae=0&fc=1408&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&ifi=2&uci=a!2&btvi=1&fsb=1&xpc=sQMeTpJVus&p=https%3A//www.educationmoney.com&dtd=13
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:d01c:1d8:8100:a0fe:f5a6:9720:1a18 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 May 2022 19:25:23 GMT
cache-control: no-cache
content-type: image/gif
content-length: 43
request-time: 0
expires: -1

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame E448 0
223 B 65ms
24ms Image
text/html 142.250.184.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13ILHZiLlaOxANJh7Ip2oveWVGECev7PoRn1kw6c1cE1I_FPJMVMDD8_LKFDnUTAeRHXw7EP

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:23 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 5397
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
16 B

69ms
68ms

Document
text/html

2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 25 May 2022 19:25:23 GMT
expires: Wed, 25 May 2022 19:25:23 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 25 May 2022 19:25:23 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v44/ Frame 0912 28 KB
28 KB 51ms
20ms Font
font/woff2 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v44/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d210f7d18b1a67c12052541793c3fc63a9175ec1809b7988b9b9a13a4b50e16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Tue, 24 May 2022 22:12:07 GMT
x-content-type-options: nosniff
age: 76396
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28276
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 19:33:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 24 May 2023 22:12:07 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 13 KB
10 KB 58ms
28ms XHR
application/json 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20220523&st=env

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5014cecbd874aaa3ee4ec5c1ee76a47f2a077da23f9f2bfaadeb20e8333c8625

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 25 May 2022 19:25:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10466
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 38ms
38ms Script
text/javascript 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 25 May 2022 19:25:23 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 85C5 13 KB
5 KB 16ms
15ms Document
text/html 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.educationmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 54
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 25 May 2022 19:24:29 GMT
expires: Thu, 25 May 2023 19:24:29 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame BD18 783 B
534 B 50ms
49ms Document
text/html 2a00:1450:4001:811::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

711f0eb193acdcfcf6fa09116ef66325117ed2cad99e0b03b742530c4e098dc3

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-J-xxysjqMfe9EowSYjL01Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.educationmoney.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 512
content-security-policy: script-src 'report-sample' 'nonce-J-xxysjqMfe9EowSYjL01Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 25 May 2022 19:25:23 GMT
expires: Wed, 25 May 2022 19:25:23 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 AAcrpHDydyl_zLrsUqLIoJaIpM6fuyfNuw3JGtq9cUA.js Show response
pagead2.googlesyndication.com/bg/ Frame 85C5 35 KB
13 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/AAcrpHDydyl_zLrsUqLIoJaIpM6fuyfNuw3JGtq9cUA.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

00072ba470f277297fccbaec52a2c8a09688a4ce9fbb27cdbb0dc91adabd7140

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 09:19:03 GMT
content-encoding: br
x-content-type-options: nosniff
age: 36380
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13604
x-xss-protection: 0
last-modified: Tue, 17 May 2022 14:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 25 May 2023 09:19:03 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame BD18 0
0 62ms
62ms Image
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20220523&jk=12748678052473&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 5BD0 42 B
64 B 47ms
47ms Fetch
image/gif 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsswQM1L6gIC7x0owCuXKlctG03cLueIP6TAnbc6_peg4JkpqTNtoU3mMFmeyFOlT-ik7LvPX75LuN-lfkyYvhQv&sig=Cg0ArKJSzLTnkXQ2NiO1EAE&id=lidar2&mcvt=1004&p=0,0,124,1005&mtos=82,771,1004,1121,1255&tos=82,689,233,117,134&v=20220523&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1653506722085&rpt=156&met=ie&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 25 May 2022 19:25:23 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 85C5 0
9 B 14ms
14ms Image
text/plain 2a00:1450:4001:828::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?5kRkJw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:828::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

date: Wed, 25 May 2022 19:25:23 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

POST
H2 200 all
csm.eu.criteo.net/ Frame 1226 0
127 B 14ms
14ms Ping
text/plain 178.250.2.150
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.150 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Finatra /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Referer: https://ads.eu.criteo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: *
date: Wed, 25 May 2022 19:25:22 GMT
cross-origin-resource-policy: cross-origin
server: Finatra
content-length: 0
strict-transport-security: max-age=31536000; preload;

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 65ms
65ms Image
text/html 2a00:1450:4001:810::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20220523&jk=12748678052473&bg=!aWqlai7NAAZ4vKt9WLw7ACkAdvg8WjzhuK9ZbH4T6Zg7sYYlipB6T8VfbkeUERS6e2uCNeMHpuFutwIAAABSUgAAAAJoAQeZAp-_jLDV4UXo1CiP0QaZGlUAGjKupAu0M1IV3s2KDL9xgRfmoxCdX2DTJIJSYdmKn1GvFV99VzwZ0qWLdnM4dyb5YRKuGoRPEx06Q1ZMhE7Wlqo_Sih2ccNUrXje7VbpfV5-CdyYvGTUM46WkoaKDiHZxfcG6XVYfDU2ao_vZ7BwZRAiLlTlI7leYLf5C4yWLiCz7DytB6ewJLj8cXoGkyYSPnHhz8RV8Oxyv9z_n7V71Spi6PmaDagQXSR2AepAQUHkm0V8xlhoz2rbccak8swHjKLU-jG6JoUcnWvWRxGodOjaoModQ4kSxPfLQHHIWQ5PxGcv3pa1c8tlVA8Vd9LT6Oi7MEhnkf0yeTtSrXusXaePm24Hv3n_IioYowvPbLhI0TU8b8aoI_c6WOP-RRvDbJ8EWCd6bbeh2ngLwxHrircuKbq5_zQyTuR_7Q0eZ-v2XGDjkMcZnDV7wCyeXCL_DuLdK1VMsdjkFIgz_qS_0fTZG-lg-574sq7O-J6JW3IRxPMZEvwSnTPFQMhWrB-FbHRB4smLVNMkk4F_9iA72u4C-h08aMgRdWs9KPKY7FuzgK6rO3pILkFJD32AZOl2LEaz6HydGGQeaiF71dA7zKwnY8dBtQTFrmdNQ6W8qMnscC1wvGCsqjZ5XqEVURqnRvAzKBWkm5C269RNctJ_rWnDBN0ay92vLVR1Ev0s_ehHnXX2yIw8gWRr9BTIELFpfBt0k9V3VAKZqIbzFtcrRrGo_YKwYYJ3mO2N5o18P3rIzGGmH_CmHUN0VMNM_i9lhZ1B-Zmc4NX3favur2RDU_HCXmxDfod0h_44sfiLR-bwGTCjOcCeKzbaAmC-poR8mchUgNIAjanAWDDZvckvplt-x3TjJohxd3SontoscA
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.educationmoney.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

POST
H3 200 log_event Show response
www.youtube.com/youtubei/v1/ Frame A3FC 28 B
54 B 28ms
28ms XHR
application/json 2a00:1450:4001:813::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/c5a4daa1/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type: application/json
X-YouTube-Utc-Offset: 0
X-YouTube-Client-Name: 56
Referer: https://www.youtube.com/embed/U45lizyqIic
X-YouTube-Client-Version: 1.20220522.00.00
X-YouTube-Time-Zone: Etc/Unknown
X-Goog-Visitor-Id: CgtfcS1vcGxqUEk5QSihhbqUBg%3D%3D
X-YouTube-Ad-Signals: dt=1653506721561&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C230%2C173&vis=1&wgl=true&ca_type=image

Response headers

date: Wed, 25 May 2022 19:25:24 GMT
content-encoding: br
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN
vary: Origin, X-Origin, Referer
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 31
x-xss-protection: 0
expires: Wed, 25 May 2022 19:25:24 GMT

Verdicts & Comments Add Verdict or Comment

88 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

26 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.educationmoney.com/	1970-01-20 20:49:38	Name: sc_is_visitor_unique Value: rx11275568.1653506721.9FBCCAA759FB4FBC78D9267250A3645E.1.1.1.1.1.1.1.1.1
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: njsjlPX-JnI
.youtube.com/	1970-01-20 07:37:38	Name: VISITOR_INFO1_LIVE Value: _q-opljPI9A
.statcounter.com/	1970-01-21 23:06:12	Name: is_unique Value: sc11275568.1653506721.0
.statcounter.com/	1970-01-20 20:49:24	Name: is_visitor_unique Value: 1653506721156377966
.educationmoney.com/	1970-01-20 12:40:02	Name: __gads Value: ID=536cd7643b953d41-220186ee9ccd0048:T=1653506721:RT=1653506721:S=ALNI_MYV85VBjifRcZC15pkUYEAu36FWXg
.doubleclick.net/	1970-01-20 12:40:02	Name: IDE Value: AHWqTUmv5PXKjajRe3vWxeZnU49Mufw1MksPWFU4LqAqdpJBOfd1lKwy4AnEbJ71-B0
.quantserve.com/	1970-01-20 05:28:02	Name: d Value: ECIBCQGcJoEA
.quantserve.com/	1970-01-20 12:48:41	Name: mc Value: 628e82a3-1abc6-d8338-e41ee
.casalemedia.com/	1970-01-20 12:04:02	Name: CMID Value: Yo6Co.NypYdnE8zz08HFHQAA
.casalemedia.com/	1970-01-20 05:28:02	Name: CMPS Value: 3163
.doubleclick.net/	1970-01-20 03:18:30	Name: DSID Value: NO_DATA
.innovid.com/	1970-01-20 05:28:02	Name: uuid Value: d0965494-71e8-43f3-93a5-d0e1bfd5fd02-20220525 15:25:23
.casalemedia.com/	1970-01-20 05:28:02	Name: CMPRO Value: 1123
.casalemedia.com/	1970-01-20 03:19:53	Name: CMST Value: Yo6Co2KOgqMA
.pubmatic.com/	1970-01-20 03:19:53	Name: KTPCACOOKIE Value: YES
.pubmatic.com/	1970-01-20 05:28:02	Name: KADUSERCOOKIE Value: 86F4CDED-9B7A-4F84-A18A-9DD67A1037E7
.e.dlx.addthis.com/	1970-01-20 12:48:41	Name: na_tc Value: Y
.addthis.com/	1970-01-20 12:48:41	Name: na_id Value: 2022052519252300010649810139
.addthis.com/	1970-01-20 12:48:41	Name: na_tc Value: Y
.addthis.com/	1970-01-20 12:48:41	Name: uid Value: 628e82a3b254344e
.addthis.com/	1970-01-20 12:48:41	Name: ouid Value: 628e82a30001e2998a7cf6363a6535ff85ae32a6a8b8f094c5ed
.dlx.addthis.com/	1970-01-20 04:01:38	Name: na_rn Value: 0
.dlx.addthis.com/	1970-01-20 04:01:38	Name: na_sr Value: 20220525
.dlx.addthis.com/	1970-01-20 03:18:26	Name: na_srp Value: 3614
.dlx.addthis.com/	1970-01-20 04:01:38	Name: na_sc_e Value: 0

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	URL: https://www.educationmoney.com/(Line 822) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://secure.statcounter.com/counter/counter.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.educationmoney.com/(Line 822) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://secure.statcounter.com/counter/counter.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network	error	URL: https://www.educationmoney.com/site.search.gif Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.educationmoney.com/site.search.grn.gif Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.educationmoney.com/site.search.red.gif Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://pix.eu.criteo.net/img/img?c=3&cq=256&h=400&m=0&partner=2861&q=80&r=0&u=http%3A%2F%2Fwww.stepstone.de%2Fupload_DE%2Flogo%2F%3Feb%3D1&v=3&w=400&s=NIvm77xmry_g62aq4_FPS5A1&b=400 Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.eu.criteo.com
adservice.google.com
adservice.google.de
ag.innovid.com
c.statcounter.com
cat.fr.eu.criteo.com
cm.g.doubleclick.net
cms.quantserve.com
connect.facebook.net
csm.eu.criteo.net
e.dlx.addthis.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
i.ytimg.com
image6.pubmatic.com
jnn-pa.googleapis.com
pagead2.googlesyndication.com
partner.googleadservices.com
pix.eu.criteo.net
pixel.rubiconproject.com
rtb.fr.eu.criteo.com
rtb.openx.net
secure-gl.imrworldwide.com
secure.statcounter.com
ssum-sec.casalemedia.com
static.criteo.net
static.doubleclick.net
tpc.googlesyndication.com
www.educationmoney.com
www.facebook.com
www.google.com
www.googletagservices.com
www.gstatic.com
www.youtube.com
yt3.ggpht.com
104.20.228.67
142.250.184.194
142.250.185.98
178.250.0.160
178.250.2.135
178.250.2.150
192.82.242.209
2.20.157.55
2600:3c03::f03c:92ff:fe05:debc
2600:9000:206f:fe00:1e:a43d:b640:93a1
2620:116:800d:21:c5a4:625:6563:a5bb
2a00:1450:4001:802::2003
2a00:1450:4001:803::2001
2a00:1450:4001:803::2016
2a00:1450:4001:808::2002
2a00:1450:4001:80e::2003
2a00:1450:4001:80e::2006
2a00:1450:4001:810::2002
2a00:1450:4001:811::2004
2a00:1450:4001:812::2002
2a00:1450:4001:813::2002
2a00:1450:4001:813::200e
2a00:1450:4001:828::2001
2a00:1450:4001:828::200a
2a00:1450:4001:829::200a
2a02:2638:1::3
2a02:2638::2
2a02:2638::b
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:d01c:1d8:8100:a0fe:f5a6:9720:1a18
35.186.253.211
69.173.144.165
69.192.160.219
00072ba470f277297fccbaec52a2c8a09688a4ce9fbb27cdbb0dc91adabd7140
080069b2dce01872cbc2bfcc0b6a2cd9b9a5b9fbb22fc1683ece0cea17aac96f
095c997695f6a290fdba58b778eb0a0fdcdd9c108669e41265527a262223f1e6
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0edefdbb2d9960f296b516b9217645a1c71416db3052c4c458d3c6526ef11f87
0fd5cf764972d1df9f1fb87a8bdd9e48787d890b2cb9661e55289923a6639e8d
10134df69ad2394f6374d310f19bb368937289afeb6e81c73ac2268a6f6dd4e4
13842c351abcc3de5eafbf9b334afe1dde5ecfb9e3cc99d947bd06117af75ffc
168b63c31d23fb4316b04f53a91acfb2efbe2a350ead9d890c671ffe96aad9db
1728900dc776f9294dcb18eb8134bcc76b01e254ee5bf7787aedb0600ba8c768
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
1b862a2ccbdafde414ca637050b73ab11f0a98c3572f890c0f84127846d517f7
1cd57716e44061e27878c07dbf5c3711aa08f97f0d03a3814a6439297ea72c7d
1ecfc5a4d72d8f9fc774268cda69765e8578cd3a3859b229288b10c36acb0b35
200ac470905f2c3b01a217be41297cbbe4c80ee4ee0087a92e9d7657169610d7
203b18a2629a2ef035deb07d8c9e51424ca98f9315543e4acce3f08361c9ac76
2380ad2259685cc9eaff048bfb6d79f5648b772e30f204d4427e42df680f0268
2718b494ae8d6907d39dd26df60394b5beedd56d1bbad695dbd452a91d0f4ce4
27410d49020a061b06d17ede9b0f749f49610fa19ee823ec6f8ad25b363928b0
2a1f6923acbeae8fe2795044d52ed5f67b0b5fea5edd0d86703556a3c64a80b7
2bb40a4ce957c08c50ab1ca4e0cdbf1572a6c368971e05d628c2193b29f35487
2c4980aefdce4dd6696edffc695f48187ce84a685af9be8cdd610111561a3283
38958459ac54077235bec3f9f59cfccb70e1fb34f120e83221bd5236dc33c010
396ca7f0dc5bc00a42de219e42e23267e49b5c22f84decccaeb717b84497b146
3b8886cb966a435c04bc978344dc4509d9eb1882b6b59d7a36b161163c2befc1
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
3ea373e48512da0b7e630f00010bd25678b227c5a8ab3f63d521982beb4434f2
444bec6366aeb81167594870416b55b59036c9152d9f4e2c2ddd1a22ff191713
44a77b26b27b71dec40322d6d72419c8c2d73e1e4cbf15b1b2c0764e06725c27
498b3f2a0357fbd50a80eb18b23ab4b461b791d640e5560b799f08ed960748a9
4b84c26fc972d527005b6353058ff181ca9dfbb9047bed018e6b019f965d3cdc
4d7bedaacd206864014c516e46f0a43e83eb0c2df67f4e29f965398bb43dc383
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5014cecbd874aaa3ee4ec5c1ee76a47f2a077da23f9f2bfaadeb20e8333c8625
51bad96ab4260d466d16c758a6e88c08d6a5d3d153592c2b0212bac3d29b59d3
5295ea6c0fb7b9c63dba351ba43a2e6833bc396e8a56f1be1d5db7d6603d69fd
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
572548cc6fe475bde1e1f0bc1a6f15819805ae423a6788cf41e4804e4bb1b9ed
59ab594e0d935b3bd15e4d696041dfbfcbab78af973a6efa6be27ba8bf10e128
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
6359eace8c50b983f2e52c14c265a66014e7543d318556eb3ba85f945422c22f
639665b9e97aad7d30114d5b9b4d4b391d1ee6e870fd4515ec28e5a24c22863a
66d02bbda60bd1f2e566716cab3ffcfd5dd3efa2c2de745404ad764783908e66
67b843c53f3a6cfa86187c1b9b76f400f14bde8455aa20641ea65fc509e28599
67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2
6b52d060a408513eeeb99563d13d1230a241fd18a7c9e3280ba644652d6ecec8
6c458c529c6dbfc574fd6b7a80af5faf8077cb8e35810f722a0469046678a23e
6da3b4e91f69d7289094f5e91fe7da56ec159fb61a26e9c05c7fa593b4eb76a1
6f62a5aeb2c0209a6e4572098e112e00ce17c5f434de670e753388886804ffcb
711f0eb193acdcfcf6fa09116ef66325117ed2cad99e0b03b742530c4e098dc3
725e869434fef8013208ed4c233d29744f9b363f867dcfb8f23e862880fa699a
7339fe12f332ac7ecd6e0ef04bb7a48fad9e74be887d67f458548ff33ea4db65
77c1f2a9b939c40689d8ee0e8a75be3a426c9341148251a18e1f5a4d62070781
7a487d46a028c374c609924015d8c7ef6dd28b613a3739aa97ed2080984775bb
7d210f7d18b1a67c12052541793c3fc63a9175ec1809b7988b9b9a13a4b50e16
819a7a475f6efb187a017babc236aeacd90fe602c4ce06c96f38d428ed67b3ad
8393b0f49cbaac879bc0a89a8d6fc918081a21fd4b13e5ae4416d2c1afbcca92
8497625687f46314eb285ba0f713e79b03056ad26e17b3edd7be97f29ad7397b
8570444d2e7c1cc2987f60d037acbcc97c7880e46c506af990083ac0114f6c6f
894762fd1d25c68a85c57d69af7e567456d50188a41a729cb3f066c398cb339c
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8ab72c25d71e12f99d7b3588afdbf14c8766294a33871a3484698cfe05605b97
8b6a66805f21df2ad98b78a86e55ff06b295b0cfb3472196c8817edcd4c07da6
8d2941546f89de0e1186029a4610caa720bd0c48783c8da44c4427e80112cc32
8ec89605fe3d580e9539c7b858e8f69ba4e26fe06377ebe04585397de23a7395
9594a2cd5ec38f47e385e1ee4a9eb2b50b15ea47c6f9d0c2cc695b3600393f82
975d333fe6a57fff1e0875a64b30e0697c13c159a6609972209bb2ae264c0349
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9bd229de4fcf0740584ff821ab4a0ca438fdd3da94c34ccf31b76617aa70d0b5
a0bd9bfaf4def6656a9233d93df518c01be681326e72cd9e00aa73fd29702b83
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a0e62ca4a82bef79bbe9dc2aba6c0782a7d8eca046bb1baa30ee91ec37931553
a2e14a498cfcc1b6920f069a9d657ad3c6fbbe217dd26dbfe54815db5107fed6
a3e6b838865eecbe0ee045e938c1d6900646ccdd8a832cdd6cbe1a407a49df1d
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a517663dd344f46e553c1c881ee6b2b0cfb16541238b12cca5510c4ffe38e4f8
a639b8370162244cb6e3ffaa62d1ffb5ee70ed5171d75698ce5e80b223ef4cb0
a71fdb2af0679f36edbf63eb7944dc2403c85572d9de916cfcb12bf6277c5c37
a9aa9ec7ef3ec92e7eb52220a9f0cb578ff2ba0a71cb3e9c1a0b828857529fcc
aad53fa60291be42db5c16ecf53ca8f72101ae6b89d6e599aacbfa0e3ba506d9
abaede74cce736979cb2cb78eabefa6c654384f3cedb61f5d4b2675c6229bfd9
adf4fb6407c8b87973b5192907086d7c20d550747cdbdefa8948614107701172
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3da98f42adfeb19d9c8fb50881c70c0969317d30e33fc7f2f643952ee7d929b
b4a584c3f5e03eeb8a22223ee5eaa8a8792573062da9dc58ba8bfc0675804eeb
ba22d8ee62e97778c8f91bd8c598092ac232cc6b71fe65f7f1dc7ad5fe9ef079
bc0cc0e8efb7b2d2672900ebfde33fa1d7e1b6ef15e1bad166de8bf1289b592c
becb55a378354595181e220f9a4440e873872a4baabc8b147f4fbf53634408b4
c0bc3be07587388188143cb937f57c41c1921c60d0ad0c1a278c9099b6fc26a6
c38e076da21dc997a97ba46c2464b656b9ab308a34318c250fb42b77e0588172
c562ef70e7efe0e28cda98045bb466fe5ecee28ec8cd9cd53b4d515a1b0d48d4
c6e1d4c278ea9167a2babd7993354ccefc90296eb580b29e186eb493ad309ca8
c7a9eedb197611dee3c7e4b95d2e0216741ba965ccf68fab86176ad405a177be
cba179f85e06c1302fec3484afc33d4e658aa2841564b64f31dc81dff33300ee
cce1b1c09bc6bd319b474f4a09df3f00d1793fe32dd150723aa1b420314a5a58
ce1e23eec62ea3c1b52e354a842e51ea07bedb24ee5ed6be100339dcdb1a9b22
ced80dc0b36469ade9a5e4a3c86bde068904125a1162f712f20629eeadb8e53a
cfb757fb5c0e5e55aafab2aa9a594ee667086b03cbbf6f33dafc3541843ea34b
d01c3e1094da8e50d8246859ef5cf0214734464c43e3ead4e4922d47661e9b95
d575fc14116b00adea0b06a786b3079d2fb3d7174804142b214d491e0afaa98a
d6932842cb870f04e9e0069ff3bbd90b815679065bf754735e56a4893ec12c66
d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336
da6a122e6ec365a084b69a701c08a52c3a39ed957124b6a8d38f8e50311baedb
dcbebae72894d33bdf61d3110d1beabad6463ff6bf48b0ef5ab6e8602da1dd4a
ddd57e7b851403a2d93d4a6ca6ee8a4532b87a58097df03ed57fa3d0ebe04440
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3be22d0d23fb10fdad928bdec027daf49e22f548a351b5cb703d710425656de
e4b58a351151e4da3ebfac8c923fc7c19c7bbbd6696d716a2f3465bf869f1138
e644d9cc4ed795003d3e8cec3360628550651d769afa0971925facc2fbb4e6ac
e844d9167fa2e6ff40c446e1e3563004d1bafe3026dbe4453d3878c9c9349a00
e95053b46c1a265698f234740eeb15e8866d8861207d1dd5477dea9f18c07fb6
eb2697b60c526a1d4980e0874700e7c2b4f43bb9292770f71bb4bb972506e415
eb6bed8efafdc53a3c9b83d2e304419557c82e244b3b8e0448ee13ec4ac8b24f
ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f
eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f061964e05339fd4e8614c885e1cd9d33830b14e2481b70c100f9ba4d1cb5bf4
f43a2715c9ebde2ad7cf51d297378f038f1d04f42c58ae1a5046b186ea4335e8
f5ac04f16be2eb0fbb4477e9e100a88674bda296ce7acf2419ec2898858b37f1
fa26d6529d8f4d669a1f2c6a5a101bb859064bf82a76b9b6de22a52b2e6c07c5
fb15a03f8543138646e42ab366659b79101b536ccae3b5ae059c422dd73c50ee
fc271185d48164cc6a67d2e55037fc22c2d5c65437f2a3e0e362b51e47099d47
fdd47af9c41d50e5819892ee91ecf36b2468cc6ac85bba4f0ee1f8542feb9bb8

www.educationmoney.com Open in urlscan Pro 2600:3c03::f03c:92ff:fe05:debc Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

150 Requests

97 %HTTPS

68 %IPv6

25 Domains

36 Subdomains

31 IPs

6 Countries

1728 kBTransfer

4940 kBSize

26 Cookies

3 Outgoing links

Page URL History

Redirected requests

150 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.educationmoney.com Open in urlscan Pro
2600:3c03::f03c:92ff:fe05:debc Public Scan

Screenshot
Live screenshot

Full Image

150
Requests

97 %
HTTPS

68 %
IPv6

25
Domains

36
Subdomains

31
IPs

6
Countries

1728 kB
Transfer

4940 kB
Size

26
Cookies

150 HTTP transactions
3 data transactions