staffslogin.com Open in urlscan Pro
161.35.181.78 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
Effective URL:
https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
Submission: On December 06 via api (December 6th 2023, 11:42:20 am UTC) from US — Scanned from DE

Summary HTTP 225 Redirects Links 11 Behaviour Indicators

Summary

This website contacted 25 IPs in 8 countries across 28 domains to perform 225 HTTP transactions. The main IP is 161.35.181.78, located in Clifton, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is staffslogin.com.
TLS certificate: Issued by R3 on October 5th 2023. Valid for: 3 months.

This is the only time staffslogin.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 6	161.35.181.78 161.35.181.78	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
23	2a00:1450:400... 2a00:1450:4001:812::2002	15169 (GOOGLE) (GOOGLE)
10	38.146.40.10 38.146.40.10	395717 (BLUEARCHI...) (BLUEARCHIVE-ZONE-1)
2	159.89.165.2 159.89.165.2	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
7 31	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
48	2a00:1450:400... 2a00:1450:4001:81c::2001	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:811::2002	15169 (GOOGLE) (GOOGLE)
2	142.250.185.99 142.250.185.99	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
7	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
18	2606:4700::68... 2606:4700::6811:c96e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
6 13	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
14	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
1 2	2620:116:800d... 2620:116:800d:21:de2e:c7b3:55c0:d5a0	16509 (AMAZON-02) (AMAZON-02)
3	2a02:fa8:8806... 2a02:fa8:8806:12::1370	41041 (VCLK-EU-SE) (VCLK-EU-SE)
4 8	2606:4700::68... 2606:4700::6812:18ad	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 3	2a05:d018:d29... 2a05:d018:d29:3601:11b1:8ae0:b180:1e1	16509 (AMAZON-02) (AMAZON-02)
2 30	142.250.185.98 142.250.185.98	15169 (GOOGLE) (GOOGLE)
4	178.250.1.9 178.250.1.9	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
6 6	37.157.6.232 37.157.6.232	198622 (ADFORM) (ADFORM)
3 3	51.89.9.251 51.89.9.251	16276 (OVH) (OVH)
3 3	151.101.130.49 151.101.130.49	54113 (FASTLY) (FASTLY)
2 3	34.96.105.8 34.96.105.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2 2	35.190.0.66 35.190.0.66	15169 (GOOGLE) (GOOGLE)
3	18.196.207.18 18.196.207.18	16509 (AMAZON-02) (AMAZON-02)
2 4	2001:678:cb4:... 2001:678:cb4:bbbb::11	56396 (AMOBEE) (AMOBEE)
3 3	52.29.230.13 52.29.230.13	16509 (AMAZON-02) (AMAZON-02)
1 1	35.236.220.17 35.236.220.17	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	2a00:1450:400... 2a00:1450:4001:813::2003	15169 (GOOGLE) (GOOGLE)
1	98.98.134.241 98.98.134.241	21859 (ZEN-ECN) (ZEN-ECN)
1 1	35.186.193.173 35.186.193.173	15169 (GOOGLE) (GOOGLE)
1	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
225	25

6 161.35.181.78 (Clifton, United States) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

staffslogin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 2a00:1450:4001:812::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 38.146.40.10 (Needham, United States)

ASN395717 (BLUEARCHIVE-ZONE-1, US)

s3.us-west-1.wasabisys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 159.89.165.2 (Bengaluru, India)

ASN14061 (DIGITALOCEAN-ASN, US)

analyzive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

31 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany) 7 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

48 2a00:1450:4001:81c::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:811::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.99 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f3.1e100.net

p4-hsumuihihija4-ma55novngz7x7ty2-if-v6exp3-v4.metric.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2606:4700::6811:c96e (United States)

ASN13335 (CLOUDFLARENET, US)

c.bannerflow.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany) 6 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:de2e:c7b3:55c0:d5a0 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

cms.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:fa8:8806:12::1370 (Singapore)

ASN41041 (VCLK-EU-SE, US)

dclk-match.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2606:4700::6812:18ad (United States) 4 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a05:d018:d29:3601:11b1:8ae0:b180:1e1 (Dublin, Ireland) 3 redirects

ASN16509 (AMAZON-02, US)

pr-bh.ybp.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

30 142.250.185.98 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 178.250.1.9 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

dis.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 37.157.6.232 (Denmark) 6 redirects

ASN198622 (ADFORM, DK)

c1.adform.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 51.89.9.251 (London, United Kingdom) 3 redirects

ASN16276 (OVH, FR)
PTR: ip251.ip-51-89-9.eu

onetag-sys.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.130.49 (United States) 3 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.96.105.8 (Kansas City, United States) 2 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.105.96.34.bc.googleusercontent.com

tr.blismedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.0.66 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 66.0.190.35.bc.googleusercontent.com

ads.travelaudience.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.196.207.18 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-207-18.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2001:678:cb4:bbbb::11 (United Kingdom) 2 redirects

ASN56396 (AMOBEE, GB)

ad.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
r.turn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.29.230.13 (Frankfurt am Main, Germany) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-29-230-13.eu-central-1.compute.amazonaws.com

pm.w55c.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.236.220.17 (Washington, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 17.220.236.35.bc.googleusercontent.com

um.simpli.fi	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:813::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 98.98.134.241 (United States)

ASN21859 (ZEN-ECN, US)

pixel-sync.sitescout.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.193.173 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 173.193.186.35.bc.googleusercontent.com

ius.ctnsnet.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 15.197.193.217 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
71	googlesyndication.com pagead2.googlesyndication.com — Cisco Umbrella Rank: 102 tpc.googlesyndication.com — Cisco Umbrella Rank: 148	997 KB
61	doubleclick.net 9 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 33 cm.g.doubleclick.net — Cisco Umbrella Rank: 219	369 KB
18	bannerflow.net c.bannerflow.net — Cisco Umbrella Rank: 8227	721 KB
14	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 138
13	google.com 6 redirects www.google.com — Cisco Umbrella Rank: 2	935 B
12	gstatic.com p4-hsumuihihija4-ma55novngz7x7ty2-if-v6exp3-v4.metric.gstatic.com www.gstatic.com fonts.gstatic.com	124 KB
10	wasabisys.com s3.us-west-1.wasabisys.com — Cisco Umbrella Rank: 73080	82 KB
9	googletagservices.com www.googletagservices.com — Cisco Umbrella Rank: 206	574 KB
8	tribalfusion.com 4 redirects a.tribalfusion.com — Cisco Umbrella Rank: 802 s.tribalfusion.com — Cisco Umbrella Rank: 2218	4 KB
6	adform.net 6 redirects c1.adform.net — Cisco Umbrella Rank: 560	4 KB
6	staffslogin.com 1 redirects staffslogin.com	75 KB
4	turn.com 2 redirects ad.turn.com — Cisco Umbrella Rank: 773 r.turn.com — Cisco Umbrella Rank: 3570	2 KB
4	criteo.com dis.criteo.com — Cisco Umbrella Rank: 550	1 KB
4	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	3 KB
3	w55c.net 3 redirects pm.w55c.net — Cisco Umbrella Rank: 818	3 KB
3	bidswitch.net x.bidswitch.net — Cisco Umbrella Rank: 336	436 B
3	blismedia.com 2 redirects tr.blismedia.com — Cisco Umbrella Rank: 1618	583 B
3	everesttech.net 3 redirects sync-tm.everesttech.net — Cisco Umbrella Rank: 685	1 KB
3	onetag-sys.com 3 redirects onetag-sys.com — Cisco Umbrella Rank: 714	1 KB
3	yahoo.com 3 redirects pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 474	2 KB
3	dotomi.com dclk-match.dotomi.com — Cisco Umbrella Rank: 2627	310 B
2	travelaudience.com 2 redirects ads.travelaudience.com — Cisco Umbrella Rank: 5555	930 B
2	quantserve.com 1 redirects cms.quantserve.com — Cisco Umbrella Rank: 749	795 B
2	analyzive.com analyzive.com	21 KB
1	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 331	149 B
1	ctnsnet.com 1 redirects ius.ctnsnet.com — Cisco Umbrella Rank: 6100	624 B
1	sitescout.com pixel-sync.sitescout.com — Cisco Umbrella Rank: 681	187 B
1	simpli.fi 1 redirects um.simpli.fi — Cisco Umbrella Rank: 780	714 B
225	28

	Domain	Requested by
48	tpc.googlesyndication.com	googleads.g.doubleclick.net pagead2.googlesyndication.com tpc.googlesyndication.com
31	googleads.g.doubleclick.net	7 redirects pagead2.googlesyndication.com googleads.g.doubleclick.net staffslogin.com
30	cm.g.doubleclick.net	2 redirects staffslogin.com googleads.g.doubleclick.net
23	pagead2.googlesyndication.com	staffslogin.com pagead2.googlesyndication.com googleads.g.doubleclick.net tpc.googlesyndication.com www.googletagservices.com
18	c.bannerflow.net	googleads.g.doubleclick.net c.bannerflow.net
14	www.googleadservices.com	staffslogin.com googleads.g.doubleclick.net
13	www.google.com	6 redirects googleads.g.doubleclick.net tpc.googlesyndication.com
10	s3.us-west-1.wasabisys.com	staffslogin.com
9	www.googletagservices.com	googleads.g.doubleclick.net
7	www.gstatic.com	googleads.g.doubleclick.net
6	c1.adform.net	6 redirects
6	staffslogin.com	1 redirects staffslogin.com
4	dis.criteo.com	googleads.g.doubleclick.net
4	s.tribalfusion.com	staffslogin.com
4	a.tribalfusion.com	4 redirects
4	fonts.googleapis.com	googleads.g.doubleclick.net
3	fonts.gstatic.com	fonts.googleapis.com
3	pm.w55c.net	3 redirects
3	x.bidswitch.net	googleads.g.doubleclick.net
3	tr.blismedia.com	2 redirects googleads.g.doubleclick.net
3	sync-tm.everesttech.net	3 redirects
3	onetag-sys.com	3 redirects
3	pr-bh.ybp.yahoo.com	3 redirects
3	dclk-match.dotomi.com	googleads.g.doubleclick.net
2	r.turn.com	staffslogin.com googleads.g.doubleclick.net
2	ad.turn.com	2 redirects
2	ads.travelaudience.com	2 redirects
2	cms.quantserve.com	1 redirects googleads.g.doubleclick.net
2	p4-hsumuihihija4-ma55novngz7x7ty2-if-v6exp3-v4.metric.gstatic.com	googleads.g.doubleclick.net p4-hsumuihihija4-ma55novngz7x7ty2-if-v6exp3-v4.metric.gstatic.com
2	analyzive.com	staffslogin.com analyzive.com
1	match.adsrvr.org	googleads.g.doubleclick.net
1	ius.ctnsnet.com	1 redirects
1	pixel-sync.sitescout.com	googleads.g.doubleclick.net
1	um.simpli.fi	1 redirects
225	34

This site contains links to these domains. Also see Links.

Domain
forms.gle
www.comerica.com
www.pngline.com
webbanking.comerica.com
coamerica-web-banking.blogspot.com
www.sitesinformation.com
busdepcap.comerica.com
www.youtube.com
cbc.comerica.com

Subject Issuer	Validity	Valid
staffslogin.com R3	`2023-10-05` - `2024-01-03`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.s3.us-west-1.wasabisys.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-27` - `2024-10-03`	a year	crt.sh
analyzive.com R3	`2023-11-30` - `2024-02-28`	3 months	crt.sh
tpc.googlesyndication.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-11` - `2024-05-10`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
quantserve.com R3	`2023-10-28` - `2024-01-26`	3 months	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2023-08-15` - `2024-09-15`	a year	crt.sh
*.criteo.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-12-01` - `2024-03-01`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
tr.blismedia.com GTS CA 1D4	`2023-12-02` - `2024-03-01`	3 months	crt.sh
*.bidswitch.net Sectigo RSA Domain Validation Secure Server CA	`2023-03-23` - `2024-03-23`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-11-20` - `2024-02-12`	3 months	crt.sh
*.sitescout.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2023-01-09` - `2024-02-02`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2023-04-12` - `2024-05-13`	a year	crt.sh

This page contains 38 frames:

Primary Page: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
Frame ID: 2455FE2F36A8EC06245BD77048F37600
Requests: 23 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20190131/zrt_lookup_fy2021.html
Frame ID: FEA8E587F24DB43FC0C7C88B3512B6F0
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&adk=1812271804&adf=3025194257&lmt=1701862935&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862935255&bpp=7&bdt=192&idt=362&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5297438775855&frm=20&pv=2&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=378
Frame ID: D98AD116CF2BE8788F8F23D8B29E3F37
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=280&slotname=9102870061&adk=152244903&adf=1715028348&pi=t.ma~as.9102870061&w=848&fwrn=4&fwrnh=100&lmt=1701862935&rafmt=1&format=848x280&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862935313&bpp=1&bdt=250&idt=323&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=148&ady=180&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=327
Frame ID: A7703635869D6A806FE67326EE4CA9B0
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3
Frame ID: 9FFE6865975327FA6691B6BE2D1E03BB
Requests: 14 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=280&adk=1092940552&adf=2200989083&pi=t.aa~a.1924974561~rp.4&w=352&fwrn=4&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=352x280&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90&nras=3&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1080&ady=1696&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=5
Frame ID: 11462168D53FF90E18D2933688356481
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7
Frame ID: 2A638A2E0F5A78FAB9C9E78481339EC5
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=3970650495&pi=t.aa~a.2226337157~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280%2C888x90&nras=5&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2997&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=8
Frame ID: 57246CCCE3B28F755B265C123C8BE2C6
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=280&adk=2012289476&adf=1708623896&pi=t.aa~a.1495420058~rp.1&w=888&fwrn=4&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x280&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280%2C888x90%2C888x90&nras=6&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=4240&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=5&fsb=1&dtd=10
Frame ID: 31E0524A63AD0976B14656BB13816CE1
Requests: 10 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=280&adk=4109395274&adf=2229934989&pi=t.aa~a.1495420058~rp.2&w=848&fwrn=4&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=848x280&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=0&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280%2C888x90%2C888x90%2C888x280&nras=7&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=148&ady=4560&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&btvi=6&fsb=1&dtd=12
Frame ID: FC8FB43F5E04B156BC23A8F2D820C7AC
Requests: 15 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: 5B08675F33EE261992F0611E0286009F
Requests: 6 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1
Frame ID: 9AFE682F5709FF1527626C555DA9724A
Requests: 17 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: EF872E9E57CC1D042D80B420ADD6326D
Requests: 2 HTTP requests in this frame

Frame: https://p4-hsumuihihija4-ma55novngz7x7ty2-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html
Frame ID: 1E6F43F29391232509102A9F1FE5E564
Requests: 2 HTTP requests in this frame

Frame: https://fonts.googleapis.com/css?family=Poppins%3A400%2C600
Frame ID: 149BBB2EC273823EAF2CBB60CEDD7069
Requests: 7 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js
Frame ID: EB07AA5DDF55AC5792208EDF1CEA48A5
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js
Frame ID: EE1BA44BEB2B0FC590598ACBFCF77CE2
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 288F085E81382ADAF235EADFB017F2A5
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: B541E5E7919B6388B22ECC6703A315BE
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: EF11B8829637C2E21E8795EFEC3C70AB
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: DA815100C29832987BD5BE7CA0159F59
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 7C9791BB4DC59164F4E68731FDC9AE40
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: EA162CE8F502E97F3AF4194E4C4509BA
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 0C1B89971FDA423D6316FDDA630AF40E
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js
Frame ID: 35066CA7D727690A24DCD2584BB18F06
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: BB27F84AB60B4FB70322BABEFDC0BAA3
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: C7F22702A27C16B4D4FD2FDA0853539F
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js
Frame ID: 1ED5C1B7B7344957FD28629BAB54D7E0
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 35E80522B6BB614A8599BD3D99C001C8
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 02D217BBAF43BC2FB39C93D7F62DF84D
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js
Frame ID: 094827A87F58B7F91812D45D03B4DD75
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js
Frame ID: 4C32F4029B2F6CD3997AAB0FA77139B3
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js
Frame ID: DCD79F2FB744A54AA8DE1011A65FE6B8
Requests: 1 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js
Frame ID: B851273E4CC88FC15AB5A603003FD828
Requests: 1 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 50BE2D886881766597DF16C151F94FB5
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 25931AB4C9B38D88F5C46021B3B5CF71
Requests: 2 HTTP requests in this frame

Frame: blob://https://googleads.g.doubleclick.net/14e09c97-2ee7-4f3b-97d2-e7d37c49cbb3
Frame ID: E9F587068CD9257E7942E5208EB29C31
Requests: 1 HTTP requests in this frame

Frame: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fonfido%2F645b60e5001eb5a425c49f0e%2Fimages%2F03fdd1ed-acd3-409d-9199-6113763a4743.gif&w=312&h=164&q=85&f=webp&rt=cover&x1=0&y1=10&x2=508&y2=277
Frame ID: 2259EA91CA9F28FBC122376DAB4997E3
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Web Banking Comerica Web Banking - Portals Log In

Page URL History Show full URLs

http://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking HTTP 301
https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Google AdSense (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

googlesyndication\.com/

Page Statistics

225
Requests

84 %
HTTPS

44 %
IPv6

28
Domains

34
Subdomains

25
IPs

8
Countries

2972 kB
Transfer

6957 kB
Size

24
Cookies

11 Outgoing links

These are links going to different origins than the main page.

URL: https://forms.gle/r4x5kpwad2TKLxJj9
Title: Remove Your Site

Search URL Search Domain Scan URL

URL: https://www.comerica.com/
Title: > More Info

Search URL Search Domain Scan URL

URL: https://www.comerica.com/onlinebanking
Title: > More Info

Search URL Search Domain Scan URL

URL: https://www.comerica.com/personal-finance.html
Title: > More Info

Search URL Search Domain Scan URL

URL: http://www.pngline.com/i/web%20banking%20login%20comerica/
Title: > More Info

Search URL Search Domain Scan URL

URL: https://webbanking.comerica.com/Comerica/Help.aspx?questionID=SelfServ...
Title: > More Info

Search URL Search Domain Scan URL

URL: https://coamerica-web-banking.blogspot.com/2011/10/comerica-web-bankin...
Title: > More Info

Search URL Search Domain Scan URL

URL: https://www.sitesinformation.com/search/comerica-web-banking-login
Title: > More Info

Search URL Search Domain Scan URL

URL: https://busdepcap.comerica.com/WDDL/Login.aspx
Title: > More Info

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=BWPYXOQ0yN0
Title: > More Info

Search URL Search Domain Scan URL

URL: https://cbc.comerica.com/pkmslogin.form
Title: > More Info

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking HTTP 301
https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 49

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 63

https://googleads.g.doubleclick.net/pagead/adview?ai=CX-xtF15wZe6gLOCyxtYP8LungAzMj86zdLjMidmkELCQHxABIOeL1SRglYKAgLgHoAH34pu0KMgBAqgDAcgDyQSqBPABT9A7OBUx5-7DaqFUQ4mbF94KA3qhoZNq4kGzGcUvF9RsA1MS8Y6pEpDxLaeaR6Br5tu6EuBih_iX3BQMlqkI2gy8Prv_48J3y6rp73R1qFxxL9U05J36L1qMu_f4CPV8HeDK7hN-csovL-7uXItIf09yQmhf3cvsK-s5Yv8Lkyrmf3T8K6ZJ0J60VaMJf-oWAJGJ5AmWGltj5vE4GBcpSuVhRUPwJ1Jj4i3Sw5Om573ltdsHF9os1iStlQIgdxuaQEpB_yRhfUG9x5_K8CnW6MlAGOzv9U4GM1ZNd9Ff-E1Njr4X7WVI5OAXrZBsmKcuwATwot6pogSIBZ3NgI5EkgUECAQYAZIFBAgFGASSBQQIBRgYkgUFCAUYqAGgBgKAB_ea7JMDqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwUQzvP1AdIIHwiA4YAQEAEYHzICqgI6AoBASL39wTpYts3yvd36ggOaCT1odHRwczovL2ZyZWUud2ViY29tcGFuaW9uLmNvbS9taW5pbWUvZGUvP2NhbXBhaWduPTE4MjgyOTgxMDIxgAoByAsBogwYKhYKFOS0sQLutbECtbixAuS0sQLutbEC2BMN0BUBgBcBshccChoIABIUcHViLTUxNzczMTYxOTkzODMzNTMYAA&sigh=1QZ6b3KuLdg&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTwDICaaNFO4xuELkspcneUymv18ASCRhjto3t443xczLQNB7iCRhfcWRZ46nYJ7qmwgzgc0VGWKjRtcUwbWOugGThImvRvoObegI3bfWLxMYAQ&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2217375779844637071186%22,%22debug_reporting%22:true,%22destination%22:%22https://webcompanion.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2210846925175%22],%224%22:[%2212-06%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%225818010341999898033%22}&andc=true

Request Chain 86

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 89

https://a.tribalfusion.com/i.match?p=b6&u=CAESEOKo3EW9JIBReNZj__F99Ug&google_cver=1&google_push=AXcoOmSKcIwO7Xnb6eF8MavrfOw7n5_KbgFM6P3mJV3gIl_5C22tJfpbrstFwPwqquadx_z9Ca2HIBd5ZIndWWVDWcVUw_Vqp0hijzWj1jupEQH1BymSK1G7Kt3FgAPguo0xAiyranVfO07uPeVZ-CndCV4uWg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmSKcIwO7Xnb6eF8MavrfOw7n5_KbgFM6P3mJV3gIl_5C22tJfpbrstFwPwqquadx_z9Ca2HIBd5ZIndWWVDWcVUw_Vqp0hijzWj1jupEQH1BymSK1G7Kt3FgAPguo0xAiyranVfO07uPeVZ-CndCV4uWg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEOKo3EW9JIBReNZj__F99Ug&google_cver=1&google_push=AXcoOmSKcIwO7Xnb6eF8MavrfOw7n5_KbgFM6P3mJV3gIl_5C22tJfpbrstFwPwqquadx_z9Ca2HIBd5ZIndWWVDWcVUw_Vqp0hijzWj1jupEQH1BymSK1G7Kt3FgAPguo0xAiyranVfO07uPeVZ-CndCV4uWg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmSKcIwO7Xnb6eF8MavrfOw7n5_KbgFM6P3mJV3gIl_5C22tJfpbrstFwPwqquadx_z9Ca2HIBd5ZIndWWVDWcVUw_Vqp0hijzWj1jupEQH1BymSK1G7Kt3FgAPguo0xAiyranVfO07uPeVZ-CndCV4uWg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 90

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEFqi43bb6-4Y5k6xxH5Vu6Q&google_cver=1&google_push=AXcoOmSAM2h3rOdb2ilDMRgMBxhpSRWtGWZdqLkh1ZLSdx09HKfnkvr2cUs3cZb-Fvvs0YlVsOtW-sWZscqErTWWt_g_gQ0hdJmU2vK6l4RSnVuVwwdODLPfMzg0o9rEKhk1LV7HmDhES3nxsN60_Hd33HH9D9A HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSAM2h3rOdb2ilDMRgMBxhpSRWtGWZdqLkh1ZLSdx09HKfnkvr2cUs3cZb-Fvvs0YlVsOtW-sWZscqErTWWt_g_gQ0hdJmU2vK6l4RSnVuVwwdODLPfMzg0o9rEKhk1LV7HmDhES3nxsN60_Hd33HH9D9A&google_hm=eS1ncFFxOVNWRTJwRmN6dHlkNXlvbnVubGQyeV9ST2ZWen5B

Request Chain 92

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESECS135kYw6nVfrOw7ow29R4&google_cver=1&google_push=AXcoOmROZmeCRokwFtG1nc9kl4UibyMdSDSsxj83BY7t-896H9xjPWF6l7lOe7sTD4eCDCFF796EN5YJVtAMWTMir560HPZS0f73EeqRYPMTKsfCOkFj88u-QLiTrb_ArVysjjphldlsUVPMu6FNHfxiup8qoX8 HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESECS135kYw6nVfrOw7ow29R4&google_cver=1&google_push=AXcoOmROZmeCRokwFtG1nc9kl4UibyMdSDSsxj83BY7t-896H9xjPWF6l7lOe7sTD4eCDCFF796EN5YJVtAMWTMir560HPZS0f73EeqRYPMTKsfCOkFj88u-QLiTrb_ArVysjjphldlsUVPMu6FNHfxiup8qoX8 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=OTE0OTk4MzY1OTMxMTk2NjMyMw&google_push=AXcoOmROZmeCRokwFtG1nc9kl4UibyMdSDSsxj83BY7t-896H9xjPWF6l7lOe7sTD4eCDCFF796EN5YJVtAMWTMir560HPZS0f73EeqRYPMTKsfCOkFj88u-QLiTrb_ArVysjjphldlsUVPMu6FNHfxiup8qoX8

Request Chain 93

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEHqYIJuLZ6SJTPRViRq8gBU&google_cver=1&google_push=AXcoOmR5gjQ9JS2pIGTRnJo7XVWorGvA54dDg5rOxQSd2eL_-Pim1Wxepbbqa649RcU06HLNgeWV0xcDXChnmKY0ryjTmbsrMlrMHsDDnKeFoGVZIZdupBWGzWraUXXolq70V9JkAqAokb3a5xHSzu2AYGMl73E HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmR5gjQ9JS2pIGTRnJo7XVWorGvA54dDg5rOxQSd2eL_-Pim1Wxepbbqa649RcU06HLNgeWV0xcDXChnmKY0ryjTmbsrMlrMHsDDnKeFoGVZIZdupBWGzWraUXXolq70V9JkAqAokb3a5xHSzu2AYGMl73E

Request Chain 105

https://a.tribalfusion.com/i.match?p=b6&u=CAESENPkZ9CbvLBc3rqTEoYybyk&google_cver=1&google_push=AXcoOmQUOYIzpYUrXP_zgkIkMWndPIXFL5qw1750iJ74VE3mKIJkmI3G-8xMfkGsSK7-RO3oPUPdrjJd4ijLigjyJ9Wu3kpAfSAemg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQUOYIzpYUrXP_zgkIkMWndPIXFL5qw1750iJ74VE3mKIJkmI3G-8xMfkGsSK7-RO3oPUPdrjJd4ijLigjyJ9Wu3kpAfSAemg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESENPkZ9CbvLBc3rqTEoYybyk&google_cver=1&google_push=AXcoOmQUOYIzpYUrXP_zgkIkMWndPIXFL5qw1750iJ74VE3mKIJkmI3G-8xMfkGsSK7-RO3oPUPdrjJd4ijLigjyJ9Wu3kpAfSAemg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQUOYIzpYUrXP_zgkIkMWndPIXFL5qw1750iJ74VE3mKIJkmI3G-8xMfkGsSK7-RO3oPUPdrjJd4ijLigjyJ9Wu3kpAfSAemg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 106

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEJb_9sh45pkuUThu7WrmCek&google_cver=1&google_push=AXcoOmTAticeqkYphqGgu_ZTwzTcEtCa8W77WVCc4tdKEVDTUO4uAgATALk6IrklDwwDe5zvEK4UGXtfzvW9cksBwrrSwFrujzvaCA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEJb_9sh45pkuUThu7WrmCek&google_push=AXcoOmTAticeqkYphqGgu_ZTwzTcEtCa8W77WVCc4tdKEVDTUO4uAgATALk6IrklDwwDe5zvEK4UGXtfzvW9cksBwrrSwFrujzvaCA

Request Chain 108

https://ads.travelaudience.com/google_pixel?google_gid=CAESEI7bSXxxKPUhwckvfRPY8_E&google_cver=1&google_push=AXcoOmQQy1Vvi3YzZ2C5jFBMUPQdpY7d7SaR3lCQJ3kRFe8xm9QNvdyl3o9IPyyZTdZhK1VFwKpQsFgI7Oawy3jX26zXUGmn2zwR HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=YVIpSo1ET1wQamVIL3iU8Q&google_push=AXcoOmQQy1Vvi3YzZ2C5jFBMUPQdpY7d7SaR3lCQJ3kRFe8xm9QNvdyl3o9IPyyZTdZhK1VFwKpQsFgI7Oawy3jX26zXUGmn2zwR

Request Chain 111

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEPDjs4HyRsoi8WUDxwgQkYo&google_cver=1&google_push=AXcoOmRjpI07yghfn2t8O3lWSsDKLYJMYKJEKfb-NchNgPkqrioxogvRZf5mIvMZMMlTorZ6otA09W4IW6ecUET8HO2f4yil80N1bA HTTP 302
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEPDjs4HyRsoi8WUDxwgQkYo&google_cver=1&google_push=AXcoOmRjpI07yghfn2t8O3lWSsDKLYJMYKJEKfb-NchNgPkqrioxogvRZf5mIvMZMMlTorZ6otA09W4IW6ecUET8HO2f4yil80N1bA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjgyMzcyMTY5MjAzOTI5Njk4MQ&google_push=AXcoOmRjpI07yghfn2t8O3lWSsDKLYJMYKJEKfb-NchNgPkqrioxogvRZf5mIvMZMMlTorZ6otA09W4IW6ecUET8HO2f4yil80N1bA

Request Chain 113

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 122

https://googleads.g.doubleclick.net/pagead/adview?ai=CzL-qGF5wZa_XGKaGvPIPnNOqiAmE_bKYdPjfxuabEGQQASDni9UkYJWCgIC4B6ABhtfXvQPIAQKpAs6IUKawGbI-qAMByAPJBKoE6QFP0Lz6SaRD9n1HYJDiM4th4zKmSHbpUGAdQCPvRnB-CVcBMDDmeqimz5rzU7YuIjQ3ztZRcgshxnmpMk0wbYqWh6A7qxTx7Vr62XO2u7kLofQbt8LyS7hu7FG1oQUhDjSff__EdM1khy3sIJYDu6OQ9rtLoORB6U2YmTd85ZW7rydpqFLc4ANO57iPsuZC03UfTmyohRDA54-XS2cEdQ4ykqrb0zst9jSmUz_vcFjCJYzBDwHPHvzSsAxS52qJ1yt4c018cMiH1DdMmw2GpWk48zojaT5rXTEhbFZk-Kl50ZmY38Opag2qgMAEjJ_4-ooEiAWu0rfIQ5IFBAgEGAGSBQQIBRgEoAYCgAfiqKhCqAfZtrECqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgH1ckbqAemvhvYBwHyBwQQ_KIF0ggfCIDhgBAQARgfMgKqAjoCgEBIvf3BOljB9Zu-3fqCA5oJPGh0dHBzOi8vd3d3LmxpbGllbnRoYWwuYmVybGluL2MwMS0xMDgtYjAyM2ViP3ZvdWNoZXI9c3BlY2lhbIAKAcgLAaIMECoOCgzktLEC7rWxArW4sQLYEw3QFQGAFwGyFxwKGggAEhRwdWItNTE3NzMxNjE5OTM4MzM1MxgA&sigh=n0kjtEwh6PQ&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSOwDICaaNK9t7kXBLOCjx7r8EfTHIdV4pLr78FFi3072HYLHTXxVor351oWcjIz5DDCaukk-8_xMQGUAnGAE&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2212168126643632457987%22,%22debug_reporting%22:true,%22destination%22:%22https://lilienthal.berlin%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22934669190%22],%224%22:[%2212-06%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%227821253497361421985%22}&andc=true

Request Chain 131

https://googleads.g.doubleclick.net/pagead/adview?ai=CyQ2sGF5wZZXbGObhxtYPhoqhmAzMj86zdLDXidmkELCQHxABIOeL1SRglYKAgLgHoAH34pu0KMgBAqgDAcgDyQSqBOkBT9CmDViJ2EFVnTMysoMIgVUu74kYDKjrgrJwgPPBrHFkbFJPEzcghIckkI3zo1wxPi3osoWgxIaR_EvM8FtXntDG_ncgqz0k8n4ispw-AI8BJy65Aw_W8T_MDU5dzhUBYjvwqjjVqXn_Ndf60jroNJ2Z9PXjYlFr2rMW_HsaZn9kbFv8LvVkwkUH4cIVHww0xoaoCfy7b-RyTTCGLwXLneiYaWDSTkgW1_xelq4949V4DO_NfBugCoJEwltjxZvSQ4903ETWZvJolnW73PTZh9w5EW_kNuLrvAMc-ETcGmd0sGnmNAFYXJzABPCi3qmiBIgFnc2AjkSSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGAoAH95rskwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBCuhgPSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WOKEnL7d-oIDmgk9aHR0cHM6Ly9mcmVlLndlYmNvbXBhbmlvbi5jb20vbWluaW1lL2RlLz9jYW1wYWlnbj0xODI4Mjk4MTAyMYAKAcgLAaIMICoeChzktLEC7rWxArW4sQKsurEC5LSxAu61sQK7u7EC2BMN0BUBgBcBshccChoIABIUcHViLTUxNzczMTYxOTkzODMzNTMYAA&sigh=QzTSWFkp0oY&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSPADICaaNfepW0Fw_mFqFTSA3ylqILOMAWcqgZuc1vXdgvnoHtF4UpbxPqgcsGrnur8A_6JbSkYaULSVA7hgB&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2212577071678312835461%22,%22debug_reporting%22:true,%22destination%22:%22https://webcompanion.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2210846925175%22],%224%22:[%2212-06%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%223558213363601238721%22}&andc=true

Request Chain 138

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEOe3VwlJ4_uUSERrjoXG4sE&google_cver=1&google_push=AXcoOmTuCppo0WAnRNVjIQUqA8P1B7wavE7N5XkSPfdsDOhNlAXbnEdD5cEzoi1DIGbpV7cAc4v2RVbSc6YvQ1Gos0VQ4SOrw1pb3A HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=ODg0MzEzNDY4ODg2OTYxNTIwOA==&gdpr=&gdpr_consent= HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEGlaA9g9qyLkvZYpsHni29I&google_cver=1

Request Chain 139

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESECPcXnNPDM9AgRnXPV0Lapo&google_cver=1&google_push=AXcoOmTx2PF-RYRk0lJ7I3C5rwn_LEUsU8UdFvMmoHBTcUxwh9dTlgi4RHKMGibLAgHcU-LSdJobIVTNptG6sx8zqw6HPwfIy_RG8g HTTP 302
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESECPcXnNPDM9AgRnXPV0Lapo&google_cver=1&google_push=AXcoOmTx2PF-RYRk0lJ7I3C5rwn_LEUsU8UdFvMmoHBTcUxwh9dTlgi4RHKMGibLAgHcU-LSdJobIVTNptG6sx8zqw6HPwfIy_RG8g HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=bVpKbmg4cFgxUmFRaWQ1&google_gid=CAESECPcXnNPDM9AgRnXPV0Lapo&google_cver=1&google_push=AXcoOmTx2PF-RYRk0lJ7I3C5rwn_LEUsU8UdFvMmoHBTcUxwh9dTlgi4RHKMGibLAgHcU-LSdJobIVTNptG6sx8zqw6HPwfIy_RG8g

Request Chain 140

https://a.tribalfusion.com/i.match?p=b6&u=CAESEFwFWmfwP-uvbPJRlFB33a0&google_cver=1&google_push=AXcoOmSVxdjfaflg07KJi8IuUKMOr_cSUuIdeWudawMYkSZKek7Res3CCUOABkufqkQpa-MGA0tUCgzs9GNa5X4Xq24wlvBVeUe9fg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmSVxdjfaflg07KJi8IuUKMOr_cSUuIdeWudawMYkSZKek7Res3CCUOABkufqkQpa-MGA0tUCgzs9GNa5X4Xq24wlvBVeUe9fg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEFwFWmfwP-uvbPJRlFB33a0&google_cver=1&google_push=AXcoOmSVxdjfaflg07KJi8IuUKMOr_cSUuIdeWudawMYkSZKek7Res3CCUOABkufqkQpa-MGA0tUCgzs9GNa5X4Xq24wlvBVeUe9fg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmSVxdjfaflg07KJi8IuUKMOr_cSUuIdeWudawMYkSZKek7Res3CCUOABkufqkQpa-MGA0tUCgzs9GNa5X4Xq24wlvBVeUe9fg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 141

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEMHHh-YuEZsdxGqqcV65A8U&google_cver=1&google_push=AXcoOmRbdhJl73mSfhnpRJRgaiGN7Vqb6Mhu5i4ivvHrAfNhm_XLEta8uLrDaXqJbFf0GuuyHARq9hnxNDwdStv_100hZUv0D7jk6Q HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEMHHh-YuEZsdxGqqcV65A8U&google_push=AXcoOmRbdhJl73mSfhnpRJRgaiGN7Vqb6Mhu5i4ivvHrAfNhm_XLEta8uLrDaXqJbFf0GuuyHARq9hnxNDwdStv_100hZUv0D7jk6Q

Request Chain 142

https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEDp4fvuToTBcJycfRF1V1GA&google_cver=1&google_push=AXcoOmSWu3aljBZSXFajuhOmtpvs-RXLl7wnQja5CJEkkUcWNU5wqKfZTZwqtTHHMKWkZmsg87km9G0iiNWlsrNPXxJlPCA0f9pnrA HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AXcoOmSWu3aljBZSXFajuhOmtpvs-RXLl7wnQja5CJEkkUcWNU5wqKfZTZwqtTHHMKWkZmsg87km9G0iiNWlsrNPXxJlPCA0f9pnrA&google_hm=hmVwXhi0bIsVOm5dAw&google_redir=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2FAdxPixel%3F%25%25GOOGLE_ERROR_PAIR%25%25%26partner_device_id%3D65705E18B46C8B153A6E5D03BLIS

Request Chain 143

https://ads.travelaudience.com/google_pixel?google_gid=CAESEET-y_bbpG-nVM-q_oAvyq4&google_cver=1&google_push=AXcoOmQUqQB6tLYUDFagok5RWXPG2E5k-1I8mQ43dx6-6ri1gwRPVF1HA-azJ6P7ygQhW6iIPM7qYuog9r6qC0xi0kjSip_L-taS HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=lD4wEv28S9orzYvLa2mSFA&google_push=AXcoOmQUqQB6tLYUDFagok5RWXPG2E5k-1I8mQ43dx6-6ri1gwRPVF1HA-azJ6P7ygQhW6iIPM7qYuog9r6qC0xi0kjSip_L-taS

Request Chain 156

https://googleads.g.doubleclick.net/pagead/adview?ai=CrbTSGF5wZYKpGMbtvPIP_pC52AP-jbWTdK-JjJCfEomyv7eSDhABIOeL1SRglYKAgLgHoAHZ3YnGA8gBAqkCzohQprAZsj6oAwHIA8kEqgTpAU_Q5-qnZ8o9I2Z81XCMk0Kc3n_7JPb4Fjm6oRUWT7GxOL_q-7lEUBzeoP_lpQL6H2-y3jFeCGMkG6vb1qNtN2yrVugKlf8fuDfvbaVg1Rklw_MK6qB04qumMU2HeUkFxsUFnAqCXFTHcwwQ_oSVod9nbH0ZBBRzEatyrT8ZoL_s1pV3yvMUoe1yE2zw08duhxOFxVHCvwg2q70FrUrEgCTur09Z7fXzdBAOdGIscVe5lu-MtRqOLot6VmTnZqsD8IXo_XWDe9_3uK1-MiwRHTzYtxK8IUXlTkw9uX8pprkcOAa_HwEL4zhWwASLmfuewQSIBdKWh9YvkgUECAQYAZIFBAgFGASgBgKAB4-i9jmoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBCmxgjSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WLnTm77d-oIDmglDaHR0cHM6Ly93d3cuaGF1c2ZyYWdlLmRlL2FydGlrZWwvZGV1dHNjaGVzLXN0YXJ0dXAtaGlsZnQtYmVpLXNvbGFyL4AKAcgLAaIMHCoaChjktLEC7rWxArW4sQKsurEC5LSxAu61sQLYEwzQFQGAFwGyFxwKGggAEhRwdWItNTE3NzMxNjE5OTM4MzM1MxgA&sigh=A8iuF7qsR6U&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSPADICaaNkKxnDnmNgME-gzdYXF7m5VW3s6zqHvChPaQd2uFtjrwRW4dMiItMzjr33WNZRID60QiWO_vpqBgB&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2215525948850760979918%22,%22debug_reporting%22:true,%22destination%22:%22https://hausfrage.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22952266457%22],%224%22:[%2212-06%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%221713344811797786721%22}&andc=true

Request Chain 157

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 160

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEJK5tt_0hHT9jxQPLm5bp0I&google_cver=1&google_push=AXcoOmQaq5rk7vSYmuBaEh8HssFeeRs-XijaqZ5Pea9nfrqTQUt6lNY1fBwgaqyf_mQo8oVLdTEFKwtI3acZKt8q1_h341ST05vhww HTTP 302
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmQaq5rk7vSYmuBaEh8HssFeeRs-XijaqZ5Pea9nfrqTQUt6lNY1fBwgaqyf_mQo8oVLdTEFKwtI3acZKt8q1_h341ST05vhww&google_hm=Xzm_zZRQgjxyes-vHEAZHQ

Request Chain 162

https://a.tribalfusion.com/i.match?p=b6&u=CAESEEmIPrPuPMeXLtAN4Zhxk6A&google_cver=1&google_push=AXcoOmTVkBZ1k72PhhCHiYMOWOY_UcBM9u-pwrh6zij9c7_eIqbEuxo5a-3vI6DsYjzIn6SHSZhYoE2iJ6zJ5_eJpc6iCUT2p-bu&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTVkBZ1k72PhhCHiYMOWOY_UcBM9u-pwrh6zij9c7_eIqbEuxo5a-3vI6DsYjzIn6SHSZhYoE2iJ6zJ5_eJpc6iCUT2p-bu%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24 HTTP 302
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEEmIPrPuPMeXLtAN4Zhxk6A&google_cver=1&google_push=AXcoOmTVkBZ1k72PhhCHiYMOWOY_UcBM9u-pwrh6zij9c7_eIqbEuxo5a-3vI6DsYjzIn6SHSZhYoE2iJ6zJ5_eJpc6iCUT2p-bu&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTVkBZ1k72PhhCHiYMOWOY_UcBM9u-pwrh6zij9c7_eIqbEuxo5a-3vI6DsYjzIn6SHSZhYoE2iJ6zJ5_eJpc6iCUT2p-bu%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24

Request Chain 163

https://um.simpli.fi/gp_match?google_gid=CAESEHx4XSGYMLyej2QjRZhOtNU&google_cver=1&google_push=AXcoOmT8fo5FVWQMBDDnHyBiMtOq-PhHSFFoNYmjZNkiId3AxQLremTfLqUk2UAZN4jia5djSLFL678bQjlbf_2xCZBlJPAbNJvu HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=4E28F891CEB54DE28CAC152F3B1C2F90&google_push=AXcoOmT8fo5FVWQMBDDnHyBiMtOq-PhHSFFoNYmjZNkiId3AxQLremTfLqUk2UAZN4jia5djSLFL678bQjlbf_2xCZBlJPAbNJvu

Request Chain 164

https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEJUGnZlN1yqFVfpPJlCKxiU&google_cver=1&google_push=AXcoOmQCskj2xuuZvf0lxJSDncmCGQ0DePAq_3Mb05_zPHR17rs1zw4W1P99YaSdYXgE7QEVlauFv9HlI2SCvv0izKOG2c4Eq1j7uw HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AXcoOmQCskj2xuuZvf0lxJSDncmCGQ0DePAq_3Mb05_zPHR17rs1zw4W1P99YaSdYXgE7QEVlauFv9HlI2SCvv0izKOG2c4Eq1j7uw&google_hm=hmVwXhi0bIsVOm5dAw&google_redir=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2FAdxPixel%3F%25%25GOOGLE_ERROR_PAIR%25%25%26partner_device_id%3D65705E18B46C8B153A6E5D03BLIS

Request Chain 165

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEPvPBDOFGWSXlFBnjTw2t7Q&google_cver=1&google_push=AXcoOmSTVe5BpEB7hGExD0gWJxZg6gCXTiGl8updr5FVy4V0HylSMc_9BsKN8Wypq3trDxMumhBQsIVnKmT0x464KtR8sLJwHfNv5g HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSTVe5BpEB7hGExD0gWJxZg6gCXTiGl8updr5FVy4V0HylSMc_9BsKN8Wypq3trDxMumhBQsIVnKmT0x464KtR8sLJwHfNv5g&google_hm=eS1ncFFxOVNWRTJwRmN6dHlkNXlvbnVubGQyeV9ST2ZWen5B

Request Chain 166

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEI27W_7gdfe5c_iTx9FDx7o&google_cver=1&google_push=AXcoOmTms5DLbqOdt5irRQUMv47QugrUBiY3VEn4l5-HiNRHqF3ai6WSPs-wfF0hFfGtNvvnm0ZtZ8WIpYwmqybGzfmCFAldOpHzZA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=OTE0OTk4MzY1OTMxMTk2NjMyMw&google_push=AXcoOmTms5DLbqOdt5irRQUMv47QugrUBiY3VEn4l5-HiNRHqF3ai6WSPs-wfF0hFfGtNvvnm0ZtZ8WIpYwmqybGzfmCFAldOpHzZA

Request Chain 174

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEHoXSs2oCLaVDqf_UD6lIGk&google_cver=1&google_push=AXcoOmRVBtKsJW7iteQUrzXOT4x31EsPYwOM8CHAv4_z48r0XjVaQLRBhJni8P4mAoAeLX3y6gFxcmxMnpEYHEK9OFPkcxgX7MpV HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzIyMjM2MDg3ODkzNDUyNTU0NA==&gdpr=&gdpr_consent= HTTP 302
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEGlaA9g9qyLkvZYpsHni29I&google_cver=1

Request Chain 178

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEHjv6rly5YpBd5u9ITHOd-w&google_cver=1&google_push=AXcoOmRu5sQlcr6z0XOKYCFfS4wuW-V00ldALIlLZZOiE4QzxghwHsskdVQ2ZOBvlT222JQLJCfWg6gtvRu4A7so3-dRlfwoa4T9 HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRu5sQlcr6z0XOKYCFfS4wuW-V00ldALIlLZZOiE4QzxghwHsskdVQ2ZOBvlT222JQLJCfWg6gtvRu4A7so3-dRlfwoa4T9&google_hm=eS1ncFFxOVNWRTJwRmN6dHlkNXlvbnVubGQyeV9ST2ZWen5B

Request Chain 179

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEHIRJHS3WTQZytkVIJ4BQPo&google_cver=1&google_push=AXcoOmSuYWmMtNPmUSzkZ3giQHwvnSgLJVVN21W2o0GOZJgweR-3ZIoe_IWj9OkVAZIIwP2s68DpAAka37ZwOjXBEcliUTYw4k2mqA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSuYWmMtNPmUSzkZ3giQHwvnSgLJVVN21W2o0GOZJgweR-3ZIoe_IWj9OkVAZIIwP2s68DpAAka37ZwOjXBEcliUTYw4k2mqA

Request Chain 180

https://ius.ctnsnet.com/int/cm?exc=1&acc=crimtan_holdings_limited&google_gid=CAESEGEMSgtXJAUHZQ4GuO4rYGY&google_cver=1&google_push=AXcoOmRv9qdKw6t4gVTlWi_z3O_jQuuN5UXgz2vvuzneCHbFeUYHizhq6cC2DRGCUrP0a0cRIx8XydRx_j1UrgO2kU91LpzN0WQPcYY HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmRv9qdKw6t4gVTlWi_z3O_jQuuN5UXgz2vvuzneCHbFeUYHizhq6cC2DRGCUrP0a0cRIx8XydRx_j1UrgO2kU91LpzN0WQPcYY&google_hm=LmNnXTC7SoOb80yUy4YXgLg

Request Chain 182

https://googleads.g.doubleclick.net/pagead/adview?ai=CdcR5GF5wZbrGGOvVxtYPhPGKkAnMj86zdLDXidmkELCQHxABIOeL1SRglYKAgLgHoAH34pu0KMgBAqgDAcgDyQSqBOwBT9DWKDVYcDd_ZetN0o_-r5Ty0KjK5F2rvdQxmx3qRGfwgM-xwwB6ds-j5E5gVFsieP0rvFkhqs6xiMEipR5kHfe3-NOoG4jC2AfK7BfCKObRkW9yMBOSEFXeDBPOvp4ij_wdwcZytPI-aSirlot2fNa3BHA4zTecVLt1d600XyI2PvJl86hMmv_P1p3CtwwlDvKjCBzqs2x5QNUbFeACGG7t_ciJbrTWb6RRkGZDraoqdx-GzQMwH3ayHZzGmTC9QcAFhPZ4qEs04bFjOhu0ZglanHUIO1L_eowEvo9tQgoEMhnFIKyGUc_HugjABPCi3qmiBIgFnc2AjkSSBQQIBBgBkgUECAUYBJIFBAgFGBiSBQUIBRioAaAGAoAH95rskwOoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBCToATSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WJHkm77d-oIDmgk9aHR0cHM6Ly9mcmVlLndlYmNvbXBhbmlvbi5jb20vbWluaW1lL2RlLz9jYW1wYWlnbj0xODI4Mjk4MTAyMYAKAcgLAaIMICoeChzktLEC7rWxArW4sQKsurEC5LSxAu61sQK7u7EC2BMN0BUBgBcBshccChoIABIUcHViLTUxNzczMTYxOTkzODMzNTMYAA&sigh=UdO7UF6yqRs&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSPADICaaNW2GibEnf86fNWug3DfVP6XkPnksZ220ltihdjGNJQAOIKiBaybPhRKrXw-c2PF8ATf0trs97DRgB&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%227478317414966271392%22,%22debug_reporting%22:true,%22destination%22:%22https://webcompanion.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2210846925175%22],%224%22:[%2212-06%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%224917374264406894721%22}&andc=true

Request Chain 186

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 189

https://googleads.g.doubleclick.net/pagead/adview?ai=CiJKuGF5wZZnlGInMxtYP1bSRgAz2jcG2dPL_9IS-EdrZHhABIOeL1SRglfrwgYwHoAH74_fWA8gBCakCe7uNKzEdsj6oAwHIA8sEqgTpAU_QPbhvlnKb4ky3R6N-hoFyy1tiuxAm2X2HeuZcIQ8tcL-G_-PYBUbUict0BqzxpV7J5Q0hKeGcw-LlCZO0vJUZLOQnznPQt3aVlaRWwiCPe1SiQzKQahbdSAulsilYpP0hzy8ogg_BAhgNQplrjefRMKvXKw59i-ZuYY60xur4fE74KBvxodz5qyFjUAumCrIq1UqAU6CpePmz7XEHyOR9RpjE84Pn6c6sJc1YVfWRigmoRt0CIBux1Tcx7s4wdg_6Ug0wvB27sy5tYfqctAGDtV9jBPWsFlhnerMSL6ZZxZML_Q0AReASwAT_3aDAwQSIBZjesLlNkgUECAQYAZIFBAgFGASgBi6AB-2biCmoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAPIHBBCHkATSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WM2KnL7d-oIDmgk6aHR0cHM6Ly9zcC11bnRlcm5laG1lcmZvcnVtLmRlL2RpZS16dWt1bmZ0LWRlci1jb21wbGlhbmNlL4AKAcgLAaIMHCoaChjktLEC7rWxArW4sQLktLEC7rWxAru7sQK4E-QD2BMN0BUBmBYBgBcBshccChoIABIUcHViLTUxNzczMTYxOTkzODMzNTMYAA&sigh=sUPbaarD0K0&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSPADICaaNCmWOceKMsPOvi783izvoPEBobzu3v5lWT6yLkzU8Qvbvj_w8elWxVxfflKoZZjO6O7vUTV35FBgB&template_id=484&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%227774353536364872872%22,%22debug_reporting%22:true,%22destination%22:%22https://sp-unternehmerforum.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22987623931%22],%224%22:[%2212-06%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2214072540022927412945%22}&andc=true

Request Chain 191

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESELkfaldySVbkGiIxjLlyZIQ&google_cver=1&google_push=AXcoOmRtL-WEvZBhH3VBorEQ_DTwohDOu3DnpnpbAU51Zxa_oAyIEpTznNagMUnHppUdSL1aXNjD-KAskH4L2W2xINJk0C2dc5qfjw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=bVpKbmg4cFgxUmFRaWQ1&google_gid=CAESELkfaldySVbkGiIxjLlyZIQ&google_cver=1&google_push=AXcoOmRtL-WEvZBhH3VBorEQ_DTwohDOu3DnpnpbAU51Zxa_oAyIEpTznNagMUnHppUdSL1aXNjD-KAskH4L2W2xINJk0C2dc5qfjw

Request Chain 192

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESELOJjK_RUr-libLldf7Ub9A&google_cver=1&google_push=AXcoOmSBP8NCm5lT9kBostLzK3DXDTWA_ZJL2h35543_riDuBTZHBP8oyIzDMLLTeZJ2dR3SkLtSKxF5A1FFO5K1RzRcLXEGLtmW HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WlhCZUdRQUU1WUszV0FCZA==&google_gid=CAESELOJjK_RUr-libLldf7Ub9A&google_cver=1&google_push=AXcoOmSBP8NCm5lT9kBostLzK3DXDTWA_ZJL2h35543_riDuBTZHBP8oyIzDMLLTeZJ2dR3SkLtSKxF5A1FFO5K1RzRcLXEGLtmW

Request Chain 196

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEKjYqoIqVIPkvmuKjJ7yEs8&google_cver=1&google_push=AXcoOmQRmQmFLhiKiANnQ6KMcrAyy57Bc0kkApkyum94dfSB_YDrTci_uuf6soii5nDPJoIeP158h6JEyPDc_vqGhySiv9bvIL6-5A HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=OTE0OTk4MzY1OTMxMTk2NjMyMw&google_push=AXcoOmQRmQmFLhiKiANnQ6KMcrAyy57Bc0kkApkyum94dfSB_YDrTci_uuf6soii5nDPJoIeP158h6JEyPDc_vqGhySiv9bvIL6-5A

Request Chain 197

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEB99cnMHlwsrFIiMRLye0E4&google_cver=1&google_push=AXcoOmQZUShmYFYH7Yd6I7onHL9Vm3qzIhWda6DdzRLJKJ4zxSry49PM-TzwZ74YZXwUFiVjywCJETLlp2Crg3wWkuyptD38J90LCw HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQZUShmYFYH7Yd6I7onHL9Vm3qzIhWda6DdzRLJKJ4zxSry49PM-TzwZ74YZXwUFiVjywCJETLlp2Crg3wWkuyptD38J90LCw

Request Chain 200

https://www.google.com/pagead/drt/ui HTTP 302
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Request Chain 203

https://googleads.g.doubleclick.net/pagead/adview?ai=C_gBfGF5wZbO0GNr7vPIPvNmmqA3L-J2QdPaXq7GFEr6Qz8zPQRABIOeL1SRglYKAgLgHoAGm9PCSAsgBAagDAcgDy4SAgASqBOQBT9DxH4VgFEFK3Ofau0-Owx-zGgWUpqb4ahjVl5b_4TWLWe2tVU3SGn9LeuMfb8MPeTthFLQ7UGCBvXt3CzfHlOOBVg27S7SW64mfyGseAVGTVyKN-mHIunydDeM48jAldaLoaVW8lMXrc0lyGvCYsGd23ftID630RB3vHvItknXn7Ar0_NE5iwQ31qS0W7HPg_UVE6QcV1bruUtEJwCUV3DneLENJ8cZTSrhvKdIT3Pxu7OPvZaedID0stPNZ2c_aNwHNi9d_8uBfH1GGr0oY468Oh5FdYcC8aFmnQM3Sf1SqMWNwATivIbMwQSIBer0laxNgAfCi4_tAagH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcB8gcEEIH4D9IIHwiA4YAQEAEYHzICqgI6AoBASL39wTpY-8ybvt36ggOaCWJodHRwczovL3d3dy5zcGlucy5jb20vbGlmdG9mZi1idW5kbGUvP3V0bV9zb3VyY2U9Z29vZ2xlJnV0bV9tZWRpdW09Y3BjJnV0bV9jYW1wYWlnbj1hcG9sbG9fZGlzcGxheYAKAcgLAaIMGCoWChTktLEC7rWxArW4sQLktLEC7rWxAtgTA9AVAYAXAbIXHAoaCAASFHB1Yi01MTc3MzE2MTk5MzgzMzUzGAA&sigh=-Yl6N9kGt4A&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSPADICaaN1rX1p6jhq1-RI2gUoEctz0WK-sLdIt9kpUi--P0yrxWv9q00Qd7K4cwshzf3cRxf0XuYDbKaKBgB&cbvp=2&vis=1 HTTP 302
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%223731159053420145595%22,%22debug_reporting%22:true,%22destination%22:%22https://spins.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22576469542%22],%224%22:[%2212-06%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%22550822892712386321%22}&andc=true

225 HTTP transactions
9 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request Web-Banking-Comerica-Web-Banking Show response
staffslogin.com/signup/
Redirect Chain

http://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking

43 KB
6 KB

492ms
150ms

Document
text/html

161.35.181.78
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

161.35.181.78 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

932685de0eba27246614e2609bde0ae37c107372bc6a9df4766ce44cc78ff76e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, must-revalidate
content-encoding: br
content-type: text/html; charset=UTF-8
date: Wed, 06 Dec 2023 11:42:14 GMT
expires: -1
pragma: no-cache
server: nginx-rc
vary: Accept-Encoding
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

Redirect headers

Connection: keep-alive
Content-Length: 174
Content-Type: text/html
Date: Wed, 06 Dec 2023 11:42:14 GMT
Location: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
Server: nginx-rc

GET
H2 200 custom-main.css
staffslogin.com/themes/loginwebmail/custom/ 6 KB
2 KB 114ms
113ms Stylesheet
text/css 161.35.181.78
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://staffslogin.com/themes/loginwebmail/custom/custom-main.css

Requested by

Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

161.35.181.78 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

28d22e66c624c7cacd394669d963f2c394c88b972d7863d8bc6c01285a31f921

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:15 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Sat, 25 Dec 2021 05:31:47 GMT
server: nginx-rc
etag: W/"61c6acc3-1802"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=2592000
x-xss-protection: 1; mode=block
expires: Fri, 05 Jan 2024 11:42:15 GMT

GET
H2 200 main.css
staffslogin.com/themes/loginwebmail/ 235 KB
25 KB 114ms
113ms Stylesheet
text/css 161.35.181.78
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://staffslogin.com/themes/loginwebmail/main.css

Requested by

Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

161.35.181.78 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

babe855d1efbfa3f08be7d6c0629da7aab30099baad5ae240ad9c3b13017f1f9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:15 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Sat, 25 Dec 2021 05:31:47 GMT
server: nginx-rc
etag: W/"61c6acc3-3abe5"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css
cache-control: max-age=2592000
x-xss-protection: 1; mode=block
expires: Fri, 05 Jan 2024 11:42:15 GMT

GET
H2 200 adsbygoogle.js Show response
pagead2.googlesyndication.com/pagead/js/ 151 KB
51 KB 129ms
75ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5177316199383353

Requested by

Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b41940c273de8cd82d5e4cfae70dc6a9e4afb8fc4900441fd00edcb7df622857

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://staffslogin.com/
Origin: https://staffslogin.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:15 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 52094
x-xss-protection: 0
server: cafe
etag: 11869145452095792811
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 06 Dec 2023 11:42:15 GMT

GET
H/1.1 200
OK home-comerica.png
s3.us-west-1.wasabisys.com/loginspartus/ 9 KB
10 KB 666ms
266ms Image
image/png 38.146.40.10
BLUEARCHIVE-ZONE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.us-west-1.wasabisys.com/loginspartus/home-comerica.png
Requested by: Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 38.146.40.10 Needham, United States, ASN395717 (BLUEARCHIVE-ZONE-1, US),
Reverse DNS
Software: WasabiS3/7.17.2740-2023-11-21-844df14924 (head01) /
Resource Hash: 006c5181aad0b98dbf9600639e4ba54abcb948fd1c17553c7de7c9df4cbcadde

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://staffslogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Wed, 06 Dec 2023 11:42:15 GMT
Last-Modified: Sat, 20 Mar 2021 12:35:40 GMT
Server: WasabiS3/7.17.2740-2023-11-21-844df14924 (head01)
x-amz-request-id: CB8DAB19B39F58A6:A
ETag: "5bd13d62f0ef45b4fcb0831dff3b554c"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 9658
x-amz-id-2: IK2sYzrIwVMgF75bK7+C2cNHHZFPPB1GHfQT7/qbnqghO/FwR9Mj3At4nYp1XVH+7N4n9rWpJxqz

GET
H/1.1 200
OK secure-online-banking-services-comerica.png
s3.us-west-1.wasabisys.com/loginspartus/ 10 KB
11 KB 667ms
272ms Image
image/png 38.146.40.10
BLUEARCHIVE-ZONE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.us-west-1.wasabisys.com/loginspartus/secure-online-banking-services-comerica.png
Requested by: Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 38.146.40.10 Needham, United States, ASN395717 (BLUEARCHIVE-ZONE-1, US),
Reverse DNS
Software: WasabiS3/7.17.2740-2023-11-21-844df14924 (head01) /
Resource Hash: 93b867d45862ab9dbe905664e47cdd5e3124d6c7bac7e140f4070fdbd67d8363

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://staffslogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Wed, 06 Dec 2023 11:42:15 GMT
Last-Modified: Sat, 20 Mar 2021 15:26:40 GMT
Server: WasabiS3/7.17.2740-2023-11-21-844df14924 (head01)
x-amz-request-id: F1599F8833B08004:B
ETag: "2719be0c72b09f0b28de03a1e94c864a"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 10403
x-amz-id-2: fNnZRz1SY46C033RLmacyaaGbwJ7oHhq4bV4jmW41L9FUtXalhy4P1Wpc5ZA/IBqa6wUsiNWr5al

GET
H/1.1 200
OK personal-banking-financial-services-comerica.png
s3.us-west-1.wasabisys.com/loginspartus/ 9 KB
10 KB 707ms
315ms Image
image/png 38.146.40.10
BLUEARCHIVE-ZONE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.us-west-1.wasabisys.com/loginspartus/personal-banking-financial-services-comerica.png
Requested by: Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 38.146.40.10 Needham, United States, ASN395717 (BLUEARCHIVE-ZONE-1, US),
Reverse DNS
Software: WasabiS3/7.17.2740-2023-11-21-844df14924 (head01) /
Resource Hash: ff112e3c33b9711ffcf49190f3b00608091a0d43dd7887cc2acdf77d68918811

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://staffslogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Wed, 06 Dec 2023 11:42:15 GMT
Last-Modified: Sat, 20 Mar 2021 14:45:33 GMT
Server: WasabiS3/7.17.2740-2023-11-21-844df14924 (head01)
x-amz-request-id: 47B60FDD6A660BA6:A
ETag: "19e36bc1b73d2f4a3fef385cb26deb9e"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 9380
x-amz-id-2: wd0Z82GbfWnprp+HH3ioP2E/V+smG//nOTmRnxEV8Cp7HkdY+1Qe4w3j066csuCDqhT5hdPtdGY9

GET
H/1.1 200
OK web-banking-login-comerica-pngline.png
s3.us-west-1.wasabisys.com/loginspartus/ 13 KB
13 KB 626ms
240ms Image
image/png 38.146.40.10
BLUEARCHIVE-ZONE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.us-west-1.wasabisys.com/loginspartus/web-banking-login-comerica-pngline.png
Requested by: Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 38.146.40.10 Needham, United States, ASN395717 (BLUEARCHIVE-ZONE-1, US),
Reverse DNS
Software: WasabiS3/7.17.2740-2023-11-21-844df14924 (head01) /
Resource Hash: 00714d6c147109c2f778f8647024095c5f803940fcb3c019543c00d8d3f67633

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://staffslogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Wed, 06 Dec 2023 11:42:15 GMT
Last-Modified: Sat, 20 Mar 2021 16:38:19 GMT
Server: WasabiS3/7.17.2740-2023-11-21-844df14924 (head01)
x-amz-request-id: 1DFE9A6457F4B8B4:A
ETag: "ba9baf6b3cc1c92abbe36ae975d3bacf"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 13075
x-amz-id-2: uju4z9f0hrnXZV9gLD+ii8OTSF7TGpgr9Qki4hPv61wxldP+rZdTfwZJCSenxpR0DHBhaemWdFf5

GET
H/1.1 200
OK user-help-webbankingcomericacom.png
s3.us-west-1.wasabisys.com/loginspartus/ 4 KB
5 KB 627ms
240ms Image
image/png 38.146.40.10
BLUEARCHIVE-ZONE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.us-west-1.wasabisys.com/loginspartus/user-help-webbankingcomericacom.png
Requested by: Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 38.146.40.10 Needham, United States, ASN395717 (BLUEARCHIVE-ZONE-1, US),
Reverse DNS
Software: WasabiS3/7.17.2740-2023-11-21-844df14924 (head01) /
Resource Hash: bc28302b4145a6174380a3aba54c74fd0b229a6b7a89c1cb7093be28dd0d2c57

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://staffslogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Wed, 06 Dec 2023 11:42:15 GMT
Last-Modified: Sat, 20 Mar 2021 16:26:48 GMT
Server: WasabiS3/7.17.2740-2023-11-21-844df14924 (head01)
x-amz-request-id: DED0EEE0BF1A0620:A
ETag: "a551e2b5a0fd981cd95fd153e6954f4e"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 4500
x-amz-id-2: dhypfXXk4yMJn7HlUKdeibZQzR/8eXnRhh5iy1HYExga876K3mseWTqvxtE9bocNkl1McVzsfivq

GET
H/1.1 200
OK comerica-web-banking-comerica-web-banking.png
s3.us-west-1.wasabisys.com/loginspartus/ 8 KB
8 KB 618ms
222ms Image
image/png 38.146.40.10
BLUEARCHIVE-ZONE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.us-west-1.wasabisys.com/loginspartus/comerica-web-banking-comerica-web-banking.png
Requested by: Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 38.146.40.10 Needham, United States, ASN395717 (BLUEARCHIVE-ZONE-1, US),
Reverse DNS
Software: WasabiS3/7.17.2740-2023-11-21-844df14924 (head01) /
Resource Hash: b1afc77cbe010a899f8e6586e9f1e172bb5c8831571455d3ed865e09b9457328

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://staffslogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Wed, 06 Dec 2023 11:42:15 GMT
Last-Modified: Sat, 20 Mar 2021 11:19:29 GMT
Server: WasabiS3/7.17.2740-2023-11-21-844df14924 (head01)
x-amz-request-id: 71588AAF40A3D33F:B
ETag: "f3cc39fee79b2ae05aa8c3de599cc892"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 8148
x-amz-id-2: sAvf5LSOCTTpA0rtpjcP94bDYfR6aFYPGM7hZpG7/tmxkFCQW3e7TctGcYmz6weVh34EKkzIbw/a

GET
H/1.1 200
OK comerica-web-banking-login-sitesinformationcom.png
s3.us-west-1.wasabisys.com/loginspartus/ 7 KB
7 KB 341ms
341ms Image
image/png 38.146.40.10
BLUEARCHIVE-ZONE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.us-west-1.wasabisys.com/loginspartus/comerica-web-banking-login-sitesinformationcom.png
Requested by: Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 38.146.40.10 Needham, United States, ASN395717 (BLUEARCHIVE-ZONE-1, US),
Reverse DNS
Software: WasabiS3/7.17.2740-2023-11-21-844df14924 (head01) /
Resource Hash: 71d352688af843750b97fc658e001388e88ad655d0bf4afdb11dee5d83f5ad0f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://staffslogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Wed, 06 Dec 2023 11:42:15 GMT
Last-Modified: Sat, 20 Mar 2021 11:19:29 GMT
Server: WasabiS3/7.17.2740-2023-11-21-844df14924 (head01)
x-amz-request-id: 5B530F204BD65839:A
ETag: "a1c86665b4d0158b80fd3ca23b2b43a6"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 6887
x-amz-id-2: npd7arNFvMze7jkoZJablFUbJ3WrETKbGjMpAEGhK/8F3t31Xu4cUeFHGvg9Tpjt1lrnm5/AddM6

GET
H/1.1 200
OK login.png
s3.us-west-1.wasabisys.com/loginspartus/ 7 KB
8 KB 214ms
214ms Image
image/png 38.146.40.10
BLUEARCHIVE-ZONE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.us-west-1.wasabisys.com/loginspartus/login.png
Requested by: Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 38.146.40.10 Needham, United States, ASN395717 (BLUEARCHIVE-ZONE-1, US),
Reverse DNS
Software: WasabiS3/7.17.2740-2023-11-21-844df14924 (head01) /
Resource Hash: 16ec1e5e6a1d23f048f226bae4b3033798b19387c33d409b4abdafac34738c1d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://staffslogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Wed, 06 Dec 2023 11:42:15 GMT
Last-Modified: Sat, 20 Mar 2021 13:44:15 GMT
Server: WasabiS3/7.17.2740-2023-11-21-844df14924 (head01)
x-amz-request-id: 7D58BEF9D56F432C:A
ETag: "87861e640d007fa60c692fdcf8fcfdea"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 7403
x-amz-id-2: mJe1MwayZMc62soWY6korCc4h9G8/nl0u/7bvPUHJ2gM3AOpfZgX6Mjuu/lRi2y511w84vvBYxkq

GET
H/1.1 200
OK comerica-online-banking-login-how-to-access.png
s3.us-west-1.wasabisys.com/loginspartus/ 10 KB
11 KB 237ms
237ms Image
image/png 38.146.40.10
BLUEARCHIVE-ZONE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.us-west-1.wasabisys.com/loginspartus/comerica-online-banking-login-how-to-access.png
Requested by: Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 38.146.40.10 Needham, United States, ASN395717 (BLUEARCHIVE-ZONE-1, US),
Reverse DNS
Software: WasabiS3/7.17.2740-2023-11-21-844df14924 (head01) /
Resource Hash: c7bc7551523d52e68c14667f0c9d5fae9a155abccc955a791bfab7a2f905d0de

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://staffslogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Wed, 06 Dec 2023 11:42:15 GMT
Last-Modified: Sat, 20 Mar 2021 11:19:29 GMT
Server: WasabiS3/7.17.2740-2023-11-21-844df14924 (head01)
x-amz-request-id: 382DFB114ACD2633:B
ETag: "2d46e2db9949a375964322a1f5031891"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 10573
x-amz-id-2: c657UzRqmX87CiHWuIfkgf6Gpm9mxqa+ueaCd5E6NnnAYDGZkff5iv5nItPlstXW4gVVR+FfBuse

GET
H/1.1 200
OK no-preview-available-yet.png
s3.us-west-1.wasabisys.com/loginspartus/ 21 B
21 B 229ms
229ms Image
image/png 38.146.40.10
BLUEARCHIVE-ZONE-1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s3.us-west-1.wasabisys.com/loginspartus/no-preview-available-yet.png
Requested by: Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 38.146.40.10 Needham, United States, ASN395717 (BLUEARCHIVE-ZONE-1, US),
Reverse DNS
Software: WasabiS3/7.17.2740-2023-11-21-844df14924 (head01) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://staffslogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Wed, 06 Dec 2023 11:42:15 GMT
Last-Modified: Sat, 20 Mar 2021 14:21:53 GMT
Server: WasabiS3/7.17.2740-2023-11-21-844df14924 (head01)
x-amz-request-id: EF22DDF14B281C14:A
ETag: "5cf36552e9e157703ca5e43ff1ce11e8"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 21
x-amz-id-2: wB879W1he464DGqyzjrrOglZDQ6T49yURerNmsVjFGENLNLkySxD5ehkZ/Y1rrZxtSduKzjghKw+

GET
H2 200 bootstrap.js Show response
staffslogin.com/themes/loginwebmail/ 123 KB
42 KB 224ms
223ms Script
application/javascript 161.35.181.78
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://staffslogin.com/themes/loginwebmail/bootstrap.js

Requested by

Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

161.35.181.78 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

8d4dd33abfe49fce190971d45ac36dd0380882605828a5ce8099181ec93a6709

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:15 GMT
content-encoding: br
x-content-type-options: nosniff
last-modified: Sat, 25 Dec 2021 05:31:47 GMT
server: nginx-rc
etag: W/"61c6acc3-1eb97"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
x-xss-protection: 1; mode=block
expires: Fri, 05 Jan 2024 11:42:15 GMT

GET
H2 404 all.js
staffslogin.com/%20themes/loginwebmail/ 0
0 326ms
326ms Script
text/html 161.35.181.78
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://staffslogin.com/%20themes/loginwebmail/all.js
Requested by: Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 161.35.181.78 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: nginx-rc /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:15 GMT
cache-control: no-cache, private
content-encoding: br
server: nginx-rc
vary: Accept-Encoding
content-type: text/html; charset=UTF-8

GET
H2 200 matomo.js Show response
analyzive.com/ 65 KB
21 KB 879ms
343ms Script
application/javascript 159.89.165.2
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://analyzive.com/matomo.js

Requested by

Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

159.89.165.2 Bengaluru, India, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

3f4a994a950f7c027cceb0aa6152c54b93ef427c746d59f1832e890048717775

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://staffslogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:15 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
last-modified: Thu, 04 May 2023 08:55:01 GMT
server: nginx-rc
content-encoding: br
etag: W/"645372e5-104c2"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=2592000
x-xss-protection: 1; mode=block
expires: Fri, 05 Jan 2024 11:42:15 GMT

GET
H3 200 show_ads_impl_with_ama_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311300101/ 398 KB
134 KB 141ms
97ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311300101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5177316199383353&plah=staffslogin.com

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5177316199383353

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5551a0a9df75fa3f58e9f2f4f27a24b46a309fc439ac42bc7ad271c86da16e69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://staffslogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:15 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 137566
x-xss-protection: 0
server: cafe
etag: 2330870466084331867
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin: *
expires: Wed, 06 Dec 2023 11:42:15 GMT

GET
H2 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231204/r20190131/ Frame FEA8 9 KB
4 KB 77ms
23ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231204/r20190131/zrt_lookup_fy2021.html

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-5177316199383353

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://staffslogin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 44206
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 23:25:29 GMT
etag: 5585625838579639069
expires: Tue, 19 Dec 2023 23:25:29 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame D98A 305 KB
65 KB 601ms
600ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&adk=1812271804&adf=3025194257&lmt=1701862935&plat=3%3A16%2C4%3A16%2C9%3A32776%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C30%3A1081344%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&pra=5&wgl=1&easpi=0&asro=0&asiscm=1&aslmt=0.4&asamt=-1&asedf=0&asefa=1&aseiel=1~2&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862935255&bpp=7&bdt=192&idt=362&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&nras=1&correlator=5297438775855&frm=20&pv=2&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fsapi=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=32768&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=1&uci=a!1&fsb=1&dtd=378

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311300101/show_ads_impl_with_ama_fy2021.js?client=ca-pub-5177316199383353&plah=staffslogin.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7cb79dab863e6668bb16c9215a457c8645ce9c92b4a161bc85e8128a14db7175

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://staffslogin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 66515
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:16 GMT
expires: Wed, 06 Dec 2023 11:42:16 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame A770 103 KB
39 KB 745ms
744ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=280&slotname=9102870061&adk=152244903&adf=1715028348&pi=t.ma~as.9102870061&w=848&fwrn=4&fwrnh=100&lmt=1701862935&rafmt=1&format=848x280&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862935313&bpp=1&bdt=250&idt=323&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=148&ady=180&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=327

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f214fd7dfdbfd0579030817f0d813bd33228f24c0cd2bff1254ecf15b0ea53d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://staffslogin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 39606
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:16 GMT
expires: Wed, 06 Dec 2023 11:42:16 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 matomo.php
analyzive.com/ 0
229 B 184ms
183ms Ping
text/plain 159.89.165.2
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://analyzive.com/matomo.php?action_name=Web%20Banking%20Comerica%20Web%20Banking%20-%20Portals%20Log%20In&idsite=17&rec=1&r=494602&h=12&m=42&s=15&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&_id=33fe87049c40482d&_idn=1&send_image=0&_refts=0&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1600x1200&pv_id=FKmQGr&nwefftype=4g&pf_net=342&pf_srv=150&pf_tfr=2&pf_dm1=351&uadata=%7B%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D

Requested by

Host: analyzive.com
URL: https://analyzive.com/matomo.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

159.89.165.2 Bengaluru, India, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx-rc /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://staffslogin.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

date: Wed, 06 Dec 2023 11:42:16 GMT
content-encoding: none
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
server: nginx-rc
x-frame-options: SAMEORIGIN
access-control-allow-origin: https://staffslogin.com
access-control-allow-credentials: true
x-xss-protection: 1; mode=block

GET
H3 200 reactive_library_fy2021.js Show response
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311300101/ 160 KB
55 KB 84ms
83ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202311300101/reactive_library_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bc3f72b5fd9d8db2907974cf2c815903dd438134ab524f6c9be1d3c8a8fa84f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://staffslogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:16 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 55950
x-xss-protection: 0
server: cafe
etag: 18312829676527222209
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=1209600
timing-allow-origin: *
expires: Wed, 06 Dec 2023 11:42:16 GMT

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 9FFE 132 KB
46 KB 629ms
629ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6bebda4047a04ddc96494e531a74e1bab893ad6b57d7ff40c02b82a624c9cddc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://staffslogin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 46632
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:16 GMT
expires: Wed, 06 Dec 2023 11:42:16 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 1146 106 KB
40 KB 540ms
540ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=280&adk=1092940552&adf=2200989083&pi=t.aa~a.1924974561~rp.4&w=352&fwrn=4&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=352x280&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90&nras=3&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1080&ady=1696&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=5

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7124feedceadbb23ed2f147b1b166d09d114d393fa835590ce80328561b711d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://staffslogin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 40997
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:16 GMT
expires: Wed, 06 Dec 2023 11:42:16 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 2A63 106 KB
40 KB 597ms
597ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

84e6ebf886857ba708f9f0b6a503a489be4ffb3dc82e49c35338f99028c56b84

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://staffslogin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 41148
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:16 GMT
expires: Wed, 06 Dec 2023 11:42:16 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 5724 105 KB
40 KB 424ms
424ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=3970650495&pi=t.aa~a.2226337157~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280%2C888x90&nras=5&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2997&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3059d2e0f0bd6f81e14934ba47c6fcec73fa6d6474973505edeb99890ae9878e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://staffslogin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 40659
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:16 GMT
expires: Wed, 06 Dec 2023 11:42:16 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame 31E0 105 KB
40 KB 410ms
410ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=280&adk=2012289476&adf=1708623896&pi=t.aa~a.1495420058~rp.1&w=888&fwrn=4&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x280&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280%2C888x90%2C888x90&nras=6&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=4240&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=5&fsb=1&dtd=10

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f6446f54f518248fa174419dfec01b48dfcf80325a4ecc5b508ac77a94fb94b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://staffslogin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 40636
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:16 GMT
expires: Wed, 06 Dec 2023 11:42:16 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ads Show response
googleads.g.doubleclick.net/pagead/ Frame FC8F 121 KB
41 KB 576ms
576ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=280&adk=4109395274&adf=2229934989&pi=t.aa~a.1495420058~rp.2&w=848&fwrn=4&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=848x280&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=0&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280%2C888x90%2C888x90%2C888x280&nras=7&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=148&ady=4560&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&btvi=6&fsb=1&dtd=12

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b7f46de7a5ecea9e08f4e72e4f052020040c37c14e7a3a24c892f8e160c1f776

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://staffslogin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: br
content-length: 42443
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:16 GMT
expires: Wed, 06 Dec 2023 11:42:16 GMT
observe-browsing-topics: ?1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/ Frame 5B08 9 KB
4 KB 21ms
21ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://staffslogin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 78518
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 13:53:38 GMT
etag: 5585625838579639069
expires: Tue, 19 Dec 2023 13:53:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 zrt_lookup_fy2021.html Show response
googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/ Frame 9AFE 9 KB
4 KB 21ms
21ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://staffslogin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 78518
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=1209600
content-encoding: br
content-length: 4130
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 13:53:38 GMT
etag: 5585625838579639069
expires: Tue, 19 Dec 2023 13:53:38 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 4745443655820685849
tpc.googlesyndication.com/simgad/ Frame A770 18 KB
18 KB 107ms
57ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/4745443655820685849?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qk-05vvf5peYTkNRHMlOp-yQJHCDQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=280&slotname=9102870061&adk=152244903&adf=1715028348&pi=t.ma~as.9102870061&w=848&fwrn=4&fwrnh=100&lmt=1701862935&rafmt=1&format=848x280&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862935313&bpp=1&bdt=250&idt=323&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=148&ady=180&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=327

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6afac4b1b297703ac3c86bee10469374b2e1a102735ad4e238292b9a23e8d666

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 05:01:11 GMT
x-content-type-options: nosniff
age: 542465
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18563
x-xss-protection: 0
last-modified: Fri, 14 Oct 2022 15:22:07 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Fri, 29 Nov 2024 05:01:11 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/ Frame A770 24 KB
9 KB 101ms
51ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 08:03:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13123
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Dec 2023 08:03:33 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame A770 3 KB
1 KB 109ms
69ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 10:35:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3978
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Dec 2023 10:35:58 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame A770 20 KB
8 KB 79ms
29ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a5b47703d2aa636762f8b39205a2e03a85ae2de2904d81e6c6a469486ca81e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8554
x-xss-protection: 0
server: cafe
etag: 636498438165408290
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame A770 202 KB
64 KB 167ms
117ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dce4158779dce6da3ede11337029f817a03f45c9559b1f91d8a7c5ac130f38c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65147
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701694399686299"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Dec 2023 11:42:16 GMT

GET
H2 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame A770 36 KB
15 KB 104ms
65ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a65f004d5a22b43dea5abdd195d59f30681e0040964b28f7bf9cf04d69a91ea1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:47:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71663
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14814
x-xss-protection: 0
server: cafe
etag: 3975445015323060182
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:47:53 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame EF87 143 B
166 B 23ms
22ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=280&slotname=9102870061&adk=152244903&adf=1715028348&pi=t.ma~as.9102870061&w=848&fwrn=4&fwrnh=100&lmt=1701862935&rafmt=1&format=848x280&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=true&rpe=1&resp_fmts=3&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862935313&bpp=1&bdt=250&idt=323&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0&nras=1&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=148&ady=180&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=2&uci=a!2&fsb=1&dtd=327
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 229
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:38:27 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 redir.html Show response
p4-hsumuihihija4-ma55novngz7x7ty2-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 1E6F 247 B
868 B 110ms
31ms Document
text/html 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-hsumuihihija4-ma55novngz7x7ty2-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

821b43472306ee9a6907150c543d526d780b0c688e18f2157519b1ade91ebf1f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 203
content-security-policy-report-only: script-src 'nonce-hHXsihL9hwjuZdTDEH-Taw' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:16 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
last-modified: Tue, 14 Nov 2023 14:08:00 GMT
pragma: no-cache
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css2
fonts.googleapis.com/ Frame 5B08 4 KB
1 KB 102ms
48ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 06 Dec 2023 11:42:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 09:53:29 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 06 Dec 2023 11:42:16 GMT

GET
H2 200 feedback_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 5B08 205 B
650 B 74ms
23ms Image
image/png 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/feedback_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 17:58:29 GMT
x-content-type-options: nosniff
age: 150227
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 205
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Tue, 03 Dec 2024 17:58:29 GMT

GET
H2 200 settings_grey600_24dp.png
www.gstatic.com/images/icons/material/system/2x/ Frame 5B08 604 B
696 B 74ms
24ms Image
image/png 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/images/icons/material/system/2x/settings_grey600_24dp.png

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 03:38:28 GMT
x-content-type-options: nosniff
age: 115428
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 604
x-xss-protection: 0
last-modified: Thu, 20 Jul 2023 22:48:00 GMT
server: sffe
vary: Origin
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
expires: Wed, 04 Dec 2024 03:38:28 GMT

GET
H2 200 fullscreen_api_adapter_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/elements/html/ Frame 5B08 16 KB
7 KB 81ms
54ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/elements/html/fullscreen_api_adapter_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41b43f64c3e5d7f9eca80634429adb1b8e0a1c5e1fe67ad71ec651a991ebfe68

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 16:03:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 70716
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6766
x-xss-protection: 0
server: cafe
etag: 14924840246271906451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 16:03:40 GMT

GET
H2 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/elements/html/ Frame 5B08 22 KB
9 KB 52ms
26ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

db2bdaad0dc9232fadb3de900bf039a0f356521698f213df1edf601e02a5870d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:42:02 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72014
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9210
x-xss-protection: 0
server: cafe
etag: 13914886398874665762
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:42:02 GMT

GET
H2 200 65396155843eb9eeda770d48 Show response
c.bannerflow.net/a/ Frame 9AFE 73 KB
24 KB 95ms
43ms Script
application/javascript 2606:4700::6811:c96e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/a/65396155843eb9eeda770d48?did=5d6fb28839d71e0001cd1a9f&deeplink=on&responsive=off&redirecturl=https://adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DCkFXsF15wZfOKLN_tvPIP8fWG-A6-9MHJdNev-sbvEZ_w8_0IEAEg54vVJGCVgoCAuAegAYn3tskDyAEJqQLkdwRDDSa1PqgDAcgDAqoE7AFP0GmlGZZe3dJgTwBFRdTNmo4wP0-xmYxOosjI4AVR5iq3GRLWHl2CQHT10y8QK6U6uQVkOoBjkFSZrzyoxGeag_gVBQG1oiYatTmSyq5YmhWj8-ChFttSYbLvFm6m1ThY_8v1kuOBDqTkwJcxi6JvZttyjgmtyfjcFeOyYvTDApgACbsr3Zk9cIwk5S9B6bTXnxrlYAqlZF4_Jvvm1Qc30bwCrFd6tTmlH1UuUnDRwUgOeN_cxz-fx0wN_shlekoXwE2JLeS7SQdNgcIyDiEKMmJ5cyRpyvh3BoiZhQ1ZHAGuPhLbbr6NhWnt4MAErauJ4MAEiAXbkIKQTaAGEYAH34jJNqgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQKoB8qpsQKoB-ulsQKoB-qxsQKoB5m1sQKoB763sQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WIqq8r3d-oIDgAoBmAsByAsBgAwBogwcKhoKGOS0sQLutbECtbixAqy6sQLktLEC7rWxAtoMEQoLEKDa3aD5noTk3wESAgEDqg0CREXIDQHYEwPQFQH4FgGAFwE%26ase%3D2%26gclid%3DEAIaIQobChMIs_L1vd36ggMV3zZPCB3xugHvEAEYASAAEgIKQfD_BwE%26num%3D1%26cid%3DCAQSTwDICaaNGT2IaNe7CqYwaNf0qcCwyumt8m7_5HY5vMxcUpJYC10lMkLrza5fuQqKiBNfrFIOjaQSd8GgkT95jH8KsnE8vo2rRKjija3m0SUYAQ%26sig%3DAOD64_18wQhWiJB1ckwf676SFhtiGANWrg%26client%3Dca-pub-5177316199383353%26adurl%3D&cb=1045086326
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:c96e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b6875b1573ae67f69232f0ee12c332eb114274cf273b548b13038a76cf3aa1f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:16 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 06 Dec 2023 11:42:16 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, s-maxage=10
cf-ray: 831443b938d491fc-FRA
request-context: appId=cid-v1:1a5f66bd-0229-467a-a946-b3753e659ecb

GET
H2 200 m_js_controller_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 9AFE 36 KB
14 KB 60ms
44ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/m_js_controller_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c2e9980bd93f0b451ec1d46d31894b06d6058fa401576e023d2f9c15d6f1bbc2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 04:54:28 GMT
content-encoding: br
x-content-type-options: nosniff
age: 24468
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14415
x-xss-protection: 0
server: cafe
etag: 9795706105763146070
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Dec 2023 04:54:28 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 9AFE 3 KB
1 KB 88ms
72ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 10:35:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3978
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Dec 2023 10:35:58 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 9AFE 20 KB
9 KB 38ms
23ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a5b47703d2aa636762f8b39205a2e03a85ae2de2904d81e6c6a469486ca81e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8554
x-xss-protection: 0
server: cafe
etag: 636498438165408290
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9AFE 202 KB
64 KB 106ms
80ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dce4158779dce6da3ede11337029f817a03f45c9559b1f91d8a7c5ac130f38c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65147
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701694399686299"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Dec 2023 11:42:16 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/ Frame 9AFE 24 KB
9 KB 85ms
70ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 08:03:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13123
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Dec 2023 08:03:33 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame EF87
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

35ms
35ms

Document
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:16 GMT
expires: Wed, 06 Dec 2023 11:42:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:16 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame A770 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 749771a538882ff95a66698f6a6e9bc137e5530691873d165df206d1d3c43d8c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 9AFE 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 56dabcaab2c4af8e3bce2996b40bf2bee77e65905d793de0e03da04716befdfa

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 iframe.html Show response
p4-hsumuihihija4-ma55novngz7x7ty2-if-v6exp3-v4.metric.gstatic.com/v6exp3/ Frame 1E6F 5 KB
2 KB 34ms
33ms Document
text/html 142.250.185.99
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://p4-hsumuihihija4-ma55novngz7x7ty2-if-v6exp3-v4.metric.gstatic.com/v6exp3/iframe.html

Requested by

Host: p4-hsumuihihija4-ma55novngz7x7ty2-if-v6exp3-v4.metric.gstatic.com
URL: https://p4-hsumuihihija4-ma55novngz7x7ty2-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.99 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f3.1e100.net

Software

sffe /

Resource Hash

041ab8486237ed55f88609f1db886fb97c5ae620cd66d0347b330fc2f365bd46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://p4-hsumuihihija4-ma55novngz7x7ty2-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 1986
content-security-policy-report-only: script-src 'nonce-p4N17wtVa03SMSvdmWWIuw' 'report-sample' 'strict-dynamic' 'unsafe-eval' 'unsafe-inline' http: https:; object-src 'none'; report-uri https://csp.withgoogle.com/csp/static-on-bigtable; base-uri 'none'
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="static-on-bigtable"
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:16 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
last-modified: Tue, 14 Nov 2023 14:08:00 GMT
pragma: no-cache
report-to: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 css
fonts.googleapis.com/ Frame 149B 2 KB
553 B 31ms
31ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Poppins%3A400%2C600

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

e537bb0b81601eabcdc6dd4e2eb938917a7c6887765651882ec0ed5081c26c67

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 06 Dec 2023 11:42:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 11:21:57 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 06 Dec 2023 11:42:16 GMT

GET
H2 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 149B 2 KB
875 B 21ms
20ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H2 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/ Frame 149B 24 KB
9 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 08:03:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13123
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Dec 2023 08:03:33 GMT

GET
H2 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 149B 3 KB
1 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 10:35:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3978
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Dec 2023 10:35:58 GMT

GET
H2 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 149B 20 KB
8 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a5b47703d2aa636762f8b39205a2e03a85ae2de2904d81e6c6a469486ca81e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8554
x-xss-protection: 0
server: cafe
etag: 636498438165408290
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H2 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 149B 202 KB
64 KB 54ms
53ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dce4158779dce6da3ede11337029f817a03f45c9559b1f91d8a7c5ac130f38c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65147
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701694399686299"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Dec 2023 11:42:16 GMT

GET
H2 200 7a8419aef3683f04c437bd15cecf843d.js Show response
www.gstatic.com/mysidia/ Frame 149B 37 KB
15 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/7a8419aef3683f04c437bd15cecf843d.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

949b3cde1a46caf4f55bb496f58a44af641a4b9fed64f95057bb5eeff142170b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 05:25:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 109011
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15452
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 19:10:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 04 Mar 2024 05:25:25 GMT

GET
H2 200 preload.jpg
c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/published/6074732/7774217/ Frame 9AFE 5 KB
6 KB 31ms
31ms Image
image/jpeg 2606:4700::6811:c96e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/published/6074732/7774217/preload.jpg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:c96e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a2799438c67a88f5eff2b8b3610ba892029e8a79f0cfc419ecccf97aaa5e2962

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 06 Dec 2023 11:42:16 GMT
cf-cache-status: HIT
content-md5: viy/IB6mMU0H80qkBY4zjQ==
age: 427119
content-length: 5250
x-ms-lease-status: unlocked
cf-bgj: h2pri
last-modified: Wed, 25 Oct 2023 18:45:09 GMT
server: cloudflare
etag: "0x8DBD58A83D77904"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
x-ms-request-id: 32988ad2-f01e-0014-7356-249dbc000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
accept-ranges: bytes
cf-ray: 831443b9994491fc-FRA

POST
H2 200 /
c.bannerflow.net/tr/v2/pixel/ Frame 9AFE 0
81 B 42ms
42ms Ping
text/plain 2606:4700::6811:c96e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/tr/v2/pixel/
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/65396155843eb9eeda770d48?did=5d6fb28839d71e0001cd1a9f&deeplink=on&responsive=off&redirecturl=https://adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DCkFXsF15wZfOKLN_tvPIP8fWG-A6-9MHJdNev-sbvEZ_w8_0IEAEg54vVJGCVgoCAuAegAYn3tskDyAEJqQLkdwRDDSa1PqgDAcgDAqoE7AFP0GmlGZZe3dJgTwBFRdTNmo4wP0-xmYxOosjI4AVR5iq3GRLWHl2CQHT10y8QK6U6uQVkOoBjkFSZrzyoxGeag_gVBQG1oiYatTmSyq5YmhWj8-ChFttSYbLvFm6m1ThY_8v1kuOBDqTkwJcxi6JvZttyjgmtyfjcFeOyYvTDApgACbsr3Zk9cIwk5S9B6bTXnxrlYAqlZF4_Jvvm1Qc30bwCrFd6tTmlH1UuUnDRwUgOeN_cxz-fx0wN_shlekoXwE2JLeS7SQdNgcIyDiEKMmJ5cyRpyvh3BoiZhQ1ZHAGuPhLbbr6NhWnt4MAErauJ4MAEiAXbkIKQTaAGEYAH34jJNqgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQKoB8qpsQKoB-ulsQKoB-qxsQKoB5m1sQKoB763sQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WIqq8r3d-oIDgAoBmAsByAsBgAwBogwcKhoKGOS0sQLutbECtbixAqy6sQLktLEC7rWxAtoMEQoLEKDa3aD5noTk3wESAgEDqg0CREXIDQHYEwPQFQH4FgGAFwE%26ase%3D2%26gclid%3DEAIaIQobChMIs_L1vd36ggMV3zZPCB3xugHvEAEYASAAEgIKQfD_BwE%26num%3D1%26cid%3DCAQSTwDICaaNGT2IaNe7CqYwaNf0qcCwyumt8m7_5HY5vMxcUpJYC10lMkLrza5fuQqKiBNfrFIOjaQSd8GgkT95jH8KsnE8vo2rRKjija3m0SUYAQ%26sig%3DAOD64_18wQhWiJB1ckwf676SFhtiGANWrg%26client%3Dca-pub-5177316199383353%26adurl%3D&cb=1045086326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:c96e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://googleads.g.doubleclick.net/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 06 Dec 2023 11:42:16 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 831443b9f9a791fc-FRA
content-length: 0
request-context: appId=cid-v1:1d9bcaa3-5ddc-4e5d-973c-949d7ceab63e

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame 9AFE 0
0 67ms
67ms Fetch
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/adview?ai=CRpvsF15wZfOKLN_tvPIP8fWG-A6-9MHJdNev-sbvEZ_w8_0IEAEg54vVJGCVgoCAuAegAYn3tskDyAEJqQLkdwRDDSa1PqgDAcgDAqoE6QFP0GmlGZZe3dJgTwBFRdTNmo4wP0-xmYxOosjI4AVR5iq3GRLWHl2CQHT10y8QK6U6uQVkOoBjkFSZrzyoxGeag_gVBQG1oiYatTmSyq5YmhWj8-ChFttSYbLvFm6m1ThY_8v1kuOBDqTkwJcxi6JvZttyjgmtyfjcFeOyYvTDApgACbsr3Zk9cIwk5S9B6bTXnxrlYAqlZF4_Jvvm1Qc30bwCrFd6tTmlH1UuUnDRwUgOeN_cxz-fx0wN_shleggV4d9NvX2d3J5DFkEnmYpvF2jneApxDE_2IB0iZSN1BO8ZpQdMbV5UE8AErauJ4MAEiAXbkIKQTaAGEYAH34jJNqgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4b2AcA8gcFEIPwvAHSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WIqq8r3d-oIDgAoByAsBogwcKhoKGOS0sQLutbECtbixAqy6sQLktLEC7rWxAtgTA9AVAYAXAbIXHAoaCAASFHB1Yi01MTc3MzE2MTk5MzgzMzUzGAA&sigh=LJ76lcemWAA&uach_m=%5BUACH%5D&ase=2&nis=4&cid=CAQSTwDICaaNGT2IaNe7CqYwaNf0qcCwyumt8m7_5HY5vMxcUpJYC10lMkLrza5fuQqKiBNfrFIOjaQSd8GgkT95jH8KsnE8vo2rRKjija3m0SUYAQ&cbvp=2&vis=1

Requested by

Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1
Attribution-Reporting-Eligible: event-source
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 06 Dec 2023 11:42:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 06 Dec 2023 11:42:16 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame A770
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CX-xtF15wZe6gLOCyxtYP8LungAzMj86zdLjMidmkELCQHxABIOeL1SRglYKAgLgHoAH34pu0KMgBAqgDAcgDyQSqBPABT9A7OBUx5-7DaqFUQ4mbF94KA3qhoZNq4kGzGcUvF9RsA1MS8Y6...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2217375779844637071186%22,%22debug_reporting%22:true,%22destination%22:%22https://webcompanion.com%22,%22event_report_window...

0
0

104ms
58ms

Fetch
text/css

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2217375779844637071186%22,%22debug_reporting%22:true,%22destination%22:%22https://webcompanion.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2210846925175%22],%224%22:[%2212-06%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%225818010341999898033%22}&andc=true

Requested by

Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:16 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"17375779844637071186","debug_reporting":true,"destination":"https://webcompanion.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["10846925175"],"4":["12-06"],"6":["true"]},"priority":"500","source_event_id":"5818010341999898033"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 06 Dec 2023 11:42:16 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 06 Dec 2023 11:42:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"17375779844637071186","debug_reporting":true,"destination":"https://webcompanion.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["10846925175"],"4":["12-06"],"6":["true"]},"priority":"500","source_event_id":"5818010341999898033"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js Show response
pagead2.googlesyndication.com/bg/ Frame EB07 50 KB
19 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js

Requested by

Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bf1da233645c84549609f619670d4d3e946ac61d516fd53e597c10ad100608a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 20:09:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 142378
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19601
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 03 Dec 2024 20:09:18 GMT

GET
H3 200 a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js Show response
pagead2.googlesyndication.com/bg/ Frame EE1B 50 KB
19 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bf1da233645c84549609f619670d4d3e946ac61d516fd53e597c10ad100608a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 20:09:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 142378
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19601
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 03 Dec 2024 20:09:18 GMT

GET
H3 200 14468903377570354480
tpc.googlesyndication.com/daca_images/simgad/ Frame 31E0 57 KB
57 KB 24ms
24ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/daca_images/simgad/14468903377570354480

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=280&adk=2012289476&adf=1708623896&pi=t.aa~a.1495420058~rp.1&w=888&fwrn=4&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x280&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280%2C888x90%2C888x90&nras=6&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=4240&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=5&fsb=1&dtd=10

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0ecb04cada8854cff0112c413c9fc971042d6888ce8f24c63d304b429c27b54b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 18:35:34 GMT
x-content-type-options: nosniff
age: 61602
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57929
x-xss-protection: 0
last-modified: Sat, 07 Aug 2021 15:20:01 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Wed, 04 Dec 2024 18:35:34 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/ Frame 31E0 24 KB
9 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 08:03:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13123
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Dec 2023 08:03:33 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 31E0 3 KB
1 KB 54ms
54ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 10:35:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3978
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Dec 2023 10:35:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 31E0 20 KB
8 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a5b47703d2aa636762f8b39205a2e03a85ae2de2904d81e6c6a469486ca81e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8554
x-xss-protection: 0
server: cafe
etag: 636498438165408290
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 31E0 0
0 34ms
33ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTGoF_F75ZTgV8mSiu2YTZrMI_GsHQ57w-3zs1-AgfD7eJVcYWYDIdFKrhzqB65Xlg3LQcSamotnsL3dDLiUDukGlriMA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=280&adk=2012289476&adf=1708623896&pi=t.aa~a.1495420058~rp.1&w=888&fwrn=4&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x280&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280%2C888x90%2C888x90&nras=6&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=4240&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=5&fsb=1&dtd=10
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 31E0 202 KB
64 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dce4158779dce6da3ede11337029f817a03f45c9559b1f91d8a7c5ac130f38c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65147
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701694399686299"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Dec 2023 11:42:16 GMT

GET
H3 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 31E0 36 KB
14 KB 55ms
54ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a65f004d5a22b43dea5abdd195d59f30681e0040964b28f7bf9cf04d69a91ea1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:47:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71663
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14814
x-xss-protection: 0
server: cafe
etag: 3975445015323060182
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:47:53 GMT

GET
H3 200 8443436899605463105
tpc.googlesyndication.com/simgad/ Frame 5724 14 KB
14 KB 33ms
32ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/8443436899605463105?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qmLYSJZ41DcKPeuI5zJWQnqsEOSIQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=3970650495&pi=t.aa~a.2226337157~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280%2C888x90&nras=5&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2997&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=8

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d325c6c872d4a8f885f69b70437577324c0b872c4b839c1a25865b307c0a63e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:29:51 GMT
x-content-type-options: nosniff
age: 166345
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14053
x-xss-protection: 0
last-modified: Fri, 14 Oct 2022 15:22:23 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 03 Dec 2024 13:29:51 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/ Frame 5724 24 KB
9 KB 57ms
57ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 08:03:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13123
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Dec 2023 08:03:33 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 5724 3 KB
1 KB 48ms
48ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 10:35:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3978
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Dec 2023 10:35:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 5724 20 KB
8 KB 28ms
28ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a5b47703d2aa636762f8b39205a2e03a85ae2de2904d81e6c6a469486ca81e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8554
x-xss-protection: 0
server: cafe
etag: 636498438165408290
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 5724 0
0 31ms
31ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRoVm-aXLM-dp9Oy0leuHsvi-9H-VOTdABiLJwdFApvidh2Ya35Ayve6Dr66Gy4CtQnD16NYb9b6JQNMfT1Q3uzNxeeuw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=3970650495&pi=t.aa~a.2226337157~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280%2C888x90&nras=5&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2997&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 5724 202 KB
64 KB 51ms
50ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dce4158779dce6da3ede11337029f817a03f45c9559b1f91d8a7c5ac130f38c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65147
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701694399686299"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Dec 2023 11:42:16 GMT

GET
H3 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 5724 36 KB
14 KB 48ms
48ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a65f004d5a22b43dea5abdd195d59f30681e0040964b28f7bf9cf04d69a91ea1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:47:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71663
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14814
x-xss-protection: 0
server: cafe
etag: 3975445015323060182
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:47:53 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 288F 143 B
166 B 22ms
21ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=280&adk=2012289476&adf=1708623896&pi=t.aa~a.1495420058~rp.1&w=888&fwrn=4&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x280&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280%2C888x90%2C888x90&nras=6&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=4240&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=5&fsb=1&dtd=10
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 229
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:38:27 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame B541 1 KB
643 B 22ms
22ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3006
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 10:52:10 GMT
etag: 48472445140208031
expires: Thu, 07 Dec 2023 10:52:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 112ms
56ms Preflight
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 06 Dec 2023 11:42:16 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame EF11 143 B
166 B 24ms
23ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=3970650495&pi=t.aa~a.2226337157~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280%2C888x90&nras=5&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2997&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 229
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:38:27 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame DA81 1 KB
643 B 21ms
21ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3006
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 10:52:10 GMT
etag: 48472445140208031
expires: Thu, 07 Dec 2023 10:52:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 31E0 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d3ce19de95535e452733373acbb58a7f94adb94fbafccfb0ee80ee724453d241

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 288F
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

37ms
36ms

Document
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:16 GMT
expires: Wed, 06 Dec 2023 11:42:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:16 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dpixel
cms.quantserve.com/ Frame B541 35 B
464 B 85ms
25ms Image
image/gif 2620:116:800d:21:de2e:c7b3:55c0:d5a0
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEI-QcOojBWhVde6e3QK2d3o&google_cver=1&google_push=AXcoOmSzvXci077GcxwE_2T12PVUN-Gnv92dXTH4dsxHblK7yYQVyHWP6xCpcMZcZDMgxK3uMUMnYmS9SddC-Nie70ONYDMrlzJIgvcyAXzx29eRAfzB1yx-X0wmPlr7KBObSXSdzvN-3gKux0zNBKfLPkKXcFs

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:de2e:c7b3:55c0:d5a0 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:16 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame B541 0
104 B 229ms
113ms Image
text/plain 2a02:fa8:8806:12::1370
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEFmLRXd8Rt_LYbD7RqwHem8&google_cver=1&google_push=AXcoOmSXtvaiCBAL4o-V4WOwFxgwLBx4-tC6zldyfenzzOjavg9PHmDwr0mzxglemUrpzhRhX_YX-2B2_pL-htDwftNnVZbHEJrUDoCAYSbN-zwd8_ykRs6FSR9t8QixEAQ_Pgram-0hOBsYi-p8Y5xqYrlyHOY
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=280&adk=2012289476&adf=1708623896&pi=t.aa~a.1495420058~rp.1&w=888&fwrn=4&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x280&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280%2C888x90%2C888x90&nras=6&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=4240&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=7&uci=a!7&btvi=5&fsb=1&dtd=10
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1370 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:16 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame B541
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEOKo3EW9JIBReNZj__F99Ug&google_cver=1&google_push=AXcoOmSKcIwO7Xnb6eF8MavrfOw7n5_KbgFM6P3mJV3gIl_5C22tJfpbrstFwPwqquadx_z9Ca2HIBd5ZIndWWVDWcVUw_Vqp0hij...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEOKo3EW9JIBReNZj__F99Ug&google_cver=1&google_push=AXcoOmSKcIwO7Xnb6eF8MavrfOw7n5_KbgFM6P3mJV3gIl_5C22tJfpbrstFwPwqquadx_z9Ca2HIBd5ZIndWWVDWcVUw_Vqp0h...

43 B
459 B

209ms
195ms

Image
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEOKo3EW9JIBReNZj__F99Ug&google_cver=1&google_push=AXcoOmSKcIwO7Xnb6eF8MavrfOw7n5_KbgFM6P3mJV3gIl_5C22tJfpbrstFwPwqquadx_z9Ca2HIBd5ZIndWWVDWcVUw_Vqp0hijzWj1jupEQH1BymSK1G7Kt3FgAPguo0xAiyranVfO07uPeVZ-CndCV4uWg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmSKcIwO7Xnb6eF8MavrfOw7n5_KbgFM6P3mJV3gIl_5C22tJfpbrstFwPwqquadx_z9Ca2HIBd5ZIndWWVDWcVUw_Vqp0hijzWj1jupEQH1BymSK1G7Kt3FgAPguo0xAiyranVfO07uPeVZ-CndCV4uWg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
Protocol: H2
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 831443bcad859a30-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 3078
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEOKo3EW9JIBReNZj__F99Ug&google_cver=1&google_push=AXcoOmSKcIwO7Xnb6eF8MavrfOw7n5_KbgFM6P3mJV3gIl_5C22tJfpbrstFwPwqquadx_z9Ca2HIBd5ZIndWWVDWcVUw_Vqp0hijzWj1jupEQH1BymSK1G7Kt3FgAPguo0xAiyranVfO07uPeVZ-CndCV4uWg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmSKcIwO7Xnb6eF8MavrfOw7n5_KbgFM6P3mJV3gIl_5C22tJfpbrstFwPwqquadx_z9Ca2HIBd5ZIndWWVDWcVUw_Vqp0hijzWj1jupEQH1BymSK1G7Kt3FgAPguo0xAiyranVfO07uPeVZ-CndCV4uWg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 831443bb6c119a30-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame B541
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEFqi43bb6-4Y5k6xxH5Vu6Q&google_cver=1&google_push=AXcoOmSAM2h3rOdb2ilDMRgMBxhpSRWtGWZdqLkh1ZLSdx09HKfnkvr2cUs3cZb-Fvvs0YlVsOtW-sWZscqErTWWt_g_gQ0...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSAM2h3rOdb2ilDMRgMBxhpSRWtGWZdqLkh1ZLSdx09HKfnkvr2cUs3cZb-Fvvs0YlVsOtW-sWZscqErTWWt_g_gQ0hdJmU2vK6l4RSnVuVwwdODLPfMzg0o9rEKhk1L...

170 B
232 B

34ms
34ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSAM2h3rOdb2ilDMRgMBxhpSRWtGWZdqLkh1ZLSdx09HKfnkvr2cUs3cZb-Fvvs0YlVsOtW-sWZscqErTWWt_g_gQ0hdJmU2vK6l4RSnVuVwwdODLPfMzg0o9rEKhk1LV7HmDhES3nxsN60_Hd33HH9D9A&google_hm=eS1ncFFxOVNWRTJwRmN6dHlkNXlvbnVubGQyeV9ST2ZWen5B

Requested by

Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 06 Dec 2023 11:42:16 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSAM2h3rOdb2ilDMRgMBxhpSRWtGWZdqLkh1ZLSdx09HKfnkvr2cUs3cZb-Fvvs0YlVsOtW-sWZscqErTWWt_g_gQ0hdJmU2vK6l4RSnVuVwwdODLPfMzg0o9rEKhk1LV7HmDhES3nxsN60_Hd33HH9D9A&google_hm=eS1ncFFxOVNWRTJwRmN6dHlkNXlvbnVubGQyeV9ST2ZWen5B
content-length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame B541 43 B
363 B 93ms
29ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmTFbCnUqsyoIAs_QZHysAGeIuSPtKuthebO7rOD2MXFFB7tv8Iv36up2yiMT6e-J7pEUCwt-2A-nYMxY8OnevGYmlR0LV1r9gc_sEUplB1LCQnJQXE4wLfFkWN48cyKAVvva_llgORNZzluOWtPFv2Utx8&google_gid=CAESELQAaeB-8IUTymP8hQYOrE0&google_cver=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:16 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 183433
expires: Wed, 06 Dec 2023 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame B541
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESECS135kYw6nVfrOw7ow29R4&google_cver=1&google_push=AXcoOmROZmeCRokwFtG1nc9kl4UibyMdSDSsxj83BY7t-896H9xjPWF6l7lOe7sTD4eCDCFF796EN5YJ...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESECS135kYw6nVfrOw7ow29R4&google_cver=1&google_push=AXcoOmROZmeCRokwFtG1nc9kl4UibyMdSDSsxj83BY7t-896H9xjPWF6l7lOe7sTD4eCDCFF796...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=OTE0OTk4MzY1OTMxMTk2NjMyMw&google_push=AXcoOmROZmeCRokwFtG1nc9kl4UibyMdSDSsxj83BY7t-896H9xjPWF6l7lOe7sTD4eCDCFF796EN5...

170 B
232 B

35ms
34ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=OTE0OTk4MzY1OTMxMTk2NjMyMw&google_push=AXcoOmROZmeCRokwFtG1nc9kl4UibyMdSDSsxj83BY7t-896H9xjPWF6l7lOe7sTD4eCDCFF796EN5YJVtAMWTMir560HPZS0f73EeqRYPMTKsfCOkFj88u-QLiTrb_ArVysjjphldlsUVPMu6FNHfxiup8qoX8

Requested by

Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=OTE0OTk4MzY1OTMxMTk2NjMyMw&google_push=AXcoOmROZmeCRokwFtG1nc9kl4UibyMdSDSsxj83BY7t-896H9xjPWF6l7lOe7sTD4eCDCFF796EN5YJVtAMWTMir560HPZS0f73EeqRYPMTKsfCOkFj88u-QLiTrb_ArVysjjphldlsUVPMu6FNHfxiup8qoX8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame B541
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEHqYIJuLZ6SJTPRViRq8gBU&google_cver=1&google_push=AXcoOmR5gjQ9JS2pIGTRnJo7XVWorGvA54dDg5rOxQSd2eL_-Pim1Wxepbbqa649RcU06HLNgeWV0xcDXChn...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmR5gjQ9JS2pIGTRnJo7XVWorGvA54dDg5rOxQSd2eL_-Pim1Wxepbbqa649RcU06HLNgeWV0xcDXChnmKY0ryjTmbsrMlrMHsDDnKeFoGVZIZdupBWG...

170 B
329 B

31ms
31ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmR5gjQ9JS2pIGTRnJo7XVWorGvA54dDg5rOxQSd2eL_-Pim1Wxepbbqa649RcU06HLNgeWV0xcDXChnmKY0ryjTmbsrMlrMHsDDnKeFoGVZIZdupBWGzWraUXXolq70V9JkAqAokb3a5xHSzu2AYGMl73E

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmR5gjQ9JS2pIGTRnJo7XVWorGvA54dDg5rOxQSd2eL_-Pim1Wxepbbqa649RcU06HLNgeWV0xcDXChnmKY0ryjTmbsrMlrMHsDDnKeFoGVZIZdupBWGzWraUXXolq70V9JkAqAokb3a5xHSzu2AYGMl73E
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame B541 0
139 B 95ms
31ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JCiM1N6pXHHMDb9l-TPV1y8HC3PwglrA3mLuZcg-Go_XYSgWoV3dJsdD1m5uHwWbv3mXvG

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:16 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
DATA 200
OK truncated
/ Frame 5724 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 470d97f885973efd71f757f98dba795f591923c2bd5032747a32a3d9b649e30c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 6537233882389388812
tpc.googlesyndication.com/simgad/ Frame 1146 24 KB
24 KB 24ms
24ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/6537233882389388812?sqp=4sqPyQQrQikqJwhfEAEdAAC0QiABKAEwCTgDQPCTCUgAUAFYAWBfcAJ4AcUBLbKdPg&rs=AOga4qkqnJMb__ljEsSfrA6dhUWYpirX5g

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=280&adk=1092940552&adf=2200989083&pi=t.aa~a.1924974561~rp.4&w=352&fwrn=4&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=352x280&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90&nras=3&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1080&ady=1696&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=5

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e44b4d77b271b6595bfed67b604e1dbbcb99906e6eed0844efcfc3f762a2c1a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 02 Dec 2023 03:30:22 GMT
x-content-type-options: nosniff
age: 375114
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24806
x-xss-protection: 0
last-modified: Fri, 10 Nov 2023 14:07:11 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Sun, 01 Dec 2024 03:30:22 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/ Frame 1146 24 KB
9 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 08:03:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13123
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Dec 2023 08:03:33 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 1146 3 KB
1 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 10:35:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3978
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Dec 2023 10:35:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 1146 20 KB
8 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a5b47703d2aa636762f8b39205a2e03a85ae2de2904d81e6c6a469486ca81e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8554
x-xss-protection: 0
server: cafe
etag: 636498438165408290
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 1146 0
0 31ms
30ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQhU6jbPDoWqkN97tu4vfcZcLMvMJuInzh6aOeZi3i3vTxagBOQZV2QyxARvm0YvvvvpxxGc0IbrSiQPLjOtflvK2Zmug
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=280&adk=1092940552&adf=2200989083&pi=t.aa~a.1924974561~rp.4&w=352&fwrn=4&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=352x280&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90&nras=3&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1080&ady=1696&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=5
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 1146 202 KB
64 KB 37ms
36ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dce4158779dce6da3ede11337029f817a03f45c9559b1f91d8a7c5ac130f38c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65147
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701694399686299"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Dec 2023 11:42:16 GMT

GET
H3 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 1146 36 KB
14 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a65f004d5a22b43dea5abdd195d59f30681e0040964b28f7bf9cf04d69a91ea1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:47:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71663
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14814
x-xss-protection: 0
server: cafe
etag: 3975445015323060182
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:47:53 GMT

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 7C97 143 B
166 B 23ms
22ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=280&adk=1092940552&adf=2200989083&pi=t.aa~a.1924974561~rp.4&w=352&fwrn=4&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=352x280&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90&nras=3&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=1080&ady=1696&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=4&uci=a!4&btvi=2&fsb=1&dtd=5
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 229
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:38:27 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame EA16 1 KB
643 B 22ms
22ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3006
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 10:52:10 GMT
etag: 48472445140208031
expires: Thu, 07 Dec 2023 10:52:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame DA81
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESENPkZ9CbvLBc3rqTEoYybyk&google_cver=1&google_push=AXcoOmQUOYIzpYUrXP_zgkIkMWndPIXFL5qw1750iJ74VE3mKIJkmI3G-8xMfkGsSK7-RO3oPUPdrjJd4ijLigjyJ9Wu3kpAfSAem...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESENPkZ9CbvLBc3rqTEoYybyk&google_cver=1&google_push=AXcoOmQUOYIzpYUrXP_zgkIkMWndPIXFL5qw1750iJ74VE3mKIJkmI3G-8xMfkGsSK7-RO3oPUPdrjJd4ijLigjyJ9Wu3kpAfSA...

43 B
541 B

195ms
195ms

Image
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESENPkZ9CbvLBc3rqTEoYybyk&google_cver=1&google_push=AXcoOmQUOYIzpYUrXP_zgkIkMWndPIXFL5qw1750iJ74VE3mKIJkmI3G-8xMfkGsSK7-RO3oPUPdrjJd4ijLigjyJ9Wu3kpAfSAemg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQUOYIzpYUrXP_zgkIkMWndPIXFL5qw1750iJ74VE3mKIJkmI3G-8xMfkGsSK7-RO3oPUPdrjJd4ijLigjyJ9Wu3kpAfSAemg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
Protocol: H2
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 831443bccda29a30-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 5607
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESENPkZ9CbvLBc3rqTEoYybyk&google_cver=1&google_push=AXcoOmQUOYIzpYUrXP_zgkIkMWndPIXFL5qw1750iJ74VE3mKIJkmI3G-8xMfkGsSK7-RO3oPUPdrjJd4ijLigjyJ9Wu3kpAfSAemg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmQUOYIzpYUrXP_zgkIkMWndPIXFL5qw1750iJ74VE3mKIJkmI3G-8xMfkGsSK7-RO3oPUPdrjJd4ijLigjyJ9Wu3kpAfSAemg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 831443bb8c399a30-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame DA81
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEJb_9sh45pkuUThu7WrmCek&google_push=AXcoOmTAticeqkYphqGgu_ZTwzTcEtCa8W77WVCc4tdKEVDTUO4uAgATAL...

170 B
188 B

34ms
34ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEJb_9sh45pkuUThu7WrmCek&google_push=AXcoOmTAticeqkYphqGgu_ZTwzTcEtCa8W77WVCc4tdKEVDTUO4uAgATALk6IrklDwwDe5zvEK4UGXtfzvW9cksBwrrSwFrujzvaCA

Requested by

Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-cph2320035-CPH
pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1701862937.969358,VS0,VE100
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEJb_9sh45pkuUThu7WrmCek&google_push=AXcoOmTAticeqkYphqGgu_ZTwzTcEtCa8W77WVCc4tdKEVDTUO4uAgATALk6IrklDwwDe5zvEK4UGXtfzvW9cksBwrrSwFrujzvaCA
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame DA81 0
173 B 85ms
32ms Image
text/plain 34.96.105.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEBfxVeL0QyHHjXanB8ltd-0&google_cver=1&google_push=AXcoOmQy4Z7qY7YnW8lrSiASgPUDxDUZJp92YnFPYrkaAk4tr66vbEGVnB4EPqW8E254sNhspHbD4GOfgEiG-Fb7-6HA-rI7uoLDnQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=3970650495&pi=t.aa~a.2226337157~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280%2C888x90&nras=5&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2997&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=8
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:16 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame DA81
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEI7bSXxxKPUhwckvfRPY8_E&google_cver=1&google_push=AXcoOmQQy1Vvi3YzZ2C5jFBMUPQdpY7d7SaR3lCQJ3kRFe8xm9QNvdyl3o9IPyyZTdZhK1VFwKpQsFgI7Oawy3jX...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=YVIpSo1ET1wQamVIL3iU8Q&google_push=AXcoOmQQy1Vvi3YzZ2C5jFBMUPQdpY7d7SaR3lCQJ3kRFe8xm9QNvdyl3o9IPyyZTdZhK1VFwKpQsFgI7Oawy3jX26zXUGmn2zwR

170 B
232 B

34ms
33ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=YVIpSo1ET1wQamVIL3iU8Q&google_push=AXcoOmQQy1Vvi3YzZ2C5jFBMUPQdpY7d7SaR3lCQJ3kRFe8xm9QNvdyl3o9IPyyZTdZhK1VFwKpQsFgI7Oawy3jX26zXUGmn2zwR

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 06 Dec 2023 11:42:16 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=YVIpSo1ET1wQamVIL3iU8Q&google_push=AXcoOmQQy1Vvi3YzZ2C5jFBMUPQdpY7d7SaR3lCQJ3kRFe8xm9QNvdyl3o9IPyyZTdZhK1VFwKpQsFgI7Oawy3jX26zXUGmn2zwR
x-host: tde-deliveryengine-production-5989b845bf-86npk
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 sync
x.bidswitch.net/ Frame DA81 43 B
146 B 71ms
22ms Image
image/gif 18.196.207.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEAg2zg92u0PXspy5wIkYicU&google_cver=1&google_push=AXcoOmQEjUYIR6ScUENUEX9JwQjytwIXmUlQE4cL90Q61UxFD7WVbIyyGFAqjRkx-ZV54ZlX6sNuXBa9ekf6kPzvW51yLXOwrlmLTw
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=3970650495&pi=t.aa~a.2226337157~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280%2C888x90&nras=5&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2997&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=6&uci=a!6&btvi=4&fsb=1&dtd=8
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.196.207.18 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-207-18.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:16 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame DA81 43 B
362 B 29ms
29ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmTUetsU-ru9oz-NFSZvMQ9WLZwhPQ3TAcP1lkMxlUqMVDByY-QXuOy9y9Uy2Uf9_arP-U7xs29OkysNbq-J62fAPYWAsE666A&google_gid=CAESEIarMtNPoAZ9BDYP2HSlZ8Q&google_cver=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:16 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 220995
expires: Wed, 06 Dec 2023 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame DA81
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEPDjs4HyRsoi8WUDxwgQkYo&google_cver=1&google_push=AXcoOmRjpI07yghfn2t8O3lWSsDKLYJMYKJEKfb-NchNgPkqrioxogvRZf5mIvMZMMlTorZ6otA09W4I...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEPDjs4HyRsoi8WUDxwgQkYo&google_cver=1&google_push=AXcoOmRjpI07yghfn2t8O3lWSsDKLYJMYKJEKfb-NchNgPkqrioxogvRZf5mIvMZMMlTorZ6otA...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjgyMzcyMTY5MjAzOTI5Njk4MQ&google_push=AXcoOmRjpI07yghfn2t8O3lWSsDKLYJMYKJEKfb-NchNgPkqrioxogvRZf5mIvMZMMlTorZ6otA09W...

170 B
232 B

33ms
32ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjgyMzcyMTY5MjAzOTI5Njk4MQ&google_push=AXcoOmRjpI07yghfn2t8O3lWSsDKLYJMYKJEKfb-NchNgPkqrioxogvRZf5mIvMZMMlTorZ6otA09W4IW6ecUET8HO2f4yil80N1bA

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:16 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=MjgyMzcyMTY5MjAzOTI5Njk4MQ&google_push=AXcoOmRjpI07yghfn2t8O3lWSsDKLYJMYKJEKfb-NchNgPkqrioxogvRZf5mIvMZMMlTorZ6otA09W4IW6ecUET8HO2f4yil80N1bA
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame DA81 0
40 B 30ms
30ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Je6IuTTjsGgvBiZGJS76FOzyBXZAmjV6vi3uJbOOcZLzjLAWWPAFagP8Fux6CKqWRW1Ba-

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:16 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame EF11
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

31ms
31ms

Document
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:16 GMT
expires: Wed, 06 Dec 2023 11:42:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:16 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 css
fonts.googleapis.com/ Frame FC8F 4 KB
655 B 29ms
29ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=280&adk=4109395274&adf=2229934989&pi=t.aa~a.1495420058~rp.2&w=848&fwrn=4&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=848x280&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=0&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280%2C888x90%2C888x90%2C888x280&nras=7&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=148&ady=4560&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&btvi=6&fsb=1&dtd=12

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

f8238cdd1cc6032f1c34cf7e559b55a936097f78cc8839628e5cc39a6fc3f390

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 06 Dec 2023 11:42:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 09:56:44 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 06 Dec 2023 11:42:16 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame FC8F 2 KB
822 B 21ms
21ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/ Frame FC8F 24 KB
9 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/abg_lite_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 08:03:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13123
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Dec 2023 08:03:33 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame FC8F 3 KB
1 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/window_focus_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 10:35:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3978
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Dec 2023 10:35:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame FC8F 20 KB
8 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/qs_click_protection_fy2021.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a5b47703d2aa636762f8b39205a2e03a85ae2de2904d81e6c6a469486ca81e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8554
x-xss-protection: 0
server: cafe
etag: 636498438165408290
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame FC8F 0
0 30ms
30ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ9B_8T8bct1WUDgv8k8tVJlMm-P18-JiIcBdxoC_6rkKIVBuhCKN8PFHfA2dKsgoDZUENKvdKOe1QG85uiyb7gw1wJBg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=280&adk=4109395274&adf=2229934989&pi=t.aa~a.1495420058~rp.2&w=848&fwrn=4&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=848x280&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=0&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280%2C888x90%2C888x90%2C888x280&nras=7&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=148&ady=4560&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&btvi=6&fsb=1&dtd=12
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame FC8F 202 KB
64 KB 35ms
35ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dce4158779dce6da3ede11337029f817a03f45c9559b1f91d8a7c5ac130f38c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65147
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701694399686299"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Dec 2023 11:42:16 GMT

GET
H3 200 7a8419aef3683f04c437bd15cecf843d.js Show response
www.gstatic.com/mysidia/ Frame FC8F 37 KB
15 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/7a8419aef3683f04c437bd15cecf843d.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

949b3cde1a46caf4f55bb496f58a44af641a4b9fed64f95057bb5eeff142170b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 05:25:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 109011
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15452
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 19:10:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 04 Mar 2024 05:25:25 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 31E0
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CzL-qGF5wZa_XGKaGvPIPnNOqiAmE_bKYdPjfxuabEGQQASDni9UkYJWCgIC4B6ABhtfXvQPIAQKpAs6IUKawGbI-qAMByAPJBKoE6QFP0Lz6SaRD9n1HYJDiM4th4zKmSHbpUGAdQCPvRnB...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2212168126643632457987%22,%22debug_reporting%22:true,%22destination%22:%22https://lilienthal.berlin%22,%22event_report_windo...

0
0

57ms
57ms

Fetch
text/css

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2212168126643632457987%22,%22debug_reporting%22:true,%22destination%22:%22https://lilienthal.berlin%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22934669190%22],%224%22:[%2212-06%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%227821253497361421985%22}&andc=true

Requested by

Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:17 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"12168126643632457987","debug_reporting":true,"destination":"https://lilienthal.berlin","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["934669190"],"4":["12-06"],"6":["true"]},"priority":"500","source_event_id":"7821253497361421985"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 06 Dec 2023 11:42:17 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 06 Dec 2023 11:42:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"12168126643632457987","debug_reporting":true,"destination":"https://lilienthal.berlin","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["934669190"],"4":["12-06"],"6":["true"]},"priority":"500","source_event_id":"7821253497361421985"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 8443436899605463105
tpc.googlesyndication.com/simgad/ Frame 2A63 14 KB
14 KB 21ms
21ms Image
image/png 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/8443436899605463105?sqp=4sqPyQQ7QjkqNxABHQAAtEIgASgBMAk4A0DwkwlYAWBfcAKAAQGIAQGdAQAAgD-oAQGwAYCt4gS4AV_FAS2ynT4&rs=AOga4qmLYSJZ41DcKPeuI5zJWQnqsEOSIQ

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d325c6c872d4a8f885f69b70437577324c0b872c4b839c1a25865b307c0a63e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:29:51 GMT
x-content-type-options: nosniff
age: 166345
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14053
x-xss-protection: 0
last-modified: Fri, 14 Oct 2022 15:22:23 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 03 Dec 2024 13:29:51 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/ Frame 2A63 24 KB
9 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 08:03:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13123
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Dec 2023 08:03:33 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 2A63 3 KB
1 KB 29ms
28ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 10:35:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3978
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Dec 2023 10:35:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 2A63 20 KB
8 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a5b47703d2aa636762f8b39205a2e03a85ae2de2904d81e6c6a469486ca81e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8554
x-xss-protection: 0
server: cafe
etag: 636498438165408290
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 2A63 0
0 31ms
31ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaS9EUUULZYKUwmCsAASJYQpsPa4zdkfh3TOD6p9RX02JrOGlFvwgtJhnNVbPeyVWcGRw5sbXtjJkVuKArK0Jlbd7uWlrQ
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 2A63 202 KB
64 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dce4158779dce6da3ede11337029f817a03f45c9559b1f91d8a7c5ac130f38c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65147
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701694399686299"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Dec 2023 11:42:16 GMT

GET
H3 200 one_click_handler_one_afma_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 2A63 36 KB
14 KB 29ms
29ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/one_click_handler_one_afma_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a65f004d5a22b43dea5abdd195d59f30681e0040964b28f7bf9cf04d69a91ea1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:47:53 GMT
content-encoding: br
x-content-type-options: nosniff
age: 71663
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14814
x-xss-protection: 0
server: cafe
etag: 3975445015323060182
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:47:53 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 0C1B 1 KB
643 B 22ms
20ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3006
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 10:52:10 GMT
etag: 48472445140208031
expires: Thu, 07 Dec 2023 10:52:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 5724
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CyQ2sGF5wZZXbGObhxtYPhoqhmAzMj86zdLDXidmkELCQHxABIOeL1SRglYKAgLgHoAH34pu0KMgBAqgDAcgDyQSqBOkBT9CmDViJ2EFVnTMysoMIgVUu74kYDKjrgrJwgPPBrHFkbFJPEzc...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2212577071678312835461%22,%22debug_reporting%22:true,%22destination%22:%22https://webcompanion.com%22,%22event_report_window...

0
0

59ms
58ms

Fetch
text/css

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2212577071678312835461%22,%22debug_reporting%22:true,%22destination%22:%22https://webcompanion.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2210846925175%22],%224%22:[%2212-06%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%223558213363601238721%22}&andc=true

Requested by

Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:17 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"12577071678312835461","debug_reporting":true,"destination":"https://webcompanion.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["10846925175"],"4":["12-06"],"6":["true"]},"priority":"500","source_event_id":"3558213363601238721"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 06 Dec 2023 11:42:17 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 06 Dec 2023 11:42:16 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"12577071678312835461","debug_reporting":true,"destination":"https://webcompanion.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["10846925175"],"4":["12-06"],"6":["true"]},"priority":"500","source_event_id":"3558213363601238721"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/18314389596035848975/ Frame FC8F 159 KB
159 KB 24ms
22ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/18314389596035848975/14763004658117789537

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bb730cd52b305ac09445308d714d2e061d43d905d4594aa636a3909c644f49ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 08:47:21 GMT
x-content-type-options: nosniff
age: 10495
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 162386
x-xss-protection: 0
last-modified: Tue, 31 Oct 2023 17:30:18 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Thu, 05 Dec 2024 08:47:21 GMT

GET
H3 200 14763004658117789537
tpc.googlesyndication.com/simgad/8551331665856499624/ Frame FC8F 2 KB
2 KB 24ms
22ms Image
image/jpeg 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/8551331665856499624/14763004658117789537?w=100&h=100&tw=1&q=75

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d06e875d038956dc321989600a8c63b20920d12c026a7fc2f7f17aced8ef64d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 12:18:49 GMT
x-content-type-options: nosniff
age: 170607
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1696
x-xss-protection: 0
last-modified: Fri, 04 Aug 2023 05:51:25 GMT
server: sffe
report-to: {"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="content-ads-owners"
expires: Tue, 03 Dec 2024 12:18:49 GMT

GET
H3 200 a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js Show response
pagead2.googlesyndication.com/bg/ Frame 3506 50 KB
19 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bf1da233645c84549609f619670d4d3e946ac61d516fd53e597c10ad100608a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 20:09:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 142378
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19601
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 03 Dec 2024 20:09:18 GMT

GET
DATA 200
OK truncated
/ Frame 1146 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 28fb07135ae96abef4307d4492bf0eb77109f5ac3272a90a261745fa4fa38b3e

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame BB27 143 B
166 B 24ms
22ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 229
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:38:27 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame C7F2 1 KB
643 B 22ms
21ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3006
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 10:52:10 GMT
etag: 48472445140208031
expires: Thu, 07 Dec 2023 10:52:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame EA16
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEOe3VwlJ4_uUSERrjoXG4sE&google_cver=1&google_push=AXcoOmTuCppo0WAnRNVjIQUqA8P1B7wavE7N5XkSPfdsDOhNlAXbnEdD5cEzoi1DIGbpV7cAc4v2RVbSc6YvQ1Gos0VQ4SOrw1pb3A
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=ODg0MzEzNDY4ODg2OTYxNTIwOA==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEGlaA9g9qyLkvZYpsHni29I&google_cver=1

43 B
398 B

83ms
29ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEGlaA9g9qyLkvZYpsHni29I&google_cver=1
Requested by: Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 06 Dec 2023 11:42:16 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEGlaA9g9qyLkvZYpsHni29I&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EA16
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESECPcXnNPDM9AgRnXPV0Lapo&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESECPcXnNPDM9AgRnXPV0Lapo&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=bVpKbmg4cFgxUmFRaWQ1&google_gid=CAESECPcXnNPDM9AgRnXPV0Lapo&google_cver=1&google_push=AXcoOmTx2PF-RYRk0lJ7I3C5rwn_LEUsU8UdFvMmoHBTcUx...

170 B
188 B

34ms
33ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=bVpKbmg4cFgxUmFRaWQ1&google_gid=CAESECPcXnNPDM9AgRnXPV0Lapo&google_cver=1&google_push=AXcoOmTx2PF-RYRk0lJ7I3C5rwn_LEUsU8UdFvMmoHBTcUxwh9dTlgi4RHKMGibLAgHcU-LSdJobIVTNptG6sx8zqw6HPwfIy_RG8g

Requested by

Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 06 Dec 2023 11:42:16 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-006fa252bd7417634@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=bVpKbmg4cFgxUmFRaWQ1&google_gid=CAESECPcXnNPDM9AgRnXPV0Lapo&google_cver=1&google_push=AXcoOmTx2PF-RYRk0lJ7I3C5rwn_LEUsU8UdFvMmoHBTcUxwh9dTlgi4RHKMGibLAgHcU-LSdJobIVTNptG6sx8zqw6HPwfIy_RG8g
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame EA16
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEFwFWmfwP-uvbPJRlFB33a0&google_cver=1&google_push=AXcoOmSVxdjfaflg07KJi8IuUKMOr_cSUuIdeWudawMYkSZKek7Res3CCUOABkufqkQpa-MGA0tUCgzs9GNa5X4Xq24wlvBVeUe9f...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEFwFWmfwP-uvbPJRlFB33a0&google_cver=1&google_push=AXcoOmSVxdjfaflg07KJi8IuUKMOr_cSUuIdeWudawMYkSZKek7Res3CCUOABkufqkQpa-MGA0tUCgzs9GNa5X4Xq24wlvBVeUe...

43 B
401 B

190ms
190ms

Image
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEFwFWmfwP-uvbPJRlFB33a0&google_cver=1&google_push=AXcoOmSVxdjfaflg07KJi8IuUKMOr_cSUuIdeWudawMYkSZKek7Res3CCUOABkufqkQpa-MGA0tUCgzs9GNa5X4Xq24wlvBVeUe9fg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmSVxdjfaflg07KJi8IuUKMOr_cSUuIdeWudawMYkSZKek7Res3CCUOABkufqkQpa-MGA0tUCgzs9GNa5X4Xq24wlvBVeUe9fg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
Protocol: H2
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 831443bd4e6f9a30-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 333
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEFwFWmfwP-uvbPJRlFB33a0&google_cver=1&google_push=AXcoOmSVxdjfaflg07KJi8IuUKMOr_cSUuIdeWudawMYkSZKek7Res3CCUOABkufqkQpa-MGA0tUCgzs9GNa5X4Xq24wlvBVeUe9fg&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmSVxdjfaflg07KJi8IuUKMOr_cSUuIdeWudawMYkSZKek7Res3CCUOABkufqkQpa-MGA0tUCgzs9GNa5X4Xq24wlvBVeUe9fg%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 831443bc1ce69a30-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EA16
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEMHHh-YuEZsdxGqqcV65A8U&google_push=AXcoOmRbdhJl73mSfhnpRJRgaiGN7Vqb6Mhu5i4ivvHrAfNhm_XLEta8uL...

170 B
188 B

34ms
34ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEMHHh-YuEZsdxGqqcV65A8U&google_push=AXcoOmRbdhJl73mSfhnpRJRgaiGN7Vqb6Mhu5i4ivvHrAfNhm_XLEta8uLrDaXqJbFf0GuuyHARq9hnxNDwdStv_100hZUv0D7jk6Q

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-cph2320035-CPH
pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
via: 1.1 varnish
server: Jetty(9.4.35.v20201120)
x-timer: S1701862937.981051,VS0,VE95
x-cache: MISS
p3p: CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin: *
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEMHHh-YuEZsdxGqqcV65A8U&google_push=AXcoOmRbdhJl73mSfhnpRJRgaiGN7Vqb6Mhu5i4ivvHrAfNhm_XLEta8uLrDaXqJbFf0GuuyHARq9hnxNDwdStv_100hZUv0D7jk6Q
cache-control: no-cache
accept-ranges: bytes
content-length: 0
x-cache-hits: 0

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame EA16
Redirect Chain

https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEDp4fvuToTBcJycfRF1V1GA&google_cver=1&google_push=AXcoOmSWu3aljBZSXFajuhOmtpvs-RXLl7wnQja5CJEkkUcWNU5wqKfZTZwqtTHHMKWkZmsg87km9G0iiNWlsr...
https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AXcoOmSWu3aljBZSXFajuhOmtpvs-RXLl7wnQja5CJEkkUcWNU5wqKfZTZwqtTHHMKWkZmsg87km9G0iiNWlsrNPXxJlPCA0f9pnrA&google_hm=hmVwXhi0bIsVOm5...

170 B
232 B

33ms
32ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AXcoOmSWu3aljBZSXFajuhOmtpvs-RXLl7wnQja5CJEkkUcWNU5wqKfZTZwqtTHHMKWkZmsg87km9G0iiNWlsrNPXxJlPCA0f9pnrA&google_hm=hmVwXhi0bIsVOm5dAw&google_redir=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2FAdxPixel%3F%25%25GOOGLE_ERROR_PAIR%25%25%26partner_device_id%3D65705E18B46C8B153A6E5D03BLIS

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AXcoOmSWu3aljBZSXFajuhOmtpvs-RXLl7wnQja5CJEkkUcWNU5wqKfZTZwqtTHHMKWkZmsg87km9G0iiNWlsrNPXxJlPCA0f9pnrA&google_hm=hmVwXhi0bIsVOm5dAw&google_redir=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2FAdxPixel%3F%25%25GOOGLE_ERROR_PAIR%25%25%26partner_device_id%3D65705E18B46C8B153A6E5D03BLIS
date: Wed, 06 Dec 2023 11:42:16 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame EA16
Redirect Chain

https://ads.travelaudience.com/google_pixel?google_gid=CAESEET-y_bbpG-nVM-q_oAvyq4&google_cver=1&google_push=AXcoOmQUqQB6tLYUDFagok5RWXPG2E5k-1I8mQ43dx6-6ri1gwRPVF1HA-azJ6P7ygQhW6iIPM7qYuog9r6qC0xi...
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=lD4wEv28S9orzYvLa2mSFA&google_push=AXcoOmQUqQB6tLYUDFagok5RWXPG2E5k-1I8mQ43dx6-6ri1gwRPVF1HA-azJ6P7ygQhW6iIPM7qYuog9r6qC0xi0kjSip_L-taS

170 B
232 B

35ms
35ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=lD4wEv28S9orzYvLa2mSFA&google_push=AXcoOmQUqQB6tLYUDFagok5RWXPG2E5k-1I8mQ43dx6-6ri1gwRPVF1HA-azJ6P7ygQhW6iIPM7qYuog9r6qC0xi0kjSip_L-taS

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 06 Dec 2023 11:42:16 GMT
via: 1.1 google
x-engine-version: 0.0.0
server: nginx/1.21.6
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location: https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=lD4wEv28S9orzYvLa2mSFA&google_push=AXcoOmQUqQB6tLYUDFagok5RWXPG2E5k-1I8mQ43dx6-6ri1gwRPVF1HA-azJ6P7ygQhW6iIPM7qYuog9r6qC0xi0kjSip_L-taS
x-host: tde-deliveryengine-production-5989b845bf-qrzvh
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame EA16 43 B
362 B 30ms
29ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmTddK6F-WtL0aUGhQwG3cDGJWKR7RqsZRx--3wqu3QfzH-m88GYEJ-3m1_vZp7maVr67zDxgXL0_eWB0pU7aeVVBj0Ag7aqLQ&google_gid=CAESEOefu88HJ51ytA3oayl2fCU&google_cver=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:16 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 191600
expires: Wed, 06 Dec 2023 00:00:00 GMT

GET
H2 204 attr
cm.g.doubleclick.net/pixel/ Frame EA16 0
49 B 31ms
30ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IMLM9DqUtw9zh5TXZw-z_iJcR4UBsB2lSg04HEoIVyWg0LXBA6a-T1QLm7fF4J8l1dyw6G

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:16 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 b1fdc9f83bbec90a172a8086cc6d7abe.js Show response
www.gstatic.com/mysidia/ Frame 9FFE 9 KB
4 KB 24ms
23ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/b1fdc9f83bbec90a172a8086cc6d7abe.js?tag=client_fast_engine_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

bbde0fd637840b04806e70ee7610047e1cfe5568854929dc58c310a861d93ca6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 07:58:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 13443
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4047
x-xss-protection: 0
last-modified: Mon, 04 Dec 2023 21:30:24 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Tue, 05 Mar 2024 07:58:13 GMT

GET
H3 200 280465d6b51993ac6d052e033b440ef2.js Show response
www.gstatic.com/mysidia/ Frame 9FFE 11 KB
5 KB 25ms
24ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/280465d6b51993ac6d052e033b440ef2.js?tag=text/vanilla_highlight

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

d3e4cdbb12defe352221c7446f538206d487f314187f7883e6f261d9246ab3af

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 13:20:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 166892
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4756
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 19:10:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Sun, 03 Mar 2024 13:20:44 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 9FFE 14 KB
1 KB 34ms
33ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Wed, 06 Dec 2023 11:42:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 06 Dec 2023 09:57:23 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 06 Dec 2023 11:42:16 GMT

GET
H3 200 load_preloaded_resource_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 9FFE 2 KB
822 B 21ms
21ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/load_preloaded_resource_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72728
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 795
x-xss-protection: 0
server: cafe
etag: 4925184154378345226
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/ Frame 9FFE 24 KB
9 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/abg_lite_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 08:03:33 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13124
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9318
x-xss-protection: 0
server: cafe
etag: 3562968281324141506
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Dec 2023 08:03:33 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 9FFE 3 KB
1 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/window_focus_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 10:35:58 GMT
content-encoding: br
x-content-type-options: nosniff
age: 3979
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 20 Dec 2023 10:35:58 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/ Frame 9FFE 20 KB
8 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20231204/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7a5b47703d2aa636762f8b39205a2e03a85ae2de2904d81e6c6a469486ca81e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 15:30:09 GMT
content-encoding: br
x-content-type-options: nosniff
age: 72727
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8554
x-xss-protection: 0
server: cafe
etag: 636498438165408290
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Tue, 19 Dec 2023 15:30:09 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 9FFE 0
0 30ms
29ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQ70iagTYyOonr8UD4nru0ubOVE3efqNe_9VikYxitIMzE0DBn-GgudAe0EEjhTjRmBnIB2Zm3HmfH8OD7KgO0a4zN7Pg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H3 200 ufs_web_display.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9FFE 202 KB
64 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dce4158779dce6da3ede11337029f817a03f45c9559b1f91d8a7c5ac130f38c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65147
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1701694399686299"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 06 Dec 2023 11:42:17 GMT

GET
H3 200 7a8419aef3683f04c437bd15cecf843d.js Show response
www.gstatic.com/mysidia/ Frame 9FFE 37 KB
15 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/mysidia/7a8419aef3683f04c437bd15cecf843d.js?tag=mysidia_one_click_handler_one_afma_2019

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

949b3cde1a46caf4f55bb496f58a44af641a4b9fed64f95057bb5eeff142170b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 05:25:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 109012
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/mysidia
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15452
x-xss-protection: 0
last-modified: Wed, 29 Nov 2023 19:10:57 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="mysidia"
vary: Accept-Encoding
report-to: {"group":"mysidia","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/mysidia"}]}
content-type: text/javascript
cache-control: public, max-age=7776000
accept-ranges: bytes
expires: Mon, 04 Mar 2024 05:25:25 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 1146
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CrbTSGF5wZYKpGMbtvPIP_pC52AP-jbWTdK-JjJCfEomyv7eSDhABIOeL1SRglYKAgLgHoAHZ3YnGA8gBAqkCzohQprAZsj6oAwHIA8kEqgTpAU_Q5-qnZ8o9I2Z81XCMk0Kc3n_7JPb4Fjm...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2215525948850760979918%22,%22debug_reporting%22:true,%22destination%22:%22https://hausfrage.de%22,%22event_report_window%22:...

0
0

57ms
57ms

Fetch
text/css

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%2215525948850760979918%22,%22debug_reporting%22:true,%22destination%22:%22https://hausfrage.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22952266457%22],%224%22:[%2212-06%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%221713344811797786721%22}&andc=true

Requested by

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:17 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"15525948850760979918","debug_reporting":true,"destination":"https://hausfrage.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["952266457"],"4":["12-06"],"6":["true"]},"priority":"500","source_event_id":"1713344811797786721"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 06 Dec 2023 11:42:17 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 06 Dec 2023 11:42:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"15525948850760979918","debug_reporting":true,"destination":"https://hausfrage.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["952266457"],"4":["12-06"],"6":["true"]},"priority":"500","source_event_id":"1713344811797786721"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 7C97
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

37ms
37ms

Document
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:17 GMT
expires: Wed, 06 Dec 2023 11:42:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:17 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame FC8F 217 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 31bce7af1253da6b4a627a629753425a4bcd633961fa818d8880c3f13cf012e6

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

OPTIONS
H2 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 56ms
56ms Preflight
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 06 Dec 2023 11:42:17 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0C1B
Redirect Chain

https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEJK5tt_0hHT9jxQPLm5bp0I&google_cver=1&google_push=AXcoOmQaq5rk7vSYmuBaEh8HssFeeRs-XijaqZ5Pea9nfrqTQUt6lNY1fB...
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmQaq5rk7vSYmuBaEh8HssFeeRs-XijaqZ5Pea9nfrqTQUt6lNY1fBwgaqyf_mQo8oVLdTEFKwtI3acZKt8q1_h341ST05vhww&google_hm=Xzm_zZRQgj...

170 B
188 B

33ms
33ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmQaq5rk7vSYmuBaEh8HssFeeRs-XijaqZ5Pea9nfrqTQUt6lNY1fBwgaqyf_mQo8oVLdTEFKwtI3acZKt8q1_h341ST05vhww&google_hm=Xzm_zZRQgjxyes-vHEAZHQ

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=AXcoOmQaq5rk7vSYmuBaEh8HssFeeRs-XijaqZ5Pea9nfrqTQUt6lNY1fBwgaqyf_mQo8oVLdTEFKwtI3acZKt8q1_h341ST05vhww&google_hm=Xzm_zZRQgjxyes-vHEAZHQ
pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
cache-control: private, no-cache, no-store, proxy-revalidate
strict-transport-security: max-age=86400
content-length: 0
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 0C1B 0
103 B 53ms
52ms Image
text/plain 2a02:fa8:8806:12::1370
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEN9C-Syz-R7ANhCvICLAj54&google_cver=1&google_push=AXcoOmSiSTWLrDEOXVHbezshCB6KolVQJPbgjUXjvQc8UBKyDaMBDvHZkJSV0-0uJDEC3qD1OodmyjwXKPtB5LWwsqg9RKSYq_6o4g
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=280&adk=4109395274&adf=2229934989&pi=t.aa~a.1495420058~rp.2&w=848&fwrn=4&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=848x280&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=0&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280%2C888x90%2C888x90%2C888x280&nras=7&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=148&ady=4560&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=8&uci=a!8&btvi=6&fsb=1&dtd=12
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1370 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 0C1B
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEEmIPrPuPMeXLtAN4Zhxk6A&google_cver=1&google_push=AXcoOmTVkBZ1k72PhhCHiYMOWOY_UcBM9u-pwrh6zij9c7_eIqbEuxo5a-3vI6DsYjzIn6SHSZhYoE2iJ6zJ5_eJpc6iCUT2p-bu&...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEEmIPrPuPMeXLtAN4Zhxk6A&google_cver=1&google_push=AXcoOmTVkBZ1k72PhhCHiYMOWOY_UcBM9u-pwrh6zij9c7_eIqbEuxo5a-3vI6DsYjzIn6SHSZhYoE2iJ6zJ5_eJpc6iCUT2p-b...

43 B
401 B

200ms
200ms

Image
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEEmIPrPuPMeXLtAN4Zhxk6A&google_cver=1&google_push=AXcoOmTVkBZ1k72PhhCHiYMOWOY_UcBM9u-pwrh6zij9c7_eIqbEuxo5a-3vI6DsYjzIn6SHSZhYoE2iJ6zJ5_eJpc6iCUT2p-bu&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTVkBZ1k72PhhCHiYMOWOY_UcBM9u-pwrh6zij9c7_eIqbEuxo5a-3vI6DsYjzIn6SHSZhYoE2iJ6zJ5_eJpc6iCUT2p-bu%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Requested by: Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking
Protocol: H2
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 831443bd8eb09a30-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 10480
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEEmIPrPuPMeXLtAN4Zhxk6A&google_cver=1&google_push=AXcoOmTVkBZ1k72PhhCHiYMOWOY_UcBM9u-pwrh6zij9c7_eIqbEuxo5a-3vI6DsYjzIn6SHSZhYoE2iJ6zJ5_eJpc6iCUT2p-bu&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DAXcoOmTVkBZ1k72PhhCHiYMOWOY_UcBM9u-pwrh6zij9c7_eIqbEuxo5a-3vI6DsYjzIn6SHSZhYoE2iJ6zJ5_eJpc6iCUT2p-bu%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 831443bc6d2c9a30-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0C1B
Redirect Chain

https://um.simpli.fi/gp_match?google_gid=CAESEHx4XSGYMLyej2QjRZhOtNU&google_cver=1&google_push=AXcoOmT8fo5FVWQMBDDnHyBiMtOq-PhHSFFoNYmjZNkiId3AxQLremTfLqUk2UAZN4jia5djSLFL678bQjlbf_2xCZBlJPAbNJvu
https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=4E28F891CEB54DE28CAC152F3B1C2F90&google_push=AXcoOmT8fo5FVWQMBDDnHyBiMtOq-PhHSFFoNYmjZNkiId3AxQLremTfLqUk2UAZN4jia5djSLFL678bQjlbf_2...

170 B
188 B

34ms
34ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=4E28F891CEB54DE28CAC152F3B1C2F90&google_push=AXcoOmT8fo5FVWQMBDDnHyBiMtOq-PhHSFFoNYmjZNkiId3AxQLremTfLqUk2UAZN4jia5djSLFL678bQjlbf_2xCZBlJPAbNJvu

Requested by

Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 06 Dec 2023 11:42:17 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-content-type-options: nosniff
server: openresty
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/html
location: https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=4E28F891CEB54DE28CAC152F3B1C2F90&google_push=AXcoOmT8fo5FVWQMBDDnHyBiMtOq-PhHSFFoNYmjZNkiId3AxQLremTfLqUk2UAZN4jia5djSLFL678bQjlbf_2xCZBlJPAbNJvu
access-control-allow-origin: *
cache-control: no-cache
access-control-allow-headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
content-length: 142
expires: Tue, 05 Dec 2023 11:42:17 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0C1B
Redirect Chain

https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEJUGnZlN1yqFVfpPJlCKxiU&google_cver=1&google_push=AXcoOmQCskj2xuuZvf0lxJSDncmCGQ0DePAq_3Mb05_zPHR17rs1zw4W1P99YaSdYXgE7QEVlauFv9HlI2SCvv...
https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AXcoOmQCskj2xuuZvf0lxJSDncmCGQ0DePAq_3Mb05_zPHR17rs1zw4W1P99YaSdYXgE7QEVlauFv9HlI2SCvv0izKOG2c4Eq1j7uw&google_hm=hmVwXhi0bIsVOm5...

170 B
188 B

34ms
34ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AXcoOmQCskj2xuuZvf0lxJSDncmCGQ0DePAq_3Mb05_zPHR17rs1zw4W1P99YaSdYXgE7QEVlauFv9HlI2SCvv0izKOG2c4Eq1j7uw&google_hm=hmVwXhi0bIsVOm5dAw&google_redir=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2FAdxPixel%3F%25%25GOOGLE_ERROR_PAIR%25%25%26partner_device_id%3D65705E18B46C8B153A6E5D03BLIS

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=blismobile&google_push=AXcoOmQCskj2xuuZvf0lxJSDncmCGQ0DePAq_3Mb05_zPHR17rs1zw4W1P99YaSdYXgE7QEVlauFv9HlI2SCvv0izKOG2c4Eq1j7uw&google_hm=hmVwXhi0bIsVOm5dAw&google_redir=https%3A%2F%2Ftr.blismedia.com%2Fv1%2Fredirect%2FAdxPixel%3F%25%25GOOGLE_ERROR_PAIR%25%25%26partner_device_id%3D65705E18B46C8B153A6E5D03BLIS
date: Wed, 06 Dec 2023 11:42:17 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0C1B
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEPvPBDOFGWSXlFBnjTw2t7Q&google_cver=1&google_push=AXcoOmSTVe5BpEB7hGExD0gWJxZg6gCXTiGl8updr5FVy4V0HylSMc_9BsKN8Wypq3trDxMumhBQsIVnKmT0x464KtR8sLJ...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSTVe5BpEB7hGExD0gWJxZg6gCXTiGl8updr5FVy4V0HylSMc_9BsKN8Wypq3trDxMumhBQsIVnKmT0x464KtR8sLJwHfNv5g&google_hm=eS1ncFFxOVNWRTJwRmN6...

170 B
188 B

36ms
36ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSTVe5BpEB7hGExD0gWJxZg6gCXTiGl8updr5FVy4V0HylSMc_9BsKN8Wypq3trDxMumhBQsIVnKmT0x464KtR8sLJwHfNv5g&google_hm=eS1ncFFxOVNWRTJwRmN6dHlkNXlvbnVubGQyeV9ST2ZWen5B

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 06 Dec 2023 11:42:17 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmSTVe5BpEB7hGExD0gWJxZg6gCXTiGl8updr5FVy4V0HylSMc_9BsKN8Wypq3trDxMumhBQsIVnKmT0x464KtR8sLJwHfNv5g&google_hm=eS1ncFFxOVNWRTJwRmN6dHlkNXlvbnVubGQyeV9ST2ZWen5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 0C1B
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEI27W_7gdfe5c_iTx9FDx7o&google_cver=1&google_push=AXcoOmTms5DLbqOdt5irRQUMv47QugrUBiY3VEn4l5-HiNRHqF3ai6WSPs-wfF0hFfGtNvvnm0ZtZ8WI...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=OTE0OTk4MzY1OTMxMTk2NjMyMw&google_push=AXcoOmTms5DLbqOdt5irRQUMv47QugrUBiY3VEn4l5-HiNRHqF3ai6WSPs-wfF0hFfGtNvvnm0ZtZ8...

170 B
188 B

33ms
33ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=OTE0OTk4MzY1OTMxMTk2NjMyMw&google_push=AXcoOmTms5DLbqOdt5irRQUMv47QugrUBiY3VEn4l5-HiNRHqF3ai6WSPs-wfF0hFfGtNvvnm0ZtZ8WIpYwmqybGzfmCFAldOpHzZA

Requested by

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=OTE0OTk4MzY1OTMxMTk2NjMyMw&google_push=AXcoOmTms5DLbqOdt5irRQUMv47QugrUBiY3VEn4l5-HiNRHqF3ai6WSPs-wfF0hFfGtNvvnm0ZtZ8WIpYwmqybGzfmCFAldOpHzZA
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 0C1B 0
12 B 31ms
31ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13IHIyBUrRgYXbcI0LPFgtsLlRvOLFoH9c-MkZXMyTwX7gcMe98Z-nlYlGD9xU_XXb-dlzx8

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js Show response
pagead2.googlesyndication.com/bg/ Frame 1ED5 50 KB
19 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bf1da233645c84549609f619670d4d3e946ac61d516fd53e597c10ad100608a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 20:09:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 142379
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19601
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 03 Dec 2024 20:09:18 GMT

OPTIONS
H3 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 57ms
56ms Preflight
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 06 Dec 2023 11:42:17 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

OPTIONS
H3 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 56ms
56ms Preflight
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 06 Dec 2023 11:42:17 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 2A63 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 08013a54ef99fe2ff284edba658171e12fd2973c34aa6a26da573d74be26003f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ Frame FC8F 16 KB
16 KB 75ms
21ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 16:05:47 GMT
x-content-type-options: nosniff
age: 156990
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 03 Dec 2024 16:05:47 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ Frame FC8F 15 KB
15 KB 80ms
27ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 23:12:30 GMT
x-content-type-options: nosniff
age: 131387
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 03 Dec 2024 23:12:30 GMT

GET
H2

200

/
r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/ Frame C7F2
Redirect Chain

https://ad.turn.com/r/cs?pid=3&google_gid=CAESEHoXSs2oCLaVDqf_UD6lIGk&google_cver=1&google_push=AXcoOmRVBtKsJW7iteQUrzXOT4x31EsPYwOM8CHAv4_z48r0XjVaQLRBhJni8P4mAoAeLX3y6gFxcmxMnpEYHEK9OFPkcxgX7MpV
https://cm.g.doubleclick.net/pixel?google_nid=turn1&google_cm&google_sc&google_hm=MzIyMjM2MDg3ODkzNDUyNTU0NA==&gdpr=&gdpr_consent=
https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEGlaA9g9qyLkvZYpsHni29I&google_cver=1

43 B
398 B

82ms
28ms

Image
image/gif

2001:678:cb4:bbbb::11
AMOBEE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEGlaA9g9qyLkvZYpsHni29I&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7
Protocol: H2
Server: 2001:678:cb4:bbbb::11 , United Kingdom, ASN56396 (AMOBEE, GB),
Reverse DNS
Software: /
Resource Hash: 48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Wed, 06 Dec 2023 11:42:16 GMT
cache-control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-length: 43
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Redirect headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://r.turn.com/r/cms/id/0/ddc/1/pid/18/uid/?gdpr=&gdpr_consent=&google_gid=CAESEGlaA9g9qyLkvZYpsHni29I&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 329
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame C7F2 0
103 B 86ms
85ms Image
text/plain 2a02:fa8:8806:12::1370
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEBBujvTQdg5grnvO9ErWAfI&google_cver=1&google_push=AXcoOmSwYaA38sZ-5x2_HPdoXa4H4ZONLjyK4AWRLJoxjoSRO0acD-P615bJ6xFKXbw4IZzBYSnu41xFdmfFtgjP1pwL_5h9G8qkZg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1370 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H2 204 pixelSync
pixel-sync.sitescout.com/dmp/ Frame C7F2 0
187 B 103ms
29ms Image
text/plain 98.98.134.241
ZEN-ECN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel-sync.sitescout.com/dmp/pixelSync?nid=8&google_gid=CAESEDydOinI5-5ZVA5BgnjrsAk&google_cver=1&google_push=AXcoOmQCpUqFC3SnIDGT8tc4F87s1JqQwi0kohR0gOhRUuKS8rFspKXq0N9a0699x-J-ah4Uofv3mvcCoZWqUXUz1i3P5u0kdIxhrg
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 98.98.134.241 , United States, ASN21859 (ZEN-ECN, US),
Reverse DNS
Software: A /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

p3p: CP="NON DEVa PSAa PSDa OUR NOR NAV",policyref="/w3c/p3p.xml"
pragma: no-cache
date: Wed, 06 Dec 2023 11:42:16 GMT
cache-control: max-age=0,no-cache,no-store
server: A
expires: Tue, 11 Oct 1977 12:34:56 GMT

GET
H2 200 sync
x.bidswitch.net/ Frame C7F2 43 B
145 B 23ms
22ms Image
image/gif 18.196.207.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEEflcQeDMmx6ncDAIbhi62M&google_cver=1&google_push=AXcoOmSZ3e2at9PiX1rzKdqyq6S4yOB9w3ZYCk6IqLmqfWVKV2F2Ks63qR2gIYHTVntljTjtk-rne3JzkH9MyrWI4rQDE5JUY2wW
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.196.207.18 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-207-18.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:17 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C7F2
Redirect Chain

https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEHjv6rly5YpBd5u9ITHOd-w&google_cver=1&google_push=AXcoOmRu5sQlcr6z0XOKYCFfS4wuW-V00ldALIlLZZOiE4QzxghwHsskdVQ2ZOBvlT222JQLJCfWg6gtvRu4A7so3-dRlfw...
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRu5sQlcr6z0XOKYCFfS4wuW-V00ldALIlLZZOiE4QzxghwHsskdVQ2ZOBvlT222JQLJCfWg6gtvRu4A7so3-dRlfwoa4T9&google_hm=eS1ncFFxOVNWRTJwRmN6dH...

170 B
188 B

34ms
34ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRu5sQlcr6z0XOKYCFfS4wuW-V00ldALIlLZZOiE4QzxghwHsskdVQ2ZOBvlT222JQLJCfWg6gtvRu4A7so3-dRlfwoa4T9&google_hm=eS1ncFFxOVNWRTJwRmN6dHlkNXlvbnVubGQyeV9ST2ZWen5B

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Wed, 06 Dec 2023 11:42:17 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
location: https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=AXcoOmRu5sQlcr6z0XOKYCFfS4wuW-V00ldALIlLZZOiE4QzxghwHsskdVQ2ZOBvlT222JQLJCfWg6gtvRu4A7so3-dRlfwoa4T9&google_hm=eS1ncFFxOVNWRTJwRmN6dHlkNXlvbnVubGQyeV9ST2ZWen5B
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C7F2
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEHIRJHS3WTQZytkVIJ4BQPo&google_cver=1&google_push=AXcoOmSuYWmMtNPmUSzkZ3giQHwvnSgLJVVN21W2o0GOZJgweR-3ZIoe_IWj9OkVAZIIwP2s68DpAAka37Zw...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSuYWmMtNPmUSzkZ3giQHwvnSgLJVVN21W2o0GOZJgweR-3ZIoe_IWj9OkVAZIIwP2s68DpAAka37ZwOjXBEcliUTYw4k2mqA

170 B
188 B

33ms
32ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSuYWmMtNPmUSzkZ3giQHwvnSgLJVVN21W2o0GOZJgweR-3ZIoe_IWj9OkVAZIIwP2s68DpAAka37ZwOjXBEcliUTYw4k2mqA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmSuYWmMtNPmUSzkZ3giQHwvnSgLJVVN21W2o0GOZJgweR-3ZIoe_IWj9OkVAZIIwP2s68DpAAka37ZwOjXBEcliUTYw4k2mqA
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame C7F2
Redirect Chain

https://ius.ctnsnet.com/int/cm?exc=1&acc=crimtan_holdings_limited&google_gid=CAESEGEMSgtXJAUHZQ4GuO4rYGY&google_cver=1&google_push=AXcoOmRv9qdKw6t4gVTlWi_z3O_jQuuN5UXgz2vvuzneCHbFeUYHizhq6cC2DRGCUr...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmRv9qdKw6t4gVTlWi_z3O_jQuuN5UXgz2vvuzneCHbFeUYHizhq6cC2DRGCUrP0a0cRIx8XydRx_j1UrgO2kU91LpzN0WQPcYY&google_hm=...

170 B
188 B

35ms
35ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmRv9qdKw6t4gVTlWi_z3O_jQuuN5UXgz2vvuzneCHbFeUYHizhq6cC2DRGCUrP0a0cRIx8XydRx_j1UrgO2kU91LpzN0WQPcYY&google_hm=LmNnXTC7SoOb80yUy4YXgLg

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:16 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NOI DSP COR NID CUR OUR NOR"
status: 302
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan_holdings_limited&google_push=AXcoOmRv9qdKw6t4gVTlWi_z3O_jQuuN5UXgz2vvuzneCHbFeUYHizhq6cC2DRGCUrP0a0cRIx8XydRx_j1UrgO2kU91LpzN0WQPcYY&google_hm=LmNnXTC7SoOb80yUy4YXgLg
content-type: text/html;charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame C7F2 0
12 B 32ms
31ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JQrIjgD4mCvvgaNcUXjomjSdCDNUfBwnu9ZOTm_PVDpsmcSpn9rd2CLJgkcaCruEOLMse-8g

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 2A63
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CdcR5GF5wZbrGGOvVxtYPhPGKkAnMj86zdLDXidmkELCQHxABIOeL1SRglYKAgLgHoAH34pu0KMgBAqgDAcgDyQSqBOwBT9DWKDVYcDd_ZetN0o_-r5Ty0KjK5F2rvdQxmx3qRGfwgM-xwwB...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%227478317414966271392%22,%22debug_reporting%22:true,%22destination%22:%22https://webcompanion.com%22,%22event_report_window%...

0
0

57ms
57ms

Fetch
text/css

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%227478317414966271392%22,%22debug_reporting%22:true,%22destination%22:%22https://webcompanion.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%2210846925175%22],%224%22:[%2212-06%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%224917374264406894721%22}&andc=true

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:17 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"7478317414966271392","debug_reporting":true,"destination":"https://webcompanion.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["10846925175"],"4":["12-06"],"6":["true"]},"priority":"500","source_event_id":"4917374264406894721"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 06 Dec 2023 11:42:17 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 06 Dec 2023 11:42:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"7478317414966271392","debug_reporting":true,"destination":"https://webcompanion.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["10846925175"],"4":["12-06"],"6":["true"]},"priority":"500","source_event_id":"4917374264406894721"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 200 s Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 35E8 143 B
166 B 24ms
23ms Document
text/html 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 230
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-encoding: gzip
content-length: 145
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:38:27 GMT
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 02D2 1 KB
643 B 21ms
21ms Document
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 3007
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 10:52:10 GMT
etag: 48472445140208031
expires: Thu, 07 Dec 2023 10:52:10 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 9FFE 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bc6ffc99fb89925d78d2109ea924ca8fc6c15b487dd2cf8a07abf1bc47e9dfb0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame BB27
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

32ms
32ms

Document
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:17 GMT
expires: Wed, 06 Dec 2023 11:42:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:17 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js Show response
pagead2.googlesyndication.com/bg/ Frame 0948 50 KB
19 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bf1da233645c84549609f619670d4d3e946ac61d516fd53e597c10ad100608a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 20:09:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 142379
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19601
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 03 Dec 2024 20:09:18 GMT

GET
H2 200 4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2
fonts.gstatic.com/s/googlesans/v58/ Frame 9FFE 33 KB
33 KB 21ms
21ms Font
font/woff2 2a00:1450:4001:813::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/googlesans/v58/4UasrENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RPjIUvQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Google%20Sans%3A400%2C500

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 29 Nov 2023 21:01:51 GMT
x-content-type-options: nosniff
age: 571226
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34108
x-xss-protection: 0
last-modified: Tue, 23 May 2023 16:35:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 28 Nov 2024 21:01:51 GMT

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame FC8F
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=CiJKuGF5wZZnlGInMxtYP1bSRgAz2jcG2dPL_9IS-EdrZHhABIOeL1SRglfrwgYwHoAH74_fWA8gBCakCe7uNKzEdsj6oAwHIA8sEqgTpAU_QPbhvlnKb4ky3R6N-hoFyy1tiuxAm2X2HeuZ...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%227774353536364872872%22,%22debug_reporting%22:true,%22destination%22:%22https://sp-unternehmerforum.de%22,%22event_report_w...

0
0

58ms
57ms

Fetch
text/css

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%227774353536364872872%22,%22debug_reporting%22:true,%22destination%22:%22https://sp-unternehmerforum.de%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22987623931%22],%224%22:[%2212-06%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2214072540022927412945%22}&andc=true

Requested by

Host: staffslogin.com
URL: https://staffslogin.com/signup/Web-Banking-Comerica-Web-Banking

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:17 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"7774353536364872872","debug_reporting":true,"destination":"https://sp-unternehmerforum.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["987623931"],"4":["12-06"],"6":["true"]},"priority":"500","source_event_id":"14072540022927412945"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 06 Dec 2023 11:42:17 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 06 Dec 2023 11:42:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"7774353536364872872","debug_reporting":true,"destination":"https://sp-unternehmerforum.de","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["987623931"],"4":["12-06"],"6":["true"]},"priority":"500","source_event_id":"14072540022927412945"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

OPTIONS
H3 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 56ms
56ms Preflight
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 06 Dec 2023 11:42:17 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 02D2
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESELkfaldySVbkGiIxjLlyZIQ&google_cve...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=bVpKbmg4cFgxUmFRaWQ1&google_gid=CAESELkfaldySVbkGiIxjLlyZIQ&google_cver=1&google_push=AXcoOmRtL-WEvZBhH3VBorEQ_DTwohDOu3DnpnpbAU51Zxa...

170 B
188 B

35ms
35ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=bVpKbmg4cFgxUmFRaWQ1&google_gid=CAESELkfaldySVbkGiIxjLlyZIQ&google_cver=1&google_push=AXcoOmRtL-WEvZBhH3VBorEQ_DTwohDOu3DnpnpbAU51Zxa_oAyIEpTznNagMUnHppUdSL1aXNjD-KAskH4L2W2xINJk0C2dc5qfjw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 06 Dec 2023 11:42:17 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-795-gb641a57#rel-ec2-master i-029f22d856dc4e10e@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=bVpKbmg4cFgxUmFRaWQ1&google_gid=CAESELkfaldySVbkGiIxjLlyZIQ&google_cver=1&google_push=AXcoOmRtL-WEvZBhH3VBorEQ_DTwohDOu3DnpnpbAU51Zxa_oAyIEpTznNagMUnHppUdSL1aXNjD-KAskH4L2W2xINJk0C2dc5qfjw
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 02D2
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WlhCZUdRQUU1WUszV0FCZA==&google_gid=CAESELOJjK_RUr-libLldf7Ub9A&google_cver=1&google_push=AXcoOmSBP8NCm5lT9kBostLzK3DXDTWA_Z...

170 B
188 B

33ms
33ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WlhCZUdRQUU1WUszV0FCZA==&google_gid=CAESELOJjK_RUr-libLldf7Ub9A&google_cver=1&google_push=AXcoOmSBP8NCm5lT9kBostLzK3DXDTWA_ZJL2h35543_riDuBTZHBP8oyIzDMLLTeZJ2dR3SkLtSKxF5A1FFO5K1RzRcLXEGLtmW

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by: cache-cph2320035-CPH
pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1701862937.193401,VS0,VE0
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=WlhCZUdRQUU1WUszV0FCZA==&google_gid=CAESELOJjK_RUr-libLldf7Ub9A&google_cver=1&google_push=AXcoOmSBP8NCm5lT9kBostLzK3DXDTWA_ZJL2h35543_riDuBTZHBP8oyIzDMLLTeZJ2dR3SkLtSKxF5A1FFO5K1RzRcLXEGLtmW
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 02D2 70 B
149 B 150ms
47ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEIyCf11C2w0eVY5OtjIwOtI&google_cver=1&google_push=AXcoOmRen25Nc8sxvJjPfnGK8lifuNiFUw8S2UkZVycfNHcDNPe4OMctEi_88fQ088OTuIMKLZDOJYlfNVYSX3zosQtZN2pTrgefZA
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:17 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H2 200 sync
x.bidswitch.net/ Frame 02D2 43 B
145 B 23ms
22ms Image
image/gif 18.196.207.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEHd5k71Yqj3xgFRZHSVXUoY&google_cver=1&google_push=AXcoOmQGMqnBnv320wnfZn72hpEdill3o7QvfZ2kX6-nbE1QcvgCVdSjOCgW8YSvSBfL29DByFJLH9_UIMpU8kdlUgYKvsYLmQK4
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.196.207.18 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-196-207-18.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:17 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

GET
H2 200 usersync.aspx
dis.criteo.com/dis/ Frame 02D2 43 B
362 B 30ms
29ms Image
image/gif 178.250.1.9
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DAXcoOmQ4gdlYPbGvy-sf4NMLbOZmMqwRlKt0QVaeqI9AYdn3ZceONUQqAyKfmnUhEmroKu1sf6SV1pgkigPtWNMXTz5p9wIkIL1X&google_gid=CAESEM26YXHg3-2PTmtrj7mppxo&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Kestrel /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:16 GMT
x-errorlevel: 0
strict-transport-security: max-age=31536000; preload;
server: Kestrel
p3p: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type: image/gif
cache-control: no-cache
cross-origin-resource-policy: cross-origin
server-processing-duration-in-ticks: 254178
expires: Wed, 06 Dec 2023 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 02D2
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEKjYqoIqVIPkvmuKjJ7yEs8&google_cver=1&google_push=AXcoOmQRmQmFLhiKiANnQ6KMcrAyy57Bc0kkApkyum94dfSB_YDrTci_uuf6soii5nDPJoIeP158h6JE...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=OTE0OTk4MzY1OTMxMTk2NjMyMw&google_push=AXcoOmQRmQmFLhiKiANnQ6KMcrAyy57Bc0kkApkyum94dfSB_YDrTci_uuf6soii5nDPJoIeP158h6...

170 B
188 B

35ms
35ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=OTE0OTk4MzY1OTMxMTk2NjMyMw&google_push=AXcoOmQRmQmFLhiKiANnQ6KMcrAyy57Bc0kkApkyum94dfSB_YDrTci_uuf6soii5nDPJoIeP158h6JEyPDc_vqGhySiv9bvIL6-5A

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=OTE0OTk4MzY1OTMxMTk2NjMyMw&google_push=AXcoOmQRmQmFLhiKiANnQ6KMcrAyy57Bc0kkApkyum94dfSB_YDrTci_uuf6soii5nDPJoIeP158h6JEyPDc_vqGhySiv9bvIL6-5A
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 02D2
Redirect Chain

https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEB99cnMHlwsrFIiMRLye0E4&google_cver=1&google_push=AXcoOmQZUShmYFYH7Yd6I7onHL9Vm3qzIhWda6DdzRLJKJ4zxSry49PM-TzwZ74YZXwUFiVjywCJETLlp2Cr...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQZUShmYFYH7Yd6I7onHL9Vm3qzIhWda6DdzRLJKJ4zxSry49PM-TzwZ74YZXwUFiVjywCJETLlp2Crg3wWkuyptD38J90LCw

170 B
188 B

33ms
33ms

Image
image/png

142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQZUShmYFYH7Yd6I7onHL9Vm3qzIhWda6DdzRLJKJ4zxSry49PM-TzwZ74YZXwUFiVjywCJETLlp2Crg3wWkuyptD38J90LCw

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Protocol

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=AXcoOmQZUShmYFYH7Yd6I7onHL9Vm3qzIhWda6DdzRLJKJ4zxSry49PM-TzwZ74YZXwUFiVjywCJETLlp2Crg3wWkuyptD38J90LCw
strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
alt-svc: h3=":443"; ma=900, h3-29=":443"; ma=900
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 02D2 0
12 B 32ms
31ms Image
text/html 142.250.185.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Ju3OP7c_mBoLp__XCXN5A87WG3p9WB4wI8y9KLLyz8VhkaU19xGv8JWUL_2ceWc6XukLf8

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:17 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js Show response
pagead2.googlesyndication.com/bg/ Frame 4C32 50 KB
19 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bf1da233645c84549609f619670d4d3e946ac61d516fd53e597c10ad100608a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 20:09:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 142379
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19601
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 03 Dec 2024 20:09:18 GMT

GET
H3

200

si Show response
googleads.g.doubleclick.net/pagead/drt/ Frame 35E8
Redirect Chain

https://www.google.com/pagead/drt/ui
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

0
17 B

36ms
36ms

Document
text/html

2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:17 GMT
expires: Wed, 06 Dec 2023 11:42:17 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:17 GMT
location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js Show response
pagead2.googlesyndication.com/bg/ Frame DCD7 50 KB
19 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=2313442388&pi=t.aa~a.2226374894~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280%2C888x90%2C352x280&nras=4&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=2035&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=5&uci=a!5&btvi=3&fsb=1&dtd=7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bf1da233645c84549609f619670d4d3e946ac61d516fd53e597c10ad100608a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 20:09:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 142379
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19601
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 03 Dec 2024 20:09:18 GMT

OPTIONS
H3 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 56ms
56ms Preflight
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 06 Dec 2023 11:42:17 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

/
www.googleadservices.com/pagead/ar-adview/ Frame 9FFE
Redirect Chain

https://googleads.g.doubleclick.net/pagead/adview?ai=C_gBfGF5wZbO0GNr7vPIPvNmmqA3L-J2QdPaXq7GFEr6Qz8zPQRABIOeL1SRglYKAgLgHoAGm9PCSAsgBAagDAcgDy4SAgASqBOQBT9DxH4VgFEFK3Ofau0-Owx-zGgWUpqb4ahjVl5b_4TW...
https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%223731159053420145595%22,%22debug_reporting%22:true,%22destination%22:%22https://spins.com%22,%22event_report_window%22:%222...

0
0

57ms
57ms

Fetch
text/css

142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22debug_key%22:%223731159053420145595%22,%22debug_reporting%22:true,%22destination%22:%22https://spins.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22576469542%22],%224%22:[%2212-06%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%22550822892712386321%22}&andc=true

Protocol

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:17 GMT
x-content-type-options: nosniff
attribution-reporting-register-source: {"debug_key":"3731159053420145595","debug_reporting":true,"destination":"https://spins.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["576469542"],"4":["12-06"],"6":["true"]},"priority":"500","source_event_id":"550822892712386321"}
server: cafe
content-type: text/css; charset=UTF-8
access-control-allow-origin: https://googleads.g.doubleclick.net
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: private
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Wed, 06 Dec 2023 11:42:17 GMT

Redirect headers

content-security-policy: script-src 'none'; object-src 'none'
date: Wed, 06 Dec 2023 11:42:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: text/html; charset=UTF-8
location: https://www.googleadservices.com/pagead/ar-adview/?nrh={"debug_key":"3731159053420145595","debug_reporting":true,"destination":"https://spins.com","event_report_window":"259200","expiry":"2592000","filter_data":{"2":["576469542"],"4":["12-06"],"6":["true"]},"priority":"500","source_event_id":"550822892712386321"}&andc=true
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 16 KB
12 KB 77ms
76ms XHR
application/json 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20231204&st=env

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e0481d8ae7d3696423a7eb08d8f83508e671518fcf9c06581bb3081fe918b045

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://staffslogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:17 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12147
x-xss-protection: 0

GET
H3 200 a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js Show response
pagead2.googlesyndication.com/bg/ Frame B851 50 KB
19 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/a_HaIzZFyEVJYJ9hlnDU0-lGrGHVFv1T5ZfBCtEAYIo.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5177316199383353&output=html&h=90&adk=1441436904&adf=1903551125&pi=t.aa~a.3143638711~rp.4&w=888&fwrn=1&fwrnh=100&lmt=1701862936&rafmt=1&to=qs&pwprc=4825467120&format=888x90&url=https%3A%2F%2Fstaffslogin.com%2Fsignup%2FWeb-Banking-Comerica-Web-Banking&ea=0&fwr=0&fwrattr=false&pra=3&rpe=1&resp_fmts=3&wgl=1&fa=40&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0.&dt=1701862936308&bpp=1&bdt=1245&idt=-M&shv=r20231204&mjsv=m202311300101&ptt=9&saldr=aa&abxe=1&prev_fmts=0x0%2C848x280&nras=2&correlator=5297438775855&frm=20&pv=1&ga_vid=1201958549.1701862936&ga_sid=1701862936&ga_hid=1797873106&ga_fc=0&u_tz=60&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=128&ady=1360&biw=1600&bih=1200&scr_x=0&scr_y=0&eid=44759876%2C44759927%2C44759837%2C31079759%2C31079825%2C44798934%2C44806139%2C44807763%2C44808148%2C44808285%2C44809072%2C95320229&oid=2&pvsid=4233272231906894&tmod=2134365744&uas=0&nvt=1&fc=1920&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=128&bc=31&psd=W251bGwsbnVsbCxudWxsLDNd&ifi=3&uci=a!3&btvi=1&fsb=1&dtd=3

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6bf1da233645c84549609f619670d4d3e946ac61d516fd53e597c10ad100608a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 20:09:18 GMT
content-encoding: br
x-content-type-options: nosniff
age: 142379
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 19601
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 03 Dec 2024 20:09:18 GMT

OPTIONS
H3 204 /
www.googleadservices.com/pagead/ar-adview/ Frame 0
0 56ms
56ms Preflight
text/html 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: attribution-reporting-eligible
Access-Control-Request-Method: GET
Origin: https://googleads.g.doubleclick.net
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: attribution-reporting-eligible
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-origin: https://googleads.g.doubleclick.net
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/html; charset=UTF-8
date: Wed, 06 Dec 2023 11:42:17 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
6 KB 37ms
37ms Script
text/javascript 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://staffslogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 06 Dec 2023 11:42:17 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 50BE 13 KB
5 KB 21ms
21ms Document
text/html 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://staffslogin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3875
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 10:37:42 GMT
expires: Thu, 05 Dec 2024 10:37:42 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 aframe Show response
www.google.com/recaptcha/api2/ Frame 2593 829 B
559 B 34ms
34ms Document
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

985ce04157293d234f57c79df71b98bc22aae52333f5f591235a8d861f4a6663

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-TJjExK2NuOI2ecJ-io9Shg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://staffslogin.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=300
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-TJjExK2NuOI2ecJ-io9Shg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 06 Dec 2023 11:42:17 GMT
expires: Wed, 06 Dec 2023 11:42:17 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 widget.082a67c3af29c4c18dbd.js Show response
c.bannerflow.net/scripts/ Frame 9AFE 24 KB
9 KB 30ms
30ms Script
application/javascript 2606:4700::6811:c96e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/widget.082a67c3af29c4c18dbd.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/65396155843eb9eeda770d48?did=5d6fb28839d71e0001cd1a9f&deeplink=on&responsive=off&redirecturl=https://adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DCkFXsF15wZfOKLN_tvPIP8fWG-A6-9MHJdNev-sbvEZ_w8_0IEAEg54vVJGCVgoCAuAegAYn3tskDyAEJqQLkdwRDDSa1PqgDAcgDAqoE7AFP0GmlGZZe3dJgTwBFRdTNmo4wP0-xmYxOosjI4AVR5iq3GRLWHl2CQHT10y8QK6U6uQVkOoBjkFSZrzyoxGeag_gVBQG1oiYatTmSyq5YmhWj8-ChFttSYbLvFm6m1ThY_8v1kuOBDqTkwJcxi6JvZttyjgmtyfjcFeOyYvTDApgACbsr3Zk9cIwk5S9B6bTXnxrlYAqlZF4_Jvvm1Qc30bwCrFd6tTmlH1UuUnDRwUgOeN_cxz-fx0wN_shlekoXwE2JLeS7SQdNgcIyDiEKMmJ5cyRpyvh3BoiZhQ1ZHAGuPhLbbr6NhWnt4MAErauJ4MAEiAXbkIKQTaAGEYAH34jJNqgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQKoB8qpsQKoB-ulsQKoB-qxsQKoB5m1sQKoB763sQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WIqq8r3d-oIDgAoBmAsByAsBgAwBogwcKhoKGOS0sQLutbECtbixAqy6sQLktLEC7rWxAtoMEQoLEKDa3aD5noTk3wESAgEDqg0CREXIDQHYEwPQFQH4FgGAFwE%26ase%3D2%26gclid%3DEAIaIQobChMIs_L1vd36ggMV3zZPCB3xugHvEAEYASAAEgIKQfD_BwE%26num%3D1%26cid%3DCAQSTwDICaaNGT2IaNe7CqYwaNf0qcCwyumt8m7_5HY5vMxcUpJYC10lMkLrza5fuQqKiBNfrFIOjaQSd8GgkT95jH8KsnE8vo2rRKjija3m0SUYAQ%26sig%3DAOD64_18wQhWiJB1ckwf676SFhtiGANWrg%26client%3Dca-pub-5177316199383353%26adurl%3D&cb=1045086326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:c96e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e742f7765cc584a0798aeb169bdd36abdcf8fab8912ff23eca35356516f4e20f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 06 Dec 2023 11:42:17 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: 5tO1ehpNiXh/YpQpE1HqCw==
age: 2097029
cf-polished: origSize=24203
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Mon, 18 Sep 2023 10:33:24 GMT
server: cloudflare
etag: W/"0x8DBB832AFF4DEA1"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: ab5ebade-b01e-0058-7126-150d8c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
cf-ray: 831443bfee9b91fc-FRA

GET
H2 200 document.00000038416200.js Show response
c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/published/6074732/7774217/ Frame 9AFE 39 KB
8 KB 31ms
31ms Script
application/javascript 2606:4700::6811:c96e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/published/6074732/7774217/document.00000038416200.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/65396155843eb9eeda770d48?did=5d6fb28839d71e0001cd1a9f&deeplink=on&responsive=off&redirecturl=https://adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DCkFXsF15wZfOKLN_tvPIP8fWG-A6-9MHJdNev-sbvEZ_w8_0IEAEg54vVJGCVgoCAuAegAYn3tskDyAEJqQLkdwRDDSa1PqgDAcgDAqoE7AFP0GmlGZZe3dJgTwBFRdTNmo4wP0-xmYxOosjI4AVR5iq3GRLWHl2CQHT10y8QK6U6uQVkOoBjkFSZrzyoxGeag_gVBQG1oiYatTmSyq5YmhWj8-ChFttSYbLvFm6m1ThY_8v1kuOBDqTkwJcxi6JvZttyjgmtyfjcFeOyYvTDApgACbsr3Zk9cIwk5S9B6bTXnxrlYAqlZF4_Jvvm1Qc30bwCrFd6tTmlH1UuUnDRwUgOeN_cxz-fx0wN_shlekoXwE2JLeS7SQdNgcIyDiEKMmJ5cyRpyvh3BoiZhQ1ZHAGuPhLbbr6NhWnt4MAErauJ4MAEiAXbkIKQTaAGEYAH34jJNqgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQKoB8qpsQKoB-ulsQKoB-qxsQKoB5m1sQKoB763sQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WIqq8r3d-oIDgAoBmAsByAsBgAwBogwcKhoKGOS0sQLutbECtbixAqy6sQLktLEC7rWxAtoMEQoLEKDa3aD5noTk3wESAgEDqg0CREXIDQHYEwPQFQH4FgGAFwE%26ase%3D2%26gclid%3DEAIaIQobChMIs_L1vd36ggMV3zZPCB3xugHvEAEYASAAEgIKQfD_BwE%26num%3D1%26cid%3DCAQSTwDICaaNGT2IaNe7CqYwaNf0qcCwyumt8m7_5HY5vMxcUpJYC10lMkLrza5fuQqKiBNfrFIOjaQSd8GgkT95jH8KsnE8vo2rRKjija3m0SUYAQ%26sig%3DAOD64_18wQhWiJB1ckwf676SFhtiGANWrg%26client%3Dca-pub-5177316199383353%26adurl%3D&cb=1045086326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:c96e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d6706fe83c29dacc54b7cb8b9682462454bcb8af6fd8eb1b0ed475fb0105cd3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 06 Dec 2023 11:42:17 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: kJZpPvVgLNFqdlyom8hylg==
age: 261529
cf-polished: origSize=43252
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Wed, 25 Oct 2023 18:45:11 GMT
server: cloudflare
etag: W/"0x8DBD58A84E72443"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: cdcad3d6-401e-005c-66d8-25808b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
cf-ray: 831443bfee9c91fc-FRA

GET
H2 200 animated-creative.5e624ab46620f4fd13c2.js Show response
c.bannerflow.net/scripts/ Frame 9AFE 156 KB
53 KB 35ms
35ms Script
application/javascript 2606:4700::6811:c96e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/animated-creative.5e624ab46620f4fd13c2.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/65396155843eb9eeda770d48?did=5d6fb28839d71e0001cd1a9f&deeplink=on&responsive=off&redirecturl=https://adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DCkFXsF15wZfOKLN_tvPIP8fWG-A6-9MHJdNev-sbvEZ_w8_0IEAEg54vVJGCVgoCAuAegAYn3tskDyAEJqQLkdwRDDSa1PqgDAcgDAqoE7AFP0GmlGZZe3dJgTwBFRdTNmo4wP0-xmYxOosjI4AVR5iq3GRLWHl2CQHT10y8QK6U6uQVkOoBjkFSZrzyoxGeag_gVBQG1oiYatTmSyq5YmhWj8-ChFttSYbLvFm6m1ThY_8v1kuOBDqTkwJcxi6JvZttyjgmtyfjcFeOyYvTDApgACbsr3Zk9cIwk5S9B6bTXnxrlYAqlZF4_Jvvm1Qc30bwCrFd6tTmlH1UuUnDRwUgOeN_cxz-fx0wN_shlekoXwE2JLeS7SQdNgcIyDiEKMmJ5cyRpyvh3BoiZhQ1ZHAGuPhLbbr6NhWnt4MAErauJ4MAEiAXbkIKQTaAGEYAH34jJNqgH2baxAqgHjs4bqAeT2BuoB-6WsQKoB_6esQKoB9XJG6gHpr4bqAeaBqgH89EbqAeW2BuoB6qbsQKoB4OtsQKoB_-esQKoB9-fsQKoB8qpsQKoB-ulsQKoB-qxsQKoB5m1sQKoB763sQLYBwDSCB8IgOGAEBABGB8yAqoCOgKAQEi9_cE6WIqq8r3d-oIDgAoBmAsByAsBgAwBogwcKhoKGOS0sQLutbECtbixAqy6sQLktLEC7rWxAtoMEQoLEKDa3aD5noTk3wESAgEDqg0CREXIDQHYEwPQFQH4FgGAFwE%26ase%3D2%26gclid%3DEAIaIQobChMIs_L1vd36ggMV3zZPCB3xugHvEAEYASAAEgIKQfD_BwE%26num%3D1%26cid%3DCAQSTwDICaaNGT2IaNe7CqYwaNf0qcCwyumt8m7_5HY5vMxcUpJYC10lMkLrza5fuQqKiBNfrFIOjaQSd8GgkT95jH8KsnE8vo2rRKjija3m0SUYAQ%26sig%3DAOD64_18wQhWiJB1ckwf676SFhtiGANWrg%26client%3Dca-pub-5177316199383353%26adurl%3D&cb=1045086326
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:c96e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b3a77ca3e3a1d649c31554b8dd826b0d8c9177031a5c5558b334c442428a0efd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 06 Dec 2023 11:42:17 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: uTRCnTb2IHOzeC2liDMqDw==
age: 455324
cf-polished: origSize=159909
x-ms-lease-status: unlocked
cf-bgj: minify
last-modified: Fri, 13 Oct 2023 10:09:15 GMT
server: cloudflare
etag: W/"0x8DBCBD474DDDD90"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: c10b5289-901e-002d-7b15-2466a0000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2011-08-18
cf-ray: 831443bfee9e91fc-FRA

GET
H3 200 Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js Show response
pagead2.googlesyndication.com/bg/ Frame 50BE 39 KB
15 KB 21ms
21ms Script
text/javascript 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/Dtt_-LR3WxpzwV0Gscftq1A_D1owstvxoTnWWhwY4Ow.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 08:03:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 13107
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15165
x-xss-protection: 0
last-modified: Tue, 28 Nov 2023 18:18:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 05 Dec 2024 08:03:50 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame 2593 0
0 55ms
55ms Image
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20231204&jk=4233272231906894&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame A770 42 B
64 B 61ms
61ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssPNQ9UiDymwb58WUHe_pHrpyv0UHxAz2JA5fzJz13hcL5m3g0fAnK5Bn6UTZKYSUMp3mFk9_OAH678i3fP4Vealg2l96nqU1NYVVfwlrWXMuUUPKCSLnwcPHjyDclmzDs3sjM7Zn8heYzO&sai=AMfl-YRVkx17ltMnPyAd_UBK7pRVhAejn6DM5MKXTB5lA6xzRC_KcXz-i5tfOElSA8VI2idWqOh3vRfh2tiAY4E7KT-8OZ-met0OeLsVxwGXKPg_X1XqAoeMpXa8t7QAA8S4SdzbUVvN2N3da1gUS2zlCKfz1V54glwbb41q&sig=Cg0ArKJSzKPSjKp7hoUEEAE&cid=CAQSTwDICaaNFO4xuELkspcneUymv18ASCRhjto3t443xczLQNB7iCRhfcWRZ46nYJ7qmwgzgc0VGWKjRtcUwbWOugGThImvRvoObegI3bfWLxMYAQ&id=lidar2&mcvt=1012&p=0,0,219,848&mtos=1012,1012,1012,1012,1012&tos=1012,0,0,0,0&v=20231204&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=4&adk=152244903&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701862935640&rpt=1002&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame 50BE 0
11 B 21ms
21ms Image
text/plain 2a00:1450:4001:81c::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?a-cPdg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:81c::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:17 GMT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
DATA 200
OK truncated
/ Frame 9AFE 66 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Type: image/webp

GET
BLOB 200
OK 14e09c97-2ee7-4f3b-97d2-e7d37c49cbb3 Show response
https://googleads.g.doubleclick.net/ Frame E9F5 668 B
0 Script
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://googleads.g.doubleclick.net/14e09c97-2ee7-4f3b-97d2-e7d37c49cbb3
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/animated-creative.5e624ab46620f4fd13c2.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cda3c421b62828768ee2741a35bef36bcfdb1199ee3eb987269f7d1ce2dd8876

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Length: 668
Content-Type

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 9AFE 8 KB
8 KB 84ms
36ms Font
font/woff 2606:4700::6811:c96e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F645b60e4e664c4e7c86bee79%2F50899199-3da2-49c8-bab5-f8bf412fdf34.woff&t=%20%3FACDEGIKSTUYabcdefghilmnorstuwy
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/html/r20231204/r20110914/zrt_lookup_fy2021.html?fsb=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:c96e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9d6b249bda6cde60dc09930b1d4727b1e14ec39af4368bfb567bf5dc474f0b03

Request headers

Referer: https://googleads.g.doubleclick.net/
Origin: https://googleads.g.doubleclick.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:17 GMT
cf-cache-status: HIT
last-modified: Tue, 05 Dec 2023 00:09:56 GMT
server: cloudflare
age: 127941
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=50899199-3da2-49c8-bab5-f8bf412fdf34-subset.woff
cf-ray: 831443c1583237da-FRA
expires: Wed, 04 Dec 2024 00:09:56 GMT

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame 2259 436 KB
437 KB 41ms
39ms Image
image/webp 2606:4700::6811:c96e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fonfido%2F645b60e5001eb5a425c49f0e%2Fimages%2F03fdd1ed-acd3-409d-9199-6113763a4743.gif&w=312&h=164&q=85&f=webp&rt=cover&x1=0&y1=10&x2=508&y2=277
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:c96e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0e6b7a35832204c8c63ba007a66748af46d9b403a5cc62042a3f71f487d73aaa

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:17 GMT
cf-cache-status: HIT
last-modified: Wed, 06 Dec 2023 00:17:31 GMT
api-supported-versions: 2.0
server: cloudflare
age: 41086
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 831443c1a80991fc-FRA
content-length: 446516
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H2 200 3b6dd862-10fe-45b9-9ac2-54c5ec42c598.svg
c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/images/ Frame 2259 3 KB
1021 B 77ms
76ms Image
image/svg+xml 2606:4700::6811:c96e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/images/3b6dd862-10fe-45b9-9ac2-54c5ec42c598.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:c96e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 43b54bf0dc587e90180cd23f2f80be58bc184880f2c408ae06d8e381080ff162

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 06 Dec 2023 11:42:17 GMT
content-encoding: br
cf-cache-status: REVALIDATED
content-md5: Ka+9Xq7RUlmecgzwE5sopA==
x-ms-lease-status: unlocked
last-modified: Wed, 11 Oct 2023 15:30:04 GMT
server: cloudflare
etag: W/"0x8DBCA6EF138F067"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 9d0faa0d-f01e-002b-4a6c-13551f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
cf-ray: 831443c1a80b91fc-FRA

GET
H2 200 7c9e2ebf-b79e-438f-a0f1-d4390d16f677.svg
c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/images/ Frame 2259 114 KB
86 KB 87ms
85ms Image
image/svg+xml 2606:4700::6811:c96e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/images/7c9e2ebf-b79e-438f-a0f1-d4390d16f677.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:c96e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: da41ed8b407887df6144a32d945e2d6f8b02452ad5510f45b964bf221f012188

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 06 Dec 2023 11:42:17 GMT
content-encoding: br
cf-cache-status: REVALIDATED
content-md5: l+ajOgDJv468IB5xFjHFEA==
x-ms-lease-status: unlocked
last-modified: Wed, 11 Oct 2023 15:30:04 GMT
server: cloudflare
etag: W/"0x8DBCA6EF1454B7E"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: ac9a67ca-e01e-0008-6e09-24cfdc000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
cf-ray: 831443c1a80e91fc-FRA

GET
H2 200 97be5013-5ae0-4942-a28f-a9abed9d050f.svg
c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/images/ Frame 2259 117 KB
44 KB 36ms
34ms Image
image/svg+xml 2606:4700::6811:c96e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/images/97be5013-5ae0-4942-a28f-a9abed9d050f.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:c96e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4d87f68193d2edcfbf85fc1927d3968282a4f4d9a9fd812d48319d72a43a14ee

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 06 Dec 2023 11:42:17 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: 08Bht/XMHfPpFMWXxy+alA==
age: 3539
x-ms-lease-status: unlocked
last-modified: Wed, 11 Oct 2023 15:30:04 GMT
server: cloudflare
etag: W/"0x8DBCA6EF14C28C5"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 730928d1-101e-000c-0a09-2442db000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
cf-ray: 831443c1a81091fc-FRA

GET
H2 200 454d5b10-48bc-47c4-a7e1-49265a13ab74.svg
c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/images/ Frame 2259 5 KB
2 KB 83ms
81ms Image
image/svg+xml 2606:4700::6811:c96e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/images/454d5b10-48bc-47c4-a7e1-49265a13ab74.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:c96e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4170a77b0bbb7d180030b077333fe835a6add460f1397cca913a114ab33a7451

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 06 Dec 2023 11:42:17 GMT
content-encoding: br
cf-cache-status: REVALIDATED
content-md5: gsFHdb68fInKD2OSt23k0Q==
x-ms-lease-status: unlocked
last-modified: Wed, 11 Oct 2023 15:30:04 GMT
server: cloudflare
etag: W/"0x8DBCA6EF13CE7B4"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: ba64474c-801e-000e-2309-24fc63000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
cf-ray: 831443c1a81391fc-FRA

GET
H2 200 82c204b1-9478-420c-ac60-68c981967239.svg
c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/images/ Frame 2259 2 KB
848 B 84ms
82ms Image
image/svg+xml 2606:4700::6811:c96e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/images/82c204b1-9478-420c-ac60-68c981967239.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:c96e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4f62ca1635a69f137a0c491e1f77919985a98b682dcc7821bafdccf8273eb0ec

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 06 Dec 2023 11:42:17 GMT
content-encoding: br
cf-cache-status: REVALIDATED
content-md5: g/SCYRitnRsVNK2qo3EDnA==
x-ms-lease-status: unlocked
last-modified: Wed, 11 Oct 2023 15:30:04 GMT
server: cloudflare
etag: W/"0x8DBCA6EF1491BC2"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 9bf4ed91-b01e-002a-2109-240ac3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
cf-ray: 831443c1a81591fc-FRA

GET
H2 200 09b4a6e5-6ab7-46e3-9efe-870ba99156b4.svg
c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/images/ Frame 2259 82 KB
32 KB 85ms
83ms Image
image/svg+xml 2606:4700::6811:c96e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/images/09b4a6e5-6ab7-46e3-9efe-870ba99156b4.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:c96e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f0e40a5437d2171eedd7b3f377eba52163f709cdb19336bf60e00bbedaf5ce02

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 06 Dec 2023 11:42:17 GMT
content-encoding: br
cf-cache-status: REVALIDATED
content-md5: 6j8g6bCQ0yqOzqFIz+N+cA==
x-ms-lease-status: unlocked
last-modified: Wed, 11 Oct 2023 15:30:04 GMT
server: cloudflare
etag: W/"0x8DBCA6EF141F06B"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 5c65f73f-c01e-0020-2009-24ae74000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
cf-ray: 831443c1a81791fc-FRA

GET
H2 200 5cf7eb3a-8629-4281-b89e-89e6d3bcc8d1.svg
c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/images/ Frame 2259 5 KB
2 KB 60ms
59ms Image
image/svg+xml 2606:4700::6811:c96e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/images/5cf7eb3a-8629-4281-b89e-89e6d3bcc8d1.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:c96e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c34d48ab880185e8c8c83e41ca814da968e9fa403da67a784713dc4dafe64d7f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 06 Dec 2023 11:42:17 GMT
content-encoding: br
cf-cache-status: REVALIDATED
content-md5: 1cjANlL7EwmG/tlFOfo/RA==
x-ms-lease-status: unlocked
last-modified: Fri, 07 Jul 2023 02:13:10 GMT
server: cloudflare
etag: W/"0x8DB7E8FB5FAB3A2"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: c2cd2b8d-901e-004f-6809-24a487000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
cf-ray: 831443c1a81891fc-FRA

GET
H2 200 d11f8f12-f79a-45f8-a484-f7b7cd540ae6.svg
c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/images/ Frame 2259 5 KB
2 KB 81ms
80ms Image
image/svg+xml 2606:4700::6811:c96e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/images/d11f8f12-f79a-45f8-a484-f7b7cd540ae6.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:c96e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 19887f7568947b9552d85ab944f99a6cec1ee3d8e6e4aa06d4ad92d438f932fe

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 06 Dec 2023 11:42:17 GMT
content-encoding: br
cf-cache-status: REVALIDATED
content-md5: KhFKVEsozUewLxpKpArtSQ==
x-ms-lease-status: unlocked
last-modified: Wed, 10 May 2023 09:30:59 GMT
server: cloudflare
etag: W/"0x8DB51394402423A"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 6ef5b544-a01e-0036-65d8-2758a3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
cf-ray: 831443c1a81991fc-FRA

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame 2259 5 KB
5 KB 32ms
31ms Image
image/webp 2606:4700::6811:c96e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fonfido%2F645b60e5001eb5a425c49f0e%2Fimages%2Fb547a93d-377e-406a-a528-27196905dbce.png&w=255&h=255&q=85&f=webp&rt=contain
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:c96e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0bacb63f4d7329e20d314c4f4472cd2192ce0d89e33af47a285b79fd9dd7f315

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 06 Dec 2023 11:42:17 GMT
cf-cache-status: HIT
last-modified: Tue, 05 Dec 2023 14:49:24 GMT
api-supported-versions: 2.0
server: cloudflare
age: 75173
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 831443c1a81a91fc-FRA
content-length: 5346
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H2 200 84dcd258-b947-4703-b8b5-84a5e47df12d.svg
c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/images/ Frame 2259 716 B
596 B 72ms
71ms Image
image/svg+xml 2606:4700::6811:c96e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/onfido/645b60e5001eb5a425c49f0e/images/84dcd258-b947-4703-b8b5-84a5e47df12d.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6811:c96e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4af80d88711edf2481d330d87b29f52bca59a5989e47bcf0b51caa41b7ff7c7c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 06 Dec 2023 11:42:17 GMT
content-encoding: br
cf-cache-status: REVALIDATED
content-md5: hlgnMo7cOqyLvJya2Wln6A==
x-ms-lease-status: unlocked
last-modified: Wed, 11 Oct 2023 14:59:36 GMT
server: cloudflare
etag: W/"0x8DBCA6AAF670869"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: ba644786-801e-000e-5809-24fc63000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
x-ms-version: 2011-08-18
cf-ray: 831443c1c82e91fc-FRA

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 9AFE 42 B
64 B 62ms
61ms Fetch
image/gif 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstRUOJTPE74fixn9h2hyKRt5sLcDcrAVZ_GKERuWteI2Pfp98LYfT06lZ3_j8R9-BRERCg-ICFFtsa-SvaSPc71A-31HV-F8Ck6mcB2U3MMEOXNNgnnBUX-ypxm8Mdk0ZNt_tkpJ4yuyOvMFQZwVw8VdJagOyM1J9hnAWkAl5aZz9SoafovTwn0v1SUq4C1yjtv1s7Jbl-sE3TaT2hK2aa3odkv26P9at-eYcE9RwoW1eM7LCRyu0plbdeOOSRoA1YPMphYEjbUH4cLdJ4RdwnagCEpGmO2WjR-DDjp7tu6KJEg5w9uq8l-95ft_hmcN3eEPyeB3E71T3t3mklvt_UuOflCrs7myMXGcUEakMGOhbTuBV9XM50gHHmh55rtj-1gx54zKoYuDYOnUZd4XlcThFs5Q2AcHifWRSUBPEs7eFbrc4TYIeKbh9czOHdUhffF7wBZuvObPmbWzqNxOg39gexLDf9cOtRit950VBI5RctIKEAKWTv_fM3asTbcrDxO1XC9rIfXlTd8gRT2Jt2TWdS1EluZSzRRrv_ry_SvEyWxbqJdrZnHQT1dEpBNCbUHVo7YLrl-LWHuz3QXvg0TOMrT2ymMqoWXHR-9OPUYdYJXWZOWdQ10GFSXtsWTpw_sGMBjEHYYZgEMJN0gWKmJMAo9lPxThuSXiN9rjb2rOxVF7d0nyxSAT4Sk2LVpbeTQxUxY_S4mX2lz3MLwnjaiijt2Oc35oLkvm2WDzWMMTxsArIHt4N88YIaghSrH-HPS9m8S8ejAIxjGUyv8YbpAc4n4A5IN5htVuL3T0yyRqiO0_g7js6l_FFzmDYHtWOgRLXckY6Dwq1LPfN5Di_60rXMXA7v6CBy5Zb4qCfjmKVxx8y3AKQ5i6flllNMGOsImEthaosjgYEgjHhPZmb692CZc61W5z8ITTYB3KaiccSqNS7EglSFgQNXk_GTI64y8OGWX1-m2Msr0EY1evtbHk1BEH2jY3ZBaXbiBhvcTjAUDQ8TBQyrb_77Q2U-lHG5puDjPGxETcv9g9fQB8VzK5FOVRudwbmLGMnG2MGFif02t2yBl9asVZ--T6XhAbHnYw9buiqTeTg&sai=AMfl-YRGBRFxKJxRIwTffxfADxU3pReYYmBoSB6lsjWunKa11P0edSrpVDeXXUltC1mdYHjyF701Q8rGojV_u0zuqHTVisGGF27WsneQVjIo_JYuMl8a9BV65-2UZ1iBCxl9_zk9v6-HEIt62tWSBrIz0bS1eVTVF5QzDpdt5I5wVT94VPk7HaVuIA&sig=Cg0ArKJSzPROEqH4bO28EAE&cid=CAQSTwDICaaNGT2IaNe7CqYwaNf0qcCwyumt8m7_5HY5vMxcUpJYC10lMkLrza5fuQqKiBNfrFIOjaQSd8GgkT95jH8KsnE8vo2rRKjija3m0SUYAQ&id=lidar2&mcvt=1017&p=-1,1,123.265625,1006&mtos=0,814,1017,1199,1230&tos=0,814,203,182,31&v=20231204&bin=7&avms=nio&bs=0,0&mc=0.76&if=1&vu=1&app=0&itpl=20&adk=1812271801&rs=2&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLG51bGwsMCxudWxsLCIiLG51bGwsMF0%3D&vs=4&r=v&rst=1701862936404&rpt=224&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/ufs_web_display.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 06 Dec 2023 11:42:17 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 59ms
58ms Image
text/html 2a00:1450:4001:812::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20231204&jk=4233272231906894&bg=!m5ilmNfNAAY3kmNgF5I7ADQBe5WfOBbe_4QCaBntMD0iCQzzeGTEkwhBV1Kt-nMXLmlfcM0GNpYKbJE7zbf6GtkqbXEAAgAAADBSAAAAAmgBBwoA2QIT5FFxF29J9G-e51erDS9XXsUiEyAtAwlMioo3UQDle6B9AfJQwtHm7-uwQZBLANp5DYOpiV7JbKBP9Vd4q7kmuScF28KS0o9KMhG9j_DahxBemJocN3qPXcs9BFRsuFbuh9wwLtOXf9_tPybzlsVYrSNg-uN8Oirom9kkeNr6pFh38xFDOpjORnSBJS0oDjazrPyiYVxKThdr-2KBZei2kXnIG6yBZmoZnc89goLv43tenO6d1ntJ2eoXfg2idzkqf4o19g6WzI36LVkvcyh_z1RKyka3W8qZArVL0nrcIBr_AmqnP-__tscCcSyX1sIYyyjTO3KhGupzn2A2xLn8ipQr-iGjx_TJyLdhvV7OV_74CirF2X4aa7jJIC0ozejxNuiYSHtGPlNGd6xw8gXi3djPgACuWpXalyPhlD7TXcNzwCOX2bd68F6SkniQr1ZU7b3WFOBuceM7vOZ51NozCnsjHjHTRYrQ_SxeA1dCjVPz4AQ-dWqtsM-vl08Z6seF9CuAxEWRdONf0Kqp7W7tIopQQqCdFIFyfSr_i1xGBDrQ5Fp_ZfsiG3xQ0GsWFLMQHst9CrouItqmsNk7RYU9_vW7a-2nViML4tUA2vPKrCgoN8xN7gtV-Hm9HhO90CRwr2uPpCw75VHrDykEOubFlCX0Bq9hoG52SA_08Y64tOg9lGBRV4x5VkZdbEoaKTwelvgF-Viag-QIDFGkAvyw996a1o_xF96SWPyPi6y3Zc1_0De3NhUy4TEU8y1NBtdOU3_r1fO-iDpPThyBoO5pv9igotQNzSsJyKJrPA6ydnAYLEObXOfI4FHapWu4rC0ox7CdpUCH9Jpz_5fDL7rqqU5DMGxtTL6QM5zggX-scvd7I9wUDhwDhSIOSokrkssKjJOf9MhLzgC9ftrv7dqB0Vx8GdUwj9Vqo2eTNKd1CHFwYcyXNRX_DRYzlo9CJgxGopKR_td2Umc46f2aNc_1HA0alXEK-Oz-rEPHnMygfXg10uJdrL4IBdBtYlgojMPdNSrlMEsSc2-Nh0d0MPS-HsIRMxxKS-wtw95CjY8D6ISneifLeLnmAS_dXR0io9WzP9Kr_Rcgm4mJeWABmzs8HFzWy6nvyZyHx_NgNHVCSxdfGpcckvx7SwqLSbnkblykzRFX8HIvmeI7MckZrJQqV5-8d8Dv3oEPqh2-7R-f4Ih-0M4hPnFGxiRs5gzLjnQ
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:812::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://staffslogin.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Verdicts & Comments Add Verdict or Comment

56 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

24 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
staffslogin.com/	1970-01-20 16:44:30	Name: XSRF-TOKEN Value: eyJpdiI6Ino0cXg4d3JlOEo5VTh6MXh6eE9MTWc9PSIsInZhbHVlIjoiVWRiVjNqaFJocXFwYWdEMXM5OTdJZllLUzN1Z0JFN3dyZFVBSGVnNnFqUkE3T2tucDQ2Q2ZXaU5BZm1Ra05lbGF4NXRSaTA5TkNpVzlGUzBRN3BpYngzcjdlTGs0UXg4ejkzUkU0WUthTFJIUzBkNW5Tc1BDY2VaOWZiQ3lIWGwiLCJtYWMiOiI0ZTY1MTcyOTVmNzJjN2NiZTczOGQ1MWJkNjM5YmQwYmFkOTc4Yjg4NmQ3OGViYTU5NTA5OTY2Y2RiYTMzZTI5In0%3D
staffslogin.com/	1970-01-20 16:44:30	Name: stafflogin_session Value: eyJpdiI6IlRIZDU0QjRlYXdORndsbHlPUmFMa3c9PSIsInZhbHVlIjoiNkgrM0pLdGd6aGlEeWpmUXFvcEd4Zm9ERjN0NmtHdmVVSW1WRE5EVmxTK0pnM3RLVlVySHcwb01MRjJGYjNIWjBRUlcwNTBkM0laTitERURWTkRGcjVwOGpiaXMvWXJRZUVPREVmTkl5SSt4MndNMEE1Nmx3UHJXQnZsMDdSWjgiLCJtYWMiOiI3NDVkMTdiNjAxNTYxYzAxZjMzMTMwNWI5NzZiNTk2ZDE4ZGJhOGQ4NGVkNzI2ZGI2OTQ3NjVkODcwMjc5ZGE1In0%3D
staffslogin.com/	1970-01-21 02:10:18	Name: _pk_id.17.78ba Value: 33fe87049c40482d.1701862936.
staffslogin.com/	1970-01-20 16:44:24	Name: _pk_ses.17.78ba Value: 1
.staffslogin.com/	1970-01-21 02:05:58	Name: __gads Value: ID=bbecfb97bb23335a:T=1701862935:RT=1701862935:S=ALNI_MZrDZ5BY9u9-2a-y3wFXnrYNhVlVw
.staffslogin.com/	1970-01-21 02:05:58	Name: __gpi Value: UID=00000ce3e8e4039c:T=1701862935:RT=1701862935:S=ALNI_MaVMmkvApyHnaJd5tNL4dnvOc_GRw
.doubleclick.net/	1970-01-20 16:44:26	Name: DSID Value: NO_DATA
.quantserve.com/	1970-01-20 18:53:58	Name: d Value: EH4BCQHMKoEA
.quantserve.com/	1970-01-21 02:14:37	Name: mc Value: 65705e18-d3e38-106b1-47583
.adform.net/	1970-01-20 17:29:01	Name: C Value: 1
.doubleclick.net/	1970-01-21 02:05:58	Name: IDE Value: AHWqTUk0S5d4Wc4_ux72wom7inNc5Sa1O5wFShnykU7Vm3OkaHet9bCyiGJd6TieDtk
.yahoo.com/	1970-01-21 01:30:20	Name: A3 Value: d=AQABBBhecGUCECDfMNH1iZ_mYfqWKTtDCAAFEgEBAQGvcWV6ZQAAAAAA_eMAAA&S=AQAAAkId01dHQb_mNwMEBVU7hh4
.blismedia.com/	1970-01-21 01:30:02	Name: b Value: 65705E18B46C8B153A6E5D03BLIS
.adform.net/	1970-01-20 18:10:46	Name: uid Value: 9149983659311966323
.googleadservices.com/	1970-01-20 18:53:58	Name: ar_debug Value: 1
.travelaudience.com/	1970-01-21 02:16:03	Name: _tracker Value: %7B%22UUID%22%3A%22943E3012-FDBC-4BDA-2BCD-8BCB6B699214%22%7D
.w55c.net/	1970-01-21 02:16:03	Name: wfivefivec Value: mZJnh8pX1RaQid5
.turn.com/	1970-01-20 21:03:34	Name: uid Value: 3222360878934525544
.everesttech.net/	1970-01-21 01:29:58	Name: everest_g_v2 Value: g_surferid~ZXBeGQAE5YK3WABd
.w55c.net/	1970-01-20 17:27:34	Name: matchgoogle Value: 5
.ctnsnet.com/	1970-01-21 01:29:58	Name: cid_2e63675d30bb4a839bf34c94cb861780 Value: 1
.ctnsnet.com/	1970-01-21 01:29:58	Name: gid_CAESEGEMSgtXJAUHZQ4GuO4rYGY Value: 1
.simpli.fi/	1970-01-21 01:31:25	Name: suid Value: 4E28F891CEB54DE28CAC152F3B1C2F90
.tribalfusion.com/	1970-01-20 18:53:58	Name: ANON_ID Value: aOntuJSyZaRHRT8vnPIvCkbAnurT8vMhmNpteDZbW5dKfZd9afZcbYKGdvXQqk7OoO96irTNlaNZc600SuSCbZaYYU1PLa

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://staffslogin.com/%20themes/loginwebmail/all.js Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.tribalfusion.com
ad.turn.com
ads.travelaudience.com
analyzive.com
c.bannerflow.net
c1.adform.net
cm.g.doubleclick.net
cms.quantserve.com
dclk-match.dotomi.com
dis.criteo.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
ius.ctnsnet.com
match.adsrvr.org
onetag-sys.com
p4-hsumuihihija4-ma55novngz7x7ty2-if-v6exp3-v4.metric.gstatic.com
pagead2.googlesyndication.com
pixel-sync.sitescout.com
pm.w55c.net
pr-bh.ybp.yahoo.com
r.turn.com
s.tribalfusion.com
s3.us-west-1.wasabisys.com
staffslogin.com
sync-tm.everesttech.net
tpc.googlesyndication.com
tr.blismedia.com
um.simpli.fi
www.google.com
www.googleadservices.com
www.googletagservices.com
www.gstatic.com
x.bidswitch.net
142.250.181.226
142.250.185.98
142.250.185.99
15.197.193.217
151.101.130.49
159.89.165.2
161.35.181.78
178.250.1.9
18.196.207.18
2001:678:cb4:bbbb::11
2606:4700::6811:c96e
2606:4700::6812:18ad
2620:116:800d:21:de2e:c7b3:55c0:d5a0
2a00:1450:4001:811::2002
2a00:1450:4001:812::2002
2a00:1450:4001:813::2003
2a00:1450:4001:813::2004
2a00:1450:4001:81c::2001
2a00:1450:4001:830::2002
2a00:1450:4001:830::2003
2a00:1450:4001:831::200a
2a02:fa8:8806:12::1370
2a05:d018:d29:3601:11b1:8ae0:b180:1e1
34.96.105.8
35.186.193.173
35.190.0.66
35.236.220.17
37.157.6.232
38.146.40.10
51.89.9.251
52.29.230.13
98.98.134.241
006c5181aad0b98dbf9600639e4ba54abcb948fd1c17553c7de7c9df4cbcadde
00714d6c147109c2f778f8647024095c5f803940fcb3c019543c00d8d3f67633
041ab8486237ed55f88609f1db886fb97c5ae620cd66d0347b330fc2f365bd46
08013a54ef99fe2ff284edba658171e12fd2973c34aa6a26da573d74be26003f
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bacb63f4d7329e20d314c4f4472cd2192ce0d89e33af47a285b79fd9dd7f315
0e6b7a35832204c8c63ba007a66748af46d9b403a5cc62042a3f71f487d73aaa
0ecb04cada8854cff0112c413c9fc971042d6888ce8f24c63d304b429c27b54b
0edb7ff8b4775b1a73c15d06b1c7edab503f0f5a30b2dbf1a139d65a1c18e0ec
16ec1e5e6a1d23f048f226bae4b3033798b19387c33d409b4abdafac34738c1d
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
19887f7568947b9552d85ab944f99a6cec1ee3d8e6e4aa06d4ad92d438f932fe
1b6875b1573ae67f69232f0ee12c332eb114274cf273b548b13038a76cf3aa1f
1fc8dfdb8f646e934bf93bc6f793604bb12c6b304c04ac509aa86cdc1a2dbbea
28d22e66c624c7cacd394669d963f2c394c88b972d7863d8bc6c01285a31f921
28fb07135ae96abef4307d4492bf0eb77109f5ac3272a90a261745fa4fa38b3e
2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058
3059d2e0f0bd6f81e14934ba47c6fcec73fa6d6474973505edeb99890ae9878e
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
31bce7af1253da6b4a627a629753425a4bcd633961fa818d8880c3f13cf012e6
3f4a994a950f7c027cceb0aa6152c54b93ef427c746d59f1832e890048717775
4170a77b0bbb7d180030b077333fe835a6add460f1397cca913a114ab33a7451
41b43f64c3e5d7f9eca80634429adb1b8e0a1c5e1fe67ad71ec651a991ebfe68
41d2526e9c4595fc1fc747555bda18a041033a863a9b2ed180e7b5836918facd
43b54bf0dc587e90180cd23f2f80be58bc184880f2c408ae06d8e381080ff162
470d97f885973efd71f757f98dba795f591923c2bd5032747a32a3d9b649e30c
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
4af80d88711edf2481d330d87b29f52bca59a5989e47bcf0b51caa41b7ff7c7c
4d45982f2dc34f36c9045ee46a75a1943666bb7fd64e103cac8c7429e7012840
4d6706fe83c29dacc54b7cb8b9682462454bcb8af6fd8eb1b0ed475fb0105cd3
4d87f68193d2edcfbf85fc1927d3968282a4f4d9a9fd812d48319d72a43a14ee
4dce4158779dce6da3ede11337029f817a03f45c9559b1f91d8a7c5ac130f38c
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f62ca1635a69f137a0c491e1f77919985a98b682dcc7821bafdccf8273eb0ec
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5551a0a9df75fa3f58e9f2f4f27a24b46a309fc439ac42bc7ad271c86da16e69
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
56dabcaab2c4af8e3bce2996b40bf2bee77e65905d793de0e03da04716befdfa
5c4a713ee4250851232be9f9f68d41586be39b299528cfc7266e0b0e7e582e1b
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
65c99d3b9f1a1b905046e30d00a97f2d4d605e565c32917e7a89a35926e04b98
6afac4b1b297703ac3c86bee10469374b2e1a102735ad4e238292b9a23e8d666
6bebda4047a04ddc96494e531a74e1bab893ad6b57d7ff40c02b82a624c9cddc
6bf1da233645c84549609f619670d4d3e946ac61d516fd53e597c10ad100608a
7124feedceadbb23ed2f147b1b166d09d114d393fa835590ce80328561b711d8
71d352688af843750b97fc658e001388e88ad655d0bf4afdb11dee5d83f5ad0f
749771a538882ff95a66698f6a6e9bc137e5530691873d165df206d1d3c43d8c
7a5b47703d2aa636762f8b39205a2e03a85ae2de2904d81e6c6a469486ca81e9
7cb79dab863e6668bb16c9215a457c8645ce9c92b4a161bc85e8128a14db7175
7d325c6c872d4a8f885f69b70437577324c0b872c4b839c1a25865b307c0a63e
821b43472306ee9a6907150c543d526d780b0c688e18f2157519b1ade91ebf1f
84e6ebf886857ba708f9f0b6a503a489be4ffb3dc82e49c35338f99028c56b84
8d4dd33abfe49fce190971d45ac36dd0380882605828a5ce8099181ec93a6709
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
932685de0eba27246614e2609bde0ae37c107372bc6a9df4766ce44cc78ff76e
93b867d45862ab9dbe905664e47cdd5e3124d6c7bac7e140f4070fdbd67d8363
949b3cde1a46caf4f55bb496f58a44af641a4b9fed64f95057bb5eeff142170b
985ce04157293d234f57c79df71b98bc22aae52333f5f591235a8d861f4a6663
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9d6b249bda6cde60dc09930b1d4727b1e14ec39af4368bfb567bf5dc474f0b03
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a2799438c67a88f5eff2b8b3610ba892029e8a79f0cfc419ecccf97aaa5e2962
a65f004d5a22b43dea5abdd195d59f30681e0040964b28f7bf9cf04d69a91ea1
aade7746342f608807b7eb107059c842fe200e1ff09e146db822250055cecaed
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b1afc77cbe010a899f8e6586e9f1e172bb5c8831571455d3ed865e09b9457328
b3a77ca3e3a1d649c31554b8dd826b0d8c9177031a5c5558b334c442428a0efd
b41940c273de8cd82d5e4cfae70dc6a9e4afb8fc4900441fd00edcb7df622857
b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79
b7f46de7a5ecea9e08f4e72e4f052020040c37c14e7a3a24c892f8e160c1f776
babe855d1efbfa3f08be7d6c0629da7aab30099baad5ae240ad9c3b13017f1f9
bb730cd52b305ac09445308d714d2e061d43d905d4594aa636a3909c644f49ed
bbde0fd637840b04806e70ee7610047e1cfe5568854929dc58c310a861d93ca6
bc28302b4145a6174380a3aba54c74fd0b229a6b7a89c1cb7093be28dd0d2c57
bc3f72b5fd9d8db2907974cf2c815903dd438134ab524f6c9be1d3c8a8fa84f4
bc6ffc99fb89925d78d2109ea924ca8fc6c15b487dd2cf8a07abf1bc47e9dfb0
c2e9980bd93f0b451ec1d46d31894b06d6058fa401576e023d2f9c15d6f1bbc2
c34d48ab880185e8c8c83e41ca814da968e9fa403da67a784713dc4dafe64d7f
c7bc7551523d52e68c14667f0c9d5fae9a155abccc955a791bfab7a2f905d0de
c8fffb0b438b7f9403ccd47fddc2de355f2f685fe2f59ac9d4c15f82854d79b1
cda3c421b62828768ee2741a35bef36bcfdb1199ee3eb987269f7d1ce2dd8876
d06e875d038956dc321989600a8c63b20920d12c026a7fc2f7f17aced8ef64d9
d3ce19de95535e452733373acbb58a7f94adb94fbafccfb0ee80ee724453d241
d3e4cdbb12defe352221c7446f538206d487f314187f7883e6f261d9246ab3af
da41ed8b407887df6144a32d945e2d6f8b02452ad5510f45b964bf221f012188
db2bdaad0dc9232fadb3de900bf039a0f356521698f213df1edf601e02a5870d
e0481d8ae7d3696423a7eb08d8f83508e671518fcf9c06581bb3081fe918b045
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e44b4d77b271b6595bfed67b604e1dbbcb99906e6eed0844efcfc3f762a2c1a1
e537bb0b81601eabcdc6dd4e2eb938917a7c6887765651882ec0ed5081c26c67
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e742f7765cc584a0798aeb169bdd36abdcf8fab8912ff23eca35356516f4e20f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0e40a5437d2171eedd7b3f377eba52163f709cdb19336bf60e00bbedaf5ce02
f214fd7dfdbfd0579030817f0d813bd33228f24c0cd2bff1254ecf15b0ea53d1
f6446f54f518248fa174419dfec01b48dfcf80325a4ecc5b508ac77a94fb94b6
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f8238cdd1cc6032f1c34cf7e559b55a936097f78cc8839628e5cc39a6fc3f390
ff112e3c33b9711ffcf49190f3b00608091a0d43dd7887cc2acdf77d68918811

staffslogin.com Open in urlscan Pro 161.35.181.78 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

225 Requests

84 %HTTPS

44 %IPv6

28 Domains

34 Subdomains

25 IPs

8 Countries

2972 kBTransfer

6957 kBSize

24 Cookies

11 Outgoing links

Page URL History

Redirected requests

225 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 9 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

staffslogin.com Open in urlscan Pro
161.35.181.78 Public Scan

Screenshot
Live screenshot

Full Image

225
Requests

84 %
HTTPS

44 %
IPv6

28
Domains

34
Subdomains

25
IPs

8
Countries

2972 kB
Transfer

6957 kB
Size

24
Cookies

225 HTTP transactions
9 data transactions