URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Submission: On June 26 via api from TR — Scanned from DE

Summary

This website contacted 53 IPs in 9 countries across 51 domains to perform 365 HTTP transactions. The main IP is 20.60.220.36, located in Tappahannock, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is pcloak.blob.core.windows.net.
TLS certificate: Issued by Microsoft RSA TLS CA 02 on March 22nd 2023. Valid for: a year.
This is the only time pcloak.blob.core.windows.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
4 20.60.220.36 8075 (MICROSOFT...)
2 77.245.159.14 42868 (NIOBEBILI...)
3 94.138.206.83 49126 (AS49126)
1 2a00:1450:400... 15169 (GOOGLE)
40 2a02:6ea0:c70... 60068 (CDN77 ^_^)
3 2a00:1450:400... 15169 (GOOGLE)
2 151.139.128.10 20446 (STACKPATH...)
1 23.206.208.114 16625 (AKAMAI-AS)
1 2a00:1450:400... 15169 (GOOGLE)
20 185.7.176.221 42910 (PREMIERDC...)
2 2a03:2880:f08... 32934 (FACEBOOK)
15 2a00:1450:400... 15169 (GOOGLE)
63 2a00:1450:400... 15169 (GOOGLE)
3 99.84.87.107 16509 (AMAZON-02)
3 2a00:1450:400... 15169 (GOOGLE)
1 52.222.253.136 16509 (AMAZON-02)
1 35.241.45.217 15169 (GOOGLE)
7 2a00:1450:400... 15169 (GOOGLE)
1 34.102.243.38 396982 (GOOGLE-CL...)
1 2a00:1450:400... 15169 (GOOGLE)
36 2a00:1450:400... 15169 (GOOGLE)
7 2a00:1450:400... 15169 (GOOGLE)
5 2a00:1450:400... 15169 (GOOGLE)
30 2a00:1450:400... 15169 (GOOGLE)
5 185.29.132.242 30419 (MEDIAMATH...)
3 11 2a00:1450:400... 15169 (GOOGLE)
7 42 142.250.186.34 15169 (GOOGLE)
3 5 185.80.39.216 27381 (CASALE-MEDIA)
2 3 185.89.210.20 29990 (ASN-APPNEX)
2 35.244.159.8 15169 (GOOGLE)
2 6 2.18.161.51 16625 (AKAMAI-AS)
8 138.201.63.150 24940 (HETZNER-AS)
2 95.101.148.198 16625 (AKAMAI-AS)
3 138.201.63.165 24940 (HETZNER-AS)
4 142.250.185.194 15169 (GOOGLE)
2 2 2a05:d018:d29... 16509 (AMAZON-02)
6 6 213.155.156.169 1299 (TWELVE99 ...)
2 2 69.173.144.138 26667 (RUBICONPR...)
4 4 52.48.181.155 16509 (AMAZON-02)
7 7 46.228.174.117 56396 (AMOBEE)
1 3.71.149.231 16509 (AMAZON-02)
3 3 20.127.253.7 8075 (MICROSOFT...)
3 141.95.98.64 16276 (OVH)
2 4 185.29.132.245 30419 (MEDIAMATH...)
1 1 35.190.0.66 15169 (GOOGLE)
2 35.227.252.103 15169 (GOOGLE)
7 7 185.64.190.78 62713 (AS-PUBMATIC)
1 1 151.101.194.49 54113 (FASTLY)
1 1 51.89.9.251 16276 (OVH)
1 2 2620:116:800d... 16509 (AMAZON-02)
3 3 54.93.94.222 16509 (AMAZON-02)
6 145.239.193.130 16276 (OVH)
2 2a0b:4d07:102::1 44239 (PROINITY ...)
2 4 2a01:4f8:d0a:... 24940 (HETZNER-AS)
2 49.12.22.42 24940 (HETZNER-AS)
3 136.243.149.243 24940 (HETZNER-AS)
2 3.11.176.98 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a02:fa8:8806... ()
2 2 37.157.6.242 ()
1 1 2600:9000:205... 16509 (AMAZON-02)
2 2 76.223.111.18 16509 (AMAZON-02)
2 18.66.147.120 ()
2 99.86.4.52 ()
1 178.250.1.9 ()
4 52.56.247.104 ()
365 53
Apex Domain
Subdomains
Transfer
89 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 133
e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
tpc.googlesyndication.com — Cisco Umbrella Rank: 155
775 KB
78 doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 219
googleads.g.doubleclick.net — Cisco Umbrella Rank: 57
cm.g.doubleclick.net — Cisco Umbrella Rank: 244
googleads4.g.doubleclick.net — Cisco Umbrella Rank: 359
392 KB
43 ye-mek.net
ye-mek.net — Cisco Umbrella Rank: 858491
cdn.ye-mek.net
654 KB
30 2mdn.net
s0.2mdn.net — Cisco Umbrella Rank: 338
2 MB
18 virgul.com
static.virgul.com — Cisco Umbrella Rank: 63446
ng.virgul.com — Cisco Umbrella Rank: 55403
ng2.virgul.com — Cisco Umbrella Rank: 60888
231 KB
14 redintelligence.net
hal9000.redintelligence.net — Cisco Umbrella Rank: 39899
hal90005.redintelligence.net — Cisco Umbrella Rank: 327283
hal900030.redintelligence.net — Cisco Umbrella Rank: 461531
87 KB
14 google.com
adservice.google.com — Cisco Umbrella Rank: 107
www.google.com — Cisco Umbrella Rank: 3
2 KB
11 mathtag.com
tags.mathtag.com — Cisco Umbrella Rank: 4813
pixel.mathtag.com — Cisco Umbrella Rank: 1145
sync.mathtag.com — Cisco Umbrella Rank: 566
9 KB
7 pubmatic.com
image6.pubmatic.com — Cisco Umbrella Rank: 822
3 KB
7 googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 207
392 KB
6 webgains.io
analytics.webgains.io
api.webgains.io
63 KB
6 medialead.de
pv.medialead.de — Cisco Umbrella Rank: 53229
2 KB
6 de17a.com
d5p.de17a.com — Cisco Umbrella Rank: 4988
2 KB
6 teads.tv
sync.teads.tv — Cisco Umbrella Rank: 1404
1 KB
5 casalemedia.com
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 621
ssum-sec.casalemedia.com — Cisco Umbrella Rank: 486
4 KB
5 ampproject.org
cdn.ampproject.org — Cisco Umbrella Rank: 387
110 KB
4 retailads.net
cdn.retailads.net — Cisco Umbrella Rank: 135629
11 KB
4 1rx.io
sync.1rx.io — Cisco Umbrella Rank: 618
3 KB
4 360yield.com
match.360yield.com — Cisco Umbrella Rank: 2458
2 KB
4 openx.net
us-u.openx.net — Cisco Umbrella Rank: 492
rtb.openx.net — Cisco Umbrella Rank: 1042
766 B
4 amazon-adsystem.com
c.amazon-adsystem.com — Cisco Umbrella Rank: 357
aax.amazon-adsystem.com — Cisco Umbrella Rank: 444
62 KB
4 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 422
imasdk.googleapis.com — Cisco Umbrella Rank: 495
fonts.googleapis.com — Cisco Umbrella Rank: 80
155 KB
4 windows.net
pcloak.blob.core.windows.net
3 KB
3 w55c.net
pm.w55c.net — Cisco Umbrella Rank: 1012
3 KB
3 id5-sync.com
id5-sync.com — Cisco Umbrella Rank: 434
3 KB
3 inmobi.com
sync.inmobi.com — Cisco Umbrella Rank: 1487
2 KB
3 unrulymedia.com
sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1281
2 KB
3 yahoo.com
pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 468
ups.analytics.yahoo.com — Cisco Umbrella Rank: 340
2 KB
3 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 249
3 KB
3 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 82
134 KB
2 webgains.team
cdn.track.production.webgains.team
4 KB
2 3lift.com
eb2.3lift.com — Cisco Umbrella Rank: 421
952 B
2 adform.net
c1.adform.net
1 KB
2 webgains.com
track.webgains.com — Cisco Umbrella Rank: 35620
4 KB
2 futalis.de
futalis.de — Cisco Umbrella Rank: 192473
801 B
2 office-partner.de
adv.office-partner.de — Cisco Umbrella Rank: 191967
2 KB
2 quantserve.com
cms.quantserve.com — Cisco Umbrella Rank: 846
828 B
2 rubiconproject.com
pixel.rubiconproject.com — Cisco Umbrella Rank: 381
914 B
2 imgiz.com
c1.imgiz.com — Cisco Umbrella Rank: 102765
131 KB
2 pghub.io
pghub.io — Cisco Umbrella Rank: 1964
feed.pghub.io — Cisco Umbrella Rank: 2174
6 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 176
89 KB
2 dmca.com
images.dmca.com — Cisco Umbrella Rank: 13184
6 KB
2 cloakan.co
www.cloakan.co
1 KB
1 criteo.com
dis.criteo.com
363 B
1 smaato.net
s.ad.smaato.net — Cisco Umbrella Rank: 805
439 B
1 dotomi.com
dclk-match.dotomi.com
104 B
1 onetag-sys.com
onetag-sys.com — Cisco Umbrella Rank: 874
338 B
1 everesttech.net
sync-tm.everesttech.net — Cisco Umbrella Rank: 778
545 B
1 travelaudience.com
ads.travelaudience.com — Cisco Umbrella Rank: 6896
556 B
1 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 60
21 KB
1 addthis.com
s7.addthis.com — Cisco Umbrella Rank: 2353
360 B
365 51
Domain Requested by
46 pagead2.googlesyndication.com static.virgul.com
pagead2.googlesyndication.com
e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
googleads.g.doubleclick.net
tpc.googlesyndication.com
s0.2mdn.net
ye-mek.net
www.googletagservices.com
42 cm.g.doubleclick.net 7 redirects googleads.g.doubleclick.net
ye-mek.net
e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
40 cdn.ye-mek.net ye-mek.net
cdn.ye-mek.net
36 tpc.googlesyndication.com e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
ye-mek.net
cdn.ampproject.org
pcloak.blob.core.windows.net
googleads.g.doubleclick.net
tpc.googlesyndication.com
s0.2mdn.net
pagead2.googlesyndication.com
30 s0.2mdn.net ye-mek.net
cdn.ampproject.org
e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
pcloak.blob.core.windows.net
s0.2mdn.net
17 googleads.g.doubleclick.net pagead2.googlesyndication.com
ye-mek.net
e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
pcloak.blob.core.windows.net
googleads.g.doubleclick.net
15 securepubads.g.doubleclick.net static.virgul.com
securepubads.g.doubleclick.net
e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
ye-mek.net
pcloak.blob.core.windows.net
www.googletagservices.com
11 www.google.com 3 redirects e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
googleads.g.doubleclick.net
tpc.googlesyndication.com
8 hal9000.redintelligence.net pcloak.blob.core.windows.net
hal90005.redintelligence.net
hal900030.redintelligence.net
8 ng.virgul.com static.virgul.com
ye-mek.net
7 image6.pubmatic.com 7 redirects
7 www.googletagservices.com e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
googleads.g.doubleclick.net
7 e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com securepubads.g.doubleclick.net
7 static.virgul.com ye-mek.net
static.virgul.com
pcloak.blob.core.windows.net
6 pv.medialead.de hal90005.redintelligence.net
hal900030.redintelligence.net
6 d5p.de17a.com 6 redirects
6 sync.teads.tv 2 redirects googleads.g.doubleclick.net
e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
5 tags.mathtag.com e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
tags.mathtag.com
googleads.g.doubleclick.net
5 cdn.ampproject.org securepubads.g.doubleclick.net
4 api.webgains.io analytics.webgains.io
4 cdn.retailads.net 2 redirects futalis.de
4 sync.mathtag.com 2 redirects tags.mathtag.com
googleads.g.doubleclick.net
4 sync.1rx.io 4 redirects
4 match.360yield.com 4 redirects
4 googleads4.g.doubleclick.net pcloak.blob.core.windows.net
4 dsum-sec.casalemedia.com 2 redirects googleads.g.doubleclick.net
4 pcloak.blob.core.windows.net pcloak.blob.core.windows.net
3 hal900030.redintelligence.net hal9000.redintelligence.net
googleads.g.doubleclick.net
hal900030.redintelligence.net
3 pm.w55c.net 3 redirects
3 id5-sync.com ye-mek.net
3 sync.inmobi.com 3 redirects
3 sync.targeting.unrulymedia.com 3 redirects
3 hal90005.redintelligence.net hal9000.redintelligence.net
e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
hal90005.redintelligence.net
3 ng2.virgul.com ye-mek.net
3 ib.adnxs.com 2 redirects googleads.g.doubleclick.net
3 adservice.google.com pagead2.googlesyndication.com
securepubads.g.doubleclick.net
3 c.amazon-adsystem.com static.virgul.com
c.amazon-adsystem.com
3 www.googletagmanager.com ye-mek.net
adv.office-partner.de
3 ye-mek.net www.cloakan.co
ye-mek.net
2 cdn.track.production.webgains.team e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
googleads.g.doubleclick.net
2 analytics.webgains.io track.webgains.com
2 eb2.3lift.com 2 redirects
2 c1.adform.net 2 redirects
2 fonts.googleapis.com hal90005.redintelligence.net
hal900030.redintelligence.net
2 track.webgains.com e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
googleads.g.doubleclick.net
2 futalis.de hal90005.redintelligence.net
hal900030.redintelligence.net
2 adv.office-partner.de hal90005.redintelligence.net
hal900030.redintelligence.net
2 cms.quantserve.com 1 redirects e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
2 rtb.openx.net e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
2 pixel.rubiconproject.com 2 redirects
2 pr-bh.ybp.yahoo.com 2 redirects
2 pixel.mathtag.com tags.mathtag.com
2 us-u.openx.net googleads.g.doubleclick.net
2 c1.imgiz.com static.virgul.com
c1.imgiz.com
2 connect.facebook.net ye-mek.net
connect.facebook.net
2 images.dmca.com ye-mek.net
2 www.cloakan.co pcloak.blob.core.windows.net
1 dis.criteo.com googleads.g.doubleclick.net
1 s.ad.smaato.net 1 redirects
1 dclk-match.dotomi.com e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
1 onetag-sys.com 1 redirects
1 sync-tm.everesttech.net 1 redirects
1 ssum-sec.casalemedia.com 1 redirects
1 ads.travelaudience.com 1 redirects
1 ups.analytics.yahoo.com e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
1 imasdk.googleapis.com c1.imgiz.com
1 feed.pghub.io pghub.io
1 pghub.io static.virgul.com
1 aax.amazon-adsystem.com c.amazon-adsystem.com
1 www.google-analytics.com www.googletagmanager.com
1 s7.addthis.com ye-mek.net
1 ajax.googleapis.com ye-mek.net
365 72

This site contains no links.

Subject Issuer Validity Valid
*.blob.core.windows.net
Microsoft RSA TLS CA 02
2023-03-22 -
2024-03-22
a year crt.sh
cpanel.cloakan.co
R3
2023-05-03 -
2023-08-01
3 months crt.sh
www.ye-mek.net
RapidSSL Global TLS RSA4096 SHA256 2022 CA1
2022-11-29 -
2023-07-07
7 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
1099124734.rsc.cdn77.org
R3
2023-06-13 -
2023-09-11
3 months crt.sh
*.google-analytics.com
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
images.dmca.com
R3
2023-05-13 -
2023-08-11
3 months crt.sh
odc-addthis-prod-01.oracle.com
DigiCert TLS RSA SHA256 2020 CA1
2023-02-07 -
2024-02-07
a year crt.sh
*.virgul.com
Sectigo RSA Domain Validation Secure Server CA
2022-10-24 -
2023-09-28
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2023-04-04 -
2023-07-03
3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
c.amazon-adsystem.com
Amazon RSA 2048 M01
2023-02-28 -
2024-02-17
a year crt.sh
*.google.com
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
aax-dtb-mobile-cf.amazon-adsystem.com
Amazon RSA 2048 M01
2023-03-16 -
2024-03-08
a year crt.sh
*.pghub.io
DigiCert TLS RSA SHA256 2020 CA1
2023-02-09 -
2024-02-08
a year crt.sh
*.imgiz.com
Sectigo RSA Domain Validation Secure Server CA
2022-09-27 -
2023-09-09
a year crt.sh
tpc.googlesyndication.com
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
misc-sni.google.com
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
*.doubleclick.net
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
*.mathtag.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-03-30 -
2024-04-29
a year crt.sh
www.google.com
GTS CA 1C3
2023-05-29 -
2023-08-21
3 months crt.sh
*.openx.net
GeoTrust RSA CA 2018
2022-07-21 -
2023-08-21
a year crt.sh
teads.tv
R3
2023-05-11 -
2023-08-09
3 months crt.sh
redintelligence.net
R3
2023-06-09 -
2023-09-07
3 months crt.sh
pixel.mathtag.com
DigiCert TLS RSA SHA256 2020 CA1
2022-07-05 -
2023-07-05
a year crt.sh
ups.analytics.yahoo.com
DigiCert SHA2 High Assurance Server CA
2023-02-21 -
2023-08-16
6 months crt.sh
*.quantserve.com
DigiCert TLS RSA SHA256 2020 CA1
2022-08-09 -
2023-09-09
a year crt.sh
pv.medialead.de
R3
2023-06-14 -
2023-09-12
3 months crt.sh
adv.office-partner.de
R3
2023-05-01 -
2023-07-30
3 months crt.sh
*.futalis.de
R3
2023-06-16 -
2023-09-14
3 months crt.sh
cdn.retailads.net
Encryption Everywhere DV TLS CA - G2
2023-05-18 -
2024-05-17
a year crt.sh
*.webgains.com
Amazon RSA 2048 M01
2023-05-15 -
2024-06-13
a year crt.sh
*.dotomi.com
GlobalSign RSA OV SSL CA 2018
2022-08-09 -
2023-09-10
a year crt.sh
*.webgains.io
Amazon RSA 2048 M02
2023-03-02 -
2023-09-21
7 months crt.sh
cdn.track.production.webgains.team
Amazon RSA 2048 M01
2023-02-28 -
2023-10-28
8 months crt.sh
*.criteo.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2023-05-12 -
2023-08-10
3 months crt.sh

This page contains 44 frames:

Primary Page: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Frame ID: 15BBE867F79EB2FD8C5338E52FDCB03F
Requests: 6 HTTP requests in this frame

Frame: https://ye-mek.net/
Frame ID: 1DCE8F576A4901E8BA83F18C4B7CB42A
Requests: 93 HTTP requests in this frame

Frame: https://static.virgul.com/theme/mockups/outside/str.html?v=2
Frame ID: 6B93AE362C727F05F4491640753C44A7
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/html/r20230620/r20190131/zrt_lookup.html
Frame ID: 362BFFF31056D34EE02CC4263E92F491
Requests: 1 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&adk=1812271804&adf=3279755397&plat=1%3A512%2C2%3A512%2C3%3A512%2C4%3A512%2C8%3A512%2C9%3A33288%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C26%3A512%2C27%3A512%2C30%3A1081856%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453215&bpp=5&bdt=878&idt=114&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&nras=1&correlator=3599492905211&frm=24&ife=1&pv=2&ga_vid=287714539.1687740453&ga_sid=1687740453&ga_hid=1928663309&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=1600&ish=1200&ifk=222437166&scr_x=-12245933&scr_y=-12245933&eid=44759876%2C44759927%2C44759837%2C31075308%2C31075413%2C31075465%2C31075473%2C42531706%2C44788442%2C44794789&oid=2&pvsid=4006622124605617&tmod=1052164672&uas=0&nvt=1&fsapi=1&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=1&uci=1.1901ez82f66&fsb=1&dtd=135
Frame ID: E59C14EEA3D36ECAC36FDBC0AE541518
Requests: 1 HTTP requests in this frame

Frame: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Frame ID: FE569E728E56F48422480625A65FBCBA
Requests: 1 HTTP requests in this frame

Frame: https://feed.pghub.io/tag?referrer_url=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&page_url=https%3A%2F%2Fye-mek.net%2F&owner=P%26G&bp_id=noktacommedya&ch=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D&initiator=js&data=%7B%22category%22%3A%22site_geneli%22%7D
Frame ID: A7D2E876ED2B517A6112663416D43D00
Requests: 1 HTTP requests in this frame

Frame: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Frame ID: 8E30FF4136C43B57C9365587B5EC3A6D
Requests: 12 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&adk=1812271804&adf=3407250215&plat=1%3A520%2C2%3A520%2C3%3A2163200%2C4%3A2163200%2C8%3A512%2C9%3A33288%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C26%3A512%2C27%3A512%2C30%3A1049088%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fye-mek.net%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453812&bpp=8&bdt=86&idt=108&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&nras=1&correlator=4671767059969&frm=8&ife=1&pv=2&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&fsapi=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=1&uci=1.1qp67jg2prau&fsb=1&dtd=124
Frame ID: 7EE43957BA26714C5114463D20901188
Requests: 1 HTTP requests in this frame

Frame: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Frame ID: 1A21640FF29D0D55CFEB97C337C2EE09
Requests: 20 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453820&bpp=35&bdt=94&idt=136&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4671767059969&frm=8&ife=1&pv=1&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.1e0bozjdbm9m&fsb=1&dtd=145
Frame ID: 1BE16FE861621BA0C40DB9A614D31131
Requests: 20 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/022305252018000/amp4ads-v0.mjs
Frame ID: 5622AF11AA195DADF4FBA3B721E30F63
Requests: 18 HTTP requests in this frame

Frame: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Frame ID: 7DEF807469A0E05CDA76DD5A6C5BD7E9
Requests: 20 HTTP requests in this frame

Frame: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Frame ID: 6ED29DC79AABCE76CA7396C2A94470A6
Requests: 20 HTTP requests in this frame

Frame: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Frame ID: 578A6B3D717A05B9921935E258152C23
Requests: 14 HTTP requests in this frame

Frame: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Frame ID: 0D4C2DCF751254FDDBD6F6AAF47318EC
Requests: 13 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjPyrHlATAB&v=APEucNWOriM71fvtNwQ-GDeuO4-9plF2Wiqu1YoDb5RGyekRrPA9G-Qt1OXCPE_aFx9KP6esktblfHF77njyCKV7gKp4NhhjWuBDHQrK3F8Ein0QUdSz4HK1AD5Ay8IrD2YizMJzmS9gnx3tV5pw4zm0zPspYsqOlpugkTE8EAiMiq4ssXRiDBk
Frame ID: 287EF22677567E2BCCC57E9CB3BDFDA5
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARiM97DlATAB&v=APEucNWcDxx8OKanGfQXnicp3wea-jwNxeYRj-BnV7vOxwDzN3EtQfy-UOnMF7OuQq64B1J2-HmXXm66Ekh6J8Hn4s6zVZKlIV0AI425YMADldT6L4BRLKmu7K2XyMyOuysN3WGA6Wqe5cmHOzSlYuIPARKJbT_pl3mUfmAVkYtiL5i57BtZpJg
Frame ID: 6ED6FAC8E296129F932E46E03321059B
Requests: 5 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: 2D6615B2E2070FACDC6F8B8FFDD8EF37
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 9A07D724357CB2987F43C394495FDEF4
Requests: 9 HTTP requests in this frame

Frame: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Frame ID: EA1DC331A5BF57381B1FCF0488BB8298
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 88D63F8650230A30784BBDAED715037D
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: F2BA0C6A22EB86401EED5D438C2E831A
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 95A87DAD4CF32CE5BBED241ACF542E91
Requests: 9 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=ybHb7UDSck&t=1&renderingType=2&ev=01_250
Frame ID: 8BD31C375D1B85C1BC71A2F6AA4E42B4
Requests: 12 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 969D6607EAD050C71EF364C13480AD9C
Requests: 3 HTTP requests in this frame

Frame: https://s0.2mdn.net/sadbundle/7493198391404092334/index.html?e=69&leftOffset=0&topOffset=0&c=8VazJQu393&t=1&renderingType=2&ev=01_250
Frame ID: AFC3238140FD77973D2C7AE4D070EA5B
Requests: 12 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Frame ID: 7796AAB43D280E2C4BC9AFA3185F3270
Requests: 3 HTTP requests in this frame

Frame: https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=24394400004294500951389012367005&t=htlp&gdpr=1&consent=1&gdpr_consent=li
Frame ID: ED2697D432668847274848F05DD5B681
Requests: 1 HTTP requests in this frame

Frame: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Frame ID: 9CA11AAB2FD997EED4EECCF3EC39F3B9
Requests: 2 HTTP requests in this frame

Frame: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=2818862324
Frame ID: 61678044067F513B9A806B90F3B41822
Requests: 2 HTTP requests in this frame

Frame: https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=75958800006171300951389012367030&t=htlp&gdpr=1&consent=1&gdpr_consent=li
Frame ID: 154B2FACBA9913E532103F61A971FF88
Requests: 1 HTTP requests in this frame

Frame: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Frame ID: 1959E467D0DB4BF352D7725124515453
Requests: 2 HTTP requests in this frame

Frame: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=2818862325
Frame ID: 6561067E919E08D47DEBE3E750F7CD88
Requests: 2 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/IQSFUkhUGxVfAIopecFKbiTYCckszFTcFsmN0yEW6wM.js
Frame ID: BAC1EC564A0418A4550B998A7E4F2C3B
Requests: 1 HTTP requests in this frame

Frame: https://hal90005.redintelligence.net/request_content.php?s=24394400004294500951389012367005&a=f78ecc3d
Frame ID: 1B0245A6D253C14F00AABE9C8983686C
Requests: 6 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: 829625D3AB046DC92A6A05F910930E4F
Requests: 9 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/bg/IQSFUkhUGxVfAIopecFKbiTYCckszFTcFsmN0yEW6wM.js
Frame ID: CC818A5E06F315ACEC76C288CD16604D
Requests: 1 HTTP requests in this frame

Frame: https://hal900030.redintelligence.net/request_content.php?s=75958800006171300951389012367030&a=e491a2c0
Frame ID: 45A4E097AC87D00A97E9B68E0D99E39D
Requests: 6 HTTP requests in this frame

Frame: https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Frame ID: CB2FEC26A717105B86B44381E1174373
Requests: 6 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 3932BFBA9017176B867D0C935DB8C548
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: A1E824E91710BCCCCBCB5B75955B8242
Requests: 2 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: CD3AEBC8C931ED42CAFD304C03953D71
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: BCBF6C7AAE0601D209323D98BFAC5B45
Requests: 2 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • addthis\.com/js/

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • tpc\.googlesyndication\.com/safeframe

Overall confidence: 100%
Detected patterns
  • 2mdn\.net

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
  • 2mdn\.net

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net

Overall confidence: 100%
Detected patterns
  • analytics\.webgains\.io

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

365
Requests

89 %
HTTPS

33 %
IPv6

51
Domains

72
Subdomains

53
IPs

9
Countries

5533 kB
Transfer

10987 kB
Size

37
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 156
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMIjiuIdDvjhSBZ9gQfmF9g&google_cver=1
Request Chain 157
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D HTTP 302
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZJjgJuzYkefU3A3c3kdCJQAA HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMIjiuIdDvjhSBZ9gQfmF9g&google_cver=1
Request Chain 158
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm HTTP 302
  • https://ib.adnxs.com/setuid?entity=101&code=CAESEEPiEz1q-qymy0Q6SGjZWWs&google_cver=1
Request Chain 159
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC} HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mzc4MTg1MjU3OTc2OTQ3NzMwOA%3D%3D
Request Chain 160
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOGZ7KL3jNgjKkEOGvUVKc8&google_cver=1
Request Chain 162
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm HTTP 302
  • https://sync.teads.tv/um?eid=3&uid=CAESENB1Pr-GJFOaN09645HJk-c&google_cver=1
Request Chain 164
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 215
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESENglKzaAGvAbF7rfscjzi_Y&google_cver=1&google_push=ATf1kGOtK4_2FI6l_rObSB0LRtLGiR4W2vM2M7svy1JDOHeTabtncWEfHkRHxc82ZRYf3Og0ccI17lGM6WHBmq9GtzlgKmM9Jpw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGOtK4_2FI6l_rObSB0LRtLGiR4W2vM2M7svy1JDOHeTabtncWEfHkRHxc82ZRYf3Og0ccI17lGM6WHBmq9GtzlgKmM9Jpw&google_hm=eS1mSWhMaDNKRTJwR01CRDFOR1NDYkR3R1NOSzhaNGtSN35B
Request Chain 216
  • https://d5p.de17a.com/cookies/google?google_gid=CAESEF7lBAKD5G-6XM_B--ZiZu8&google_cver=1&google_push=ATf1kGMMsckoKHJZlwbmFpDvhs9VteeiBbOSskS4v4k80nKJoya475ykN51_rQij4yvBnCLvWZa1K0ZJnMvIFTEA5ToSvmoBcJs HTTP 302
  • https://d5p.de17a.com/cookies/google;c?google_gid=CAESEF7lBAKD5G-6XM_B--ZiZu8&google_cver=1&google_push=ATf1kGMMsckoKHJZlwbmFpDvhs9VteeiBbOSskS4v4k80nKJoya475ykN51_rQij4yvBnCLvWZa1K0ZJnMvIFTEA5ToSvmoBcJs HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGMMsckoKHJZlwbmFpDvhs9VteeiBbOSskS4v4k80nKJoya475ykN51_rQij4yvBnCLvWZa1K0ZJnMvIFTEA5ToSvmoBcJs
Request Chain 217
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESELkkPXHlyITuQHaSzIBNFlo&google_cver=1&google_push=ATf1kGOWVGtjOki9DcutlkVuVZTj92xngM7QZGvxK2ICuN3M1P2oulfHcUanGenuUOXHiLsVKd541rq5acjLqWMPeRmwgZt5W4Y6 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEpDNTM5QlYtWS1DQVNQ&google_push=ATf1kGOWVGtjOki9DcutlkVuVZTj92xngM7QZGvxK2ICuN3M1P2oulfHcUanGenuUOXHiLsVKd541rq5acjLqWMPeRmwgZt5W4Y6
Request Chain 218
  • https://match.360yield.com/match/ebda?google_gid=CAESEJjCUy7b6Q121-IlBrRDPLM&google_cver=1&google_push=ATf1kGOTuTJ-Dl7Uw4dldA1DsouBpYz4h2hOfPC0BB_tDJfA8Swrt1Xomo_5KAW5NpxJcU49F84b7rc8OQkM5maHe-FOE0ZoQkn_ HTTP 302
  • https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEJjCUy7b6Q121-IlBrRDPLM&google_cver=1&google_push=ATf1kGOTuTJ-Dl7Uw4dldA1DsouBpYz4h2hOfPC0BB_tDJfA8Swrt1Xomo_5KAW5NpxJcU49F84b7rc8OQkM5maHe-FOE0ZoQkn_ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=uac6qD-HRKOXN8fMj7mMtQ&google_push=ATf1kGOTuTJ-Dl7Uw4dldA1DsouBpYz4h2hOfPC0BB_tDJfA8Swrt1Xomo_5KAW5NpxJcU49F84b7rc8OQkM5maHe-FOE0ZoQkn_
Request Chain 219
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEBVfswJmuGNWkyrRRhEHQRg&google_cver=1&google_push=ATf1kGNIV-9XyzH5Y9EJmcTVEQWPzmH-EBpcm6K3EiR5g0PDGEj7Lf4fH92JLUMpDI3NVxYHa-fTAl9oL-LgZEssO12yL18i525t HTTP 302
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=ATf1kGNIV-9XyzH5Y9EJmcTVEQWPzmH-EBpcm6K3EiR5g0PDGEj7Lf4fH92JLUMpDI3NVxYHa-fTAl9oL-LgZEssO12yL18i525t&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&cb=1687740454628 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-49bea114-ddba-49a5-86ec-f45632124bba-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DATf1kGNIV-9XyzH5Y9EJmcTVEQWPzmH-EBpcm6K3EiR5g0PDGEj7Lf4fH92JLUMpDI3NVxYHa-fTAl9oL-LgZEssO12yL18i525t%26google_hm%3DA0m-oRTdukmlhuz0VjISS7o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGNIV-9XyzH5Y9EJmcTVEQWPzmH-EBpcm6K3EiR5g0PDGEj7Lf4fH92JLUMpDI3NVxYHa-fTAl9oL-LgZEssO12yL18i525t&google_hm=A0m-oRTdukmlhuz0VjISS7o
Request Chain 221
  • https://sync.inmobi.com/gob?google_gid=CAESEMJmKHQY2BOQ-XznuTD881o&google_cver=1&google_push=ATf1kGO3bAF5mPwu5-pFX5HnolWZ026a8XLcXvrirq798cr-OtZf3NorjARTa0YmQ16ehS-Fyx6fWjVMfmieHetzl_ILz6hi9KOe HTTP 302
  • https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGO3bAF5mPwu5-pFX5HnolWZ026a8XLcXvrirq798cr-OtZf3NorjARTa0YmQ16ehS-Fyx6fWjVMfmieHetzl_ILz6hi9KOe
Request Chain 223
  • https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEGtHSCIBAMISum6zw62rBdk&google_cver=1&google_push=ATf1kGNG3F8wWZbcm9tnqN4FoVJgzoZAFhiysV2KX8T87MOui_cH4s1TIPQwXllEa2OIAXRRm84cdFKtRzz-zLH5xBHyYRbqtTerFA HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=8ZhkmOAmTgGpXGsPjTC64w&google_push=ATf1kGNG3F8wWZbcm9tnqN4FoVJgzoZAFhiysV2KX8T87MOui_cH4s1TIPQwXllEa2OIAXRRm84cdFKtRzz-zLH5xBHyYRbqtTerFA
Request Chain 224
  • https://ads.travelaudience.com/google_pixel?google_gid=CAESEL-ksOoENgw1EsupGYPM6B8&google_cver=1&google_push=ATf1kGOsdAUKO3iqpgnT5vdwGr40v90A5XXalIOrZ5dnrsTmEf6y0Avvf4p38ovNM8xZoetBB71_3XWQm83X9eRUrGN2fAAZZPo7tQ HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=WGS3T-SUSc-9zC_lT_zwYQ2&google_push=ATf1kGOsdAUKO3iqpgnT5vdwGr40v90A5XXalIOrZ5dnrsTmEf6y0Avvf4p38ovNM8xZoetBB71_3XWQm83X9eRUrGN2fAAZZPo7tQ
Request Chain 225
  • https://d5p.de17a.com/cookies/google?google_gid=CAESEP4MqeA5fzloO2Ck3iaFTP8&google_cver=1&google_push=ATf1kGP2iZjDPs1TUSrGFPPiMUJ6dn6Ng1KlwpdE3O-hniMC3Nmb4tvgTjfakagFR8X0k7Y-R7AdpX9HBxAEP_fQ_VUNFUfSKO_P0A HTTP 302
  • https://d5p.de17a.com/cookies/google;c?google_gid=CAESEP4MqeA5fzloO2Ck3iaFTP8&google_cver=1&google_push=ATf1kGP2iZjDPs1TUSrGFPPiMUJ6dn6Ng1KlwpdE3O-hniMC3Nmb4tvgTjfakagFR8X0k7Y-R7AdpX9HBxAEP_fQ_VUNFUfSKO_P0A HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGP2iZjDPs1TUSrGFPPiMUJ6dn6Ng1KlwpdE3O-hniMC3Nmb4tvgTjfakagFR8X0k7Y-R7AdpX9HBxAEP_fQ_VUNFUfSKO_P0A
Request Chain 227
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEF5B9yDMLlnsH2fkHYED41g&google_cver=1&google_push=ATf1kGP2wlTqaMgEmkjPQalUkosFWGSRNKdcXIV3wXRXQqhdjmfMdJfJrAQ-R-E0XXGtDYI9kEtjP2fQLWu3-1G695lN4a1Dh8H3Lg HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEF5B9yDMLlnsH2fkHYED41g&google_cver=1&google_push=ATf1kGP2wlTqaMgEmkjPQalUkosFWGSRNKdcXIV3wXRXQqhdjmfMdJfJrAQ-R-E0XXGtDYI9kEtjP2fQLWu3-1G695lN4a1Dh8H3Lg&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WKr6BDP-Rq6qIc1XsD0i6g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGP2wlTqaMgEmkjPQalUkosFWGSRNKdcXIV3wXRXQqhdjmfMdJfJrAQ-R-E0XXGtDYI9kEtjP2fQLWu3-1G695lN4a1Dh8H3Lg
Request Chain 228
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHw1FHOr0_5VGnSHsGQ4KcE&google_cver=1&google_push=ATf1kGP7dSJe_UpjZc_BtpdX4RaF3oDNrzei-7bTBkTPPBA7m3Z5qe_vujXlojT20dz-nQv_1LrmTq5scfT1Oqb6q7m4JbZjtID7Qw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEHw1FHOr0_5VGnSHsGQ4KcE&google_hm=ZJjgJuzYkefU3A3c3kdCJQAADS8AAAIB&google_nid=index&google_push=ATf1kGP7dSJe_UpjZc_BtpdX4RaF3oDNrzei-7bTBkTPPBA7m3Z5qe_vujXlojT20dz-nQv_1LrmTq5scfT1Oqb6q7m4JbZjtID7Qw
Request Chain 229
  • https://sync.inmobi.com/gob?google_gid=CAESEFHDrJ0XGS4485zhfcqU1WI&google_cver=1&google_push=ATf1kGMqJDtdIKOR9uZCkmDPr8UYsoe9JSJ3Wo971HQRsGV3Tq_mdGqPD_mrAAdASzXO4reuFYoRE91aQhaCZ3qopE5pbjMcCMvBIac HTTP 302
  • https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGMqJDtdIKOR9uZCkmDPr8UYsoe9JSJ3Wo971HQRsGV3Tq_mdGqPD_mrAAdASzXO4reuFYoRE91aQhaCZ3qopE5pbjMcCMvBIac
Request Chain 231
  • https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESEAR2Pn3PGbF2daPykWLI7i8&google_cver=1&google_push=ATf1kGNKfZgQLrFsa4lrz6Px4jZA4E_Ln-vP8V0zh4NKzE0QRN_z1jb_dNhdUBJDQEHFviaUBwVsUZBAiZMq8yQ3mHoo5VCvPJWgIA HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEAR2Pn3PGbF2daPykWLI7i8&google_push=ATf1kGNKfZgQLrFsa4lrz6Px4jZA4E_Ln-vP8V0zh4NKzE0QRN_z1jb_dNhdUBJDQEHFviaUBwVsUZBAiZMq8yQ3mHoo5VCvPJWgIA
Request Chain 232
  • https://d5p.de17a.com/cookies/google?google_gid=CAESEKkwuYKJDQnoUL0nNRgGdmw&google_cver=1&google_push=ATf1kGMrR7M3V8Y6Nogd44OdL9kxhz5GZXia9MAzioY5rsXuxegFLjP79eTG_okk1WiAubfxV-scpxgIgj1uR_CQL6L6HHiVS0M3Iw HTTP 302
  • https://d5p.de17a.com/cookies/google;c?google_gid=CAESEKkwuYKJDQnoUL0nNRgGdmw&google_cver=1&google_push=ATf1kGMrR7M3V8Y6Nogd44OdL9kxhz5GZXia9MAzioY5rsXuxegFLjP79eTG_okk1WiAubfxV-scpxgIgj1uR_CQL6L6HHiVS0M3Iw HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGMrR7M3V8Y6Nogd44OdL9kxhz5GZXia9MAzioY5rsXuxegFLjP79eTG_okk1WiAubfxV-scpxgIgj1uR_CQL6L6HHiVS0M3Iw
Request Chain 234
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEMg7EPYG8VmorlOgyMCLRco&google_cver=1&google_push=ATf1kGM5jdZa6opxdYJ3F4D2tWdNvLxtBsfd3bKBwvZGNwBWaNwjcwWhVhcLqzmjXaq1UeLXEqVLgft__e0hAS-tHRHzH1k0gZU6BQ HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEMg7EPYG8VmorlOgyMCLRco&google_cver=1&google_push=ATf1kGM5jdZa6opxdYJ3F4D2tWdNvLxtBsfd3bKBwvZGNwBWaNwjcwWhVhcLqzmjXaq1UeLXEqVLgft__e0hAS-tHRHzH1k0gZU6BQ&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=dSD5l0uaQqaENtaMD40_Bw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGM5jdZa6opxdYJ3F4D2tWdNvLxtBsfd3bKBwvZGNwBWaNwjcwWhVhcLqzmjXaq1UeLXEqVLgft__e0hAS-tHRHzH1k0gZU6BQ
Request Chain 235
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDFf3RQhKR9EG6CFBIoyVRo&google_cver=1&google_push=ATf1kGMaGIFdx_zqOQMbs2QL3ESW3DdvtwOwgKOMUzR2ADAM3Rp76HISDwGnkKFwq0mShdgfHpuxEXTYavluE9Tr2lgr4pl85o_9 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEpDNTM5QlgtQS1MUTEz&google_push=ATf1kGMaGIFdx_zqOQMbs2QL3ESW3DdvtwOwgKOMUzR2ADAM3Rp76HISDwGnkKFwq0mShdgfHpuxEXTYavluE9Tr2lgr4pl85o_9
Request Chain 236
  • https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEA0Qs9U_nh6cwrKW8vQMcW4&google_cver=1&google_push=ATf1kGMr0TIEK77uEVM0hyttaBHofj0HmNP83vq1gZsHQ6DrlhW_kd4nMVtXygYRnI-7QRWaglr0hjvQpLNiYIZ2NPlSMT6DvKqSvg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGMr0TIEK77uEVM0hyttaBHofj0HmNP83vq1gZsHQ6DrlhW_kd4nMVtXygYRnI-7QRWaglr0hjvQpLNiYIZ2NPlSMT6DvKqSvg
Request Chain 237
  • https://sync.teads.tv/um?eid=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEOmwCr4GE6j5IzB91hLkF1Y&google_cver=1&google_push=ATf1kGOK8SHMEMy_qa6HGdtBNTjMvgmpFpWJ4n49Md0hy9BI3vKmzHAS7AeP2vb6ScQAlwFls6NXdAzzKxGExy4fepL019gaNMggE0k HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=ATf1kGOK8SHMEMy_qa6HGdtBNTjMvgmpFpWJ4n49Md0hy9BI3vKmzHAS7AeP2vb6ScQAlwFls6NXdAzzKxGExy4fepL019gaNMggE0k HTTP 302
  • https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Request Chain 239
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 240
  • https://www.google.com/pagead/drt/ui HTTP 302
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Request Chain 253
  • https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEK49SuFDrDuOviPm1Wax20g&google_cver=1&google_push=ATf1kGM_XqDI59rrJ1jSNxePPwBwmYxLmM0HuvHki_4aZgGlleCroUZl5CGYPL4rtwlc4z8mSkkmHTk9hfZhUj-A9GBBFgDCjsGR HTTP 302
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEK49SuFDrDuOviPm1Wax20g&google_cver=1&google_push=ATf1kGM_XqDI59rrJ1jSNxePPwBwmYxLmM0HuvHki_4aZgGlleCroUZl5CGYPL4rtwlc4z8mSkkmHTk9hfZhUj-A9GBBFgDCjsGR HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=M054Snk3SGsxUWRBb2U1&google_gid=CAESEK49SuFDrDuOviPm1Wax20g&google_cver=1&google_push=ATf1kGM_XqDI59rrJ1jSNxePPwBwmYxLmM0HuvHki_4aZgGlleCroUZl5CGYPL4rtwlc4z8mSkkmHTk9hfZhUj-A9GBBFgDCjsGR
Request Chain 254
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEG0Mex24B1Ko7ViBD-xfHpg&google_cver=1&google_push=ATf1kGOtGyNtrme1U10XIdflTBSxqq_mCuXXpEIV_IaKz2YHcUwwBbCHINcqCtWgWc2pmViFV9cbGVjPCiN3AI2LNGu598leZF-r HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGOtGyNtrme1U10XIdflTBSxqq_mCuXXpEIV_IaKz2YHcUwwBbCHINcqCtWgWc2pmViFV9cbGVjPCiN3AI2LNGu598leZF-r&google_hm=eS14QlJLX1lORTJwR1o0OXdEcEN2WmdwM0RqcDZGemxvNH5B
Request Chain 255
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEA7idbSptvnTrW6GQwHnDPM&google_cver=1&google_push=ATf1kGN7Glhc7NGZYwOJFIQj8lZNQ4jSodAhYKb-2MYMlBDiDHlIWdN29eWDgwlBZmTn775Je9-ymavCK5HB7MQklF_ldDSZ-gOr HTTP 302
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEA7idbSptvnTrW6GQwHnDPM&google_cver=1&google_push=ATf1kGN7Glhc7NGZYwOJFIQj8lZNQ4jSodAhYKb-2MYMlBDiDHlIWdN29eWDgwlBZmTn775Je9-ymavCK5HB7MQklF_ldDSZ-gOr&rdf=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=JmVRfPtNSQW_bx3qTqNciw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGN7Glhc7NGZYwOJFIQj8lZNQ4jSodAhYKb-2MYMlBDiDHlIWdN29eWDgwlBZmTn775Je9-ymavCK5HB7MQklF_ldDSZ-gOr
Request Chain 256
  • https://match.360yield.com/match/ebda?google_gid=CAESEAubchAGfiybN-_znYEJCrI&google_cver=1&google_push=ATf1kGNuoil6vYEajmOdkaBmDlykToa2E4cGnuivBt3W8tTvw47sxRbrQFSJRjuIIiQxe5TzC5N9402Jdw0OQ4lxjJSQoEgZE5s HTTP 302
  • https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEAubchAGfiybN-_znYEJCrI&google_cver=1&google_push=ATf1kGNuoil6vYEajmOdkaBmDlykToa2E4cGnuivBt3W8tTvw47sxRbrQFSJRjuIIiQxe5TzC5N9402Jdw0OQ4lxjJSQoEgZE5s HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=uac6qD-HRKOXN8fMj7mMtQ&google_push=ATf1kGNuoil6vYEajmOdkaBmDlykToa2E4cGnuivBt3W8tTvw47sxRbrQFSJRjuIIiQxe5TzC5N9402Jdw0OQ4lxjJSQoEgZE5s
Request Chain 257
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEJsvoTayVZw9W_A8sd6Bpqg&google_cver=1&google_push=ATf1kGMbJkDEAc5vVJAeFufUioO0Ajv1vgQ1PAvmjAoBCnIvn4GslQIENK9C1CegB1XS_T_-MC7SmqyQBoLF4KHbsTKMxxFxBJeW HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-49bea114-ddba-49a5-86ec-f45632124bba-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DATf1kGMbJkDEAc5vVJAeFufUioO0Ajv1vgQ1PAvmjAoBCnIvn4GslQIENK9C1CegB1XS_T_-MC7SmqyQBoLF4KHbsTKMxxFxBJeW%26google_hm%3DA0m-oRTdukmlhuz0VjISS7o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGMbJkDEAc5vVJAeFufUioO0Ajv1vgQ1PAvmjAoBCnIvn4GslQIENK9C1CegB1XS_T_-MC7SmqyQBoLF4KHbsTKMxxFxBJeW&google_hm=A0m-oRTdukmlhuz0VjISS7o
Request Chain 258
  • https://sync.inmobi.com/gob?google_gid=CAESEIAo0okaXFxo9zc5TkB2KaQ&google_cver=1&google_push=ATf1kGPlsp3kgw3JzDbEJYcJ54RJlppZqX7_Y4YhXCdWzbuWsZmBzz-EyFYNnc7XjnLa7ACS58uP21P6DW9VPbTsmR05qbSa8-xfLg HTTP 302
  • https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGPlsp3kgw3JzDbEJYcJ54RJlppZqX7_Y4YhXCdWzbuWsZmBzz-EyFYNnc7XjnLa7ACS58uP21P6DW9VPbTsmR05qbSa8-xfLg
Request Chain 268
  • https://cdn.retailads.net/tb.php?t=150337V2172132532M&subid=24394400004294500951389012367005&ra_cnt_active=1&ra_cnt=1 HTTP 302
  • https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=2818862324
Request Chain 293
  • https://cdn.retailads.net/tb.php?t=150337V2172132532M&subid=75958800006171300951389012367030&ra_cnt_active=1&ra_cnt=1 HTTP 302
  • https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=2818862325
Request Chain 309
  • https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEHqSZukttyvxROyP0mX5OZQ&google_cver=1&google_push=ATf1kGP77wggCPGEnB35xAlG-mzhsjIcnz0bGtUADNg1l9omiXKA9MuDlrgTb2e_qiuEYhcnK2IiWzTpJdCW1lNxxpyMyPvBufAr HTTP 302
  • https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEHqSZukttyvxROyP0mX5OZQ&google_cver=1&google_push=ATf1kGP77wggCPGEnB35xAlG-mzhsjIcnz0bGtUADNg1l9omiXKA9MuDlrgTb2e_qiuEYhcnK2IiWzTpJdCW1lNxxpyMyPvBufAr HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjQyNjE3MjY0MTI0MDU5MjE0OQ&google_push=ATf1kGP77wggCPGEnB35xAlG-mzhsjIcnz0bGtUADNg1l9omiXKA9MuDlrgTb2e_qiuEYhcnK2IiWzTpJdCW1lNxxpyMyPvBufAr
Request Chain 310
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%25253A%25252F%25252Fimage8.pubmatic.com%25252FAdServer%25252FImgSync%25253Fsec%25253D1%252526p%25253D156578%252526mpc%25253D4%252526fp%25253D1%252526pu%25253Dhttps%2525253A%2525252F%2525252Fimage4.pubmatic.com%2525252FAdServer%2525252FSPug%2525253Fp%2525253D156578%25252526sc%2525253D1&google_gid=CAESEBPrgPz30NDMOC1kg20SWmg&google_cver=1&google_push=ATf1kGOYH6R-KVW7-vC3-JiRgLhespGySaksAReWrEAiTFLIDrEjmW7sWmEvczortvkyBt0qOQzU-uZgVWQRC9akJOKzYzbH65U1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WKr6BDP-Rq6qIc1XsD0i6g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGOYH6R-KVW7-vC3-JiRgLhespGySaksAReWrEAiTFLIDrEjmW7sWmEvczortvkyBt0qOQzU-uZgVWQRC9akJOKzYzbH65U1
Request Chain 311
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEP2YPXv-m3bwo5qegap0uXk&google_cver=1&google_push=ATf1kGPwO69tzDiPEqYgzGuBct4qaFfBv7V6r-8R5c5NzLxNpfdxGlbttcF_7tUh9K3p4weI_oPww3GyrpPjQm6fVr-0Ql-JpKsR HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGPwO69tzDiPEqYgzGuBct4qaFfBv7V6r-8R5c5NzLxNpfdxGlbttcF_7tUh9K3p4weI_oPww3GyrpPjQm6fVr-0Ql-JpKsR
Request Chain 312
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEKnGbdxjeBwZd_dJxOspSj0&google_cver=1&google_push=ATf1kGOY2fVc-wJH-6KtqTlkKk_Y3SlZqZyeQAGlpw4OOHmU6AuQMqc2gWsuRFRphBPWdX871qDFZqcfNFIkCP7baZq8qkfHt6X8 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-49bea114-ddba-49a5-86ec-f45632124bba-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DATf1kGOY2fVc-wJH-6KtqTlkKk_Y3SlZqZyeQAGlpw4OOHmU6AuQMqc2gWsuRFRphBPWdX871qDFZqcfNFIkCP7baZq8qkfHt6X8%26google_hm%3DA0m-oRTdukmlhuz0VjISS7o HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGOY2fVc-wJH-6KtqTlkKk_Y3SlZqZyeQAGlpw4OOHmU6AuQMqc2gWsuRFRphBPWdX871qDFZqcfNFIkCP7baZq8qkfHt6X8&google_hm=A0m-oRTdukmlhuz0VjISS7o
Request Chain 313
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEP2-VqpIgGqQgeHipb5Z82I&google_cver=1&google_push=ATf1kGNyrFFh1842hLMfAgYzThYa9aktA0Q95TDD91BDXzCfhuC6rfF8Qp95xD4oOV5XwNIA2KCMY0q9Qnhk08Jtih-5HIUVNUQ HTTP 302
  • https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=ATf1kGNyrFFh1842hLMfAgYzThYa9aktA0Q95TDD91BDXzCfhuC6rfF8Qp95xD4oOV5XwNIA2KCMY0q9Qnhk08Jtih-5HIUVNUQ&google_gid=CAESEP2-VqpIgGqQgeHipb5Z82I HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzA2ODQzMTAxNDE0MDM0ODc0OTIxNA%3D%3D&google_push=ATf1kGNyrFFh1842hLMfAgYzThYa9aktA0Q95TDD91BDXzCfhuC6rfF8Qp95xD4oOV5XwNIA2KCMY0q9Qnhk08Jtih-5HIUVNUQ
Request Chain 314
  • https://sync.teads.tv/um?eid=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEMs85DogOzTUqvkp4GbVvWA&google_cver=1&google_push=ATf1kGMl0n8E2uYB5_NbzNlNvm4iqmVnzA6WJdwmqoToJKtMw-1AmW1IF0TyDW5eyKJV6bccK3PuPCDXPSHSp71JK_JuwFalEauS HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=ATf1kGMl0n8E2uYB5_NbzNlNvm4iqmVnzA6WJdwmqoToJKtMw-1AmW1IF0TyDW5eyKJV6bccK3PuPCDXPSHSp71JK_JuwFalEauS HTTP 302
  • https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Request Chain 333
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEKY-0yslzkXLZGu4kTYAHh0&google_cver=1&google_push=ATf1kGNAthQhogJcsy8IMpYhFbLkT6SW-MHRhOavS-CGfzv9fSk3VPvtUNFY3hNhKjClxOBrGFhIgatsRwdRhmuWrCB0RGqhl1LzO9E HTTP 302
  • https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ATf1kGNAthQhogJcsy8IMpYhFbLkT6SW-MHRhOavS-CGfzv9fSk3VPvtUNFY3hNhKjClxOBrGFhIgatsRwdRhmuWrCB0RGqhl1LzO9E&google_hm=DA921SCXJnTPBFq4A_sVUA
Request Chain 334
  • https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEKuR8bHHwASmsenc_Plbe0k&google_cver=1&google_push=ATf1kGPGw5qbEBAZxLU0fzknLY2uE4_xfYNjxB3z4sIaXFXj1qtIZjs9UOdsVlKwCtUMd50WvtcXsA9Snx5CvaIggP2Im0m2aRKIbg HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=M054Snk3SGsxUWRBb2U1&google_gid=CAESEKuR8bHHwASmsenc_Plbe0k&google_cver=1&google_push=ATf1kGPGw5qbEBAZxLU0fzknLY2uE4_xfYNjxB3z4sIaXFXj1qtIZjs9UOdsVlKwCtUMd50WvtcXsA9Snx5CvaIggP2Im0m2aRKIbg
Request Chain 335
  • https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEGtHSCIBAMISum6zw62rBdk&google_cver=1&google_push=ATf1kGM85gkmSEdNWfpROOGxr0FnJT2KimkGtsPgjkZWXatSLzZt1A3OrzxwK9sRl0Z2vAmc6iuEXU3m7Aeuwkt7eO7UNIP42rIJOdQ HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=8ZhkmOAmTgGpXGsPjTC64w&google_push=ATf1kGM85gkmSEdNWfpROOGxr0FnJT2KimkGtsPgjkZWXatSLzZt1A3OrzxwK9sRl0Z2vAmc6iuEXU3m7Aeuwkt7eO7UNIP42rIJOdQ

365 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request 6x69807j0b5.html
pcloak.blob.core.windows.net/web/
1 KB
2 KB
Document
General
Full URL
https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.60.220.36 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
d469330093a2cebd898628a339df6abaf5edcb89e85769ff79840371195a7d1f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Content-Length
1318
Content-MD5
+Dz/d7Mp2GQfilgWrAkqiw==
Content-Type
text/html
Date
Mon, 26 Jun 2023 00:47:30 GMT
ETag
0x8DB5ED0599CC10C
Last-Modified
Sat, 27 May 2023 16:35:15 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-blob-type
BlockBlob
x-ms-lease-status
unlocked
x-ms-request-id
2923fc71-501e-0041-7cc7-a71ae9000000
x-ms-version
2009-09-19
jquery.min.js
pcloak.blob.core.windows.net/web/
0
0
Script
General
Full URL
https://pcloak.blob.core.windows.net/web/jquery.min.js
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.60.220.36 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-request-id
2923fcfd-501e-0041-76c7-a71ae9000000
Date
Mon, 26 Jun 2023 00:47:30 GMT
x-ms-version
2009-09-19
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-Length
215
Content-Type
application/xml
cloakan.js
pcloak.blob.core.windows.net/web/
308 B
717 B
Script
General
Full URL
https://pcloak.blob.core.windows.net/web/cloakan.js
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.60.220.36 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
4651fd93f167c3620b534c30bc23ae2a2e7cf742621d8e6d12553c09c388284a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Mon, 26 Jun 2023 00:47:31 GMT
Last-Modified
Mon, 13 Jun 2022 14:36:49 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
zPiKctHo6j8i1UGOFPpInw==
ETag
0x8DA4D4A263C11C2
Content-Type
text/javascript
x-ms-request-id
2923fe1b-501e-0041-6dc7-a71ae9000000
x-ms-version
2009-09-19
Content-Length
308
style.css
pcloak.blob.core.windows.net/web/
166 B
568 B
Stylesheet
General
Full URL
https://pcloak.blob.core.windows.net/web/style.css
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.60.220.36 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
cf906196a7c1414e11983955e101a051d55a864f2bc9fd52a453d952d92fd9b5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Mon, 26 Jun 2023 00:47:30 GMT
Last-Modified
Mon, 13 Jun 2022 14:36:49 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Content-MD5
9ruAIrm4XHnQO3/sM8J0AQ==
ETag
0x8DA4D4A26527CA0
Content-Type
text/css
x-ms-request-id
2923fd8c-501e-0041-74c7-a71ae9000000
x-ms-version
2009-09-19
Content-Length
166
px.php
www.cloakan.co/
743 B
681 B
XHR
General
Full URL
https://www.cloakan.co/px.php?id=6x69807j0b5
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
77.245.159.14 , Turkey, ASN42868 (NIOBEBILISIMHIZMETLERI, TR),
Reverse DNS
stilgar.wlsrv.com
Software
LiteSpeed / PHP/7.3.33
Resource Hash
120fdf7c1e8de286b8c6ad005bd52d7b3d71cfa17bd6d1f72d023fe952d03708

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pcloak.blob.core.windows.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:31 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.3.33
vary
Accept-Encoding,User-Agent
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
content-length
404
nv.php
www.cloakan.co/
232 B
385 B
Script
General
Full URL
https://www.cloakan.co/nv.php?id=6x69807j0b5-m
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/cloakan.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
77.245.159.14 , Turkey, ASN42868 (NIOBEBILISIMHIZMETLERI, TR),
Reverse DNS
stilgar.wlsrv.com
Software
LiteSpeed / PHP/7.3.33
Resource Hash
9cacc351a59879d938ef01e274eca7f341deaaa666237a3de94737ccc05a4b86

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pcloak.blob.core.windows.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:32 GMT
content-encoding
br
server
LiteSpeed
x-powered-by
PHP/7.3.33
vary
Accept-Encoding,User-Agent
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
content-length
112
/
ye-mek.net/ Frame 1DCE
77 KB
77 KB
Document
General
Full URL
https://ye-mek.net/
Requested by
Host: www.cloakan.co
URL: https://www.cloakan.co/nv.php?id=6x69807j0b5-m
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
94.138.206.83 , Turkey, ASN49126 (AS49126, TR),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
87553692241e0fb8a6deffb8db12e875a48d6408ac236b29f57840a012eb563c

Request headers

Referer
https://pcloak.blob.core.windows.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-cache
content-length
78773
content-type
text/html; charset=utf-8
date
Mon, 26 Jun 2023 00:47:31 GMT
expires
-1
pragma
no-cache
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
x-powered-by-plesk
PleskWin
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/1.9.1/ Frame 1DCE
90 KB
33 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Thu, 22 Jun 2023 17:18:53 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
286119
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
33018
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 21 Jun 2024 17:18:53 GMT
yemeknet.js
ye-mek.net/js/ Frame 1DCE
10 KB
11 KB
Script
General
Full URL
https://ye-mek.net/js/yemeknet.js?v=1
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
94.138.206.83 , Turkey, ASN49126 (AS49126, TR),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
613b97a3f938c5185dc5fcb46ec9c9488f460fdf8a9765eea9f05aebe46a0c50

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-powered-by-plesk
PleskWin
date
Mon, 26 Jun 2023 00:47:31 GMT
last-modified
Tue, 20 Aug 2019 13:15:54 GMT
server
Microsoft-IIS/10.0
etag
"0a144655957d51:0"
x-powered-by
ASP.NET
content-type
application/javascript
cache-control
max-age=691200
accept-ranges
bytes
content-length
10691
maincss.css
cdn.ye-mek.net/ Frame 1DCE
40 KB
12 KB
Stylesheet
General
Full URL
https://cdn.ye-mek.net/maincss.css?v=434
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
5804cd3bfdf7f7b00ae1f2beef50b9ac7bbdcadcb47e8c3454e8609a52096b92

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
content-encoding
gzip
x-cache
HIT
x-77-cache
HIT
x-age
5931050
x-accel-date
1681809402
x-77-nzt
AcO1rw7HiVH/KoBaAA
x-accel-expires
@1713345402
last-modified
Tue, 24 Nov 2020 00:00:32 GMT
server
CDN77-Turbo
etag
W/"5fbc4d20-9e5b"
x-77-nzt-ray
9083393055268b8124e098649f027620
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
js
www.googletagmanager.com/gtag/ Frame 1DCE
121 KB
47 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-38733763-1
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
fce1426766d7b9cadc525e12dd5965153a69ec29ac827fcdbf525a6f50c84fdf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:32 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
47885
x-xss-protection
0
last-modified
Mon, 26 Jun 2023 00:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 26 Jun 2023 00:47:32 GMT
WebResource.axd
ye-mek.net/ Frame 1DCE
23 KB
23 KB
Script
General
Full URL
https://ye-mek.net/WebResource.axd?d=YeedoL8dFzo5gymDuarFXngFaaXpLN8jYlixY-HzMyr_r8lEwXsCQefYQgi2kFzYfrVacpu_9us1eVTBWQamZuI0ynrH9LDfafZF-A5wZF41&t=637811837229275428
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
94.138.206.83 , Turkey, ASN49126 (AS49126, TR),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
40732e9dcfa704cf615e4691bb07aecfd1cc5e063220a46e4a7ff6560c77f5db

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-powered-by-plesk
PleskWin
date
Mon, 26 Jun 2023 00:47:31 GMT
last-modified
Wed, 23 Feb 2022 00:28:42 GMT
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-type
application/x-javascript
cache-control
public
content-length
23063
expires
Sat, 04 May 2024 23:14:43 GMT
searchButton.png
cdn.ye-mek.net/App_UI/Img/ Frame 1DCE
542 B
894 B
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/searchButton.png
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
324a9c1f26949a62b89c5846de23826737bf3b14443e3f5a969b1799604a0588

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5931049
x-accel-date
1681809403
content-length
542
x-77-nzt
AcO1rw6zf1j/KYBaAA
x-accel-expires
@1713345403
last-modified
Sat, 22 Oct 2022 20:00:57 GMT
server
CDN77-Turbo
etag
"63544bf9-21e"
x-77-nzt-ray
9083393055268b8124e09864e0549420
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
ara.png
cdn.ye-mek.net/App_UI/Img/ Frame 1DCE
2 KB
2 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/ara.png
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
3ed559a849229d0ba1622b39b2343f2307a91aae5bab1f08e55c89e50874c980

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5931040
x-accel-date
1681809412
content-length
1651
x-77-nzt
AcO1rw4C6N3/IIBaAA
x-accel-expires
@1713345412
last-modified
Mon, 14 May 2018 22:41:08 GMT
server
CDN77-Turbo
etag
"5afa1084-673"
x-77-nzt-ray
9083393055268b8124e09864bdb09f21
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cilekli-dondurma-resimli-yemek-tarifi(16).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2023/06/ Frame 1DCE
14 KB
15 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2023/06/cilekli-dondurma-resimli-yemek-tarifi(16).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
f8fd679d9f44bca3f206280b3e5601ccbd0a22d9d46be815a98859729a6e57f8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
3756
x-accel-date
1687736696
content-length
14588
x-77-nzt
AcO1rw6hoyj/rA4AAA
x-accel-expires
@1719272696
last-modified
Sun, 25 Jun 2023 23:22:33 GMT
server
CDN77-Turbo
etag
"6498cc39-38fc"
x-77-nzt-ray
9083393055268b8124e09864a73aad21
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
kaburga-misir-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2023/06/ Frame 1DCE
17 KB
17 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2023/06/kaburga-misir-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
60553b12e1cecec323684ec8158d0fdcc8cc22ae5ee712fc104390e70637df74

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
91765
x-accel-date
1687648687
content-length
17278
x-77-nzt
AcO1rw7YDlX/dWYBAA
x-accel-expires
@1719184687
last-modified
Sat, 24 Jun 2023 23:00:33 GMT
server
CDN77-Turbo
etag
"64977591-437e"
x-77-nzt-ray
9083393055268b8124e09864d59fcc22
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
bezelyeli-enginar-yemegi-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2023/06/ Frame 1DCE
13 KB
14 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2023/06/bezelyeli-enginar-yemegi-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
b28212f4baadf3c72472e06c83eeb9f674659bc3390f8279644cc35c2b3cca60

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
177146
x-accel-date
1687563306
content-length
13577
x-77-nzt
AcO1rw6tMU7/+rMCAA
x-accel-expires
@1719099306
last-modified
Fri, 23 Jun 2023 23:12:58 GMT
server
CDN77-Turbo
etag
"649626fa-3509"
x-77-nzt-ray
9083393055268b8124e098641a2ad322
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
cilek-kompostosu-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2023/06/ Frame 1DCE
13 KB
13 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2023/06/cilek-kompostosu-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
1c850554971fd0815ab530813c41947b41fd5485122fcc6ddad7e52554ca4c5f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
266217
x-accel-date
1687474235
content-length
13316
x-77-nzt
AcO1rw5lvlD/6Q8EAA
x-accel-expires
@1719010235
last-modified
Thu, 22 Jun 2023 22:09:37 GMT
server
CDN77-Turbo
etag
"6494c6a1-3404"
x-77-nzt-ray
9083393055268b8124e09864f22ed822
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
sebzeli-tencere-kebabi-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2022/04/ Frame 1DCE
16 KB
16 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2022/04/sebzeli-tencere-kebabi-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
e5e28786e68ee9365dbc5f4b39fa49358367e4371322c7bfc70f7b016e7cfed3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5930432
x-accel-date
1681810020
content-length
16006
x-77-nzt
AcO1rw6HkDP/wH1aAA
x-accel-expires
@1713346020
last-modified
Wed, 13 Apr 2022 23:53:28 GMT
server
CDN77-Turbo
etag
"62576278-3e86"
x-77-nzt-ray
9083393055268b8124e09864bdc9e122
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
firinda-karnabahar-resimli-yemek-tarifi(16).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2019/10/ Frame 1DCE
13 KB
13 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2019/10/firinda-karnabahar-resimli-yemek-tarifi(16).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
ea934cb5f0a09a318af075c2d81d855c697e7773e7b7b377aab5e4ba00ccf955

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5929893
x-accel-date
1681810559
content-length
13270
x-77-nzt
AcO1rw7nFHf/pXtaAA
x-accel-expires
@1713346559
last-modified
Tue, 29 Oct 2019 20:59:39 GMT
server
CDN77-Turbo
etag
"5db8a83b-33d6"
x-77-nzt-ray
9083393055268b8124e098649604f822
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
seftali-kebabi-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2015/04/ Frame 1DCE
13 KB
14 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2015/04/seftali-kebabi-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
caba686e8a0a57536805240ee1ac6b56d9f5b5add5a8bf88fd6ff83d8a860b63

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5930913
x-accel-date
1681809539
content-length
13794
x-77-nzt
AcO1rw6obJz/oX9aAA
x-accel-expires
@1713345539
last-modified
Wed, 01 May 2019 22:40:09 GMT
server
CDN77-Turbo
etag
"5cca2049-35e2"
x-77-nzt-ray
9083393055268b8124e098640e7a0023
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
kc4b1ymalc4b1-kibrit-kebabc4b1-resimli-yemek-tarifi-20.jpg
cdn.ye-mek.net/App_UI/Img/out/270/2012/09/ Frame 1DCE
14 KB
14 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2012/09/kc4b1ymalc4b1-kibrit-kebabc4b1-resimli-yemek-tarifi-20.jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
dacdec6aa88bb9571d309c295248ee5b202de625eba8aaa232f863ad9ba9fed5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5927237
x-accel-date
1681813215
content-length
14293
x-77-nzt
AcO1rw7ifTX/RXFaAA
x-accel-expires
@1713349215
last-modified
Wed, 01 May 2019 22:05:06 GMT
server
CDN77-Turbo
etag
"5cca1812-37d5"
x-77-nzt-ray
9083393055268b8124e09864be280923
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
kabak-cintmesi-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2021/10/ Frame 1DCE
15 KB
16 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2021/10/kabak-cintmesi-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
063f8f4e188f3fa9e65377bc04b667d77880ee000d6704882a8cfd0a61503421

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5930656
x-accel-date
1681809796
content-length
15542
x-77-nzt
AcO1rw6aJT//oH5aAA
x-accel-expires
@1713345796
last-modified
Sat, 16 Oct 2021 22:36:04 GMT
server
CDN77-Turbo
etag
"616b53d4-3cb6"
x-77-nzt-ray
9083393055268b8124e09864b0071123
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
anadolu-corbasi-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2020/12/ Frame 1DCE
14 KB
14 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2020/12/anadolu-corbasi-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
1c67a7d5bd4eeea4dac61fdb402693f5ecce11630369d396bd6ec60516bda492

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5929410
x-accel-date
1681811042
content-length
14404
x-77-nzt
AcO1rw72Hof/wnlaAA
x-accel-expires
@1713347042
last-modified
Tue, 01 Dec 2020 00:12:50 GMT
server
CDN77-Turbo
etag
"5fc58a82-3844"
x-77-nzt-ray
9083393055268b8124e09864c9dd1323
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
mulayim-corbasi-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2020/05/ Frame 1DCE
11 KB
11 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2020/05/mulayim-corbasi-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
e99b7c0ba127e7fd8f4112c7c8fbc3f0aa0582d4f33c703d7651eb6375d9b36a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5930897
x-accel-date
1681809555
content-length
10929
x-77-nzt
AcO1rw44sd//kX9aAA
x-accel-expires
@1713345555
last-modified
Fri, 01 May 2020 23:34:23 GMT
server
CDN77-Turbo
etag
"5eacb1ff-2ab1"
x-77-nzt-ray
9083393055268b8124e09864f1341c23
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
saksi-kebabi-resimli-yemek-tarifi(16).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2013/08/ Frame 1DCE
14 KB
14 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2013/08/saksi-kebabi-resimli-yemek-tarifi(16).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
27b521443caa2567c561c9a2bd377929f40cf7fb68113ccbc4b42669c6841e79

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5930898
x-accel-date
1681809554
content-length
13931
x-77-nzt
AcO1rw6zxBz/kn9aAA
x-accel-expires
@1713345554
last-modified
Wed, 01 May 2019 22:17:07 GMT
server
CDN77-Turbo
etag
"5cca1ae3-366b"
x-77-nzt-ray
9083393055268b8124e0986421328f23
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
lokanta-usulu-kavurma-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2023/04/ Frame 1DCE
15 KB
15 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2023/04/lokanta-usulu-kavurma-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
27b62f116d3964364a5054f01a59e237c576d204d47cded37d221f39beed4397

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5930861
x-accel-date
1681809591
content-length
15361
x-77-nzt
AcO1rw4JhIH/bX9aAA
x-accel-expires
@1713345591
last-modified
Wed, 12 Apr 2023 22:36:34 GMT
server
CDN77-Turbo
etag
"64373272-3c01"
x-77-nzt-ray
9083393055268b8124e09864b6b09a23
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
salcali-pirincli-sulu-kofte-resimli-yemek-tarifi(16).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2014/08/ Frame 1DCE
13 KB
14 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2014/08/salcali-pirincli-sulu-kofte-resimli-yemek-tarifi(16).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
b1701639174cb872a535071c10f17980f509ef1588d3a06bc7f8aad5ef0d25aa

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5928706
x-accel-date
1681811746
content-length
13484
x-77-nzt
AcO1rw6vvsb/AndaAA
x-accel-expires
@1713347746
last-modified
Wed, 01 May 2019 22:27:36 GMT
server
CDN77-Turbo
etag
"5cca1d58-34ac"
x-77-nzt-ray
9083393055268b8124e09864916ca223
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
mantar-soslu-kofte-resimli-yemek-tarifi(20).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2022/04/ Frame 1DCE
14 KB
15 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2022/04/mantar-soslu-kofte-resimli-yemek-tarifi(20).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
63b3428dab8c9858bfec0fdd1766207549e01494b99c89a230937546c926592d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5930277
x-accel-date
1681810175
content-length
14751
x-77-nzt
AcO1rw5BnSn/JX1aAA
x-accel-expires
@1713346175
last-modified
Thu, 21 Apr 2022 11:59:00 GMT
server
CDN77-Turbo
etag
"62614704-399f"
x-77-nzt-ray
9083393055268b8124e09864b367a423
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
sebzeli-yahni-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2019/11/ Frame 1DCE
11 KB
12 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2019/11/sebzeli-yahni-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
89aaa0ce1877279f39fc4f3451e07fbbbafadc7a46827a4d56e88fcc98a7c3c1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5925258
x-accel-date
1681815194
content-length
11422
x-77-nzt
AcO1rw4q7kb/imlaAA
x-accel-expires
@1713351194
last-modified
Thu, 28 Nov 2019 21:35:18 GMT
server
CDN77-Turbo
etag
"5de03d96-2c9e"
x-77-nzt-ray
9083393055268b8124e09864be47ac23
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
tavuk-kalamar-resimli-yemek-tarifi(16).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2016/06/ Frame 1DCE
14 KB
14 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2016/06/tavuk-kalamar-resimli-yemek-tarifi(16).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
879d5861c9bdf530e2c9a5194305a8753fc7d7a198fbb487d6535c994e82a19f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5929479
x-accel-date
1681810973
content-length
14115
x-77-nzt
AcO1rw7xqDP/B3paAA
x-accel-expires
@1713346973
last-modified
Wed, 01 May 2019 23:00:07 GMT
server
CDN77-Turbo
etag
"5cca24f7-3723"
x-77-nzt-ray
9083393055268b8124e098643cecb823
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
tavuklu-kereviz-yemegi-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2019/10/ Frame 1DCE
12 KB
12 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2019/10/tavuklu-kereviz-yemegi-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
4c6847d6c187314e234ace1a963c78c659d2429c0790444c674b5d72180822bb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-nzt
AcO1rw7V46zB
x-accel-expires
@1719276452
date
Mon, 26 Jun 2023 00:47:32 GMT
x-77-pop
frankfurtDE
last-modified
Wed, 09 Oct 2019 22:00:21 GMT
server
CDN77-Turbo
etag
"5d9e5875-2ef9"
x-77-nzt-ray
9083393055268b8124e09864ab3ac123
x-cache
MISS
content-type
image/jpeg
access-control-allow-origin
*
x-77-cache
MISS
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
12025
tavuk-kroket-resimli-yemek-tarifi(20).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2022/05/ Frame 1DCE
14 KB
15 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2022/05/tavuk-kroket-resimli-yemek-tarifi(20).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
05c72250b7b0da8e896799e32f88440d53848a083665b797629e25bad1bde6fd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5930525
x-accel-date
1681809927
content-length
14613
x-77-nzt
AcO1rw4A0oz/HX5aAA
x-accel-expires
@1713345927
last-modified
Thu, 26 May 2022 23:00:23 GMT
server
CDN77-Turbo
etag
"62900687-3915"
x-77-nzt-ray
9083393055268b8124e09864e253c423
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
tavada-tavuk-sis-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2014/07/ Frame 1DCE
15 KB
16 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2014/07/tavada-tavuk-sis-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
4bff962fb085bc7a7d81b7a59a2dceb2a6dd7f44a6d25af7040fd62f86393a05

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5930963
x-accel-date
1681809489
content-length
15765
x-77-nzt
AcO1rw6ZKO7/039aAA
x-accel-expires
@1713345489
last-modified
Wed, 01 May 2019 22:26:43 GMT
server
CDN77-Turbo
etag
"5cca1d23-3d95"
x-77-nzt-ray
9083393055268b8124e09864c784cb23
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
firinda-mor-lahana-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2023/03/ Frame 1DCE
17 KB
18 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2023/03/firinda-mor-lahana-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
db378770c0af0f809c8d1f0c2dee4c831d85530c768c9ac1960f068cc4895ac5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5928609
x-accel-date
1681811843
content-length
17693
x-77-nzt
AcO1rw4I4mf/oXZaAA
x-accel-expires
@1713347843
last-modified
Wed, 01 Mar 2023 22:18:58 GMT
server
CDN77-Turbo
etag
"63ffcf52-451d"
x-77-nzt-ray
9083393055268b8124e098645c97d323
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
firinda-patlican-graten-resimli-yemek-tarifi(16).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2022/08/ Frame 1DCE
16 KB
16 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2022/08/firinda-patlican-graten-resimli-yemek-tarifi(16).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
3d8139674dae70e3d6825845bd963841ab4ce23d55252685fe8061f6276bdc1e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5930266
x-accel-date
1681810186
content-length
16224
x-77-nzt
AcO1rw5F27n/Gn1aAA
x-accel-expires
@1713346186
last-modified
Thu, 11 Aug 2022 22:25:22 GMT
server
CDN77-Turbo
etag
"62f581d2-3f60"
x-77-nzt-ray
9083393055268b8124e09864499fdc23
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
misir-tempura-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2023/02/ Frame 1DCE
14 KB
14 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2023/02/misir-tempura-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
6003a2f2c3891e74c7e2f6b11f46977551c5543bc59b3f4d11fbdacc7321797e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5930677
x-accel-date
1681809775
content-length
14469
x-77-nzt
AcO1rw7XI9j/tX5aAA
x-accel-expires
@1713345775
last-modified
Mon, 20 Feb 2023 22:19:13 GMT
server
CDN77-Turbo
etag
"63f3f1e1-3885"
x-77-nzt-ray
9083393055268b8124e098645828e923
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
kabak-baligi-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2020/06/ Frame 1DCE
16 KB
16 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2020/06/kabak-baligi-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
43531e83c15a96469ab4c9157633196740214b7303c1f34cd46930a3a97bfd8f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5930008
x-accel-date
1681810444
content-length
16514
x-77-nzt
AcO1rw6bztD/GHxaAA
x-accel-expires
@1713346444
last-modified
Thu, 04 Jun 2020 01:09:59 GMT
server
CDN77-Turbo
etag
"5ed849e7-4082"
x-77-nzt-ray
9083393055268b8124e09864963ff223
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
eristeli-barbunya-corbasi-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2022/06/ Frame 1DCE
13 KB
13 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2022/06/eristeli-barbunya-corbasi-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
e9f4eb06811b8f2c55fe2837c64b600feb5da3ce8f747707a9aa7a4e9ddc5346

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5929401
x-accel-date
1681811051
content-length
13079
x-77-nzt
AcO1rw7a8J//uXlaAA
x-accel-expires
@1713347051
last-modified
Sat, 11 Jun 2022 21:39:47 GMT
server
CDN77-Turbo
etag
"62a50ba3-3317"
x-77-nzt-ray
9083393055268b8124e098645e3ef823
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
sebzeli-mantar-corbasi-resimli-yemek-tarifi(16).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2021/09/ Frame 1DCE
11 KB
11 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2021/09/sebzeli-mantar-corbasi-resimli-yemek-tarifi(16).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
c018d9d9a7c6716218e78a7b9e458a0a31b925d725dd2ab6d21cbd73d3489c8b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5930724
x-accel-date
1681809728
content-length
10831
x-77-nzt
AcO1rw7Fftb/5H5aAA
x-accel-expires
@1713345728
last-modified
Mon, 13 Sep 2021 22:09:29 GMT
server
CDN77-Turbo
etag
"613fcc19-2a4f"
x-77-nzt-ray
9083393055268b8124e0986409630024
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
sutlu-sebze-corbasi-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2022/05/ Frame 1DCE
11 KB
12 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2022/05/sutlu-sebze-corbasi-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
7953fed1425101977e823b0480db597be902d342936bc4c6ce3bb0699c0aa6d4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5930963
x-accel-date
1681809489
content-length
11424
x-77-nzt
AcO1rw4uV6n/039aAA
x-accel-expires
@1713345489
last-modified
Thu, 12 May 2022 22:33:41 GMT
server
CDN77-Turbo
etag
"627d8b45-2ca0"
x-77-nzt-ray
9083393055268b8124e0986469650724
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
eristeli-domates-corbasi-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2015/06/ Frame 1DCE
14 KB
14 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2015/06/eristeli-domates-corbasi-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
840f32948f13a31acb240f2481999e70efe9eabea0d423581bb2e4f9e53aafb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5930204
x-accel-date
1681810248
content-length
13963
x-77-nzt
AcO1rw6lv+f/3HxaAA
x-accel-expires
@1713346248
last-modified
Wed, 01 May 2019 22:44:10 GMT
server
CDN77-Turbo
etag
"5cca213a-368b"
x-77-nzt-ray
9083393055268b8124e0986425a60f24
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
iki-renkli-irmik-tatlisi-resimli-yemek-tarifi(16).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2016/07/ Frame 1DCE
15 KB
16 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2016/07/iki-renkli-irmik-tatlisi-resimli-yemek-tarifi(16).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
4c89e14d3c19403c9d589468af36666cd11ee8147e67018962960b4b4dfc1b01

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5929535
x-accel-date
1681810917
content-length
15612
x-77-nzt
AcO1rw5BkR7/P3paAA
x-accel-expires
@1713346917
last-modified
Wed, 01 May 2019 23:02:34 GMT
server
CDN77-Turbo
etag
"5cca258a-3cfc"
x-77-nzt-ray
9083393055268b8124e0986446231824
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
saray-tatlisi-resimli-yemek-tarifi(16).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2019/04/ Frame 1DCE
11 KB
12 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2019/04/saray-tatlisi-resimli-yemek-tarifi(16).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
6cc106510fe7cd2e3a163255575eebc60d198038a9d2ac7192dc3f42d7a8f9b0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5930961
x-accel-date
1681809491
content-length
11752
x-77-nzt
AcO1rw7iRIj/0X9aAA
x-accel-expires
@1713345491
last-modified
Wed, 01 May 2019 23:46:53 GMT
server
CDN77-Turbo
etag
"5cca2fed-2de8"
x-77-nzt-ray
9083393055268b8124e09864f4011f24
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
ganajli-cikolatali-tart-kek-resimli-yemek-tarifi(20).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2016/01/ Frame 1DCE
17 KB
17 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2016/01/ganajli-cikolatali-tart-kek-resimli-yemek-tarifi(20).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
54b5a96d1e72c83e7f67ed666929ad684643a20eea80c1910e64551dbfcb3a62

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5928502
x-accel-date
1681811950
content-length
17108
x-77-nzt
AcO1rw6hr+j/NnZaAA
x-accel-expires
@1713347950
last-modified
Wed, 01 May 2019 22:53:08 GMT
server
CDN77-Turbo
etag
"5cca2354-42d4"
x-77-nzt-ray
9083393055268b8124e0986499fe2424
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
pekmezli-irmik-helvasi-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2021/07/ Frame 1DCE
12 KB
12 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2021/07/pekmezli-irmik-helvasi-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
738c833b1971e8ca2544bb7b541c638802c160f45755ad59245de6591c0eaaed

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5927612
x-accel-date
1681812840
content-length
12426
x-77-nzt
AcO1rw7HY3f/vHJaAA
x-accel-expires
@1713348840
last-modified
Mon, 05 Jul 2021 10:37:45 GMT
server
CDN77-Turbo
etag
"60e2e0f9-308a"
x-77-nzt-ray
9083393055268b8124e098646fec2d24
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
kahvaltilik-sos-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2016/08/ Frame 1DCE
14 KB
15 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2016/08/kahvaltilik-sos-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
d036abb9b708f36c43590e94cebe3e17bae3a2cdbc8fa672e3612686241f23b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5920783
x-accel-date
1681819669
content-length
14501
x-77-nzt
AcO1rw6OS2b/D1haAA
x-accel-expires
@1713355669
last-modified
Wed, 01 May 2019 23:03:35 GMT
server
CDN77-Turbo
etag
"5cca25c7-38a5"
x-77-nzt-ray
9083393055268b8124e09864e91e3424
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
simit-pisi-resimli-yemek-tarifi(16).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2021/02/ Frame 1DCE
13 KB
13 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2021/02/simit-pisi-resimli-yemek-tarifi(16).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
abcfc66c4fb4bb9a1493824f5acd764bd8e06bc80a03f7cc2817159b22486ba6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5930661
x-accel-date
1681809791
content-length
13453
x-77-nzt
AcO1rw5QZg7/pX5aAA
x-accel-expires
@1713345791
last-modified
Sun, 07 Feb 2021 23:16:25 GMT
server
CDN77-Turbo
etag
"602074c9-348d"
x-77-nzt-ray
9083393055268b8124e0986401fd4324
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
milfoylu-biber-dolma-sarma-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2015/07/ Frame 1DCE
12 KB
13 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2015/07/milfoylu-biber-dolma-sarma-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
89ed4e12076b5eded37d4463f6fffca0b3f23f5bf60a3981859a8edb28e269b7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5930464
x-accel-date
1681809988
content-length
12652
x-77-nzt
AcO1rw4e/CD/4H1aAA
x-accel-expires
@1713345988
last-modified
Wed, 01 May 2019 22:44:51 GMT
server
CDN77-Turbo
etag
"5cca2163-316c"
x-77-nzt-ray
9083393055268b8124e0986483ce4524
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
yumurta-katlama-resimli-yemek-tarifi(12).jpg
cdn.ye-mek.net/App_UI/Img/out/270/2021/01/ Frame 1DCE
12 KB
13 KB
Image
General
Full URL
https://cdn.ye-mek.net/App_UI/Img/out/270/2021/01/yumurta-katlama-resimli-yemek-tarifi(12).jpg?w=270&h=202
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
23d58172a13a810fa151cb35f5f0bee205d2294327be9d8b7172553719cf3e66

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-nzt
AcO1rw5hbArB
x-accel-expires
@1719276452
date
Mon, 26 Jun 2023 00:47:32 GMT
x-77-pop
frankfurtDE
last-modified
Wed, 20 Jan 2021 23:18:27 GMT
server
CDN77-Turbo
etag
"6008ba43-31bf"
x-77-nzt-ray
9083393055268b8124e098642b515024
x-cache
MISS
content-type
image/jpeg
access-control-allow-origin
*
x-77-cache
MISS
cache-control
public, max-age=31536000
accept-ranges
bytes
content-length
12735
_dmca_premi_badge_5.png
images.dmca.com/Badges/ Frame 1DCE
5 KB
6 KB
Image
General
Full URL
https://images.dmca.com/Badges/_dmca_premi_badge_5.png?ID=da1d399b-5fd3-4da3-b5cd-8af692c19999
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
ad3ee286844c46dba3f0d26e100f508c410b28f52784fbeec2d513ef6c6fda7a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:32 GMT
last-modified
Thu, 02 Jun 2011 03:26:26 GMT
server
Microsoft-IIS/10.0
etag
"8ae3cdbd420cc1:0"
x-powered-by
ASP.NET
x-hw
1687740452.cds320.fr8.hn,1687740452.cds153.fr8.c
content-type
image/png
access-control-allow-origin
*
cache-control
public,max-age=31536000
accept-ranges
bytes
link
<https://www.dmca.com/Badges/_dmca_premi_badge_5.png>; rel="canonical"
content-length
5605
addthis_widget.js
s7.addthis.com/js/300/ Frame 1DCE
56 B
360 B
Script
General
Full URL
https://s7.addthis.com/js/300/addthis_widget.js
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.206.208.114 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-206-208-114.deploy.static.akamaitechnologies.com
Software
Oracle API Gateway /
Resource Hash
f475c34186022ba531ebc8bba97fc10df7e4c3ea854f314a18ab0644c851620d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 26 Jun 2023 00:47:33 GMT
server
Oracle API Gateway
opc-request-id
/2227664DAFA544E05E2D945DFE015FC1/AAF125B666037C433D5EFA0993201281
x-frame-options
sameorigin
vary
Accept-Encoding
content-type
text/javascript
x-distribution
99
x-host
s7.addthis.com
content-length
76
x-xss-protection
1; mode=block
DMCABadgeHelper.min.js
images.dmca.com/Badges/ Frame 1DCE
465 B
585 B
Script
General
Full URL
https://images.dmca.com/Badges/DMCABadgeHelper.min.js
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.139.128.10 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map3.hwcdn.net
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e8021f1a9dad409f7e699457ac334653bf800464df69900237c4de1c29e275d0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:32 GMT
content-encoding
gzip
last-modified
Fri, 21 Jun 2019 20:14:34 GMT
server
Microsoft-IIS/10.0
etag
"26b181f16d28d51:0"
x-powered-by
ASP.NET
x-hw
1687740452.cds320.fr8.hn,1687740452.cds057.fr8.c
content-type
application/javascript
access-control-allow-origin
*
cache-control
public,max-age=31536000
accept-ranges
bytes
link
<https://www.dmca.com/Badges/DMCABadgeHelper.min.js>; rel="canonical"
content-length
395
analytics.js
www.google-analytics.com/ Frame 1DCE
52 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-38733763-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 26 Jun 2023 00:35:22 GMT
last-modified
Mon, 12 Jun 2023 18:23:07 GMT
server
Golfe2
age
730
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20994
expires
Mon, 26 Jun 2023 02:35:22 GMT
outside.js
static.virgul.com/theme/mockups/adcode/ Frame 1DCE
75 KB
26 KB
Script
General
Full URL
https://static.virgul.com/theme/mockups/adcode/outside.js?dts=19534
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software
openresty/1.15.8.3 /
Resource Hash
66413d92e3b48b21f37de7968a4c6ee6dafb956f4963d0557959a3d10db2c492

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
gzip
last-modified
Fri, 23 Jun 2023 06:55:07 GMT
server
openresty/1.15.8.3
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=43200
sdk.js
connect.facebook.net/tr_TR/ Frame 1DCE
3 KB
2 KB
Script
General
Full URL
https://connect.facebook.net/tr_TR/sdk.js
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
cd112948bd1c9837ad3b54daa7afa4e3c009093964a2ccde3110fe48e0c75ec0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 26 Jun 2023 00:47:32 GMT
content-md5
fDn3N6YNeG6+haG+Qmj2Ug==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
1686
x-fb-debug
5RO+T8tTdXS2Eh0JBdaKnNyH9RhNhZSv312uTUre52GL4Oh9g0YvLRPjUnXy3qQHnFweRimyWUmVZYdzqZqGQw==
x-fb-content-md5
d8a16c7e4deedbe955c4ef0b6bd1a9be
cross-origin-opener-policy
same-origin-allow-popups
etag
"c5c528eb772357d2720efbd5f30b4ae2"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
origin-agent-cluster
?0
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin
*
expires
Mon, 26 Jun 2023 00:51:11 GMT
sprite_3.png
cdn.ye-mek.net/grafik/ Frame 1DCE
21 KB
21 KB
Image
General
Full URL
https://cdn.ye-mek.net/grafik/sprite_3.png
Requested by
Host: cdn.ye-mek.net
URL: https://cdn.ye-mek.net/maincss.css?v=434
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6ea0:c700::10 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
ecadacb686d0540a5768dae41d50597a71dfaa8135b90f1371d4bfa266e4e361

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cdn.ye-mek.net/maincss.css?v=434
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-77-pop
frankfurtDE
date
Mon, 26 Jun 2023 00:47:32 GMT
x-cache
HIT
x-77-cache
HIT
x-age
5931050
x-accel-date
1681809402
content-length
21525
x-77-nzt
AcO1rw4kFlz/KoBaAA
x-accel-expires
@1713345402
last-modified
Mon, 14 May 2018 20:55:05 GMT
server
CDN77-Turbo
etag
"5af9f7a9-5415"
x-77-nzt-ray
9083393055268b8124e0986481f25224
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
sdk.js
connect.facebook.net/tr_TR/ Frame 1DCE
307 KB
87 KB
Script
General
Full URL
https://connect.facebook.net/tr_TR/sdk.js?hash=656f41fe7e47ac32ac6b3b0290321414
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/tr_TR/sdk.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
04894c4482c08cb1de75b81d01f59d50d9b415d69a4fddd0f7e49ce7cd533871
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://ye-mek.net/
Origin
https://ye-mek.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
date
Mon, 26 Jun 2023 00:47:32 GMT
content-md5
kir/Q2q69ilqX93V+EKQxA==
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400
content-length
88818
x-fb-debug
QtZp9xwzs3IbGt1syj2fmE5rInzcmaALZZDpUOGeE70QHJvEoffYcMMtVBLJHju1PCmH+UO+XhHfko5OtcpafQ==
x-fb-content-md5
d397e847b162d1800be402fba177d0a8
cross-origin-opener-policy
same-origin-allow-popups
etag
"0eb70f112f926ba57234ccf15a83f801"
vary
Accept-Encoding
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy
accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
timing-allow-origin
*
priority
u=3,i
expires
Mon, 24 Jun 2024 23:56:23 GMT
gpt.js
securepubads.g.doubleclick.net/tag/js/ Frame 1DCE
77 KB
26 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/adcode/outside.js?dts=19534
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
c38f3daeed83c9c8c6c87d5a279880731cedd7aac29d3c5e44d2f6722b6db654
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
26460
x-xss-protection
0
server
cafe
etag
927 / 19534 / m202306200101 / config-hash: 3635630053877940451
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
expires
Mon, 26 Jun 2023 00:47:33 GMT
ads.js
static.virgul.com/theme/mockups/mockups/tracker/imp/collect/adview/ad/ Frame 1DCE
120 B
306 B
Script
General
Full URL
https://static.virgul.com/theme/mockups/mockups/tracker/imp/collect/adview/ad/ads.js
Requested by
Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/adcode/outside.js?dts=19534
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software
openresty/1.15.8.3 /
Resource Hash
d9fd0aeda423bd39a36871759ef7b17dab3d51e5981cd5839103f990b8b9ef60

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
last-modified
Wed, 21 Dec 2022 18:47:42 GMT
server
openresty/1.15.8.3
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=5184000
accept-ranges
bytes
content-length
120
str.html
static.virgul.com/theme/mockups/outside/ Frame 6B93
891 B
1 KB
Document
General
Full URL
https://static.virgul.com/theme/mockups/outside/str.html?v=2
Requested by
Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/adcode/outside.js?dts=19534
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software
openresty/1.15.8.3 /
Resource Hash
2af1b8e91e1ea0f27fab2f6bac1dd1d81867b7a2a8d7cef1084fa39309e0ac6f

Request headers

Referer
https://ye-mek.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
cache-control
max-age=5184000
content-length
891
content-type
text/html
date
Mon, 26 Jun 2023 00:47:33 GMT
last-modified
Wed, 28 Sep 2022 10:07:57 GMT
server
openresty/1.15.8.3
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ Frame 1DCE
138 KB
48 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6593523210010154
Requested by
Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/adcode/outside.js?dts=19534
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
30df855503fd1c0baa970732174d0d9be85866235d99bfd2f2341be57e966a8c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ye-mek.net/
Origin
https://ye-mek.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48327
x-xss-protection
0
server
cafe
etag
17349184329276860129
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 26 Jun 2023 00:47:33 GMT
prebid7.38.0.js
static.virgul.com/theme/mockups/outside/ Frame 1DCE
489 KB
182 KB
Script
General
Full URL
https://static.virgul.com/theme/mockups/outside/prebid7.38.0.js
Requested by
Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/adcode/outside.js?dts=19534
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software
openresty/1.15.8.3 /
Resource Hash
cff57bb539a961e5816127eb4b662175d6a1c92917effe0f943de85c35911101

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
gzip
last-modified
Mon, 27 Mar 2023 14:56:06 GMT
server
openresty/1.15.8.3
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=5184000
apstag.js
c.amazon-adsystem.com/aax2/ Frame 1DCE
236 KB
58 KB
Script
General
Full URL
https://c.amazon-adsystem.com/aax2/apstag.js
Requested by
Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/adcode/outside.js?dts=19534
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.87.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-87-107.muc50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
dbc211260f3fb81e545fbebe8be8c367ebe670a585e60e1ec58524c06723ecbc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:34:58 GMT
content-encoding
gzip
via
1.1 b3fce8903671f8346e7a6a138d2d4610.cloudfront.net (CloudFront), 1.1 2d469870f5a756385a1eb37325629a1e.cloudfront.net (CloudFront)
last-modified
Thu, 15 Jun 2023 18:14:54 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P1, MUC50-C1
age
756
x-amz-server-side-encryption
AES256
etag
W/"9352f20e556bff9fea6fd0461aac850d"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
public, max-age=3600
x-amz-cf-id
CKIq5THxVcppID_WFucv529TROLcYdnx8MU1poN1xvQTXDUbyyraGg==
pageview
ng.virgul.com/ Frame 1DCE
33 KB
5 KB
Script
General
Full URL
https://ng.virgul.com/pageview?c=site_geneli&mt=1687740453081&v=https%3A%2F%2Fye-mek.net%2F&r=yemek_net:site_geneli&userId=&tp=&os=&call=noktaad.ads.vvad&vd=0&ses=0&dim=1600x1200&l=&y=&w=0&ext=,as,rc0,hf1,vv1,gprec%3Dyemek%26rec_ing%3D&info=&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&rdmt=0.80481127489973
Requested by
Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/adcode/outside.js?dts=19534
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software
openresty/1.15.8.3 /
Resource Hash
013dea275b5a8ea557928bc40495322ac526a7a09513ca006fb336485c002c22

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
gzip
server
openresty/1.15.8.3
vary
Accept-Encoding
p3p
CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'
access-control-allow-origin
https://ye-mek.net
content-type
application/javascript
access-control-allow-credentials
true
expires
Tue, 04 Jan 2022 10:49:40 GMT
yemek_net.js
static.virgul.com/theme/mockups/fallback/ Frame 1DCE
12 KB
2 KB
Script
General
Full URL
https://static.virgul.com/theme/mockups/fallback/yemek_net.js?dts=19534
Requested by
Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/adcode/outside.js?dts=19534
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software
openresty/1.15.8.3 /
Resource Hash
5103b27b55207be49f024a501641c7cb93e6469073ccbe194cd5963b53716184

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
gzip
last-modified
Tue, 20 Jun 2023 21:45:07 GMT
server
openresty/1.15.8.3
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=5184000
hb
ng.virgul.com/ Frame 1DCE
50 KB
5 KB
Script
General
Full URL
https://ng.virgul.com/hb?call=noktaad.setHbParameters&site=yemek_net&dts=468816
Requested by
Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/adcode/outside.js?dts=19534
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software
openresty/1.15.8.3 /
Resource Hash
ab0b18ffda35fd2897523716ac7f43a29c56743632551ec20c9fdeafbc5d9336

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
gzip
server
openresty/1.15.8.3
vary
Accept-Encoding
p3p
CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'
access-control-allow-origin
https://ye-mek.net
content-type
application/javascript
cache-control
max-age=3600
access-control-allow-credentials
true
config
c.amazon-adsystem.com/cdn/prod/ Frame 1DCE
0
308 B
XHR
General
Full URL
https://c.amazon-adsystem.com/cdn/prod/config?src=600&u=https%3A%2F%2Fye-mek.net&pubid=e0a76a78-9ad1-46f2-a337-886c2e24ac91
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.87.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-87-107.muc50.r.cloudfront.net
Software
Server /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 21:53:17 GMT
via
1.1 2d469870f5a756385a1eb37325629a1e.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
MUC50-C1
age
10455
x-cache
Hit from cloudfront
access-control-allow-origin
https://ye-mek.net
cache-control
max-age=21550, s-maxage=21600
access-control-allow-credentials
true
x-amz-cf-id
GlBQsrUNXY5DpsLOTALAtyfEXjs-1mkXegkTUbtcSlyHYj5hqyJxxg==
aps_csm.js
c.amazon-adsystem.com/bao-csm/aps-comm/ Frame 1DCE
6 KB
3 KB
XHR
General
Full URL
https://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.87.107 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-87-107.muc50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
rBtfgJUMGYsy5fZuQwMAU7hSD.fVdF76
content-encoding
gzip
via
1.1 4ba99d04800d29b58ab9861f60991a2a.cloudfront.net (CloudFront)
date
Sun, 25 Jun 2023 09:19:17 GMT
x-amz-cf-pop
MUC50-C1
age
55697
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Sat, 24 Jun 2023 09:19:11 GMT
server
AmazonS3
etag
W/"a4d296427fc806b21335359e398c025c"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
vary
Accept-Encoding,Origin
x-amz-cf-id
TsKE8rtCg1xHu73jkueWEmq08XcjeGQuuqHVIsiJwd_q_UvLhnoh5Q==
show_ads_impl_with_ama_fy2021.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306160901/ Frame 1DCE
356 KB
119 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306160901/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6593523210010154&plah=ye-mek.net&bust=31075473
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6593523210010154
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b436a622b2ee1610a74cbaa71436e7b59d970d310fe106aee25337ef4ccaa0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
122033
x-xss-protection
0
server
cafe
etag
13728702780562702892
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Mon, 26 Jun 2023 00:47:33 GMT
zrt_lookup.html
googleads.g.doubleclick.net/pagead/html/r20230620/r20190131/ Frame 362B
10 KB
5 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/html/r20230620/r20190131/zrt_lookup.html
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6593523210010154
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ye-mek.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
21031
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=1209600
content-encoding
br
content-length
4540
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sun, 25 Jun 2023 18:57:02 GMT
etag
15057649708203361565
expires
Sun, 09 Jul 2023 18:57:02 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/ Frame 1DCE
393 KB
125 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
923ac60ae2b51d9cb2025f34d30e8188c5bdfb61e04f7d5c88908b56800c7ed0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 12:45:09 GMT
content-encoding
br
x-content-type-options
nosniff
age
43344
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
127691
x-xss-protection
0
server
cafe
etag
13681810057703077335
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
expires
Mon, 24 Jun 2024 12:45:09 GMT
empowerwebplayer3.js
static.virgul.com/theme/mockups/outside/ Frame 1DCE
10 KB
3 KB
Script
General
Full URL
https://static.virgul.com/theme/mockups/outside/empowerwebplayer3.js?v=20
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software
openresty/1.15.8.3 /
Resource Hash
3e9569df702eb478e6e7699775a0f555b64ef9e89d89a81742bc97c7803dba96

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
gzip
last-modified
Tue, 13 Jun 2023 13:36:40 GMT
server
openresty/1.15.8.3
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=5184000
integrator.js
adservice.google.com/adsid/ Frame 1DCE
107 B
456 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=ye-mek.net
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306160901/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6593523210010154&plah=ye-mek.net&bust=31075473
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame E59C
603 B
67 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&adk=1812271804&adf=3279755397&plat=1%3A512%2C2%3A512%2C3%3A512%2C4%3A512%2C8%3A512%2C9%3A33288%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C26%3A512%2C27%3A512%2C30%3A1081856%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453215&bpp=5&bdt=878&idt=114&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&nras=1&correlator=3599492905211&frm=24&ife=1&pv=2&ga_vid=287714539.1687740453&ga_sid=1687740453&ga_hid=1928663309&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=1600&ish=1200&ifk=222437166&scr_x=-12245933&scr_y=-12245933&eid=44759876%2C44759927%2C44759837%2C31075308%2C31075413%2C31075465%2C31075473%2C42531706%2C44788442%2C44794789&oid=2&pvsid=4006622124605617&tmod=1052164672&uas=0&nvt=1&fsapi=1&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=1&uci=1.1901ez82f66&fsb=1&dtd=135
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306160901/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6593523210010154&plah=ye-mek.net&bust=31075473
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ye-mek.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
br
content-length
46
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:47:33 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
bid
aax.amazon-adsystem.com/e/dtb/ Frame 1DCE
23 B
460 B
XHR
General
Full URL
https://aax.amazon-adsystem.com/e/dtb/bid?src=600&u=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&pr=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&pid=IizdJYdwjWPGK&cb=0&ws=1600x1200&v=23.612.1758&t=1200&slots=%5B%7B%22sd%22%3A%22div-gpt-ad-1455783126174-15338221728129623web_yemeknet_right_tower%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F21728129623%2Fweb_yemeknet_right_tower%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-1455783126174-15336621728129623web_yemeknet_masthead%22%2C%22s%22%3A%5B%22970x250%22%2C%22970x90%22%2C%22728x90%22%2C%22300x250%22%2C%22200x200%22%5D%2C%22sn%22%3A%22%2F21728129623%2Fweb_yemeknet_masthead%22%7D%2C%7B%22sd%22%3A%22div-gpt-ad-1455783126174-15338321728129623web_yemeknet_left_tower%22%2C%22s%22%3A%5B%22160x600%22%2C%22120x600%22%5D%2C%22sn%22%3A%22%2F21728129623%2Fweb_yemeknet_left_tower%22%7D%5D&pubid=e0a76a78-9ad1-46f2-a337-886c2e24ac91&gdprl=%7B%22status%22%3A%22no-cmp%22%7D
Requested by
Host: c.amazon-adsystem.com
URL: https://c.amazon-adsystem.com/aax2/apstag.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.253.136 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-253-136.fra60.r.cloudfront.net
Software
Server /
Resource Hash
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
Security Headers
Name Value
Strict-Transport-Security max-age=47474747; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
strict-transport-security
max-age=47474747; includeSubDomains; preload
via
1.1 68b2682a924ac399aa2724b5b439e75c.cloudfront.net (CloudFront)
server
Server
x-amz-cf-pop
FRA60-P3
x-amz-rid
T3P9J806KQBD73GH5Z09
vary
Accept-Encoding,User-Agent
x-cache
Miss from cloudfront
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
https://ye-mek.net
access-control-allow-credentials
true
timing-allow-origin
*
content-length
23
x-amz-cf-id
mWtcOyhktagbOjELGUm8PzEi397Z8wAZMm4nCKlpaBJbUKQnBkZiNQ==
yemek_net.js
static.virgul.com/theme/mockups/sites/ Frame 1DCE
11 KB
5 KB
Script
General
Full URL
https://static.virgul.com/theme/mockups/sites/yemek_net.js?dts=468816
Requested by
Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/adcode/outside.js?dts=19534
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software
openresty/1.15.8.3 /
Resource Hash
a7a580492938c753648b19da1321bf7ea66d7a2e9b1fa42058c821e268fba9e1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
gzip
last-modified
Thu, 27 Apr 2023 09:08:06 GMT
server
openresty/1.15.8.3
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=5184000
pandg-sdk.js
pghub.io/js/ Frame 1DCE
17 KB
5 KB
Script
General
Full URL
https://pghub.io/js/pandg-sdk.js
Requested by
Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/adcode/outside.js?dts=19534
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.45.217 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
217.45.241.35.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
27961ab8c37cddad89230364167c048c6377a80e38542a5ffbca600faf4098ea

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:43:44 GMT
content-encoding
gzip
age
229
x-guploader-uploadid
ADPycduf890llyykd5r4nT7Q-3ZooVrPVzxEYqcq6wDUZx_J3-fc-b8mA5pUwH0hlzje9XlWXHIagRgDwEaWMQjf9Nxq
x-goog-storage-class
MULTI_REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
5009
last-modified
Mon, 05 Jun 2023 16:36:50 GMT
server
UploadServer
etag
"47a886353056caf33a998c6041e20896"
vary
Accept-Encoding
x-goog-generation
1685983010517890
x-goog-hash
crc32c=aHj4lg==, md5=R6iGNTBWyvM6mYxgQeIIlg==
access-control-allow-origin
*
access-control-expose-headers
Access-Control-Allow-Origin
cache-control
public,max-age=3600
x-goog-stored-content-length
5009
accept-ranges
bytes
content-type
application/javascript
zoneview
ng.virgul.com/ Frame 1DCE
0
209 B
Image
General
Full URL
https://ng.virgul.com/zoneview?c=&mt=1687740453369&v=https%3A%2F%2Fye-mek.net%2F&r=153366@153377@153378@153379@153379@153382@153383:yemek_net&userId=vnet634f4ce2-00c5-4905-8c8e-c86254eb39f9&tp=&os=&call=&vd=0&ses=0&dim=1600x1200&l=&y=&w=0&ext=,as,rc1,hf1,vv1,gprec%3Dyemek%26rec_ing%3D&info=&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&rdmt=0.7120362257640915
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software
openresty/1.15.8.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://ye-mek.net
date
Mon, 26 Jun 2023 00:47:33 GMT
access-control-allow-credentials
true
expires
Tue, 04 Jan 2022 10:49:40 GMT
server
openresty/1.15.8.3
content-length
0
p3p
CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'
ads
securepubads.g.doubleclick.net/gampad/ Frame 1DCE
27 KB
11 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4006622124605617&correlator=1128984393292733&eid=31075028%2C31075149&output=ldjh&gdfp_req=1&vrg=202306200101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_kategori_sayfalari_728x90_repeating&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C728x90%7C468x60&fluid=height&ifi=2&adks=3733009076&sfv=1-0-40&eri=1&cust_params=amznbid%3D0%26amznp%3D0%26category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1687740453081%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvnet634f4ce2-00c5-4905-8c8e-c86254eb39f9%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D&ppid=vnet634f4ce200c549058c8ec86254eb39f9&sc=1&cdm=ye-mek.net&abxe=1&dt=1687740453410&lmt=1687740453&dlt=1687740452337&idt=959&adxs=436&adys=2665&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=v4j20i2ifm87&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=976x0&msz=996x0&fws=388&ohw=1600&ga_vid=287714539.1687740453&ga_sid=1687740453&ga_hid=1928663309&ga_fc=true
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
34caa61fc8a8d83d86b9a0f6d8b17fe3edfe249e6204b6bb59bd298bb41fdd2c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11646
x-xss-protection
0
google-lineitem-id
6241543851
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138425219174
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ye-mek.net
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame FE56
6 KB
3 KB
Document
General
Full URL
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ye-mek.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:47:33 GMT
expires
Tue, 25 Jun 2024 00:47:33 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
NoktaNpmPlayerApi.js
c1.imgiz.com/player_others/html5/ Frame 1DCE
7 KB
3 KB
Script
General
Full URL
https://c1.imgiz.com/player_others/html5/NoktaNpmPlayerApi.js?dts=19534
Requested by
Host: static.virgul.com
URL: https://static.virgul.com/theme/mockups/outside/empowerwebplayer3.js?v=20
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software
openresty/1.15.8.3 /
Resource Hash
0b29697868cd68cfd1b5650054cc96ea755016b3242bd26469cdbd4e4f6fc18a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
gzip
last-modified
Wed, 13 Oct 2021 11:58:21 GMT
server
openresty/1.15.8.3
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
expires
Mon, 03 Jul 2023 00:47:33 GMT
zoneview
ng.virgul.com/ Frame 1DCE
0
209 B
Image
General
Full URL
https://ng.virgul.com/zoneview?c=&mt=1687740453513&v=https%3A%2F%2Fye-mek.net%2F&r=153394@153493:yemek_net&userId=vnet634f4ce2-00c5-4905-8c8e-c86254eb39f9&tp=&os=&call=&vd=0&ses=0&dim=1600x1200&l=&y=&w=0&ext=,as,rc1,hf1,vv1,gprec%3Dyemek%26rec_ing%3D&info=&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&rdmt=0.38139621438248983
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software
openresty/1.15.8.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://ye-mek.net
date
Mon, 26 Jun 2023 00:47:33 GMT
access-control-allow-credentials
true
expires
Tue, 04 Jan 2022 10:49:40 GMT
server
openresty/1.15.8.3
content-length
0
p3p
CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'
tag
feed.pghub.io/ Frame A7D2
13 B
257 B
Document
General
Full URL
https://feed.pghub.io/tag?referrer_url=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&page_url=https%3A%2F%2Fye-mek.net%2F&owner=P%26G&bp_id=noktacommedya&ch=%7B%22architecture%22%3A%22%22%2C%22bitness%22%3A%22%22%2C%22brands%22%3A%5B%5D%2C%22fullVersionList%22%3A%5B%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22%22%2C%22platformVersion%22%3A%22%22%7D&initiator=js&data=%7B%22category%22%3A%22site_geneli%22%7D
Requested by
Host: pghub.io
URL: https://pghub.io/js/pandg-sdk.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.102.243.38 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
38.243.102.34.bc.googleusercontent.com
Software
/
Resource Hash
b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628
Security Headers
Name Value
Content-Security-Policy default-src 'none';img-src https://*.pghub.io https://match.adsrvr.org
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://ye-mek.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-origin
*
access-control-max-age
300
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-store
content-security-policy
default-src 'none';img-src https://*.pghub.io https://match.adsrvr.org
content-type
text/html;charset=utf-8
date
Mon, 26 Jun 2023 00:47:33 GMT
strict-transport-security
max-age=31536000
via
1.1 google
integrator.js
adservice.google.com/adsid/ Frame 1DCE
107 B
165 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=ye-mek.net
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ Frame 1DCE
24 KB
11 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4006622124605617&correlator=1350192671401776&eid=31075028%2C31075149&output=ldjh&gdfp_req=1&vrg=202306200101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_left_tower&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600%7C120x600%7C120x240%7C160x800&fluid=height&ifi=3&adks=3299242717&sfv=1-0-40&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1687740453081%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvnet634f4ce2-00c5-4905-8c8e-c86254eb39f9%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D&ppid=vnet634f4ce200c549058c8ec86254eb39f9&sc=1&cdm=ye-mek.net&abxe=1&dt=1687740453627&lmt=1687740453&dlt=1687740452337&idt=959&adxs=122&adys=150&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=asxfyhxf3ueu&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=160x-1&msz=160x-1&fws=900&ohw=160&ga_vid=287714539.1687740453&ga_sid=1687740453&ga_hid=1928663309&ga_fc=true
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
5f465103fbc289c19d4e8e2b69a5db092b99e2050809018e6b407992135ff9d3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11356
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ye-mek.net
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame 1DCE
34 KB
14 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4006622124605617&correlator=2924469346148764&eid=31075028%2C31075149&output=ldjh&gdfp_req=1&vrg=202306200101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_kategori_sayfalari_728x90_2&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C728x90%7C468x60&fluid=height&ifi=4&adks=345722362&sfv=1-0-40&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1687740453081%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvnet634f4ce2-00c5-4905-8c8e-c86254eb39f9%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D&ppid=vnet634f4ce200c549058c8ec86254eb39f9&sc=1&cdm=ye-mek.net&abxe=1&dt=1687740453633&lmt=1687740453&dlt=1687740452337&idt=959&adxs=436&adys=1389&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=bc27sp21o5sj&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=976x0&msz=996x0&fws=388&ohw=1600&ga_vid=287714539.1687740453&ga_sid=1687740453&ga_hid=1928663309&ga_fc=true
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d3f15ee61f5e412a4028b0ebbdf44c123c1ff96f54422d4ced512943d53970ed
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14802
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ye-mek.net
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame 1DCE
64 KB
14 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4006622124605617&correlator=2362555437224042&eid=31075028%2C31075149&output=ldjh&gdfp_req=1&vrg=202306200101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_right_tower&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C160x600%7C120x600%7C120x240%7C160x800&fluid=height&ifi=5&adks=3203893797&sfv=1-0-40&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1687740453081%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvnet634f4ce2-00c5-4905-8c8e-c86254eb39f9%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D&ppid=vnet634f4ce200c549058c8ec86254eb39f9&sc=1&cdm=ye-mek.net&abxe=1&dt=1687740453637&lmt=1687740453&dlt=1687740452337&idt=959&adxs=1318&adys=150&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=nc2x2ad5a8zn&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=160x-1&msz=160x-1&fws=900&ohw=160&ga_vid=287714539.1687740453&ga_sid=1687740453&ga_hid=1928663309&ga_fc=true
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e0b1e9c2a3c1938f32d84d4e7fbcbddc828ed5cbdb2a2d8f5c362223fa13ba7d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14537
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ye-mek.net
access-control-expose-headers
x-google-amp-ad-validated-version
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame 1DCE
24 KB
11 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4006622124605617&correlator=341629858974589&eid=31075028%2C31075149&output=ldjh&gdfp_req=1&vrg=202306200101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_masthead&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C970x250%7C970x90%7C728x90%7C300x250%7C468x60%7C250x250%7C200x200%7C160x160%7C640x205&fluid=height&ifi=6&adks=3050045420&sfv=1-0-40&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1687740453081%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvnet634f4ce2-00c5-4905-8c8e-c86254eb39f9%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D&ppid=vnet634f4ce200c549058c8ec86254eb39f9&sc=1&cdm=ye-mek.net&abxe=1&dt=1687740453640&lmt=1687740453&dlt=1687740452337&idt=959&adxs=315&adys=158&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=h032c9omho4k&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=996x0&msz=996x0&fws=388&ohw=1600&ga_vid=287714539.1687740453&ga_sid=1687740453&ga_hid=1928663309&ga_fc=true
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
dc27a06fff02bff8a6288746f88a5e981e72bf5c6259440b5f7aed8dd7427033
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11170
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ye-mek.net
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame 1DCE
111 KB
40 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4006622124605617&correlator=1633314209197879&eid=31075028%2C31075149&output=ldjh&gdfp_req=1&vrg=202306200101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_kategori_sayfalari_ust_728x90&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C728x90%7C468x60&fluid=height&ifi=7&adks=456810305&sfv=1-0-40&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1687740453081%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvnet634f4ce2-00c5-4905-8c8e-c86254eb39f9%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D&ppid=vnet634f4ce200c549058c8ec86254eb39f9&sc=1&cdm=ye-mek.net&abxe=1&dt=1687740453644&lmt=1687740453&dlt=1687740452337&idt=959&adxs=436&adys=751&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=td9gjxac8tsr&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=976x0&msz=996x0&fws=388&ohw=1600&ga_vid=287714539.1687740453&ga_sid=1687740453&ga_hid=1928663309&ga_fc=true
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8b81ff8571e580de0209f2f5549026d5948bed4a084d7448ff28fe5156a906b7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
41019
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ye-mek.net
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ Frame 1DCE
112 KB
40 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=4006622124605617&correlator=2046274479960777&eid=31075028%2C31075149&output=ldjh&gdfp_req=1&vrg=202306200101&ptt=17&impl=fif&iu_parts=21728129623%3A33502485%2Cweb_yemeknet_kategori_sayfalari_728x90_repeating&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C728x90%7C468x60&fluid=height&ifi=8&adks=2157304621&sfv=1-0-40&eri=1&cust_params=category%3Dsite_geneli%26plm%3Dnull%26viewable%3D2%26site%3Dyemek_net%26mt%3D1687740453081%26pager%3D1%2540site_geneli%2540yemek_net%253Asite_geneli%26policy%3D0%26host%3Dye-mek.net%26url%3Dhttps%253A%2520%2520ye%2520mek.net%2520%26targetCtr%3D0%26pid%3Dvnet634f4ce2-00c5-4905-8c8e-c86254eb39f9%26targetCr%3D0%26Mobile%3Dfalse%26env%3Dweb%26webmAd%3D1%26overlay%3D1%26rc%3D0%26datasave%3D0%26rec%3Dyemek%26rec_ing%3D&ppid=vnet634f4ce200c549058c8ec86254eb39f9&sc=1&cdm=ye-mek.net&abxe=1&dt=1687740453649&lmt=1687740453&dlt=1687740452337&idt=959&adxs=436&adys=2027&biw=-12245933&bih=-12245933&isw=1600&ish=1200&scr_x=-12245933&scr_y=-12245933&ucis=v56qukbfu4m&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&nhd=1&url=https%3A%2F%2Fye-mek.net%2F&ref=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&top=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&frm=24&vis=1&psz=976x0&msz=996x0&fws=388&ohw=1600&ga_vid=287714539.1687740453&ga_sid=1687740453&ga_hid=1928663309&ga_fc=true
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
217a55bff68c2e16ef6e1cb42c3afecef0253183c569e3f8bfb79dc7b02fa371
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
41331
x-xss-protection
0
google-lineitem-id
-1
pragma
no-cache
server
cafe
google-creative-id
-1
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://ye-mek.net
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 8E30
6 KB
3 KB
Document
General
Full URL
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ye-mek.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:47:33 GMT
expires
Tue, 25 Jun 2024 00:47:33 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
ima3.js
imasdk.googleapis.com/js/sdkloader/ Frame 1DCE
361 KB
121 KB
Script
General
Full URL
https://imasdk.googleapis.com/js/sdkloader/ima3.js
Requested by
Host: c1.imgiz.com
URL: https://c1.imgiz.com/player_others/html5/NoktaNpmPlayerApi.js?dts=19534
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5a9863314577494b778cade4d77d719a27fca818d6091efe35b972cac31026f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-doubleclick-instream-static"
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
123120
x-xss-protection
0
expires
Mon, 26 Jun 2023 00:47:33 GMT
NoktaPlayer.js
c1.imgiz.com/player_others/html5/ Frame 1DCE
398 KB
128 KB
Script
General
Full URL
https://c1.imgiz.com/player_others/html5/NoktaPlayer.js?d=6/26/2023
Requested by
Host: c1.imgiz.com
URL: https://c1.imgiz.com/player_others/html5/NoktaNpmPlayerApi.js?dts=19534
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software
openresty/1.15.8.3 /
Resource Hash
bea17c8870ba8dae9515993b5c55b65437f03f0e2672e1c3d3dbe7872dd74e5c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
gzip
last-modified
Mon, 29 May 2023 18:51:56 GMT
server
openresty/1.15.8.3
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=604800
expires
Mon, 03 Jul 2023 00:47:33 GMT
ext.js
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 8E30
24 KB
7 KB
Script
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 21 Jun 2023 12:02:51 GMT
content-encoding
br
x-content-type-options
nosniff
age
391482
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6402
x-xss-protection
0
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Thu, 20 Jun 2024 12:02:51 GMT
adsbygoogle.js
pagead2.googlesyndication.com/pagead/js/ Frame 8E30
137 KB
47 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6593523210010154
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1b5fe5917523b0287c18a0f30935db770aa86246028eee151fe53c281d05d138
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Origin
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48175
x-xss-protection
0
server
cafe
etag
8913863426007159597
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Mon, 26 Jun 2023 00:47:33 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 8E30
179 KB
56 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
13b4bb0bb059eee9a7ddf5b8ae3f395e28e7f81918eeac0ec934f3d050c4d0a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57242
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1687383875062185"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 26 Jun 2023 00:47:33 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 8E30
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsu8y6wM4yUd2FKgx2t1z_0I-cISQvU8GdmxTZBWqXUt28nDhBl1x6evesJXU0pD5XXGnl1Mr_a5Qq7IcoUS1TnzIhKJ6hB6d72TFaZHpjQyf5VI6ZszTPmhxrNVRd8MODX1p-Ee4HUva5OAktFF6Fw8omDP6dOD9gApooEf042Ak8ZCO7AWmygWoj_pk4t5kj8OuTof8q-5dp0s2cCw_wkyZoU7q1Pfcl1BedhyYyIX0fEfF8VGacVSVTybZV58jkaoxMkiRnqdkzS1HP3FeBRw-3Mvw7ojFP0K_9x1dViYSHV7cj3wvKRZKhL8uH1iTkltzGBsxxzOh6dtBCosu4MMtHQOpnyGSWLFcHbF-FWHrpV5MV2WFzPbXA&sai=AMfl-YQHTSjrRTg9sDfEDJydjZdcFj5-HCH425lgnN55pTiVGA--UhrxwKkZ1U_CDmCH-XUeJ1EYjbRST1EKlZzKVq34-jK4SQ5sSVAQL1iplKQ&sig=Cg0ArKJSzCFnKMiJUN9UEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Mon, 26 Jun 2023 00:47:33 GMT
show_ads_impl_with_ama_fy2021.js
pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306160901/ Frame 8E30
356 KB
119 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306160901/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6593523210010154&plah=e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js?client=ca-pub-6593523210010154
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
71e65ce4266cea9dae94ee02fad3affca7a5d739d7df7893a9a9c2daf68b786b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
122045
x-xss-protection
0
server
cafe
etag
14212539518841537712
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600, stale-while-revalidate=3600
timing-allow-origin
*
expires
Mon, 26 Jun 2023 00:47:33 GMT
truncated
/ Frame 8E30
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
794dc48504b6e88ec8444014ba8d432c582b38965c354a8b10d41ee73a8063cc

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
integrator.js
adservice.google.com/adsid/ Frame 8E30
107 B
122 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306160901/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6593523210010154&plah=e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
content-type
application/javascript; charset=UTF-8
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
100
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 7EE4
0
16 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&adk=1812271804&adf=3407250215&plat=1%3A520%2C2%3A520%2C3%3A2163200%2C4%3A2163200%2C8%3A512%2C9%3A33288%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C26%3A512%2C27%3A512%2C30%3A1049088%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fye-mek.net%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453812&bpp=8&bdt=86&idt=108&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&nras=1&correlator=4671767059969&frm=8&ife=1&pv=2&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&fsapi=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=1&uci=1.1qp67jg2prau&fsb=1&dtd=124
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306160901/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6593523210010154&plah=e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:47:33 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
container.html
e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 1A21
6 KB
3 KB
Document
General
Full URL
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ye-mek.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:47:33 GMT
expires
Tue, 25 Jun 2024 00:47:33 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
ads
googleads.g.doubleclick.net/pagead/ Frame 1BE1
32 KB
14 KB
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453820&bpp=35&bdt=94&idt=136&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4671767059969&frm=8&ife=1&pv=1&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.1e0bozjdbm9m&fsb=1&dtd=145
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306160901/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6593523210010154&plah=e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
31c1b28c2195aab6e2ebe11ebdbe1631fe4fd7481e1af41c78227affa1b0c61b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
br
content-length
13921
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:47:34 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
amp4ads-v0.mjs
cdn.ampproject.org/rtv/022305252018000/ Frame 5622
222 KB
61 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/022305252018000/amp4ads-v0.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
8bd1387deb212ba27c6a71bda54698de8377ef85b3fe2c4f3fa104e3e4381c3f
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 23 Jun 2023 23:11:20 GMT
age
178574
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
61811
x-xss-protection
0
server
sffe
etag
"98b5f6358377a24d"
vary
Accept-Encoding
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Sat, 22 Jun 2024 23:11:20 GMT
amp-ad-exit-0.1.mjs
cdn.ampproject.org/rtv/022305252018000/v0/ Frame 5622
15 KB
5 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/022305252018000/v0/amp-ad-exit-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e2ac756b7d18a0715d66cff4a48f4ba89882b3bcec6cd4fda5455387eaff84d
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 23 Jun 2023 21:45:18 GMT
age
183736
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
5238
x-xss-protection
0
server
sffe
etag
"6efdfbd3c81d03c9"
vary
Accept-Encoding
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Sat, 22 Jun 2024 21:45:18 GMT
amp-analytics-0.1.mjs
cdn.ampproject.org/rtv/022305252018000/v0/ Frame 5622
94 KB
28 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/022305252018000/v0/amp-analytics-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7a9344144d755ac52f3d8405003feb8eab3b79aebc78e330537ea10861d6f32e
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 23 Jun 2023 20:39:58 GMT
age
187656
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
28864
x-xss-protection
0
server
sffe
etag
"51fe97ef57b83921"
vary
Accept-Encoding
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Sat, 22 Jun 2024 20:39:58 GMT
amp-fit-text-0.1.mjs
cdn.ampproject.org/rtv/022305252018000/v0/ Frame 5622
5 KB
2 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/022305252018000/v0/amp-fit-text-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a28b55f41413d16c71a76b7af3ff9f707323bb3906096b85f7a581415aaeff55
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Wed, 21 Jun 2023 07:06:46 GMT
age
409248
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1896
x-xss-protection
0
server
sffe
etag
"fbb7a7837efaff21"
vary
Accept-Encoding
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Thu, 20 Jun 2024 07:06:46 GMT
amp-form-0.1.mjs
cdn.ampproject.org/rtv/022305252018000/v0/ Frame 5622
40 KB
13 KB
Script
General
Full URL
https://cdn.ampproject.org/rtv/022305252018000/v0/amp-form-0.1.mjs
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
45352935afb3119009abbfa8ed5bf7b67fc4edf64e8b718a134975410823ace9
Security Headers
Name Value
Content-Security-Policy default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
default-src * blob: data:; script-src blob: https://cdn.ampproject.org/lts/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0.mjs https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp.withgoogle.com/csp/amp
content-encoding
br
x-content-type-options
nosniff
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 23 Jun 2023 21:40:06 GMT
age
184048
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
12956
x-xss-protection
0
server
sffe
etag
"bd37dd4c3b7b688b"
vary
Accept-Encoding
report-to
{"group":"amphtml-china-available","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/amphtml-china-available"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="amphtml-china-available"
expires
Sat, 22 Jun 2024 21:40:06 GMT
truncated
/ Frame 5622
215 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1a7eeb7772427c5d7d2a5969b662868460cd128b228d29567f0a7ae75e1c494

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
5648818383791576392
s0.2mdn.net/simgad/ Frame 5622
532 KB
532 KB
Image
General
Full URL
https://s0.2mdn.net/simgad/5648818383791576392
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
187574c8a3cf0026b633b356842e03d60450be911027b697e9542a650d1049c8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 23:35:48 GMT
x-content-type-options
nosniff
age
90706
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
544482
x-xss-protection
0
last-modified
Fri, 31 Mar 2023 09:51:21 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 23 Jun 2024 23:35:48 GMT
14952963386359035714
s0.2mdn.net/simgad/ Frame 5622
10 KB
10 KB
Image
General
Full URL
https://s0.2mdn.net/simgad/14952963386359035714
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2d3ebc5963c3ba449fc6f11b2d5ac883abaf7dbc046ac7c1b267518e0ca5fa27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 14:13:04 GMT
x-content-type-options
nosniff
age
124470
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
10020
x-xss-protection
0
last-modified
Fri, 31 Mar 2023 09:51:26 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 23 Jun 2024 14:13:04 GMT
ad
googleads.g.doubleclick.net/dbm/ Frame 5622
42 B
63 B
Image
General
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DuPl6T9bJxd-0ev6tq31RTgqI0jpLyQffjYz8CeTzXG1m0jo25_k4ovsk6b1zMgyjZ0SwWCJbvPhMzDCLsM6y9fQ32jLjwUbd_dUQax5PJLEAsW4Ab00FGBPLKzyEOq-SeTNkmMz8WUmYQkdnWeU7hQb5W0Q&dbm_d=AKAmf-DKqzBQSkbRmJ2pMJ6CUxnCfRjc_Me04RFJoO2Rfg6-H-i8FokhGzoJeSgC9CD10r4I7ioyocbu-ApgqEv4RRUyzbkS9ThtI9rBGpbamgkB2IHPB8UmxOzeor3efrmg1i_SN3feihmQjdQP6fKZ3DoXovNUEI-bNInfr513Wf7hUJyYhEs_GYI21sLDJONsH2AYNBRWlXM5aijnlSrb1kAJyDDzR4eDX2UPEAhlTVSMruZs2TnwMuOTtm09GEgUfXyN-41RAzbhyik9vC29B24Fq60fjd4uFIQYwcrPYQYAJeKpjbswYdvtCmJnAGn3RxvJ9ULO-huG94N0DG1swncWhyOC6cbf_j348OyAQzStQhsEn4tOCp9w0ZsJ3mEcIr0_cXQoJxVeakfzROb8jVrzFZxH5aGbgT5ZnpYfPFrHw177yJtCdoTsUJFXIcEPQiRKRcc9uwVmmHGQbCy0EmOG9gkFIyFS80IIAtbAuz19OaQzlj9aqtTMsiTzY0vze_TvSdiSE0W4rY9Agz7QS7H3jedjxklnh8LJ6vY12fV4p97a8kfvF44-0AlroeDGIJGc2_1NtiYeYrpXlqDYqpCXnXQU-ALLu6t5x8bK4SfUX2MGYVd3FlOJh6qmdnLikWr88OmTPkvYOui_TVcmjPrLi3ZvfjZtkbF4F-WSXwTmR3eVtmgQr52nRBv8wrgcIlDs8S0OnWVLnbtRl2_-EonamjRiO_4s7-2E4UjwtnyB_SjYWh40iRh_q8RLUZyAheSoWTESMytlY_Fuhsj44L6fRodXHCrDbFoaSRIbLdBUuk3amdzf7pD_948eNcP79uFDGdQkDu2pCcyDSqFr6taNHKNHKnGSgDYvm6BKbaI3TYY_u6-dnH-230VluLFpoOUrxRM4f6CiUP0PWJ8E8HMT_D4HR2OazsfBncd6pe4EL4ORtqE__TT8JYDMVJlwmMyE29civm8v5_NwFf1wPHR6737eFFovk2BAuKW8h3E6P6ba5ZwY7QN16js0V0jMeWMrCWDxeQ8m4Inidk9bHkObLe2XZhQl_SyDIZDyNV0ZFlHrK1Ehvs0VtcDTh7B59ztJto4ORhUT_pbe5uzOvoO50ckp2J0P4oRURrQDhBtrsR6Wu6CcwBd46HEn32D3X1tbCcSWDZFKijAFTJoFpL4-2EfIFqVAIvPwoEs5RXrbFIk8IySZqDHGeGxePFdhy6tvemxwnSdJySfi969BxNgvo9NRnNdDpbNceXskOPoxmfrEizAEUQ5r4FJqDm5HSuQk7_kaIP9CqnTniqICZ5YthoCneoUtqSVyM4ZnIsZcu7G9NY0V2cF-YoYPFcEs2IMSIXrzfA_dfkisayBtVQRqzNcLTDbEDXDGdML2RW9H9rHm3ncETveudrCSQetPoPeQU3Mg3VeWpWKIUZpkRnLprNkhQqdpbUgWJPF6wuw44h8e5rtSTZrcv6JU3xWzp8c_50I3PxkVhTVJiHfym3A7XRJufeswzRTyiOTiSpTSxY0AifYPoDeVKiC6Is2cHqlmLMew9vaw_9ufzQzV5gslL_XXVCqsvL4GWrDt-6BgWwkwgoQAhkf5nEYDBR_vMCaMYLFUD5TqpPFqpJgpr2pxTASGARAUZfqJbzy8THX9O8RblN0uugpfAYZ5HMVMpoMPNm9CkdMIAGCPsM5Vs_ZL4R6T1fxs1u0B0irhKYxPK9A6quTsrM26t3xwCxl-Tt37ufj0RxQ7s-KuLJUoBI_3XYa5WuR3Kb4Bla9aOu--97-42DGc-M0ASiEesS7uE9GWXgFTRCbwC5fXU4dU_WjO1GkZulfp_EiXyDdHpHrmbY-2kSHqTSsGa7cn9fbhql3tFINk6De7697CZlX1PKK352ZK88GsX_aGyjR1kVfZSqXAbYxS24sS4cKQyfrkEuG1GBU2KZganfYN2OvYDpz5Y4DtGoPdixbUWJM_Ech82zKLfde-sqInQSkog8F1Fq692pzPEsjWqyHOAetkyiKlqBrmMpD6vue1AIRg67GYfWfie3wmUD_9kyyzCXS3X7QXGPsuyLKuTw6R5J1kiW1YbtAwxVpVwBqYzZMA_i62fxTwtz8rgAb8nx0FplvupuDoqzwY2ILd1oMovU4WuiITgTOSBLr6VqmRAIeOD1bexNptyw2aN9bAxUQc_x6lZLPG19_AAa2SPVB5LNknBJB_JAMZX4L8iIFd9w4EJhR38XhnjivvZsiYKVYhnfRJaE2lkmMmYcMV36akEudgdlFA6zT3jjdEVwMwxCwa-u_t-rQemhIvaqS_2sOn10M3ZAcJ0DmUGvR8PTb__L-UExj_SO29v97SYZxpCXTcuojlg76rSMAt_7vAgEntOhhBwV36fUdAFk0uIcIKeaZXi0lVXoxp3n9tJrWaUVnCmWnFOVX-Osb4_JSa3qiqo8fVJEkJgyJJ3mjno9-knxLi0cRMHTo7s7aQ0APcecXL2eHZ7MAK_A6JFU2uq5vwOBa0mgJ6NEjyWqbVhysL6DXNjOXCsa0GHXhH1UmkGhLyZzpliTPYyqMe0VRtvTsR1-7XVHs9_RtcXd9tsB-2HBg5ig9s-ApWrCgj6D7lp9Jb2Q4tT6gpioMqVC4bKhdwFVjI95dAbY-CJJWm5xDlnVpf3zoOxZssMwWcZzORTH_8rhRQi2ckpBfN2aGsIFHX77zcc15nymBObBZhMB2HEH_8KJF2idukuwyRJD2JqVtse_DiBJ7vGpOb8RI4ZRtvgO3Midm72HMiX3GI45xt0NPzL0nu2aQV7U6sL5f1vWy13guz973WPdM-Zn1PwdAdgT73Um8gKiU658j31nznNNF5nGj_3ydTlZkMpqztKRDeh5Tr2fk6pVcnF9gQXxCYSfwwoxAkoepstZCRaYXHgf3tDBf7hkmxctiZbGlmCrVZwhBCg_C68XVXkwqgCtbMd04VIGEoaTnq9zTw7QK33XMZbfMxEOCfJfw6nR7_IM1eREdOUVyWuHTT8Ql_kz0jYek4bYqGJ8vjCfyS0HYGsene4NScSoOkQS9U2WYUib1IXFgnt2LHbKEZkiLPK3IY2a9nZd_wqKd6mg4nyvkBfeU6MaE1b0l1oW4bipqvFuKnnbPCaFAVW4aP82uoRYVmaYYlpnN4UUs_mZhAk7yjUrNTDHlVmUD--SteMKb6gMlMRosTqmD11cAsdWgA3BuJmFCUSwMoGjdC0sbW3R67Te2HVgrhgJsdBofWJ5wvA19j9LMjxzNlfMcT3HLXcTD3mCVjjryZrt5keMNsc7gj0HSKKEMk0-KAAHBv1uOYnY0v45i-JkiQXfbckUiliWrd0MPrscwig69O03aJ67VT-TvpdP67syfhQOJHlI6mtq0Do0xknLj1FQfoUa4VezqNNI8o21TVDubIf96_CQ-8ST-CjGFVSWMWtw&cid=CAQSOwBygQiDcN2yCWRQ7PRY2NttP0LamLUhmNoWMpjEf3R0T7_Oz2sQaKGjj31H0wTXKUiVdp9pkcB4yM53GAE&dc_exteid=31133316215948106170672480969936781&dc_pubid=4
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:33 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame 5622
0
0
Image
General
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CTt_zJeCYZLjjK6KXjuwP2YKyyAuX9tbmb7ebyK2NEcfJor3AARABIMCygmtglYK0gsAHoAHTqd35AsgBBqkCNsTwkR9Hsj6oAwGqBNsBT9DjVlo6trxojiAxEjFB9Lu4jboX9kOrNqQVJIqyVh8lqwhQtuT1Lyilld7A3Jqp4IoBxpwHbm1u-Zoo__f0zEJAWiJqPq3ttXOV2AMhLsmDm1oUxckQM1uoXh1rpsE47SoKitHrUb6Ox_mK7_Z1cv2Qp7naI64y9y-9ZE6S5dDkPkdEQrSH-eQ6XjDXrdJ7i5v0E6UYuOmKH8NkfVssmw9WsFkU3jaAskZP50fNL1LRc7QaBOpV7QLOmfXTYAppgagH94CWkaMalXJUJOhIohbRhrXKmMDz0Or3wATw97ucrwTgBAOIBc75m5VKkgUGCBsQAhgBkgUGCB0QBBgBkgUGCB0QARgBkgUGCB4QARgBkAYBoAY3gAeV1qKGAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcKEIOkDhi0kcDlAdIIFgiA4YAQEAEYHTICqgI6AoBASL39wTryCBthZHgtc3Vic3luLTcyNzU1Mjg0NTMxNjIzMDmACgPICwGwE8O84xPIE5vtjuID0BMA2BMNiBQC2BQB0BUBgBcBshceChwIABIUcHViLTY1OTM1MjMyMTAwMTAxNTQY6sFt&sigh=71jGViSH1sU&uach_m=[UACH]&cid=CAQSOwBygQiDcN2yCWRQ7PRY2NttP0LamLUhmNoWMpjEf3R0T7_Oz2sQaKGjj31H0wTXKUiVdp9pkcB4yM53GAE&template_id=509&vt=10
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

tr.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 5622
3 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/abg/tr.png
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1e5a886321d0e00c13f7abff03ca39fd782f42997fd34bcbf4fc93718f3670cc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 19:49:55 GMT
x-content-type-options
nosniff
server
cafe
age
17858
etag
9957912877679239782
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/png
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3057
x-xss-protection
0
expires
Mon, 26 Jun 2023 19:49:55 GMT
icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 5622
344 B
450 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/abg/icon.png
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 19:03:49 GMT
x-content-type-options
nosniff
server
cafe
age
20624
etag
6766994032117382215
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/png
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
344
x-xss-protection
0
expires
Mon, 26 Jun 2023 19:03:49 GMT
container.html
e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 7DEF
6 KB
3 KB
Document
General
Full URL
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ye-mek.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:47:33 GMT
expires
Tue, 25 Jun 2024 00:47:33 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
container.html
e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 6ED2
6 KB
3 KB
Document
General
Full URL
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ye-mek.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
1
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:47:33 GMT
expires
Tue, 25 Jun 2024 00:47:33 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
container.html
e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 578A
6 KB
3 KB
Document
General
Full URL
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ye-mek.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
1
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:47:33 GMT
expires
Tue, 25 Jun 2024 00:47:33 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
container.html
e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 0D4C
6 KB
3 KB
Document
General
Full URL
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202306200101/pubads_impl.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ye-mek.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
1
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, immutable, max-age=31536000
content-encoding
br
content-length
2653
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:47:33 GMT
expires
Tue, 25 Jun 2024 00:47:33 GMT
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
adview
securepubads.g.doubleclick.net/pagead/ Frame 1A21
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=CuDOHJeCYZNOeK9GSrATA37jgC8-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTc5ODM2NTEyNTc4MzgyODLIAQngAgCoAwHIAwKqBPUBT9A9nD7P7nONlnsmRbQBldQQh0N8bzRlNVQGG5rDOvOuY-c_ENZOI-NmiJUhoFicC_Ee4GExScmmBm_UTQP8dsRr-QYrnT5mKquvlw9yWUxFywpyfxWKsOBI8y8QfhxjXbcCTSQY4gjVKhrMq-fjdHzDQvWz0vUf3vb7RZkfTLqxTI9VscK_ZcXpHrxD6CVm4A42GbzgxHtmWlUHpd4qapmo5GeummdTxSIjwht9YtJSGiTLTQMlSnwA8-AtLQJbWlSeSCkqJDhHO2P4RV9k0CIvZxJsYgl_2u3ozzcDHJwTKFUDtJnJnuYvE42300nQ8dej_dTgBAGABr7U1vzZmuidqAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA8ggbYWR4LXN1YnN5bi03Mjc1NTI4NDUzMTYyMzA5gAoD-gsCCAGADAHQFQGAFwGyFxwKGhIUcHViLTc5ODM2NTEyNTc4MzgyODIY6sFt&sigh=ASTkEupWjnI&uach_m=[UACH]&cid=CAQSOwBygQiDROaPcwqYbfIIJy5z4Ew27EzL3AzGBBgMM3s6A8Q0iM1xs5DUZipd8Zy4iRDGI6pBkqnTQmF2GAE&tpd=AGWhJmu83hau7rsIcyakKWUq5d8rpm2aTkRqg6t4yHiDqXW3kVqTVaXYQ3JHVSO5Z0iWPVJ3zWQCIhQO3A0Ldl0IcH66DbEaTSvNOkxCTSON0dMAPq5RR70kq3RT6malJZra7Lb1mbHUN9hPvJTZJNVu8Wb3Eue6Y1DU0NEc3MnwfhQsIpgABThlotUbzdxwLkUiJ8jgDQEVjHDwahF3anaz0p0LVHhnu9Zxr9jcpHA1GWDd1J3f7EqVoGPvFotKAEzG8kaapP46Ipoa6_0UuYI937aAQmWDVUx9EFlBNlV76-Oqrf306eeJ612EKqHr0S3QXDDB3_qE8johRvBiUEU9CDlnT_bCo6s1JQ4XOJK13GwgBPagHWskYVInudM-I2u7ncWXTRJVL6SK2JoEFGafPfTJGykI3vHeFXSi9mqGnEqUhK0hHNf4fCQBD4yk3OjBizkGqw8y4mQWNnnTXB1ofxe3oNAhoO_rJitZgbopEmSMCUwDQUgi-c8eJKtfDGfG3PnJP8P57OMKpbQpEC1JcEdopEfheX29-N7aQ7yeKSwmoW5kyV7s0A48m1hFhOuL2zUgxwJrzZGhoGhTKQf_lrnykLo30249FbZDauWcFd9VD3iwwBPI2yI-_1M0xeZQVExWTTUdYRy_BJSJfqOijY4LPqAxprNVLDJ0t7a3bfwj6Qrtwxqm2TpQ_NmQEFHXgRiXgkur4BEwWydmWcAejdUK2PnSTy_tMf04GsKjPkjVfE7ASBeaIrEJ5Yj5GQe5MQ7ziTx90osl99dorm8__3HZfjlfM7DjabclLQYLkQlR5fTIyGuFOhuA3n7Na_GLiNw8-QcteAX2WmAVhinaEnM0FC0N-ty9AQ8_yy_6w4J3Y7bvzGAsrXbBLFwc-A3od2Md0-ou7jKHW8unqzET_lfyKxFDqMp5UdT_f5AXoVqXJKKcC8moFiWKB3ixlumD3ZZqO0o22lWBdnRn1G1z8m5jGVcE54PvBzxYTtT7XGgqpE_4JpWZ9nLQZWxG9ZNCxJG8dhE077LBSd1iM6JdvfFAVNhCG2VL-xtYg5hWoJkPLJDhMszJZE55pqAXiAodyE1RMtw2kPrJ1GDyjX29ainWOidyn5C9DuD0CtCekpDr
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

js
tags.mathtag.com/notify/ Frame 1A21
3 KB
2 KB
Script
General
Full URL
https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvWVRJeFptWmtaVGd0WW1ZeVpTMHdNbVpqTFRBd01EQXRNREF3TURBd01EQXdNREF3LzY3NDMxNDE0ODEzMDg4NzUwNi82NjIyMzMyLzQ1NjIzMDYvNC9ESFNDM3Nsb1NycWg5enJyUjFEdTU0OE9lUE5GOFZIeGl6cE1hc0V2RUFZLzEvNC8wLzAvOTU2ODAzLzAvMjE2NTM2LzY1MTg3MS8xLzAvMC9NREF3TURBd01EQXRNREF3TUMwd01EQXdMVEF3TURBdE1EQXdNREF3TURBd01EQXcvMC8wLzAvMC8wLzY3NDMxNDE0ODEzMDg4NzUwNi96cmgvMC84My8xMS85OTkvMTYyLzJhMDA6Yzk4OjIwMzA6Oi8wLjAwMC8xNjg3NzQwNDUzLzE2ODc3NTMwNTMvNC9wdWItNzk4MzY1MTI1NzgzODI4Mi8/VyGBx_7rK_HnORBCuru_44pG0cA&nodeid=4836&group=zrh&auctionid=674314148130887506&pbs_auctionid=674314148130887506&shardkey=674314148130887506&sid=4562306&cid=6622332&bp=a_aiebbd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.173&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCqH4bJeCYZNOeK9GSrATA37jgC8-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTc5ODM2NTEyNTc4MzgyODLIAQngAgCoAwHIAwKqBPgBT9A9nD7P7nONlnsmRbQBldQQh0N8bzRlNVQGG5rDOvOuY-c_ENZOI-NmiJUhoFicC_Ee4GExScmmBm_UTQP8dsRr-QYrnT5mKquvlw9yWUxFywpyfxWKsOBI8y8QfhxjXbcCTSQY4gjVKhrMq-fjdHzDQvWz0vUf3vb7RZkfTLqxTI9VscK_ZcXpHrxD6CVm4A42GbzgxHtmWlUHpd4qapmo5GeummdTxSIjwht9YtJSGiTLTQMlSnwA8-AtLQJbWlSeSCkqJDhHO2P4RV9kkiAO9b7Qxg7yfqVDF3es7IEHIukJmoEoIyZvvHcWzWXIX04f-lmV4-bgBAGABr7U1vzZmuidqAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA8ggbYWR4LXN1YnN5bi03Mjc1NTI4NDUzMTYyMzA5-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_0kRp_ZrM1lJgXF0K7UVuDO8nWDIQ%26client%3Dca-pub-7983651257838282%26adurl%3D
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software
MMBD/3.392.6 /
Resource Hash
8fa78a13364fe775263b0af713b452fd1de4920bdd4ac3041fd0213d73484772

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:34 GMT
x-mm-nodeid
4836
Content-Encoding
gzip
x-mm-bid-request-time
1687740453
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Connection
close
x-mm-handled-by-owner
true
Last-Modified
Mon, 26 Jun 2023 00:47:33 GMT
Server
MMBD/3.392.6
x-mm-latency
0 (1)
x-mm-notify-action-done
LD5wfw
Content-Type
application/x-javascript; charset=UTF-8
x-mm-dbg
NotCount
Cache-Control
no-cache
x-mm-host
zrh-router-x85, zrh-bidder-x171
x-mm-lag
1
Expires
Mon, 26 Jun 2023 00:47:33 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 1A21
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/window_focus_fy2021.js
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 19:48:41 GMT
content-encoding
br
x-content-type-options
nosniff
age
17933
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 09 Jul 2023 19:48:41 GMT
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 1A21
19 KB
8 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8d67e93b773c993230e55a3881853d5e8d399b32fb591d845c41553c0fe8c71b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 19:19:38 GMT
content-encoding
br
x-content-type-options
nosniff
age
19676
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8131
x-xss-protection
0
server
cafe
etag
7076601798724011321
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 09 Jul 2023 19:19:38 GMT
l
www.google.com/ads/measurement/ Frame 1A21
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSfGpBqbMbw1pUrzGitVVuZu_7sg1S76tcQsiLlHRbnbd2Nt6v5mK49BSZLVWho5PeS_XPrceJKVPa5edhZNz5FKOcdPA
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

ext.js
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 1A21
24 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 21 Jun 2023 12:02:51 GMT
content-encoding
br
x-content-type-options
nosniff
age
391483
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6402
x-xss-protection
0
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Thu, 20 Jun 2024 12:02:51 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 1A21
179 KB
56 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
13b4bb0bb059eee9a7ddf5b8ae3f395e28e7f81918eeac0ec934f3d050c4d0a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57242
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1687383875062185"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 26 Jun 2023 00:47:34 GMT
pixel
googleads.g.doubleclick.net/xbbe/ Frame 287E
624 B
242 B
Document
General
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjPyrHlATAB&v=APEucNWOriM71fvtNwQ-GDeuO4-9plF2Wiqu1YoDb5RGyekRrPA9G-Qt1OXCPE_aFx9KP6esktblfHF77njyCKV7gKp4NhhjWuBDHQrK3F8Ein0QUdSz4HK1AD5Ay8IrD2YizMJzmS9gnx3tV5pw4zm0zPspYsqOlpugkTE8EAiMiq4ssXRiDBk
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
br
content-length
222
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:47:34 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
dv3.js
pagead2.googlesyndication.com/pagead/js/ Frame 7DEF
78 KB
27 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/dv3.js
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
28042
x-xss-protection
0
server
cafe
etag
3261498652431352696
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=600
timing-allow-origin
*
expires
Mon, 26 Jun 2023 00:47:34 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 7DEF
42 B
63 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-Cg-mOUnoLi3zUvwBxpPEI0fMDy674zQCFGqVCy9A-88UHqtoN62phXH9e5jQT8J-iTGFsrAfE3cMU26ELBViBqQcEKFUmVaelg8vDEAIW2v9fRZ3w
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 7DEF
0
20 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=4246618124978499561&x=1&ct=76
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 7DEF
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/window_focus_fy2021.js
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 19:48:41 GMT
content-encoding
br
x-content-type-options
nosniff
age
17933
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 09 Jul 2023 19:48:41 GMT
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 7DEF
19 KB
8 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8d67e93b773c993230e55a3881853d5e8d399b32fb591d845c41553c0fe8c71b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 19:19:38 GMT
content-encoding
br
x-content-type-options
nosniff
age
19676
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8131
x-xss-protection
0
server
cafe
etag
7076601798724011321
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 09 Jul 2023 19:19:38 GMT
l
www.google.com/ads/measurement/ Frame 7DEF
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQpR6Ba1lyRBpWZWuEpK-ptBU2fL_Ka-PRDhQmKVvltRwT1Y5jBm8uoC-7vOmNj7haCnREDiSIzYXfWeMNDLMK12rNoQQ
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 7DEF
179 KB
56 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
13b4bb0bb059eee9a7ddf5b8ae3f395e28e7f81918eeac0ec934f3d050c4d0a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57242
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1687383875062185"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 26 Jun 2023 00:47:34 GMT
pixel
googleads.g.doubleclick.net/xbbe/ Frame 6ED6
640 B
262 B
Document
General
Full URL
https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARiM97DlATAB&v=APEucNWcDxx8OKanGfQXnicp3wea-jwNxeYRj-BnV7vOxwDzN3EtQfy-UOnMF7OuQq64B1J2-HmXXm66Ekh6J8Hn4s6zVZKlIV0AI425YMADldT6L4BRLKmu7K2XyMyOuysN3WGA6Wqe5cmHOzSlYuIPARKJbT_pl3mUfmAVkYtiL5i57BtZpJg
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding
br
content-length
242
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:47:34 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
dv3.js
pagead2.googlesyndication.com/pagead/js/ Frame 6ED2
78 KB
27 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/dv3.js
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
15b18f906b7ca778339817ae6b31289687188a5cb4ca6904865544e48324686c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
28050
x-xss-protection
0
server
cafe
etag
6804656964934420094
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=600
timing-allow-origin
*
expires
Mon, 26 Jun 2023 00:47:34 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 6ED2
42 B
63 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CBWS5K_SN3lf6tiD_qUa8GuZdG6iv1nBLj79aSVDxxlwMy2yo-8W0zBx-5x0wqLeYxfQcOBjMr7T6XF-darfI7AKE3erlCCAivjxEOOvr1RqE7E5I
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 6ED2
0
20 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=14270463404999264288&x=1&ct=76
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 6ED2
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/window_focus_fy2021.js
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 19:48:41 GMT
content-encoding
br
x-content-type-options
nosniff
age
17933
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 09 Jul 2023 19:48:41 GMT
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 6ED2
19 KB
8 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8d67e93b773c993230e55a3881853d5e8d399b32fb591d845c41553c0fe8c71b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 19:19:38 GMT
content-encoding
br
x-content-type-options
nosniff
age
19676
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8131
x-xss-protection
0
server
cafe
etag
7076601798724011321
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 09 Jul 2023 19:19:38 GMT
l
www.google.com/ads/measurement/ Frame 6ED2
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSPTTakYVsvw5QAcTQ_l9nJNBYNSmE-VQXXLaRv_CeZXiNSkJiKpAJsJN55iiOyOR9SXUPZwx3BiMSUZXY9JJ7ufKkZ6g
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 6ED2
179 KB
56 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
13b4bb0bb059eee9a7ddf5b8ae3f395e28e7f81918eeac0ec934f3d050c4d0a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57242
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1687383875062185"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 26 Jun 2023 00:47:34 GMT
m_js_controller_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 578A
34 KB
13 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/m_js_controller_fy2021.js
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
63715e8ffb3d4efab913b95b9369dc96445bde93529cdc97909bdf57a8134300
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 20:30:29 GMT
content-encoding
br
x-content-type-options
nosniff
age
15425
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13554
x-xss-protection
0
server
cafe
etag
10619647361806024282
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 09 Jul 2023 20:30:29 GMT
ext.js
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 578A
24 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 21 Jun 2023 12:02:51 GMT
content-encoding
br
x-content-type-options
nosniff
age
391483
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6402
x-xss-protection
0
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Thu, 20 Jun 2024 12:02:51 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 578A
179 KB
56 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
13b4bb0bb059eee9a7ddf5b8ae3f395e28e7f81918eeac0ec934f3d050c4d0a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57242
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1687383875062185"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 26 Jun 2023 00:47:34 GMT
abg_lite_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/ Frame 578A
22 KB
9 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/abg_lite_fy2021.js
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
81f66fb840c902b62f902bc4e27a6e3dee001d2f8babf5e767f78f16136ff0b7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 18:49:13 GMT
content-encoding
br
x-content-type-options
nosniff
age
21501
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9007
x-xss-protection
0
server
cafe
etag
10216374826415589524
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 09 Jul 2023 18:49:13 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 578A
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/window_focus_fy2021.js
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 19:48:41 GMT
content-encoding
br
x-content-type-options
nosniff
age
17933
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 09 Jul 2023 19:48:41 GMT
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 578A
19 KB
8 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8d67e93b773c993230e55a3881853d5e8d399b32fb591d845c41553c0fe8c71b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 19:19:38 GMT
content-encoding
br
x-content-type-options
nosniff
age
19676
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8131
x-xss-protection
0
server
cafe
etag
7076601798724011321
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 09 Jul 2023 19:19:38 GMT
l
www.google.com/ads/measurement/ Frame 578A
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaTTXEjeHqDDclZ46IVEFKSeEgJyHNbIdQWMwYh4y6qtMONLvMntfGVN8DhaHahpPDZ2Uq4rzJAZ0N6oyxyKpabvc9sXpg
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

m_js_controller_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 0D4C
34 KB
13 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/m_js_controller_fy2021.js
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
63715e8ffb3d4efab913b95b9369dc96445bde93529cdc97909bdf57a8134300
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 20:30:29 GMT
content-encoding
br
x-content-type-options
nosniff
age
15425
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13554
x-xss-protection
0
server
cafe
etag
10619647361806024282
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 09 Jul 2023 20:30:29 GMT
ext.js
tpc.googlesyndication.com/safeframe/1-0-40/js/ Frame 0D4C
24 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-40/js/ext.js
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 21 Jun 2023 12:02:51 GMT
content-encoding
br
x-content-type-options
nosniff
age
391483
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6402
x-xss-protection
0
last-modified
Thu, 03 Nov 2022 19:10:08 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Thu, 20 Jun 2024 12:02:51 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 0D4C
179 KB
56 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
13b4bb0bb059eee9a7ddf5b8ae3f395e28e7f81918eeac0ec934f3d050c4d0a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57242
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1687383875062185"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 26 Jun 2023 00:47:34 GMT
abg_lite_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/ Frame 0D4C
22 KB
9 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/abg_lite_fy2021.js
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
81f66fb840c902b62f902bc4e27a6e3dee001d2f8babf5e767f78f16136ff0b7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 18:49:13 GMT
content-encoding
br
x-content-type-options
nosniff
age
21501
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9007
x-xss-protection
0
server
cafe
etag
10216374826415589524
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 09 Jul 2023 18:49:13 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 0D4C
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/window_focus_fy2021.js
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 19:48:41 GMT
content-encoding
br
x-content-type-options
nosniff
age
17933
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 09 Jul 2023 19:48:41 GMT
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 0D4C
19 KB
8 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8d67e93b773c993230e55a3881853d5e8d399b32fb591d845c41553c0fe8c71b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 19:19:38 GMT
content-encoding
br
x-content-type-options
nosniff
age
19676
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8131
x-xss-protection
0
server
cafe
etag
7076601798724011321
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 09 Jul 2023 19:19:38 GMT
l
www.google.com/ads/measurement/ Frame 0D4C
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaSIabWuIPD9vbSTqCWhi3uHPW-oVXBt--Q8YSfMH73PFdcSR7azSf6zhn7yNypoLYvE44xypp-Juibb7eypMF5S5oEpqA
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

rum
dsum-sec.casalemedia.com/ Frame 287E
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMIjiuIdDvjhSBZ9gQfmF9g&google_cver=1
43 B
766 B
Image
General
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMIjiuIdDvjhSBZ9gQfmF9g&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjPyrHlATAB&v=APEucNWOriM71fvtNwQ-GDeuO4-9plF2Wiqu1YoDb5RGyekRrPA9G-Qt1OXCPE_aFx9KP6esktblfHF77njyCKV7gKp4NhhjWuBDHQrK3F8Ein0QUdSz4HK1AD5Ay8IrD2YizMJzmS9gnx3tV5pw4zm0zPspYsqOlpugkTE8EAiMiq4ssXRiDBk
Protocol
HTTP/1.1
Server
185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 26 Jun 2023 00:47:34 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=499
Content-Length
43
Expires
0

Redirect headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMIjiuIdDvjhSBZ9gQfmF9g&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
rum
dsum-sec.casalemedia.com/ Frame 287E
Redirect Chain
  • https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
  • https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
  • https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZJjgJuzYkefU3A3c3kdCJQAA
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMIjiuIdDvjhSBZ9gQfmF9g&google_cver=1
43 B
766 B
Image
General
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMIjiuIdDvjhSBZ9gQfmF9g&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjPyrHlATAB&v=APEucNWOriM71fvtNwQ-GDeuO4-9plF2Wiqu1YoDb5RGyekRrPA9G-Qt1OXCPE_aFx9KP6esktblfHF77njyCKV7gKp4NhhjWuBDHQrK3F8Ein0QUdSz4HK1AD5Ay8IrD2YizMJzmS9gnx3tV5pw4zm0zPspYsqOlpugkTE8EAiMiq4ssXRiDBk
Protocol
HTTP/1.1
Server
185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 26 Jun 2023 00:47:34 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=497
Content-Length
43
Expires
0

Redirect headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEMIjiuIdDvjhSBZ9gQfmF9g&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
313
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
setuid
ib.adnxs.com/ Frame 287E
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
  • https://ib.adnxs.com/setuid?entity=101&code=CAESEEPiEz1q-qymy0Q6SGjZWWs&google_cver=1
43 B
1 KB
Image
General
Full URL
https://ib.adnxs.com/setuid?entity=101&code=CAESEEPiEz1q-qymy0Q6SGjZWWs&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjPyrHlATAB&v=APEucNWOriM71fvtNwQ-GDeuO4-9plF2Wiqu1YoDb5RGyekRrPA9G-Qt1OXCPE_aFx9KP6esktblfHF77njyCKV7gKp4NhhjWuBDHQrK3F8Ein0QUdSz4HK1AD5Ay8IrD2YizMJzmS9gnx3tV5pw4zm0zPspYsqOlpugkTE8EAiMiq4ssXRiDBk
Protocol
HTTP/1.1
Server
185.89.210.20 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
944.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 26 Jun 2023 00:47:34 GMT
AN-X-Request-Uuid
cc8e91a7-4ac8-4216-adac-c8711505c49f
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
image/gif
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
37.58.58.248; 37.58.58.248; 944.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://ib.adnxs.com/setuid?entity=101&code=CAESEEPiEz1q-qymy0Q6SGjZWWs&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
290
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 287E
Redirect Chain
  • https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dappnexus%26google_hm%3D%24%7BBASE64_UID_ENC%7D
  • https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mzc4MTg1MjU3OTc2OTQ3NzMwOA%3D%3D
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mzc4MTg1MjU3OTc2OTQ3NzMwOA%3D%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARjPyrHlATAB&v=APEucNWOriM71fvtNwQ-GDeuO4-9plF2Wiqu1YoDb5RGyekRrPA9G-Qt1OXCPE_aFx9KP6esktblfHF77njyCKV7gKp4NhhjWuBDHQrK3F8Ein0QUdSz4HK1AD5Ay8IrD2YizMJzmS9gnx3tV5pw4zm0zPspYsqOlpugkTE8EAiMiq4ssXRiDBk
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Mon, 26 Jun 2023 00:47:34 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
37.58.58.248; 37.58.58.248; 944.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
f74360a5-9f71-4ce7-9a88-21124b3a7be5
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=Mzc4MTg1MjU3OTc2OTQ3NzMwOA%3D%3D
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame 6ED6
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
  • https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOGZ7KL3jNgjKkEOGvUVKc8&google_cver=1
43 B
114 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOGZ7KL3jNgjKkEOGvUVKc8&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARiM97DlATAB&v=APEucNWcDxx8OKanGfQXnicp3wea-jwNxeYRj-BnV7vOxwDzN3EtQfy-UOnMF7OuQq64B1J2-HmXXm66Ekh6J8Hn4s6zVZKlIV0AI425YMADldT6L4BRLKmu7K2XyMyOuysN3WGA6Wqe5cmHOzSlYuIPARKJbT_pl3mUfmAVkYtiL5i57BtZpJg
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
via
1.1 google
server
OXGW/0.0.0
vary
Accept
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEOGZ7KL3jNgjKkEOGvUVKc8&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
295
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
cm
us-u.openx.net/w/1.0/ Frame 6ED6
43 B
304 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARiM97DlATAB&v=APEucNWcDxx8OKanGfQXnicp3wea-jwNxeYRj-BnV7vOxwDzN3EtQfy-UOnMF7OuQq64B1J2-HmXXm66Ekh6J8Hn4s6zVZKlIV0AI425YMADldT6L4BRLKmu7K2XyMyOuysN3WGA6Wqe5cmHOzSlYuIPARKJbT_pl3mUfmAVkYtiL5i57BtZpJg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/0.0.0 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
content-encoding
gzip
via
1.1 google
server
OXGW/0.0.0
vary
Accept, Accept-Encoding
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
56
expires
Mon, 26 Jul 1997 05:00:00 GMT
um
sync.teads.tv/ Frame 6ED6
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
  • https://sync.teads.tv/um?eid=3&uid=CAESENB1Pr-GJFOaN09645HJk-c&google_cver=1
23 B
163 B
Image
General
Full URL
https://sync.teads.tv/um?eid=3&uid=CAESENB1Pr-GJFOaN09645HJk-c&google_cver=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARiM97DlATAB&v=APEucNWcDxx8OKanGfQXnicp3wea-jwNxeYRj-BnV7vOxwDzN3EtQfy-UOnMF7OuQq64B1J2-HmXXm66Ekh6J8Hn4s6zVZKlIV0AI425YMADldT6L4BRLKmu7K2XyMyOuysN3WGA6Wqe5cmHOzSlYuIPARKJbT_pl3mUfmAVkYtiL5i57BtZpJg
Protocol
H2
Server
2.18.161.51 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-161-51.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.10 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

expires
Mon, 26 Jun 2023 00:47:34 GMT
pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
cache-control
max-age=0, no-cache, no-store
server
akka-http/10.2.10
content-length
23
content-type
image/gif

Redirect headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://sync.teads.tv/um?eid=3&uid=CAESENB1Pr-GJFOaN09645HJk-c&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
281
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
um
sync.teads.tv/ Frame 6ED6
23 B
163 B
Image
General
Full URL
https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPG8uQEQu-u9ARiM97DlATAB&v=APEucNWcDxx8OKanGfQXnicp3wea-jwNxeYRj-BnV7vOxwDzN3EtQfy-UOnMF7OuQq64B1J2-HmXXm66Ekh6J8Hn4s6zVZKlIV0AI425YMADldT6L4BRLKmu7K2XyMyOuysN3WGA6Wqe5cmHOzSlYuIPARKJbT_pl3mUfmAVkYtiL5i57BtZpJg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.161.51 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-161-51.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.10 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

expires
Mon, 26 Jun 2023 00:47:34 GMT
pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
cache-control
max-age=0, no-cache, no-store
server
akka-http/10.2.10
content-length
23
content-type
image/gif
si
googleads.g.doubleclick.net/pagead/drt/ Frame 5622
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
0
Image
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H3
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Redirect headers

date
Mon, 26 Jun 2023 00:47:34 GMT
x-content-type-options
nosniff
server
cafe
content-type
text/html; charset=UTF-8
location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
gen_204
pagead2.googlesyndication.com/pagead/ Frame 7DEF
0
20 B
Ping
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1161698462532&version=m202301230201
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 7DEF
0
20 B
Ping
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1161698462532&version=m202301230201&ct=76&x=1&cor=4246618124978499600
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ad
googleads.g.doubleclick.net/dbm/ Frame 7DEF
87 KB
36 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B3NmchB9-I6SeSQGxB_7OYL6XWN1P7gWPz9hZQg7lg_tPKT90K4blUhpcZEB7rxv-7pZQM0nz4VsFh8gUBENDMDwfO7sKse3V5aX91fXubDuwjWq7JsL5KU7U7-1qceVGGHe15hdDNX3s43nP1KUxAK37hbCBlPvM1DgD83YmOHQo4prM&dbm_d=AKAmf-BhNNlF6zBx3cllW0UERr9AvPGeREc6jeF8ZHIqxfmykfdODg4H7xOEFKJAAh410O1fhwHRLqZV_rnZS2C8ln_MVE72i7dI-1zb-VN5U17DXdc8T7WVWlJsDPYAEdzcvVdGkBMNDr7olcCbvXW9AjQUoOTM3UY1Hu8KmuDrP1EUPhl_u7wsy0kfuBAczGSFdRHXeo5VMvkUr2J0wPG8KvmA1Dz3mdYBnffQd6k3NN_ASg5wFX5nNKGSskC2VQtTw92jubeohC-L-joYcBaCjfrZR6nquBQXt67XFcYkB8WvhhOa49fb4RT-MEmyGEROrKUUmnsGFkKI8t0L1dc5ya2swVqwjykfls5TAZIcAlrd31hHrYbf8hSIwbX3ctwVRNR0gFewYXXh2OJQLzuN4o486y4o8VjacyqNic2M0ZMIbFfstvhKY11_ddS64M0vJTJULWGGILtdo_O3oGfDtRWbDGmf2JN-At0Yg1MLY9quY3cjCjhPbJcN1dXrxcHzbi7-ihhhlM9bBCeLuvCqp9eWpYbS30Inr83KjAtQO1izPsQXj5GqUmI6Lf9KZ4nUYCC67V-unfuIObDinC1a989YKEZjeWK7aMpytUJ0UAh-9H16IEbHh908w24g_sXNBuwDtCobp4t93Z-oSkP6tsy9iH9kC6-w9obHAFdn-97El9Vup_pQQTxhXWw3YmioI0naB0dtPEMl8vYiGbYfPpSWQhPrrP64f9JV9G4J1brPGroTRnUkpd4PgZuvyQz9QDzhJUrLWLctUVTOhXogkJ2Swm3sRof7rRVzyZ1T5pSgH5nwCZCHFPxuBla_xhZwBZhx9MROMAlbdZ0IJBOAUWXao6SXDrLsVakF_CXJ1MIBGmVU28oTTIxEXddeKbVyTn2zUD_VpYOPx6epVArV8grhXXtsDm3jp5qiLXxp-xAXXETARYqGux2VDK8Wry494vWZJD3a9S3QW532fVmiOfi_S2xtJi2FrGg7YG74P9TOnTadRNWM37lcJqu5gNNwEfiTp_0-uU_YsYqLBecr5Qh841tkr5UpR1VX2leCNc-uIv85JWR3_GQbYjuNtgutMc4EcISzHq4IAU3b3k6lgHGsm0aivTC5Edpw8c2mVT3Txiak3xaWrRisIBL0kAkDGC5xiE7T5RYe9SJmTmY58EdQhCgM7-wTxNTuGTqFMUH9WPGaOx_0m8y8dXB6G_Ngu2_4MZzFpxqUYTj3y8TmHFl5VQlGpFhCss5kNeCCgm0yO34AgL6r1GFOuiM7zae9IzUf1AxaOrK61I8V81c7GYxKiDJMy96qzq6G7GSfFAyxO2YttVY7hT7JBOyc4R8425wcLgKtVR9twutW5YyOL41QKcA1w-R6WSUIUfX3livi5NEsxMK1toceDiiR3xOiVdihUJiN8vvmUKNrH764mnweCPBWAxgFlTrW_VnhIAgyiY4vIuye1rFOSJ62ONIAg5N0z57B-a91k7EaCQppPhtxvEDBuGRAqK_xet8Z89IfNxsAM7fFZUc8QnuPp9oQx240edkb6NxY-2dxcMMBVNd8n6Vcfi3bDM_rredxZ3Ze1-fOt6SB3JLskkzGnO3yLDX5IyuNsSacuci_FgYWgCI6XdFTq8TiU8m7_U9kiZTtfBL-f5bjajHTqBwlHf8nppmUcKHoW2_eeFWec2Jyt5ZA9DvQQbGAnBhP5efwriQISop7t_xc05heMa42QanHdwS3M95uLOx9vVUZz7by19pitjbgvxAGIGBB2YSTUeZ5s286ji0jeV1n7iJvvwyBvQ6QL0HTsUQcb3RnT8YOHc0SBjVEUhdl_vIzuov_KxlLDHBTY0IvPO33r1Z1N_eC_dY5ySkmBGTl8xtM2o3xCmwdn-eH01SvWdphTfMXFs4lmg2mmmUOCrDwIIK9apJ5Nuegw7QUeGvh07Bl6eSpvg6FHA_Jlp2fis7tQ7MK8DukXMiIAgyRtDPqR7Xxm12JJSwbdUXdEXakNqL1bgDLL6cvhar9gcgzlzAx7U5AIEYd4AhVMHKyogP3BJWs3tCIAiiuWoBHiTBZbfoRfVNY7-yW6qyzRzJbCXZ4D8wwXO9ucKVKZqxZCKWzMEEcCFP1i9i7WVWGRPcK-oiI8D5rUnUr9GLkhajSH0UC2qvvsVvFj5VVQc2xmGofFaMgrFU_GdaEl8ocdK_efSu3jp211A7mhxY64KtxcjaDb1qASQB2t1LlzGBo_3Z6USekbzhucKKaduWQ3GkHyHMkHAryGYoe9N_Vw--_wQuIZh3cGVACzX9H5SDubTVCbbftvuxbYmm3UHDmdI7VGnmsxRvwvEE7rfTg1RzuSep1jAVJrAurdhEFZ5EvSZH7JL5sIpRZF4iPDg2WnpW3qvg-fmiUpY7E8KInhtpz0UQ8jJM9plk2f6YrHeH6-i5uVJ9tPk0PaL3YTTJGw7gxctsgrmm8TIPzg7srosTFg-FD210tvs38HOJJVZpPz6keM_oXdZxEhKm_BuGGy76kvEj37cGWgOwRN7ZxOKphstwkjIKiWKzXZMdEhCRE_6YgCwFbwmgrLmvw4QFD4oGI3kbO1yVMMfrc9jSfZVq_7MG6xP16vRYZ4IrFrJLqmWbtTxwfYclME2MxJjZfflrVjCZW0H39bNOuRg4rBsdeHrNP8Z9OvG5d9Pf48e9Uw_KUBszVqNER_AaeY6cDfM0LxZiUmYsukR_gnlHPW_cWC6Oogbz3rww5CRI-OwJFQaTQ9onFFCAZv3DoFO1ZUatJIz_DgLqbFk47hVQgHhVMf4g3hf16bXIEtMplIUCJ0cqaytrIMITtovSRimyzhibigCaZsDba7wUJJRviv25EywcakwjRS-rTzoOMgl7k2EsaBech3myLP34CotmczkkevnTAOjBe-2mDi0DlOsSuW2lmJxrvpSjmOHnv82H9JJlQaYZ5SjPrROrZRLQpc5RhVC2QccuIS7P48BwVjcZoFw64Yc4DqEGqyNgKej-EKSy9GhYjlfH_3UkOqaIQrsblZWLogqwTafvusKCZwzAaKbLsX5J5h46kWtTurW1-jazGUEBlgK-z7sQsO4tX2xpJ65RcUrcNiB0QUR4qQk8anqL_iApoIx8SKsrxQKvgMix9703h_zTw_s4qC5-G4_09Mf1ivzw-Rx3gz1cXV6dBk2iIeF8lpaz4IvOpyDzJFVG54bggp_HXrJT7aEoaWBwSuvI827BVKhhcaWEQH6ik9o5eOGGMkkh8hbkJxwqx-V3-ZYKB_jTqhmxvSGBNxBFv1PrtZIWpXWqI00O8VrET4OTZ9-9rDSxz_dtaAefFCSWhN4uRaha2bATl8JBIhFKgHJB4BPkCx4MaMlvzLQ&cid=CAQSOwBygQiDs7BmK0K-MwR-e_kxgxi3y3s9MZ_xMZW5V_e2MN-pD6sYQw5pBvu2nhNuJlYJOPBrlpM3dLkPGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=4246618124978499600&adk=2465470143&idt=34&cac=0&dtd=26
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
319caa83ea9ebbcba230cbd1f27e850f6a57bac0dbabababfed010cdbd9d2d2f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
36759
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ajk4xlebn4mw
hal9000.redintelligence.net/zone/ Frame 1A21
10 KB
4 KB
Script
General
Full URL
https://hal9000.redintelligence.net/zone/ajk4xlebn4mw?subid=&gdpr=1&gdpr_consent=li&rnd=674314148130887506&extVar[]=DOUBLEBORDER:1&extVar[]=MMA_SSP:adx&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DWl7tkedum3B-P5FulDCt_A%26exch_seat%3D20035004448%26mt_aid%3D674314148130887506%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_cid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCqH4bJeCYZNOeK9GSrATA37jgC8-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTc5ODM2NTEyNTc4MzgyODLIAQngAgCoAwHIAwKqBPgBT9A9nD7P7nONlnsmRbQBldQQh0N8bzRlNVQGG5rDOvOuY-c_ENZOI-NmiJUhoFicC_Ee4GExScmmBm_UTQP8dsRr-QYrnT5mKquvlw9yWUxFywpyfxWKsOBI8y8QfhxjXbcCTSQY4gjVKhrMq-fjdHzDQvWz0vUf3vb7RZkfTLqxTI9VscK_ZcXpHrxD6CVm4A42GbzgxHtmWlUHpd4qapmo5GeummdTxSIjwht9YtJSGiTLTQMlSnwA8-AtLQJbWlSeSCkqJDhHO2P4RV9kkiAO9b7Qxg7yfqVDF3es7IEHIukJmoEoIyZvvHcWzWXIX04f-lmV4-bgBAGABr7U1vzZmuidqAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA8ggbYWR4LXN1YnN5bi03Mjc1NTI4NDUzMTYyMzA5-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_0kRp_ZrM1lJgXF0K7UVuDO8nWDIQ%2526client%253Dca-pub-7983651257838282%2526adurl%253D%26mt_lp%3Dhttps%253A%2F%2Fwww.soberberlin.com%2F%26redirect%3D
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.150.63.201.138.clients.your-server.de
Software
Apache /
Resource Hash
4d4ade47e7e34a0fb1e94299ab2892a2d226f8a11fee5ca00d6d81ae663aeb5d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:34 GMT
Content-Encoding
gzip
Server
Apache
Connection
close
Content-Length
3457
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
ck-confirm
tags.mathtag.com/ Frame 1A21
49 B
330 B
Image
General
Full URL
https://tags.mathtag.com/ck-confirm?bid_id=674314148130887506&node_id=4836&exch_id=4
Requested by
Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvWVRJeFptWmtaVGd0WW1ZeVpTMHdNbVpqTFRBd01EQXRNREF3TURBd01EQXdNREF3LzY3NDMxNDE0ODEzMDg4NzUwNi82NjIyMzMyLzQ1NjIzMDYvNC9ESFNDM3Nsb1NycWg5enJyUjFEdTU0OE9lUE5GOFZIeGl6cE1hc0V2RUFZLzEvNC8wLzAvOTU2ODAzLzAvMjE2NTM2LzY1MTg3MS8xLzAvMC9NREF3TURBd01EQXRNREF3TUMwd01EQXdMVEF3TURBdE1EQXdNREF3TURBd01EQXcvMC8wLzAvMC8wLzY3NDMxNDE0ODEzMDg4NzUwNi96cmgvMC84My8xMS85OTkvMTYyLzJhMDA6Yzk4OjIwMzA6Oi8wLjAwMC8xNjg3NzQwNDUzLzE2ODc3NTMwNTMvNC9wdWItNzk4MzY1MTI1NzgzODI4Mi8/VyGBx_7rK_HnORBCuru_44pG0cA&nodeid=4836&group=zrh&auctionid=674314148130887506&pbs_auctionid=674314148130887506&shardkey=674314148130887506&sid=4562306&cid=6622332&bp=a_aiebbd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.173&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCqH4bJeCYZNOeK9GSrATA37jgC8-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTc5ODM2NTEyNTc4MzgyODLIAQngAgCoAwHIAwKqBPgBT9A9nD7P7nONlnsmRbQBldQQh0N8bzRlNVQGG5rDOvOuY-c_ENZOI-NmiJUhoFicC_Ee4GExScmmBm_UTQP8dsRr-QYrnT5mKquvlw9yWUxFywpyfxWKsOBI8y8QfhxjXbcCTSQY4gjVKhrMq-fjdHzDQvWz0vUf3vb7RZkfTLqxTI9VscK_ZcXpHrxD6CVm4A42GbzgxHtmWlUHpd4qapmo5GeummdTxSIjwht9YtJSGiTLTQMlSnwA8-AtLQJbWlSeSCkqJDhHO2P4RV9kkiAO9b7Qxg7yfqVDF3es7IEHIukJmoEoIyZvvHcWzWXIX04f-lmV4-bgBAGABr7U1vzZmuidqAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA8ggbYWR4LXN1YnN5bi03Mjc1NTI4NDUzMTYyMzA5-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_0kRp_ZrM1lJgXF0K7UVuDO8nWDIQ%26client%3Dca-pub-7983651257838282%26adurl%3D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software
MMBD/3.392.6 /
Resource Hash
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:34 GMT
Server
MMBD/3.392.6
Content-Type
image/gif
Cache-Control
no-cache
x-mm-host
zrh-router-x37, zrh-bidder-x171
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
49
Expires
Mon, 26 Jun 2023 00:47:33 GMT
img
pixel.mathtag.com/event/ Frame 1A21
43 B
418 B
Image
General
Full URL
https://pixel.mathtag.com/event/img?mt_id=1368875&mt_adid=216764&v1=4&v2=674314148130887506&v3=651871&v4=4562306&v5=6622332&mt_nsync=1&no_attr=1
Requested by
Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvWVRJeFptWmtaVGd0WW1ZeVpTMHdNbVpqTFRBd01EQXRNREF3TURBd01EQXdNREF3LzY3NDMxNDE0ODEzMDg4NzUwNi82NjIyMzMyLzQ1NjIzMDYvNC9ESFNDM3Nsb1NycWg5enJyUjFEdTU0OE9lUE5GOFZIeGl6cE1hc0V2RUFZLzEvNC8wLzAvOTU2ODAzLzAvMjE2NTM2LzY1MTg3MS8xLzAvMC9NREF3TURBd01EQXRNREF3TUMwd01EQXdMVEF3TURBdE1EQXdNREF3TURBd01EQXcvMC8wLzAvMC8wLzY3NDMxNDE0ODEzMDg4NzUwNi96cmgvMC84My8xMS85OTkvMTYyLzJhMDA6Yzk4OjIwMzA6Oi8wLjAwMC8xNjg3NzQwNDUzLzE2ODc3NTMwNTMvNC9wdWItNzk4MzY1MTI1NzgzODI4Mi8/VyGBx_7rK_HnORBCuru_44pG0cA&nodeid=4836&group=zrh&auctionid=674314148130887506&pbs_auctionid=674314148130887506&shardkey=674314148130887506&sid=4562306&cid=6622332&bp=a_aiebbd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.173&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCqH4bJeCYZNOeK9GSrATA37jgC8-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTc5ODM2NTEyNTc4MzgyODLIAQngAgCoAwHIAwKqBPgBT9A9nD7P7nONlnsmRbQBldQQh0N8bzRlNVQGG5rDOvOuY-c_ENZOI-NmiJUhoFicC_Ee4GExScmmBm_UTQP8dsRr-QYrnT5mKquvlw9yWUxFywpyfxWKsOBI8y8QfhxjXbcCTSQY4gjVKhrMq-fjdHzDQvWz0vUf3vb7RZkfTLqxTI9VscK_ZcXpHrxD6CVm4A42GbzgxHtmWlUHpd4qapmo5GeummdTxSIjwht9YtJSGiTLTQMlSnwA8-AtLQJbWlSeSCkqJDhHO2P4RV9kkiAO9b7Qxg7yfqVDF3es7IEHIukJmoEoIyZvvHcWzWXIX04f-lmV4-bgBAGABr7U1vzZmuidqAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA8ggbYWR4LXN1YnN5bi03Mjc1NTI4NDUzMTYyMzA5-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_0kRp_ZrM1lJgXF0K7UVuDO8nWDIQ%26client%3Dca-pub-7983651257838282%26adurl%3D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.148.198 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-101-148-198.deploy.static.akamaitechnologies.com
Software
MT3 1031 59fd23a master cdg cdg-pixel-x15 config_version:"1438" /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:34 GMT
Server
MT3 1031 59fd23a master cdg cdg-pixel-x15 config_version:"1438"
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
*
Content-Type
image/gif
Cache-Control
no-cache
Connection
keep-alive
Content-Length
43
Expires
Mon, 26 Jun 2023 00:47:33 GMT
img
tags.mathtag.com/event/ Frame 1A21
49 B
330 B
Image
General
Full URL
https://tags.mathtag.com/event/img?type=mmImpTrack&exch=adx&bid=674314148130887506&st=4562306&time=1687740454&nodeid=4836
Requested by
Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvWVRJeFptWmtaVGd0WW1ZeVpTMHdNbVpqTFRBd01EQXRNREF3TURBd01EQXdNREF3LzY3NDMxNDE0ODEzMDg4NzUwNi82NjIyMzMyLzQ1NjIzMDYvNC9ESFNDM3Nsb1NycWg5enJyUjFEdTU0OE9lUE5GOFZIeGl6cE1hc0V2RUFZLzEvNC8wLzAvOTU2ODAzLzAvMjE2NTM2LzY1MTg3MS8xLzAvMC9NREF3TURBd01EQXRNREF3TUMwd01EQXdMVEF3TURBdE1EQXdNREF3TURBd01EQXcvMC8wLzAvMC8wLzY3NDMxNDE0ODEzMDg4NzUwNi96cmgvMC84My8xMS85OTkvMTYyLzJhMDA6Yzk4OjIwMzA6Oi8wLjAwMC8xNjg3NzQwNDUzLzE2ODc3NTMwNTMvNC9wdWItNzk4MzY1MTI1NzgzODI4Mi8/VyGBx_7rK_HnORBCuru_44pG0cA&nodeid=4836&group=zrh&auctionid=674314148130887506&pbs_auctionid=674314148130887506&shardkey=674314148130887506&sid=4562306&cid=6622332&bp=a_aiebbd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.135.173&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCqH4bJeCYZNOeK9GSrATA37jgC8-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTc5ODM2NTEyNTc4MzgyODLIAQngAgCoAwHIAwKqBPgBT9A9nD7P7nONlnsmRbQBldQQh0N8bzRlNVQGG5rDOvOuY-c_ENZOI-NmiJUhoFicC_Ee4GExScmmBm_UTQP8dsRr-QYrnT5mKquvlw9yWUxFywpyfxWKsOBI8y8QfhxjXbcCTSQY4gjVKhrMq-fjdHzDQvWz0vUf3vb7RZkfTLqxTI9VscK_ZcXpHrxD6CVm4A42GbzgxHtmWlUHpd4qapmo5GeummdTxSIjwht9YtJSGiTLTQMlSnwA8-AtLQJbWlSeSCkqJDhHO2P4RV9kkiAO9b7Qxg7yfqVDF3es7IEHIukJmoEoIyZvvHcWzWXIX04f-lmV4-bgBAGABr7U1vzZmuidqAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA8ggbYWR4LXN1YnN5bi03Mjc1NTI4NDUzMTYyMzA5-gsCCAGADAHQFQGAFwE%26num%3D1%26sig%3DAOD64_0kRp_ZrM1lJgXF0K7UVuDO8nWDIQ%26client%3Dca-pub-7983651257838282%26adurl%3D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software
MMBD/3.392.6 /
Resource Hash
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:34 GMT
Server
MMBD/3.392.6
Content-Type
image/gif
Cache-Control
no-cache
x-mm-host
zrh-router-x70, zrh-bidder-x171
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
49
Expires
Mon, 26 Jun 2023 00:47:33 GMT
5648818383791576392
s0.2mdn.net/simgad/ Frame 5622
532 KB
532 KB
Image
General
Full URL
https://s0.2mdn.net/simgad/5648818383791576392
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/022305252018000/amp4ads-v0.mjs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
187574c8a3cf0026b633b356842e03d60450be911027b697e9542a650d1049c8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 23:35:48 GMT
x-content-type-options
nosniff
age
90706
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
544482
x-xss-protection
0
last-modified
Fri, 31 Mar 2023 09:51:21 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 23 Jun 2024 23:35:48 GMT
14952963386359035714
s0.2mdn.net/simgad/ Frame 5622
10 KB
10 KB
Image
General
Full URL
https://s0.2mdn.net/simgad/14952963386359035714
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/022305252018000/amp4ads-v0.mjs
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2d3ebc5963c3ba449fc6f11b2d5ac883abaf7dbc046ac7c1b267518e0ca5fa27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 14:13:04 GMT
x-content-type-options
nosniff
age
124470
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
10020
x-xss-protection
0
last-modified
Fri, 31 Mar 2023 09:51:26 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 23 Jun 2024 14:13:04 GMT
tr.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 5622
3 KB
3 KB
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/abg/tr.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/022305252018000/amp4ads-v0.mjs
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
1e5a886321d0e00c13f7abff03ca39fd782f42997fd34bcbf4fc93718f3670cc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 19:49:55 GMT
x-content-type-options
nosniff
server
cafe
age
17859
etag
9957912877679239782
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/png
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3057
x-xss-protection
0
expires
Mon, 26 Jun 2023 19:49:55 GMT
icon.png
tpc.googlesyndication.com/pagead/images/abg/ Frame 5622
344 B
368 B
Image
General
Full URL
https://tpc.googlesyndication.com/pagead/images/abg/icon.png
Requested by
Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/022305252018000/amp4ads-v0.mjs
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 19:03:49 GMT
x-content-type-options
nosniff
server
cafe
age
20625
etag
6766994032117382215
vary
Accept-Encoding
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/png
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
344
x-xss-protection
0
expires
Mon, 26 Jun 2023 19:03:49 GMT
5648818383791576392
s0.2mdn.net/simgad/ Frame 578A
532 KB
532 KB
Image
General
Full URL
https://s0.2mdn.net/simgad/5648818383791576392
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
187574c8a3cf0026b633b356842e03d60450be911027b697e9542a650d1049c8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 23:35:48 GMT
x-content-type-options
nosniff
age
90706
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
544482
x-xss-protection
0
last-modified
Fri, 31 Mar 2023 09:51:21 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 23 Jun 2024 23:35:48 GMT
14952963386359035714
s0.2mdn.net/simgad/ Frame 578A
10 KB
10 KB
Image
General
Full URL
https://s0.2mdn.net/simgad/14952963386359035714
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2d3ebc5963c3ba449fc6f11b2d5ac883abaf7dbc046ac7c1b267518e0ca5fa27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 14:13:04 GMT
x-content-type-options
nosniff
age
124470
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
10020
x-xss-protection
0
last-modified
Fri, 31 Mar 2023 09:51:26 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 23 Jun 2024 14:13:04 GMT
ad
googleads.g.doubleclick.net/dbm/ Frame 578A
42 B
63 B
Fetch
General
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-Cn3YbO1U5NTxXogAM1c2wnQ8FPe6nsdaaOKzGEGrARxh5On9NGRPOzbAofZK2Hl7awE0pHwnVrU-rvXcf5Cb7nECkwNceiYXFAhOJlpXDHiAxuKxH6r3j0sDsPYjosTYsIAWkFg405VS0VLJ1QqjWONfKLug&dbm_d=AKAmf-DBHVLu_ovt-IcvyAFf1e-DS7nNnbsGuz1oCXglONPG2qj8pLp5_eSpA32G6kdQv_PHFY8aAbvyI8qjdBqstTLog0MlTHXZMip1Dab6b_PnBA8a26JWtH1hAQDPfYbH4OQmc6iNXql-RkpBjr-Pm1rZD_CwzzYmFoHXnvGUvC8LKuGNEuNFNLGMVjXiy641PtiV_Cu08x9-p99fGbK16n6Su1u-14e4QWqCThsoQddzrcTXouVgCrEF55GZOzXgPUr-Twu2MdnbZW74fIhWcLRMsren0Smeq_6MGaJPZkz9r5TXjEvhY-nRaIbdsgqMRCDvG_N0EBd_S8tcbS0jBmh8KKMCceoLyxWHTR0FNrVSkyENrPCk8mjJhljZ_ffJAyjTrTBkz_TK9ki6vBty-XHkgV3-AcAn78CvyxdgXQQdZmIax1QxaEJr1Y1uC4vOZL5eFp-l5eeyXKqGQO6pZ9MusAS04VdaEy2zUQS70_MnPH3X4tayWNAJ_NWZ7nL5jdWkizYK7XqbmaI_L1ePD9wiwvepS1RtuROsoWJw0SSpfBRq82wZdy0TolDKzV_jo_V4nOneZYcjRZao2p9HFosTNOZIEOFMRPEHJOXCC5ACa7xIfRzKqBC5fGUcVmsCJm-8593AS4NvFnJpF4DtZiUWePqnI-eM6Ln7XW5jNtofpnxfGhupIPojgryWWjiOVklR5D2MMoMqAElF41mBeGSwkWi5u4j9miFNznJcFBMckd70R1Y_LOEXUCAibtTtEoMrXVbrI32RQWwZyPBRcARNZCds9DTOMF1mHBQiz7dBXxuWzHgZ6vvjcbu-EyN__KDUVvHn0fN3sxswXWp-F0Wo0ZVMnepUfBMT2NceiEAHaIbCxAW62qeFdsokM12AdeUeH9pAEG9HUfuyA-BYVNeda2s-2yNt1KV8tL3KLZhya6ndHQv39Optzl1mka7n39E9fFJPScqUIrMMGSGHMA7ECaf5IiY2PYVkyNr5WpMqgV-Bc4oa3AM1ZcnFO3YWDx2ETtlx0mTs12oQPekeHKEMEv8mC4L2IbgP8jg8KMmo4aSzjHhS42V1yn0XR5D9VXA9Vx5swdJ2ea22RtJlKjcEJI-MMXZvZUpMvfAoeBMcJnbqFlGMVjEzoss-vnCKi03K4GOfoUMHa2IHCpO-MZ-_nrEttnXYdvTLhfovhnBm-HiG9zRGFbX_uBBSs6rf_yvB_1VhH1d4SwpP5z-sfokWv0Nm7m6t4NxjHwIAmIowT3sX_iybCRhQQnO2KHdp8OX-AH6wnfulFlyM-ozdN9kUziAeyR87AnZDhdeu_kHclbFocPZbHqDJ3g7iUZTq9kpWPZk7B_scQ8y3WlNGK4pAIWAN1cfKOE1lZMC9kVevakasb5vQv_bObenElERR09_5GgZlmHyr__u8uwUaldvt4I2bmo3Baar2DKYG9-kdfldGBTn8Dt3jsJLxIJv4fcSym-tL0HOkbNTdE8OQJEo2lIgSoRt8FDeIc-BsF24kWUUThV0ycyT7lWUjennzcKlTsRX50wZeNsChXCO03fkqFrb9ueDiKHj5Os0uZy_EdxESdkt0eAneNhtH63h724p9AdxX89s1yz2Vfh37Og5RH95cfY4M7-gJq1pufQTj4HQZSby3j2i2_3JXAqEq7cRLcMAHxKY8z-IppUivheIa60p8KiYaAmgVKg88SGGguWhexOVPXF28NHI8y85c1lD9qqjDZYZKvQgX1-N5UDDOC_JHACVAsBWBWiDFbpXGKJzXeEmVN2TxnaodToWtwvvJkjgjhYyGUqnk2kFm4BDE4-bgJLEbANFvo185JAOZ1E86KCvQwd3chb_cDjktbWO7v4_bl8ycDnZzk20VHJ3Md1nV7qVlsqbAWRSzPHA4TGpcjbdQhULN-JHtf76_2gy8DCZeuW8KPdnwZ6IYINFKWKyrarUZp3HFnMAePdTG6l0zSpKOyqxub_o1s00XZnBe3AmdNMEr2a-Vk-GkSVL0i-C7baiYIq1N24P8E50cQ3RZ-Iigp0-HScZYe4io89FZeF-kQpFKGvM7kg2AhxJ5XzXtXZKj2xmJicFt2t-FsPCvVaq7t3B27xCzG8PEL4H-S-VGfsEWrmBw_Kr0qnE6NawufXGdYvLQ2SU9rlcD6aJRnnczQT1Cx8kta2iz2cEalCpMr3PkhC7up7393PQpop6DmSPa99zBAVxVSHUQICkzBI2nYIfyUND9jnYjNZjZd1TX2NCYh-BUse7pzWPYiQfKouIPGafDtcb-TCIUg35zhoFcXEJpJ-v7i5xGccGD8GTL_QtIwLl3eiC8sCnJf_8gv9ranAIM2-CWA7qIPxRNzztYPgJN6UwOrh7KTC9aM1uBBuGJqwQQEzKIEmTAeHbScD76f3h53P6m2ASSnxrDBjgLkHCbQu8mA3Cw7ICGmNPMObjP_eAy3Do8qtb2k2fkgyC9WKbvAqlZTMUa7KtDjSWhsqEOiwN3C1n79MLVKlK8eKaRyXwVEAqisghHt_JK0wdMikHklp62IgmcO3rQxb2gFZmE8GHRBo3Bq4xhH7VfdOYBU6ITV9FgNWcNBkJiz8jjcWX_VrbzT7KkGuB0V8Hd_00tVjzK9MwVwGv0DYJjktOQUbKPICy22MsfKfgRXeGjaFMagxotgvIa8EYTj1zKXuVwQQUs-B_FliVjnKdVs7d8zcQe97j8T1Ap2eR9XdGt2WQ_fln9TuydOxAtjGWQ2nk83TlEDssex2ueP7MZlPX4IU9lFkvcVTW5tVGt8ZuLorNFnJUctJbZb_ZH87eICbviX4QAoQKwJOQZi0G1uUV6agiewi6CuXIBG5pkz5qA7PSNg-7B6FS7I-I0m7BtOUa4pXEqjqryCcEiEdYEZYyG_Hax5JG9uLCSUTAZbasL3ZzR9JnnBLlJlypsBn5mKNebxECvxMw8prYU6PDOc9C1lF4TU16AuZtTKNgYPcshoJMbdYrC1YV4UJbK6u1pe2QmtobZWao2xU-4YlefOBU5UNfKjda6w4R-vdUkq5Wut_SyCzqrzJOluVbkQR77kmuIdpfwZ0gwVjxlEvlUYu2ShSM2vtQwDSoNXLlzbn4hGzVRwSYvkKm7TbpXDHiQziOkh6EFYom0LvsV1rvv0N-UhlxR7x8cf5K7cKwwdlJS5SldZ3n9qqYk7LiKK0BQM_NmAGsCj1e86Lm4rk01cOqp58aQCjoP1HUrLFlY9n7pXceDDSDo2M5OtamyyJ5LEuRz3DRFaYBuyE5Ug_WCOdcGQ6u4Y1b4vb9lvbVUzOFufOeZ_1-T2aYEvwW77WTtrjFYYL-sXR-81h7fiJjVklUnAnxfKhuKxS_81-T8-mq8AuxiwC9gotZHe_VH90eTZnNNg0Y-OguALqSWshbV&cid=CAQSOwBygQiDvVEaJaX6CuYYX77-byyUXqAUykH1jGIKFnr6X7yFN0vvxfx9xpoGXZiDI0B-PG_ihqtyjbleGAE&dc_exteid=31133316216231632627085396778274701&dc_pubid=4
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame 578A
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=Cqxl9JeCYZMf2K8v03wPT95fQBZf21uZvt5vIrY0Rx8mivcABEAEgwLKCa2CVgrSCwAegAdOp3fkCyAEGqQI2xPCRH0eyPqgDAaoE2QFP0GaO-aYRLeb_j4HcoKjvRT-abz5wQctWM8q9PtmlLP8ykShDVpQJQqP1dq8L4vk92mkFloHe_V6a34mDMHOxI1eyb9vgMgJW-2xcLaVIAif5p43qoRMxfRAHzZAQFN_ZBKTx1j1VOmyi86xCgC2PrRnSfJFpGixb9hfq1J-kU-1gZBTn9N2meJbAu-HBdGk8GNUCWxogwd0H2aCJyyJ2eFL0SfSP6yn8C_YkoLmeZvzG_ueuM9SCftF6rfYQLmQWDaDGM8bry-vHWnOcQoA5iAVsI8Ys1QCywATw97ucrwTgBAOIBc75m5VKkgUGCBsQAhgBkgUGCB0QBBgBkgUGCB0QARgBkgUGCB4QARgBkAYBoAY3gAeV1qKGAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcKEOu-Bhi0kcDlAdIIFgiA4YAQEAEYHTICqgI6AoBASL39wTryCBthZHgtc3Vic3luLTcyNzU1Mjg0NTMxNjIzMDmACgPICwGwE8O84xPIE5vtjuID0BMA2BMNiBQC2BQB0BUBgBcBshceChwIABIUcHViLTY1OTM1MjMyMTAwMTAxNTQY6sFt&sigh=UiDrtaQYRXE&uach_m=[UACH]&cid=CAQSOwBygQiDvVEaJaX6CuYYX77-byyUXqAUykH1jGIKFnr6X7yFN0vvxfx9xpoGXZiDI0B-PG_ihqtyjbleGAE&template_id=509&vt=10
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

10261972549777223277
s0.2mdn.net/simgad/ Frame 0D4C
44 KB
44 KB
Image
General
Full URL
https://s0.2mdn.net/simgad/10261972549777223277
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
25b451f3cad26104f57800c79546bf5a40295d0cecf5623e623f4479b94d0ddd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 21 Jun 2023 17:53:55 GMT
x-content-type-options
nosniff
age
370419
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
44765
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 13:36:45 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 20 Jun 2024 17:53:55 GMT
7352296608196688721
s0.2mdn.net/simgad/ Frame 0D4C
10 KB
10 KB
Image
General
Full URL
https://s0.2mdn.net/simgad/7352296608196688721
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2d3ebc5963c3ba449fc6f11b2d5ac883abaf7dbc046ac7c1b267518e0ca5fa27
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 21 Jun 2023 17:53:55 GMT
x-content-type-options
nosniff
age
370419
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
10020
x-xss-protection
0
last-modified
Mon, 05 Jun 2023 13:36:48 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 20 Jun 2024 17:53:55 GMT
ad
googleads.g.doubleclick.net/dbm/ Frame 0D4C
42 B
63 B
Fetch
General
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BL1HZATyyBNQQyhVolzD45jSBAjyNvxSXBPAvP-3Wo6nG1EWaa4-n2lYaEB2SRfIa6yt09ZcVdEqeYavPlFIJh5Hg5-kDQRb4wZXgFZ4Pmczj3jJ2m4kTWFw1exeVW1AOg8OdGrUUR7AyZdmKgF8-4MnQ7cw&dbm_d=AKAmf-CmN2Z46fD4Zra02WPwdyI0TAr--BDRPNkO_0xKWRPBSZjZbAS2HAPOnOjkWVxHWXRMkXVBflByLgq_AHa5_ZAtYYCB-zJ2i4gr5azNojel5Tbj-6t4gzQNx5mBDw92J--vawyycYYKWmyIJXsWB05BFRy1X27stbWnTuls-B8FWaIFhJrHCHvX1dQ2htYxP5J6nNO2DzyGWUTHZ5w-pGf60YPCLQ4L81PhKJRzvTc-4Ptp_8LehUHXo6CQCjswpV6mTbLCfPtc-CbvbgghUsT1EHKrT_7eFQu1gFmtAJCSrYHLY6u1qXhvZUQMTggku57nAKZ66PTltgq3wukfpxMzdaHqr48pxO0X26IBNVExBlLb9g126eY5StYfcTZ6-Q_AI2AQ9VpJucE7f3U9N1J7Ryqzt3FA9pTMizZGyUdAqx9DtlM9JgJmyK8ayBLev0tSvro7hUVc5lP5mGAgXtBCHshK1g5zDU1hVcbcfOmJ0gX8tpBvZ-qllx_xt4scHjaXDETGDrPzTbby8siUIiCFrig2snBPEJT-hwH_6378glk1EGTVlAUhEwtPFQ8gkOEskXmAiEU_-pGDwiqkOF2Dlz482ZV1wrk4DcrGuCDmeDAp1aagyd0lMoT3jooABbpoBtH4O6mCeNBZGPaBGELkt69I342ly-BSYBYqT7wO8x2GVnu2K3BzAOsHXBnF6MEYiwHcJ3ebMuQJfnCGVDbslMX1WfuUn6FIksMDCRER_nkHF6dAhIU71S17rxKuNOQMFFvKKlBljCrEobA13qGa6zbJKQyv0OdLXhJOtvFi3DckOxxe8VFChWwt4rc7IsauyJzQqgs1ljr8zQmVC4h53h8b0YpP7gDx6w7GJhOQxHmGpUNRY5aDdjY9nQqAtpBMwBoWacvkq-mSLWaDqa9EMR5ex6u1dcj4Ko2ZnJdg0rIfk40WAj9LlcHhPw40AKco2b2wD3BmklSrwLnAJ4HwgxRt-WwUbXNHwDeM_JqJ7hdsDqVLyGQITgS-enjHki9sTzpEFkwiO-ZwuaGugs301oytIHNmrbyrJaMukJ0dVWu5vkskAiX-QwwVgdUK-332C3DnVHxWeQpfRnCnyan9P3RiPvL4JjlNMhcj7eMn3gbr8NnBpyeBEIHPJXmVvFnzT6FpuC9tIYXQs7xbK5ExQAf-pGpCUTYcAE7sIOGDi5PxM_pInuqs4DdK39fogKJrsPuI1TtQzcjyoWKYlfwvlKTRwIdWP5Qc61qz2QADd16JwGxpETD9VdZRsaflB0eMyWFnaECZBtq0jSyyAIwobwdR85G_rXMmJp16RqniLF1Kp854YfVP_bTJruk_RZ4L0xU7OZW-l7In0GZDFTozkxLMrMUX-aJoOZSteeQPgb-E9mgMcGhHdaNXGufrpfclAMVZTpLzfDEtlPr5t6uVIDe94lVkKBrq_mELeXMIdgiAbGX1iCU8atjhM9l75_ydZ6FSp64KgTjsdseNN9-q7f3JNI1LN-7svgE6MsT7CFeCEm6J5-adNNm0Fu1pHHzO-P5fHxffS17Gdgr7hVW1zcmf-OwgT1qa-4B_GtH0dpxBR_HQUI5rSaKGDXbGBiCP2hsp7_fV2U-8zE3V5VYqqziXGEnltWzLWds8q6QPUvG52v1ABY_fUDGvWe3isieoDR2UeAH6J6o7dXre8vvIy3YM1fT-OLTlqRSqmVtupJtta7OHrq2TlN7hD68sNQI-fdPgjvXY25oqqZBF9Xm5h9AIWZpPAY2yB2LCGqfu5E2GGdb1-ODz4sJSMO_Ttqh98vu05XZ9GCCCauUqIGxeOnJiEfqu9xpGG2TUzeqqFsSsWL0oTp-2IsOO9xsDsZ6I7GwujznJVKav9wl1uA-iM1K5JFSTAQoAQzyAMjPglB-C8ze641F09xPCSzBca5mPzdCPvd-Mh_PRwfJq7KJrMiFeOuPfmaCgtHMQpXXyhWs4WX5308QTbIr_G0S_MYCk_narwHJVXEJaq1sywrIEMQW7DDAnMMfn5xpLRCSgEPWfNvIUy_lXK7wcYXyWG136j_9KmkMrziZi2SED6i0VWQI6xBQVcffS-NylQ2oJad-hgy-0BaCQvFVA44CmOlA2pbRqpEQs6GLZAmVnDgq1k5fhiChS_pz3fhpbO872Htkg1wuf0UxASGpCueYcLZBi8Z6y7D7TypxM-P6yALlFDREjkRcxM8dkevk7IwurJofouRtLULtKXX-OhqqX_t3dYgMCnzQvmjj8J6TUJjoGHHFdqGUhDinnzYmw10EA-oRGVecYio5U2Pty0R61jKAYRdX-gSgJRrlhLyj_oFQdBlMfv1zKHor2bVsbwYp506l_D0rmBrkcbEHMFC0qMfxSbfghK3C0i4hpC1KftBRnlYPfixXUkVwPCD21XywpNcBkZu7sSvUi5L_LhAP6ent_vglFNvsAp5xPKH8w3bfQAsg5Pr3e6Wud-IhAKomI0VujtdvRwjNDCbcR1FcRNNuC7M20pIiFDkJE64FkGgojosiy8qbIV3AfYrPyegKSwvvYRhXejLIwYe07qGG0hwjH80Zfc-bOH4GT83RAg_7XCXsBTtPIb29-VZykS8x_JgFKOEk4gzqmFV-PZQrmFRw0nJgKaLGH3jWc0oYOj28osHS99tsbCdeJfx31bnCsdS9foDpKbeIBo6QalbWSDct8XuPKFf3ZOvKqGPbFEeEpz7IR-LCZTZtXlVflUbugDGAaCPN7JnhdfEhit24ecAmOPutJVrPgQowFKCCASKCAQS_3d2uuaq1F4AIyQFdjUWX1yPLfqORI0cw3-ZZ482kJ7r37SIgiIpmX5uA1NxDv1-Qeu67jLkos7Nw7qTvplBWgCRXpu4HWKmFd2tYE8vSjR0tUNxYwcHwJF-JtDbI8x3_our-vRKXnoiHO3BOu_GYnElVP6FGWC0awJ_KvmiyBOlrcAAjN1vmjmzc-5H7qiHaklqgP4UEL9aMXerobkv0L4SArCnZPogA0N1oKEGPi-0pvf2bPU3ktqavYe8vdNIlIaOIPBYE3KVMJWRLgjt0OT4RSxSY0IbgO0s6i5Jo8hZrHsTitrl0HKQQbh4LJo2QUTRZY5tIWWjiDjvRfm_ZvvxmYzX_1JeJZ80p6Zb7AxryV65eQDSTET5EhBk5wzqIPvzWe34_dsuaBWRwh9gWPumsDvdi6R-6pZR2eOortvZy1sjtcD8zMdDueeULLYDV07Ewx1RncGBdGM9hwPdMBnQG4SNGpopCrfaWBLaNx4w_waWiiKOEVWaKG9t7fvOH0opNDyGpDcXrxuiu8013K5eLZ-NksFo_UktyFZW7sl1cCPH3LgHZJEl2JoK6zZudu4Bl8spI1wS8MgVTtYPirckg6OvbU6BmNLo9DAcQ8Kum24-XisvHhvTUfCh5UBufmlhk4uKIsrRYsMJIl2VDsD_ttNIFLl8K_oz7vZkJBGkwVYUptJlc-xowMxnmxv1IN1w&cid=CAQSOwBygQiD6pCfnjJ_aejAdijtoe6kY-thltdFohshRLdA2lWDdxB2APp2PQI7G9y7_65iS5Kr6kPBSItZGAE&dc_exteid=31133316216616007220562085183455562&dc_pubid=4
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adview
securepubads.g.doubleclick.net/pagead/ Frame 0D4C
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pagead/adview?ai=Cr6bGJeCYZKWZK8nm3wOryoTgAenAw_5wsJTHrOkR1-WivcABEAEgwLKCa2CVgoCAmAegAdOp3fkCyAEGqQI2xPCRH0eyPqgDAaoE2QFP0MH2HynRnfEFWY6y17boWMeheqj8J2HSkRjGjtMfs6z7we0q00EgKVz3HldDbFA6wpGCF_g-Fe_IwXBIZeaSTETyDoJ7bw1dEsbz0O9MCO-xQ14OWie02PmcpSmIF80AAU6YfeBsjWYksurmzc5_EOMRL3q9z8F7NonGLrOoAR5ojZip2AIHmgqwoRfQxVvOXkrTKBIQdHvpDHhCsL3RYQMUVEaXjs2KhNdJgVcKoQKGg17OgpAWvNF1ySBL6wRJMED2fYlT3E7He3R3Cr-kuB_yXd3LSML3wAS106qQrQTgBAOIBa7a17lLkgUGCAMQAhgBkgUGCBsQAhgBkgUGCB0QBBgBkgUGCB0QARgBkgUGCB4QARgBkAYBoAY3gAeV1qKGAagHjs4bqAeT2BuoB-6WsQKoB_6esQKoB6SjsQKoB9XJG6gHpr4b2AcB8gcKEIPMBhil9e_sAdIIFgiA4YAQEAEYHTICqgI6AoBASL39wTryCBthZHgtc3Vic3luLTcyNzU1Mjg0NTMxNjIzMDmACgPICwGwE9LL4xPIE5e6heMD0BMA2BMNiBQE2BQB0BUBgBcBshceChwIABIUcHViLTY1OTM1MjMyMTAwMTAxNTQY6sFt&sigh=-g35qv4DAT4&uach_m=[UACH]&cid=CAQSOwBygQiD6pCfnjJ_aejAdijtoe6kY-thltdFohshRLdA2lWDdxB2APp2PQI7G9y7_65iS5Kr6kPBSItZGAE&template_id=509&vt=10
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

gen_204
pagead2.googlesyndication.com/pagead/ Frame 6ED2
0
20 B
Ping
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=2692466427256&version=m202301300101
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 6ED2
0
20 B
Ping
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=2692466427256&version=m202301300101&ct=76&x=1&cor=14270463404999264000
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ad
googleads.g.doubleclick.net/dbm/ Frame 6ED2
87 KB
36 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DlTNHfkDfl8dCu7VWdpWE6X0PBoTwt0uazF_Rj4gcIvhxtMdK3Ul3thYcE1ReaXIa5o--kvgXEBZqch3C_PKgVv3A4Yfu-doibOFU0JNpr_gXom24vPFLK4ckIYD11pLKAVxy-g9ucw_S98hf-9daDc5z-WWjrIUkiwC2F9zqRaxL5Yu4&dbm_d=AKAmf-AFOAtuhHU6tTQQmCz0MOFsrc8a3YJqANVN60SekvNM1nZZW5gsdrVoZwe_-F_QsGKbH-sNuWu8swDb5spTakABWEkj4A_kNzZ4qv6QzG_KD_JxvwsfDUnQM26V5xxS9H9sB1d2fKudHrqQnufBNtL24znNZhdKXp396SQRPSokOK0ZeqSO4CqCIWbbkNxe8j4JCA7qWV5mDlnjsro18TvObT8E4psQjU98XcHRhoIJHR9qy7W9a19xcJxkl_xq_nRRREuuRhsRh9kkoJcCu30JAwy-eazNA0qp8P_71d1UNS0RyTROWGp4meATT4OM7IPQXvuATRPf00hv9RQjQTzNbG7IP2BvKKcG-MbpjsMN4k7o1vourExmTFrB9v3Ng0rt-PVico1k1mYIMxoLE2dA1bNnRXzV1bulpWgStnSTW6-3xqY1RKQzkqjwjGsodWfzry9Li1e4-v6mlIbxefDpTeX516eqwH0ZfkQ27yb5HSjRlcOWjnh6XtI6znjXS3-0MABmWs0e3Y24MaGDc0xVHM6DrsdHb8hjQ0CuiCF6lFPJ5poXpQ2gSN2a-Eow2fiuRaCmfhPffeohhHXWCWq7CuiWI9OEEErKgmcLwMEVmfa1z5qMsRBMq5vZeJqy_gGf-otP6OplQQil0CBjHuzVXAePPsp8EIKP8fpmWLppiLiIUKVgakl04qtlAEBxFd9ekQ3kdy3FaNEFtDAZPICXKvvai8MqNaX_uzMlxru80_qqTwAKPZbblG9cKx0z44ruhhPHFS6BvYDEHP8Ev_0ESeiyjNmsMq6EgduuGNOZJ59H9zsmZ2M_XRzRwvHZF-O4o5JqmUUVhCwE_wd8oucpy4iD026AZ3CfSGP-yGnNKzHoavFc2tpbhWYFFKPcCwzNZyNXBXIdhAVhf5KwjUAtSFZshzvihqrGzOT11o34VAusKOkBOP00K0C2ShW__C9EX5a1gKb8VKMofa2DE0_w28HGsG88bfHbKB9pL5Ll0dCMaMEYCdAkQ4VPy1vAZHpofkryrYhuze07EzLw-9E17hekf3SIPYkSeLxtWexODqbp2nAxRz0fCLemyj45oYGooXrS0_w37pSrMCiQsHL9MCnDs6v23yVnNRkLum7tpPNCMJg4rG-hwzDTMfnrZSC1Cil7Mup5Nk1mBpzhoQgP0trihmcxrHJNbCrIA3P2ZNKgbwZ2GEcwC3LwT01Yp1cyE4pL2yujnAkoRGegolEF2JEd7OfxYc9yf06Dq_z5Qog79nBq0w7gold36eV7B4VyWKML6wL61sSmzcnS_yZxnsMq8OJDQIICqLZaj4rGof0uZA0QGe6xKlf-CfBHOSh_AE4LoKZZp7E3DxvIOfDbh4DVBim4DCbfn3RvkhpRPNBFw8vYXfG7HM-WAzhTHsd-ZEHCKxzik7l4oWClythLUyZmeyqEP2smU048CZ9KYxP_zFUjOu-fgqYPzOqhEJt98uJt1gU78u3HSuxNlRXkdPQR0G9CDGANL4_kmEzA0UUjYSvO28gZRvqBl9Dmwkjr0L5NG8N-76VH0cqBaWJKbVofQmTCHhJJUCazC2woN2z8osJx0IWQnpHnrk_jhn7D1DQ3aZwD1c3eiCMhso0g44JKZ0_ZwBWgkUvyAMBkwgaYElzXFNWi2q3xG7CgBsa6ncdzFVJ8aS3GqFLd8UdYvO92Bh7VfTHzv0w-2URVEuk7HGEv5gEfB5vO3ToAglACd49ZEaoRQxS53rN4IIlCpmSR_qEAb5VcRGz0vACGSsrJtP6in0RTAcdJOgD_lOc8i3RIKmqK1TDy-muOzyJPO3yYiDYwy_aq6V2tElb45w3VfbLgxo7fIMDN0bugVSTBn5JtCjiXgNqEI04uSCSdV9GNkXAV-E6WP-A7wbQl-_8ac0LJXMQs2xqyZ-txYw5ffBaJKfbvhPC8ILwhjWJDWebY1CYo8OUjMUvEE6zggqCCwNz-Icnym9RM7qk71-h4FoZvRNMNCApwgLpB7ir-A--HbDzeIAI6y0nSRU_c6LpJwtD-O75PJU1hScjxEKIchYSAC0x2hbsRLg4owSbPIAorHIsQEXb1Tysb877mdvoqC_sCuMETsHZgy_xPBoP_Qoiy3VFWI4HbRQKjUrBcvB5pm6VFYAtggRsgE0kp61wlzxvGjSeCXhbzsnAgsw5EULDmznv2HkObfvk-t22us2blEjRmO6-gPVOke-dtBOTImmeT9q5uv1b56oSE6FLqokZR25krt3XBmx6V_FwVIK0tz7sADyem72gKEakM84zoOezWtARxcjfWjquyUq3lqmsjGpgPd-C7JFIiX574kgTSKCDYTumCFEfWSpJV550741ip6BcNknnOEBe9CshSoolvXxFXtxCpR0PaspEHpDzq9JaVg9VXkKL1Nb2Qt2e7jMM_gT4eKofVq9Lgqh4brYfY6xZOb_p0lffyfckBswvEuew4YObkRSwYYalMHJmVbLnLn9NCrAd53YFYQpCZGQB977TyN2PPLYvYRhl4APUQloo9L3UwdidEcetttmxebk9RRddjRY9VfUgT18q0_2j9IRO67UyXU6i14w5KmdrKNgarYoAUScF7WgYsfEaclc6HHbo8FtnMbGDZT7Mhh7-KybsxQKCxB3ouY8zcqt-u7tGizMtnHH-Olbu7nskToPRveawVeAi3ZXdk80WfJrwy3sbg8zo3RqpC43hmKIibauMCpunkgWD0BsnINAGUUM9SjS_QShYqcveXsBdBq_Jjn3zrQDB1vNlCXvzfYI3enlCQs7FiPO4g02YyrZar3t5danphAyeEPBtRRmVmDS46gRErplE4rnxJWhPQjlEtMhTvvDC3w7t6lR4UyB-ExXr-EsFGs_3Vb6KMWuoYpB8vNZ0WnBRs2Jv7n2c2V3O9rbbMPGoKk1SDsiQJcvpX325AKtxakz_k_SbABYEuqyYVUTxlKJPQywLrYrGBh8wiERUQNOgA9jydPA19j5K8tIpdEl_JYEZqZnFlhopfM-KmVkWguu09u2XN-n5RiwkpU7Nro6Px7biZGyABI5cU0zG5evExln0TjXy6X7ABJQhbagwFgbXxGG-NvECBm3CNmofqeowrNLTuVs1JcYsZUj4KMj3eOS-nlyvUyJqx8GR6J2PdOaLxHSU_Cbi7se1ybxux6-8rJNlRJN-Ezdvzeng-UxkPY3ndL8Dns0XXs8T5SvDyzq9Y4WJX-nfpUh33nBC_d5x_V_zHiEA_PKj-b8FhNxanAXQXJeG3xIPgGXmxWpybw-YIjMouZVfXbjPXZhqLUw08MOpa6_9g_Wft2VKJyM8D3LNvPVAuwEGtnpTqBKpcOjk0KGpQVX4bhGvhw8G6tVBHuIoFwdVrDVrcmzeLyGKCEciaIoUkxXMeQH9f&cid=CAQSOwBygQiDXmAqvXuuookQYDfhJ6ej_lHZbYI8f4L7HHZBlLAkW6EF0jymtdZt-uRWBoKSOdcnTEXeR1OoGAE&dc_eid=31075529&dv3_ver=m202301300101&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=14270463404999264000&adk=212707235&idt=57&cac=0&dtd=5
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
c921bf926ea675616cac9484850459d23f98786a28299ab280181bef5b1583f4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
36811
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
5ed7638be4b07a92411bbffe
ng2.virgul.com/tck/imp/ Frame 1DCE
0
209 B
Image
General
Full URL
https://ng2.virgul.com/tck/imp/5ed7638be4b07a92411bbffe?g=1&t=gb&r=153366@site_geneli@yemek_net:site_geneli&l=&c=%2Cas%2Crc0%2Chf1%2Cvv1%2Cgprec%3Dyemek%26rec_ing%3D&info=&mt=1687740453081&userId=vnet634f4ce2-00c5-4905-8c8e-c86254eb39f9
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software
openresty/1.15.8.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://ye-mek.net
date
Mon, 26 Jun 2023 00:47:34 GMT
access-control-allow-credentials
true
expires
Tue, 04 Jan 2022 10:49:40 GMT
server
openresty/1.15.8.3
content-length
0
p3p
CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'
html_inpage_rendering_lib_200_278.js
s0.2mdn.net/879366/ Frame 7DEF
172 KB
60 KB
Script
General
Full URL
https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Origin
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 10:17:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
52210
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
61485
x-xss-protection
0
last-modified
Tue, 14 Mar 2023 18:43:57 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Mon, 26 Jun 2023 10:17:24 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/ Frame 7DEF
11 KB
4 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/omrhp.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B3NmchB9-I6SeSQGxB_7OYL6XWN1P7gWPz9hZQg7lg_tPKT90K4blUhpcZEB7rxv-7pZQM0nz4VsFh8gUBENDMDwfO7sKse3V5aX91fXubDuwjWq7JsL5KU7U7-1qceVGGHe15hdDNX3s43nP1KUxAK37hbCBlPvM1DgD83YmOHQo4prM&dbm_d=AKAmf-BhNNlF6zBx3cllW0UERr9AvPGeREc6jeF8ZHIqxfmykfdODg4H7xOEFKJAAh410O1fhwHRLqZV_rnZS2C8ln_MVE72i7dI-1zb-VN5U17DXdc8T7WVWlJsDPYAEdzcvVdGkBMNDr7olcCbvXW9AjQUoOTM3UY1Hu8KmuDrP1EUPhl_u7wsy0kfuBAczGSFdRHXeo5VMvkUr2J0wPG8KvmA1Dz3mdYBnffQd6k3NN_ASg5wFX5nNKGSskC2VQtTw92jubeohC-L-joYcBaCjfrZR6nquBQXt67XFcYkB8WvhhOa49fb4RT-MEmyGEROrKUUmnsGFkKI8t0L1dc5ya2swVqwjykfls5TAZIcAlrd31hHrYbf8hSIwbX3ctwVRNR0gFewYXXh2OJQLzuN4o486y4o8VjacyqNic2M0ZMIbFfstvhKY11_ddS64M0vJTJULWGGILtdo_O3oGfDtRWbDGmf2JN-At0Yg1MLY9quY3cjCjhPbJcN1dXrxcHzbi7-ihhhlM9bBCeLuvCqp9eWpYbS30Inr83KjAtQO1izPsQXj5GqUmI6Lf9KZ4nUYCC67V-unfuIObDinC1a989YKEZjeWK7aMpytUJ0UAh-9H16IEbHh908w24g_sXNBuwDtCobp4t93Z-oSkP6tsy9iH9kC6-w9obHAFdn-97El9Vup_pQQTxhXWw3YmioI0naB0dtPEMl8vYiGbYfPpSWQhPrrP64f9JV9G4J1brPGroTRnUkpd4PgZuvyQz9QDzhJUrLWLctUVTOhXogkJ2Swm3sRof7rRVzyZ1T5pSgH5nwCZCHFPxuBla_xhZwBZhx9MROMAlbdZ0IJBOAUWXao6SXDrLsVakF_CXJ1MIBGmVU28oTTIxEXddeKbVyTn2zUD_VpYOPx6epVArV8grhXXtsDm3jp5qiLXxp-xAXXETARYqGux2VDK8Wry494vWZJD3a9S3QW532fVmiOfi_S2xtJi2FrGg7YG74P9TOnTadRNWM37lcJqu5gNNwEfiTp_0-uU_YsYqLBecr5Qh841tkr5UpR1VX2leCNc-uIv85JWR3_GQbYjuNtgutMc4EcISzHq4IAU3b3k6lgHGsm0aivTC5Edpw8c2mVT3Txiak3xaWrRisIBL0kAkDGC5xiE7T5RYe9SJmTmY58EdQhCgM7-wTxNTuGTqFMUH9WPGaOx_0m8y8dXB6G_Ngu2_4MZzFpxqUYTj3y8TmHFl5VQlGpFhCss5kNeCCgm0yO34AgL6r1GFOuiM7zae9IzUf1AxaOrK61I8V81c7GYxKiDJMy96qzq6G7GSfFAyxO2YttVY7hT7JBOyc4R8425wcLgKtVR9twutW5YyOL41QKcA1w-R6WSUIUfX3livi5NEsxMK1toceDiiR3xOiVdihUJiN8vvmUKNrH764mnweCPBWAxgFlTrW_VnhIAgyiY4vIuye1rFOSJ62ONIAg5N0z57B-a91k7EaCQppPhtxvEDBuGRAqK_xet8Z89IfNxsAM7fFZUc8QnuPp9oQx240edkb6NxY-2dxcMMBVNd8n6Vcfi3bDM_rredxZ3Ze1-fOt6SB3JLskkzGnO3yLDX5IyuNsSacuci_FgYWgCI6XdFTq8TiU8m7_U9kiZTtfBL-f5bjajHTqBwlHf8nppmUcKHoW2_eeFWec2Jyt5ZA9DvQQbGAnBhP5efwriQISop7t_xc05heMa42QanHdwS3M95uLOx9vVUZz7by19pitjbgvxAGIGBB2YSTUeZ5s286ji0jeV1n7iJvvwyBvQ6QL0HTsUQcb3RnT8YOHc0SBjVEUhdl_vIzuov_KxlLDHBTY0IvPO33r1Z1N_eC_dY5ySkmBGTl8xtM2o3xCmwdn-eH01SvWdphTfMXFs4lmg2mmmUOCrDwIIK9apJ5Nuegw7QUeGvh07Bl6eSpvg6FHA_Jlp2fis7tQ7MK8DukXMiIAgyRtDPqR7Xxm12JJSwbdUXdEXakNqL1bgDLL6cvhar9gcgzlzAx7U5AIEYd4AhVMHKyogP3BJWs3tCIAiiuWoBHiTBZbfoRfVNY7-yW6qyzRzJbCXZ4D8wwXO9ucKVKZqxZCKWzMEEcCFP1i9i7WVWGRPcK-oiI8D5rUnUr9GLkhajSH0UC2qvvsVvFj5VVQc2xmGofFaMgrFU_GdaEl8ocdK_efSu3jp211A7mhxY64KtxcjaDb1qASQB2t1LlzGBo_3Z6USekbzhucKKaduWQ3GkHyHMkHAryGYoe9N_Vw--_wQuIZh3cGVACzX9H5SDubTVCbbftvuxbYmm3UHDmdI7VGnmsxRvwvEE7rfTg1RzuSep1jAVJrAurdhEFZ5EvSZH7JL5sIpRZF4iPDg2WnpW3qvg-fmiUpY7E8KInhtpz0UQ8jJM9plk2f6YrHeH6-i5uVJ9tPk0PaL3YTTJGw7gxctsgrmm8TIPzg7srosTFg-FD210tvs38HOJJVZpPz6keM_oXdZxEhKm_BuGGy76kvEj37cGWgOwRN7ZxOKphstwkjIKiWKzXZMdEhCRE_6YgCwFbwmgrLmvw4QFD4oGI3kbO1yVMMfrc9jSfZVq_7MG6xP16vRYZ4IrFrJLqmWbtTxwfYclME2MxJjZfflrVjCZW0H39bNOuRg4rBsdeHrNP8Z9OvG5d9Pf48e9Uw_KUBszVqNER_AaeY6cDfM0LxZiUmYsukR_gnlHPW_cWC6Oogbz3rww5CRI-OwJFQaTQ9onFFCAZv3DoFO1ZUatJIz_DgLqbFk47hVQgHhVMf4g3hf16bXIEtMplIUCJ0cqaytrIMITtovSRimyzhibigCaZsDba7wUJJRviv25EywcakwjRS-rTzoOMgl7k2EsaBech3myLP34CotmczkkevnTAOjBe-2mDi0DlOsSuW2lmJxrvpSjmOHnv82H9JJlQaYZ5SjPrROrZRLQpc5RhVC2QccuIS7P48BwVjcZoFw64Yc4DqEGqyNgKej-EKSy9GhYjlfH_3UkOqaIQrsblZWLogqwTafvusKCZwzAaKbLsX5J5h46kWtTurW1-jazGUEBlgK-z7sQsO4tX2xpJ65RcUrcNiB0QUR4qQk8anqL_iApoIx8SKsrxQKvgMix9703h_zTw_s4qC5-G4_09Mf1ivzw-Rx3gz1cXV6dBk2iIeF8lpaz4IvOpyDzJFVG54bggp_HXrJT7aEoaWBwSuvI827BVKhhcaWEQH6ik9o5eOGGMkkh8hbkJxwqx-V3-ZYKB_jTqhmxvSGBNxBFv1PrtZIWpXWqI00O8VrET4OTZ9-9rDSxz_dtaAefFCSWhN4uRaha2bATl8JBIhFKgHJB4BPkCx4MaMlvzLQ&cid=CAQSOwBygQiDs7BmK0K-MwR-e_kxgxi3y3s9MZ_xMZW5V_e2MN-pD6sYQw5pBvu2nhNuJlYJOPBrlpM3dLkPGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=4246618124978499600&adk=2465470143&idt=34&cac=0&dtd=26
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 19:19:34 GMT
content-encoding
br
x-content-type-options
nosniff
age
19680
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4172
x-xss-protection
0
server
cafe
etag
5499578052516643378
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 09 Jul 2023 19:19:34 GMT
abg_lite.js
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/ Frame 7DEF
30 KB
11 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/abg_lite.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-B3NmchB9-I6SeSQGxB_7OYL6XWN1P7gWPz9hZQg7lg_tPKT90K4blUhpcZEB7rxv-7pZQM0nz4VsFh8gUBENDMDwfO7sKse3V5aX91fXubDuwjWq7JsL5KU7U7-1qceVGGHe15hdDNX3s43nP1KUxAK37hbCBlPvM1DgD83YmOHQo4prM&dbm_d=AKAmf-BhNNlF6zBx3cllW0UERr9AvPGeREc6jeF8ZHIqxfmykfdODg4H7xOEFKJAAh410O1fhwHRLqZV_rnZS2C8ln_MVE72i7dI-1zb-VN5U17DXdc8T7WVWlJsDPYAEdzcvVdGkBMNDr7olcCbvXW9AjQUoOTM3UY1Hu8KmuDrP1EUPhl_u7wsy0kfuBAczGSFdRHXeo5VMvkUr2J0wPG8KvmA1Dz3mdYBnffQd6k3NN_ASg5wFX5nNKGSskC2VQtTw92jubeohC-L-joYcBaCjfrZR6nquBQXt67XFcYkB8WvhhOa49fb4RT-MEmyGEROrKUUmnsGFkKI8t0L1dc5ya2swVqwjykfls5TAZIcAlrd31hHrYbf8hSIwbX3ctwVRNR0gFewYXXh2OJQLzuN4o486y4o8VjacyqNic2M0ZMIbFfstvhKY11_ddS64M0vJTJULWGGILtdo_O3oGfDtRWbDGmf2JN-At0Yg1MLY9quY3cjCjhPbJcN1dXrxcHzbi7-ihhhlM9bBCeLuvCqp9eWpYbS30Inr83KjAtQO1izPsQXj5GqUmI6Lf9KZ4nUYCC67V-unfuIObDinC1a989YKEZjeWK7aMpytUJ0UAh-9H16IEbHh908w24g_sXNBuwDtCobp4t93Z-oSkP6tsy9iH9kC6-w9obHAFdn-97El9Vup_pQQTxhXWw3YmioI0naB0dtPEMl8vYiGbYfPpSWQhPrrP64f9JV9G4J1brPGroTRnUkpd4PgZuvyQz9QDzhJUrLWLctUVTOhXogkJ2Swm3sRof7rRVzyZ1T5pSgH5nwCZCHFPxuBla_xhZwBZhx9MROMAlbdZ0IJBOAUWXao6SXDrLsVakF_CXJ1MIBGmVU28oTTIxEXddeKbVyTn2zUD_VpYOPx6epVArV8grhXXtsDm3jp5qiLXxp-xAXXETARYqGux2VDK8Wry494vWZJD3a9S3QW532fVmiOfi_S2xtJi2FrGg7YG74P9TOnTadRNWM37lcJqu5gNNwEfiTp_0-uU_YsYqLBecr5Qh841tkr5UpR1VX2leCNc-uIv85JWR3_GQbYjuNtgutMc4EcISzHq4IAU3b3k6lgHGsm0aivTC5Edpw8c2mVT3Txiak3xaWrRisIBL0kAkDGC5xiE7T5RYe9SJmTmY58EdQhCgM7-wTxNTuGTqFMUH9WPGaOx_0m8y8dXB6G_Ngu2_4MZzFpxqUYTj3y8TmHFl5VQlGpFhCss5kNeCCgm0yO34AgL6r1GFOuiM7zae9IzUf1AxaOrK61I8V81c7GYxKiDJMy96qzq6G7GSfFAyxO2YttVY7hT7JBOyc4R8425wcLgKtVR9twutW5YyOL41QKcA1w-R6WSUIUfX3livi5NEsxMK1toceDiiR3xOiVdihUJiN8vvmUKNrH764mnweCPBWAxgFlTrW_VnhIAgyiY4vIuye1rFOSJ62ONIAg5N0z57B-a91k7EaCQppPhtxvEDBuGRAqK_xet8Z89IfNxsAM7fFZUc8QnuPp9oQx240edkb6NxY-2dxcMMBVNd8n6Vcfi3bDM_rredxZ3Ze1-fOt6SB3JLskkzGnO3yLDX5IyuNsSacuci_FgYWgCI6XdFTq8TiU8m7_U9kiZTtfBL-f5bjajHTqBwlHf8nppmUcKHoW2_eeFWec2Jyt5ZA9DvQQbGAnBhP5efwriQISop7t_xc05heMa42QanHdwS3M95uLOx9vVUZz7by19pitjbgvxAGIGBB2YSTUeZ5s286ji0jeV1n7iJvvwyBvQ6QL0HTsUQcb3RnT8YOHc0SBjVEUhdl_vIzuov_KxlLDHBTY0IvPO33r1Z1N_eC_dY5ySkmBGTl8xtM2o3xCmwdn-eH01SvWdphTfMXFs4lmg2mmmUOCrDwIIK9apJ5Nuegw7QUeGvh07Bl6eSpvg6FHA_Jlp2fis7tQ7MK8DukXMiIAgyRtDPqR7Xxm12JJSwbdUXdEXakNqL1bgDLL6cvhar9gcgzlzAx7U5AIEYd4AhVMHKyogP3BJWs3tCIAiiuWoBHiTBZbfoRfVNY7-yW6qyzRzJbCXZ4D8wwXO9ucKVKZqxZCKWzMEEcCFP1i9i7WVWGRPcK-oiI8D5rUnUr9GLkhajSH0UC2qvvsVvFj5VVQc2xmGofFaMgrFU_GdaEl8ocdK_efSu3jp211A7mhxY64KtxcjaDb1qASQB2t1LlzGBo_3Z6USekbzhucKKaduWQ3GkHyHMkHAryGYoe9N_Vw--_wQuIZh3cGVACzX9H5SDubTVCbbftvuxbYmm3UHDmdI7VGnmsxRvwvEE7rfTg1RzuSep1jAVJrAurdhEFZ5EvSZH7JL5sIpRZF4iPDg2WnpW3qvg-fmiUpY7E8KInhtpz0UQ8jJM9plk2f6YrHeH6-i5uVJ9tPk0PaL3YTTJGw7gxctsgrmm8TIPzg7srosTFg-FD210tvs38HOJJVZpPz6keM_oXdZxEhKm_BuGGy76kvEj37cGWgOwRN7ZxOKphstwkjIKiWKzXZMdEhCRE_6YgCwFbwmgrLmvw4QFD4oGI3kbO1yVMMfrc9jSfZVq_7MG6xP16vRYZ4IrFrJLqmWbtTxwfYclME2MxJjZfflrVjCZW0H39bNOuRg4rBsdeHrNP8Z9OvG5d9Pf48e9Uw_KUBszVqNER_AaeY6cDfM0LxZiUmYsukR_gnlHPW_cWC6Oogbz3rww5CRI-OwJFQaTQ9onFFCAZv3DoFO1ZUatJIz_DgLqbFk47hVQgHhVMf4g3hf16bXIEtMplIUCJ0cqaytrIMITtovSRimyzhibigCaZsDba7wUJJRviv25EywcakwjRS-rTzoOMgl7k2EsaBech3myLP34CotmczkkevnTAOjBe-2mDi0DlOsSuW2lmJxrvpSjmOHnv82H9JJlQaYZ5SjPrROrZRLQpc5RhVC2QccuIS7P48BwVjcZoFw64Yc4DqEGqyNgKej-EKSy9GhYjlfH_3UkOqaIQrsblZWLogqwTafvusKCZwzAaKbLsX5J5h46kWtTurW1-jazGUEBlgK-z7sQsO4tX2xpJ65RcUrcNiB0QUR4qQk8anqL_iApoIx8SKsrxQKvgMix9703h_zTw_s4qC5-G4_09Mf1ivzw-Rx3gz1cXV6dBk2iIeF8lpaz4IvOpyDzJFVG54bggp_HXrJT7aEoaWBwSuvI827BVKhhcaWEQH6ik9o5eOGGMkkh8hbkJxwqx-V3-ZYKB_jTqhmxvSGBNxBFv1PrtZIWpXWqI00O8VrET4OTZ9-9rDSxz_dtaAefFCSWhN4uRaha2bATl8JBIhFKgHJB4BPkCx4MaMlvzLQ&cid=CAQSOwBygQiDs7BmK0K-MwR-e_kxgxi3y3s9MZ_xMZW5V_e2MN-pD6sYQw5pBvu2nhNuJlYJOPBrlpM3dLkPGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=4246618124978499600&adk=2465470143&idt=34&cac=0&dtd=26
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
c99a1db5a8ee11a2fc13ab0544e3865f781fab4515592ff6467e7273478f813d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 19:21:16 GMT
content-encoding
br
x-content-type-options
nosniff
age
19578
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11398
x-xss-protection
0
server
cafe
etag
3934322099733601226
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 09 Jul 2023 19:21:16 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 7DEF
41 KB
15 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 13:52:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
471299
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Jun 2024 13:52:35 GMT
s
googleads.g.doubleclick.net/pagead/drt/ Frame 2D66
143 B
166 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
1862
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=3600
content-encoding
gzip
content-length
145
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:16:32 GMT
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 9A07
1 KB
643 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
41304
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=86400
content-encoding
br
content-length
618
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sun, 25 Jun 2023 13:19:10 GMT
etag
48472445140208031
expires
Mon, 26 Jun 2023 13:19:10 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
s
googleads.g.doubleclick.net/pagead/drt/ Frame EA1D
143 B
166 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
1862
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=3600
content-encoding
gzip
content-length
145
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:16:32 GMT
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 88D6
1 KB
643 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
41304
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=86400
content-encoding
br
content-length
618
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sun, 25 Jun 2023 13:19:10 GMT
etag
48472445140208031
expires
Mon, 26 Jun 2023 13:19:10 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
truncated
/ Frame 578A
217 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
125b17989b8b3fcf3e154506845bec4b8689ff825416ab4ba80ddd66e8cfa94d

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 0D4C
216 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
42577d21f831d4abd1a55f6217fded0ef0b4b90aa0a1f2fdd67011978c21505a

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame F2BA
1 KB
643 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
41304
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=86400
content-encoding
br
content-length
618
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sun, 25 Jun 2023 13:19:10 GMT
etag
48472445140208031
expires
Mon, 26 Jun 2023 13:19:10 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
truncated
/ Frame 7DEF
214 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4f4d88e24a0e7c039f02682664c5b83aaf89afc0e5e2093c31bbd23a6f4b6c39

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
js
tags.mathtag.com/notify/ Frame 1BE1
2 KB
2 KB
Script
General
Full URL
https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvWXpWaU1EUTJObU10WlRSaU9TMHpPR1U0TFRBd01EQXRNREF3TURBd01EQXdNREF3Lzc1OTE4NDMxODIyMDc2OTExNDUvNjYyMjMzMi80NTYyMzA2LzQvREhTQzNzbG9TcnFoOXpyclIxRHU1Nk1VU3lhcTJMNlFpWXkxZnByM29Lcy8xLzQvMC8wLzk1NjgwMy8wLzIxNjUzNi82NTE4NzEvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC83NTkxODQzMTgyMjA3NjkxMTQ1L2Ftcy8wLzg0LzExLzk5OS8xNjIvMmEwMDpjOTg6MjAzMDo6LzAuMDAwLzE2ODc3NDA0NTQvMTY4Nzc1MzA1NC80L3B1Yi02NTkzNTIzMjEwMDEwMTU0Lw/Yj5byie7u23R2pKFD_cjVSGftJA&nodeid=4015&group=cdg&auctionid=7591843182207691145&pbs_auctionid=7591843182207691145&shardkey=7591843182207691145&sid=4562306&cid=6622332&bp=a_aiebbd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.132.25&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCBozlJeCYZLLqO7WorASStLroBM-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTY1OTM1MjMyMTAwMTAxNTTIAQmoAwHIAwKqBLEBT9BIzp8KKGxHN-xNRUFbet6WdVxpNpuSqNV5IE4CNRIG3oa1ddFitq_4z99lBDiFUhFE_IVHMhIDihml9_MkyJQ8eMuIrwEkDyDXYeIyklDvn4irP8InVh2cbKg8-Lak96dkVSTA9z1WnxditH6BGeVhzrwha3yarTt0R2YCgveOv9j3RHH3bC6yhsviHbNCHoNcpFhj7ubDaEVnVraGCSxF5WTE5s9xJLrWR9lXI7R7gAa-1Nb82ZronagBoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3gH9kcgYGyyOhepiMRuKehIoRS9g%26client%3Dca-pub-6593523210010154%26adurl%3D
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453820&bpp=35&bdt=94&idt=136&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4671767059969&frm=8&ife=1&pv=1&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.1e0bozjdbm9m&fsb=1&dtd=145
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software
MMBD/3.392.6 /
Resource Hash
1e6b480f7b684675c28af3af9fdbfa38aa03eb189057159d9ef58a59c1f04ef8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:34 GMT
x-mm-nodeid
4015
Content-Encoding
gzip
x-mm-bid-request-time
1687740454
Connection
close
x-mm-handled-by-owner
true
Last-Modified
Mon, 26 Jun 2023 00:47:34 GMT
Server
MMBD/3.392.6
x-mm-latency
29 (0)
x-mm-notify-action-done
LD5wfw
Content-Type
application/x-javascript; charset=UTF-8
x-mm-dbg
NotCount
Cache-Control
no-cache
x-mm-host
zrh-router-x44, cdg-bidder-x162
x-mm-lag
0
Expires
Mon, 26 Jun 2023 00:47:33 GMT
window_focus_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 1BE1
3 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/window_focus_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453820&bpp=35&bdt=94&idt=136&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4671767059969&frm=8&ife=1&pv=1&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.1e0bozjdbm9m&fsb=1&dtd=145
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 19:48:41 GMT
content-encoding
br
x-content-type-options
nosniff
age
17933
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1236
x-xss-protection
0
server
cafe
etag
15004572836499977866
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 09 Jul 2023 19:48:41 GMT
qs_click_protection_fy2021.js
tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/ Frame 1BE1
19 KB
8 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20230620/r20110914/client/qs_click_protection_fy2021.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453820&bpp=35&bdt=94&idt=136&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4671767059969&frm=8&ife=1&pv=1&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.1e0bozjdbm9m&fsb=1&dtd=145
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8d67e93b773c993230e55a3881853d5e8d399b32fb591d845c41553c0fe8c71b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 19:19:38 GMT
content-encoding
br
x-content-type-options
nosniff
age
19676
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
8131
x-xss-protection
0
server
cafe
etag
7076601798724011321
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 09 Jul 2023 19:19:38 GMT
l
www.google.com/ads/measurement/ Frame 1BE1
0
0
Image
General
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaR2wfsuxjw6183_IQzrNHxN48AsPwKgUX6rUtaQM3_g8GxY_K9u1q5_cr1pmgsrlnOaQ1eljckfufm-v3PcPXustmC25A
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453820&bpp=35&bdt=94&idt=136&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4671767059969&frm=8&ife=1&pv=1&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.1e0bozjdbm9m&fsb=1&dtd=145
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 1BE1
179 KB
56 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453820&bpp=35&bdt=94&idt=136&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4671767059969&frm=8&ife=1&pv=1&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.1e0bozjdbm9m&fsb=1&dtd=145
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
13b4bb0bb059eee9a7ddf5b8ae3f395e28e7f81918eeac0ec934f3d050c4d0a2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
57242
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1687383875062185"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
timing-allow-origin
*
expires
Mon, 26 Jun 2023 00:47:34 GMT
request.php
hal90005.redintelligence.net/ Frame 1A21
3 KB
2 KB
Script
General
Full URL
https://hal90005.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=8c0b5788f2&subid=&uid=d859959d4fc5aab9&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DWl7tkedum3B-P5FulDCt_A%26exch_seat%3D20035004448%26mt_aid%3D674314148130887506%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_cid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCqH4bJeCYZNOeK9GSrATA37jgC8-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTc5ODM2NTEyNTc4MzgyODLIAQngAgCoAwHIAwKqBPgBT9A9nD7P7nONlnsmRbQBldQQh0N8bzRlNVQGG5rDOvOuY-c_ENZOI-NmiJUhoFicC_Ee4GExScmmBm_UTQP8dsRr-QYrnT5mKquvlw9yWUxFywpyfxWKsOBI8y8QfhxjXbcCTSQY4gjVKhrMq-fjdHzDQvWz0vUf3vb7RZkfTLqxTI9VscK_ZcXpHrxD6CVm4A42GbzgxHtmWlUHpd4qapmo5GeummdTxSIjwht9YtJSGiTLTQMlSnwA8-AtLQJbWlSeSCkqJDhHO2P4RV9kkiAO9b7Qxg7yfqVDF3es7IEHIukJmoEoIyZvvHcWzWXIX04f-lmV4-bgBAGABr7U1vzZmuidqAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA8ggbYWR4LXN1YnN5bi03Mjc1NTI4NDUzMTYyMzA5-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_0kRp_ZrM1lJgXF0K7UVuDO8nWDIQ%2526client%253Dca-pub-7983651257838282%2526adurl%253D%26mt_lp%3Dhttps%253A%2F%2Fwww.soberberlin.com%2F%26redirect%3D&documentReferer=https%3A%2F%2Fe171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html%3Fn%3D1&ancestorOrigins=null&random=6651112481175&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by
Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/ajk4xlebn4mw?subid=&gdpr=1&gdpr_consent=li&rnd=674314148130887506&extVar[]=DOUBLEBORDER:1&extVar[]=MMA_SSP:adx&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DWl7tkedum3B-P5FulDCt_A%26exch_seat%3D20035004448%26mt_aid%3D674314148130887506%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_cid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCqH4bJeCYZNOeK9GSrATA37jgC8-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTc5ODM2NTEyNTc4MzgyODLIAQngAgCoAwHIAwKqBPgBT9A9nD7P7nONlnsmRbQBldQQh0N8bzRlNVQGG5rDOvOuY-c_ENZOI-NmiJUhoFicC_Ee4GExScmmBm_UTQP8dsRr-QYrnT5mKquvlw9yWUxFywpyfxWKsOBI8y8QfhxjXbcCTSQY4gjVKhrMq-fjdHzDQvWz0vUf3vb7RZkfTLqxTI9VscK_ZcXpHrxD6CVm4A42GbzgxHtmWlUHpd4qapmo5GeummdTxSIjwht9YtJSGiTLTQMlSnwA8-AtLQJbWlSeSCkqJDhHO2P4RV9kkiAO9b7Qxg7yfqVDF3es7IEHIukJmoEoIyZvvHcWzWXIX04f-lmV4-bgBAGABr7U1vzZmuidqAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA8ggbYWR4LXN1YnN5bi03Mjc1NTI4NDUzMTYyMzA5-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_0kRp_ZrM1lJgXF0K7UVuDO8nWDIQ%2526client%253Dca-pub-7983651257838282%2526adurl%253D%26mt_lp%3Dhttps%253A%2F%2Fwww.soberberlin.com%2F%26redirect%3D
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.201.63.165 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.165.63.201.138.clients.your-server.de
Software
Apache /
Resource Hash
388c4ce7ac700d765099cb846265b5173e783e236491f03597b8a54adc676df4

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 26 Jun 2023 00:47:34 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type
application/x-javascript; charset=utf-8
Cache-Control
no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId
24394400004294500951389012367005
Connection
close
Content-Length
1146
Expires
Mon, 26 Jun 2023 01:47:34 +0200
html_inpage_rendering_lib_200_278.js
s0.2mdn.net/879366/ Frame 6ED2
172 KB
60 KB
Script
General
Full URL
https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Origin
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 10:17:24 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
52210
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
61485
x-xss-protection
0
last-modified
Tue, 14 Mar 2023 18:43:57 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Mon, 26 Jun 2023 10:17:24 GMT
omrhp.js
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/ Frame 6ED2
11 KB
4 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/elements/html/omrhp.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DlTNHfkDfl8dCu7VWdpWE6X0PBoTwt0uazF_Rj4gcIvhxtMdK3Ul3thYcE1ReaXIa5o--kvgXEBZqch3C_PKgVv3A4Yfu-doibOFU0JNpr_gXom24vPFLK4ckIYD11pLKAVxy-g9ucw_S98hf-9daDc5z-WWjrIUkiwC2F9zqRaxL5Yu4&dbm_d=AKAmf-AFOAtuhHU6tTQQmCz0MOFsrc8a3YJqANVN60SekvNM1nZZW5gsdrVoZwe_-F_QsGKbH-sNuWu8swDb5spTakABWEkj4A_kNzZ4qv6QzG_KD_JxvwsfDUnQM26V5xxS9H9sB1d2fKudHrqQnufBNtL24znNZhdKXp396SQRPSokOK0ZeqSO4CqCIWbbkNxe8j4JCA7qWV5mDlnjsro18TvObT8E4psQjU98XcHRhoIJHR9qy7W9a19xcJxkl_xq_nRRREuuRhsRh9kkoJcCu30JAwy-eazNA0qp8P_71d1UNS0RyTROWGp4meATT4OM7IPQXvuATRPf00hv9RQjQTzNbG7IP2BvKKcG-MbpjsMN4k7o1vourExmTFrB9v3Ng0rt-PVico1k1mYIMxoLE2dA1bNnRXzV1bulpWgStnSTW6-3xqY1RKQzkqjwjGsodWfzry9Li1e4-v6mlIbxefDpTeX516eqwH0ZfkQ27yb5HSjRlcOWjnh6XtI6znjXS3-0MABmWs0e3Y24MaGDc0xVHM6DrsdHb8hjQ0CuiCF6lFPJ5poXpQ2gSN2a-Eow2fiuRaCmfhPffeohhHXWCWq7CuiWI9OEEErKgmcLwMEVmfa1z5qMsRBMq5vZeJqy_gGf-otP6OplQQil0CBjHuzVXAePPsp8EIKP8fpmWLppiLiIUKVgakl04qtlAEBxFd9ekQ3kdy3FaNEFtDAZPICXKvvai8MqNaX_uzMlxru80_qqTwAKPZbblG9cKx0z44ruhhPHFS6BvYDEHP8Ev_0ESeiyjNmsMq6EgduuGNOZJ59H9zsmZ2M_XRzRwvHZF-O4o5JqmUUVhCwE_wd8oucpy4iD026AZ3CfSGP-yGnNKzHoavFc2tpbhWYFFKPcCwzNZyNXBXIdhAVhf5KwjUAtSFZshzvihqrGzOT11o34VAusKOkBOP00K0C2ShW__C9EX5a1gKb8VKMofa2DE0_w28HGsG88bfHbKB9pL5Ll0dCMaMEYCdAkQ4VPy1vAZHpofkryrYhuze07EzLw-9E17hekf3SIPYkSeLxtWexODqbp2nAxRz0fCLemyj45oYGooXrS0_w37pSrMCiQsHL9MCnDs6v23yVnNRkLum7tpPNCMJg4rG-hwzDTMfnrZSC1Cil7Mup5Nk1mBpzhoQgP0trihmcxrHJNbCrIA3P2ZNKgbwZ2GEcwC3LwT01Yp1cyE4pL2yujnAkoRGegolEF2JEd7OfxYc9yf06Dq_z5Qog79nBq0w7gold36eV7B4VyWKML6wL61sSmzcnS_yZxnsMq8OJDQIICqLZaj4rGof0uZA0QGe6xKlf-CfBHOSh_AE4LoKZZp7E3DxvIOfDbh4DVBim4DCbfn3RvkhpRPNBFw8vYXfG7HM-WAzhTHsd-ZEHCKxzik7l4oWClythLUyZmeyqEP2smU048CZ9KYxP_zFUjOu-fgqYPzOqhEJt98uJt1gU78u3HSuxNlRXkdPQR0G9CDGANL4_kmEzA0UUjYSvO28gZRvqBl9Dmwkjr0L5NG8N-76VH0cqBaWJKbVofQmTCHhJJUCazC2woN2z8osJx0IWQnpHnrk_jhn7D1DQ3aZwD1c3eiCMhso0g44JKZ0_ZwBWgkUvyAMBkwgaYElzXFNWi2q3xG7CgBsa6ncdzFVJ8aS3GqFLd8UdYvO92Bh7VfTHzv0w-2URVEuk7HGEv5gEfB5vO3ToAglACd49ZEaoRQxS53rN4IIlCpmSR_qEAb5VcRGz0vACGSsrJtP6in0RTAcdJOgD_lOc8i3RIKmqK1TDy-muOzyJPO3yYiDYwy_aq6V2tElb45w3VfbLgxo7fIMDN0bugVSTBn5JtCjiXgNqEI04uSCSdV9GNkXAV-E6WP-A7wbQl-_8ac0LJXMQs2xqyZ-txYw5ffBaJKfbvhPC8ILwhjWJDWebY1CYo8OUjMUvEE6zggqCCwNz-Icnym9RM7qk71-h4FoZvRNMNCApwgLpB7ir-A--HbDzeIAI6y0nSRU_c6LpJwtD-O75PJU1hScjxEKIchYSAC0x2hbsRLg4owSbPIAorHIsQEXb1Tysb877mdvoqC_sCuMETsHZgy_xPBoP_Qoiy3VFWI4HbRQKjUrBcvB5pm6VFYAtggRsgE0kp61wlzxvGjSeCXhbzsnAgsw5EULDmznv2HkObfvk-t22us2blEjRmO6-gPVOke-dtBOTImmeT9q5uv1b56oSE6FLqokZR25krt3XBmx6V_FwVIK0tz7sADyem72gKEakM84zoOezWtARxcjfWjquyUq3lqmsjGpgPd-C7JFIiX574kgTSKCDYTumCFEfWSpJV550741ip6BcNknnOEBe9CshSoolvXxFXtxCpR0PaspEHpDzq9JaVg9VXkKL1Nb2Qt2e7jMM_gT4eKofVq9Lgqh4brYfY6xZOb_p0lffyfckBswvEuew4YObkRSwYYalMHJmVbLnLn9NCrAd53YFYQpCZGQB977TyN2PPLYvYRhl4APUQloo9L3UwdidEcetttmxebk9RRddjRY9VfUgT18q0_2j9IRO67UyXU6i14w5KmdrKNgarYoAUScF7WgYsfEaclc6HHbo8FtnMbGDZT7Mhh7-KybsxQKCxB3ouY8zcqt-u7tGizMtnHH-Olbu7nskToPRveawVeAi3ZXdk80WfJrwy3sbg8zo3RqpC43hmKIibauMCpunkgWD0BsnINAGUUM9SjS_QShYqcveXsBdBq_Jjn3zrQDB1vNlCXvzfYI3enlCQs7FiPO4g02YyrZar3t5danphAyeEPBtRRmVmDS46gRErplE4rnxJWhPQjlEtMhTvvDC3w7t6lR4UyB-ExXr-EsFGs_3Vb6KMWuoYpB8vNZ0WnBRs2Jv7n2c2V3O9rbbMPGoKk1SDsiQJcvpX325AKtxakz_k_SbABYEuqyYVUTxlKJPQywLrYrGBh8wiERUQNOgA9jydPA19j5K8tIpdEl_JYEZqZnFlhopfM-KmVkWguu09u2XN-n5RiwkpU7Nro6Px7biZGyABI5cU0zG5evExln0TjXy6X7ABJQhbagwFgbXxGG-NvECBm3CNmofqeowrNLTuVs1JcYsZUj4KMj3eOS-nlyvUyJqx8GR6J2PdOaLxHSU_Cbi7se1ybxux6-8rJNlRJN-Ezdvzeng-UxkPY3ndL8Dns0XXs8T5SvDyzq9Y4WJX-nfpUh33nBC_d5x_V_zHiEA_PKj-b8FhNxanAXQXJeG3xIPgGXmxWpybw-YIjMouZVfXbjPXZhqLUw08MOpa6_9g_Wft2VKJyM8D3LNvPVAuwEGtnpTqBKpcOjk0KGpQVX4bhGvhw8G6tVBHuIoFwdVrDVrcmzeLyGKCEciaIoUkxXMeQH9f&cid=CAQSOwBygQiDXmAqvXuuookQYDfhJ6ej_lHZbYI8f4L7HHZBlLAkW6EF0jymtdZt-uRWBoKSOdcnTEXeR1OoGAE&dc_eid=31075529&dv3_ver=m202301300101&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=14270463404999264000&adk=212707235&idt=57&cac=0&dtd=5
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 19:19:34 GMT
content-encoding
br
x-content-type-options
nosniff
age
19680
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
4172
x-xss-protection
0
server
cafe
etag
5499578052516643378
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 09 Jul 2023 19:19:34 GMT
abg_lite.js
pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/ Frame 6ED2
30 KB
11 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/pagead/js/r20230620/r20110914/abg_lite.js
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DlTNHfkDfl8dCu7VWdpWE6X0PBoTwt0uazF_Rj4gcIvhxtMdK3Ul3thYcE1ReaXIa5o--kvgXEBZqch3C_PKgVv3A4Yfu-doibOFU0JNpr_gXom24vPFLK4ckIYD11pLKAVxy-g9ucw_S98hf-9daDc5z-WWjrIUkiwC2F9zqRaxL5Yu4&dbm_d=AKAmf-AFOAtuhHU6tTQQmCz0MOFsrc8a3YJqANVN60SekvNM1nZZW5gsdrVoZwe_-F_QsGKbH-sNuWu8swDb5spTakABWEkj4A_kNzZ4qv6QzG_KD_JxvwsfDUnQM26V5xxS9H9sB1d2fKudHrqQnufBNtL24znNZhdKXp396SQRPSokOK0ZeqSO4CqCIWbbkNxe8j4JCA7qWV5mDlnjsro18TvObT8E4psQjU98XcHRhoIJHR9qy7W9a19xcJxkl_xq_nRRREuuRhsRh9kkoJcCu30JAwy-eazNA0qp8P_71d1UNS0RyTROWGp4meATT4OM7IPQXvuATRPf00hv9RQjQTzNbG7IP2BvKKcG-MbpjsMN4k7o1vourExmTFrB9v3Ng0rt-PVico1k1mYIMxoLE2dA1bNnRXzV1bulpWgStnSTW6-3xqY1RKQzkqjwjGsodWfzry9Li1e4-v6mlIbxefDpTeX516eqwH0ZfkQ27yb5HSjRlcOWjnh6XtI6znjXS3-0MABmWs0e3Y24MaGDc0xVHM6DrsdHb8hjQ0CuiCF6lFPJ5poXpQ2gSN2a-Eow2fiuRaCmfhPffeohhHXWCWq7CuiWI9OEEErKgmcLwMEVmfa1z5qMsRBMq5vZeJqy_gGf-otP6OplQQil0CBjHuzVXAePPsp8EIKP8fpmWLppiLiIUKVgakl04qtlAEBxFd9ekQ3kdy3FaNEFtDAZPICXKvvai8MqNaX_uzMlxru80_qqTwAKPZbblG9cKx0z44ruhhPHFS6BvYDEHP8Ev_0ESeiyjNmsMq6EgduuGNOZJ59H9zsmZ2M_XRzRwvHZF-O4o5JqmUUVhCwE_wd8oucpy4iD026AZ3CfSGP-yGnNKzHoavFc2tpbhWYFFKPcCwzNZyNXBXIdhAVhf5KwjUAtSFZshzvihqrGzOT11o34VAusKOkBOP00K0C2ShW__C9EX5a1gKb8VKMofa2DE0_w28HGsG88bfHbKB9pL5Ll0dCMaMEYCdAkQ4VPy1vAZHpofkryrYhuze07EzLw-9E17hekf3SIPYkSeLxtWexODqbp2nAxRz0fCLemyj45oYGooXrS0_w37pSrMCiQsHL9MCnDs6v23yVnNRkLum7tpPNCMJg4rG-hwzDTMfnrZSC1Cil7Mup5Nk1mBpzhoQgP0trihmcxrHJNbCrIA3P2ZNKgbwZ2GEcwC3LwT01Yp1cyE4pL2yujnAkoRGegolEF2JEd7OfxYc9yf06Dq_z5Qog79nBq0w7gold36eV7B4VyWKML6wL61sSmzcnS_yZxnsMq8OJDQIICqLZaj4rGof0uZA0QGe6xKlf-CfBHOSh_AE4LoKZZp7E3DxvIOfDbh4DVBim4DCbfn3RvkhpRPNBFw8vYXfG7HM-WAzhTHsd-ZEHCKxzik7l4oWClythLUyZmeyqEP2smU048CZ9KYxP_zFUjOu-fgqYPzOqhEJt98uJt1gU78u3HSuxNlRXkdPQR0G9CDGANL4_kmEzA0UUjYSvO28gZRvqBl9Dmwkjr0L5NG8N-76VH0cqBaWJKbVofQmTCHhJJUCazC2woN2z8osJx0IWQnpHnrk_jhn7D1DQ3aZwD1c3eiCMhso0g44JKZ0_ZwBWgkUvyAMBkwgaYElzXFNWi2q3xG7CgBsa6ncdzFVJ8aS3GqFLd8UdYvO92Bh7VfTHzv0w-2URVEuk7HGEv5gEfB5vO3ToAglACd49ZEaoRQxS53rN4IIlCpmSR_qEAb5VcRGz0vACGSsrJtP6in0RTAcdJOgD_lOc8i3RIKmqK1TDy-muOzyJPO3yYiDYwy_aq6V2tElb45w3VfbLgxo7fIMDN0bugVSTBn5JtCjiXgNqEI04uSCSdV9GNkXAV-E6WP-A7wbQl-_8ac0LJXMQs2xqyZ-txYw5ffBaJKfbvhPC8ILwhjWJDWebY1CYo8OUjMUvEE6zggqCCwNz-Icnym9RM7qk71-h4FoZvRNMNCApwgLpB7ir-A--HbDzeIAI6y0nSRU_c6LpJwtD-O75PJU1hScjxEKIchYSAC0x2hbsRLg4owSbPIAorHIsQEXb1Tysb877mdvoqC_sCuMETsHZgy_xPBoP_Qoiy3VFWI4HbRQKjUrBcvB5pm6VFYAtggRsgE0kp61wlzxvGjSeCXhbzsnAgsw5EULDmznv2HkObfvk-t22us2blEjRmO6-gPVOke-dtBOTImmeT9q5uv1b56oSE6FLqokZR25krt3XBmx6V_FwVIK0tz7sADyem72gKEakM84zoOezWtARxcjfWjquyUq3lqmsjGpgPd-C7JFIiX574kgTSKCDYTumCFEfWSpJV550741ip6BcNknnOEBe9CshSoolvXxFXtxCpR0PaspEHpDzq9JaVg9VXkKL1Nb2Qt2e7jMM_gT4eKofVq9Lgqh4brYfY6xZOb_p0lffyfckBswvEuew4YObkRSwYYalMHJmVbLnLn9NCrAd53YFYQpCZGQB977TyN2PPLYvYRhl4APUQloo9L3UwdidEcetttmxebk9RRddjRY9VfUgT18q0_2j9IRO67UyXU6i14w5KmdrKNgarYoAUScF7WgYsfEaclc6HHbo8FtnMbGDZT7Mhh7-KybsxQKCxB3ouY8zcqt-u7tGizMtnHH-Olbu7nskToPRveawVeAi3ZXdk80WfJrwy3sbg8zo3RqpC43hmKIibauMCpunkgWD0BsnINAGUUM9SjS_QShYqcveXsBdBq_Jjn3zrQDB1vNlCXvzfYI3enlCQs7FiPO4g02YyrZar3t5danphAyeEPBtRRmVmDS46gRErplE4rnxJWhPQjlEtMhTvvDC3w7t6lR4UyB-ExXr-EsFGs_3Vb6KMWuoYpB8vNZ0WnBRs2Jv7n2c2V3O9rbbMPGoKk1SDsiQJcvpX325AKtxakz_k_SbABYEuqyYVUTxlKJPQywLrYrGBh8wiERUQNOgA9jydPA19j5K8tIpdEl_JYEZqZnFlhopfM-KmVkWguu09u2XN-n5RiwkpU7Nro6Px7biZGyABI5cU0zG5evExln0TjXy6X7ABJQhbagwFgbXxGG-NvECBm3CNmofqeowrNLTuVs1JcYsZUj4KMj3eOS-nlyvUyJqx8GR6J2PdOaLxHSU_Cbi7se1ybxux6-8rJNlRJN-Ezdvzeng-UxkPY3ndL8Dns0XXs8T5SvDyzq9Y4WJX-nfpUh33nBC_d5x_V_zHiEA_PKj-b8FhNxanAXQXJeG3xIPgGXmxWpybw-YIjMouZVfXbjPXZhqLUw08MOpa6_9g_Wft2VKJyM8D3LNvPVAuwEGtnpTqBKpcOjk0KGpQVX4bhGvhw8G6tVBHuIoFwdVrDVrcmzeLyGKCEciaIoUkxXMeQH9f&cid=CAQSOwBygQiDXmAqvXuuookQYDfhJ6ej_lHZbYI8f4L7HHZBlLAkW6EF0jymtdZt-uRWBoKSOdcnTEXeR1OoGAE&dc_eid=31075529&dv3_ver=m202301300101&rfl=https%3A%2F%2Fpcloak.blob.core.windows.net&ds=l&xdt=1&iif=1&cor=14270463404999264000&adk=212707235&idt=57&cac=0&dtd=5
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
c99a1db5a8ee11a2fc13ab0544e3865f781fab4515592ff6467e7273478f813d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 19:21:16 GMT
content-encoding
br
x-content-type-options
nosniff
age
19578
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11398
x-xss-protection
0
server
cafe
etag
3934322099733601226
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Sun, 09 Jul 2023 19:21:16 GMT
UFYwWwmt.js
tpc.googlesyndication.com/sodar/ Frame 6ED2
41 KB
15 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 13:52:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
471299
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15207
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 19 Jun 2024 13:52:35 GMT
adview
googleads.g.doubleclick.net/pagead/ Frame 1BE1
0
0
Fetch
General
Full URL
https://googleads.g.doubleclick.net/pagead/adview?ai=CbmkBJeCYZLLqO7WorASStLroBM-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTY1OTM1MjMyMTAwMTAxNTTIAQmoAwHIAwKqBK4BT9BIzp8KKGxHN-xNRUFbet6WdVxpNpuSqNV5IE4CNRIG3oa1ddFitq_4z99lBDiFUhFE_IVHMhIDihml9_MkyJQ8eMuIrwEkDyDXYeIyklDvn4irP8InVh2cbKg8-Lak96dkVSTA9z1WnxditH6BGeVhzrwha3yarTt0R2YCgveOv9j3RHH3bGywp1lOoRdFkycUD4AjQRbefE_bXJie6JGFpcs-R9FdPBRP-97agAa-1Nb82ZronagBoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQIAKAfoLAggBgAwB0BUBgBcBshcaChgSFHB1Yi02NTkzNTIzMjEwMDEwMTU0GAA&sigh=obxnmbgD_iw&uach_m=[UACH]&cid=CAQSKQBygQiDHhbipY7in9nnfCoaC7aqKCR_nWviRjDKTfdIMrhDLLVwlzKLGAE&tpd=AGWhJmv6ypGLriqPrVDhjuVv4psR4_kis61OOz2CclxA4QUiRCgM2zVNDDh6p3A9Jt5S-He7jlKu0z8HfVHUVsLRBAfii2uG7d6sxQuDKKTMoOxw9tuQaRFHH9bvoZP_JBsgTN44jA_6RNU5CoIZKjpDqiSgKD7kpRViCLN7_cg4p1RcrZDdbtAOs8Sv62v6NumNGly8SkLSKsufHbf2p7OmWQIbJl-piSSCge3Z9uaO9bw2aSmoLedudnZrnK31nALzSgfY-QyWyn_ZwKwM_b7XoS45mdZFGMmgYMCes5NG3zRYExDZ8ntltTeKLOgBX8huS1u4n6tWBUvpfUvB1xBX4Z1ovwcKMktjxCSYacLvlRk7EayQB596Jxyv0FsyDLI9pEtzrRNbtCTeGmrmvI4I5-uc2Q7gkKNv8UE_Is_LaIEM0anNQAo87EJVg7DTfpbR0TThhWaWz02imyFY6h4eNqg47lJi1gf9HnWN4ZijQGx4EM-EqoKlTweNT8vNyUzg9_m84UhQ_BoMbvDZQlin-Y4DEp6nbRl0vzfGi-m1pfxAy8qzb_YWy44FOMLTIo9MOQcbqNUf5yqZjDai97SQyqDx5bWpqSOhVIrgsbyXPWGRkImWjFAvt5h6o16q2kzhzgWKOcnTP3oIo3C3Zj2oPxew-PviGj8Cy1HzWdC9UuVIxkGgm3hVzJV2UHaXqTakHiCu1xPDFJvwpyJSSq0FoW_kUBG6WxzYTlcPAoA0Q1UzJjopiD8UelTaZ8UDOFylp94IlnnfDv6HTuFDvUIjM6azUqOIkUKr2H2rSwP-WtAILXr3COEYuq6OX_FA0mmceqwmJ4mvCKlgHR7zIlwiW43JUBCF7LVrZCdKreQc0ys72Td3sKbgDl839ieAFwWlHErMoWDQ88gNkT69LIH8UY1FyKUjT-KaJE2RQOLA-MMws1rEBzEjRznRNdcf-7dr3k8Sq0fK2SMmClStzl2GraNM9odi9DEdi4_Oem-Y837bxd2y8arXfWYK1RGuA90-kzxuzQ9kyVbMWIgg2M62kJNzVMxcoqWxXP3-77-G53dWRvu42CMIDqpXa-6CMfR0YuFhZXSH_iKQV8WYcH0bwWtgmCKl6xEU7YaE-iP4ToPKy8NE3kY
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453820&bpp=35&bdt=94&idt=136&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4671767059969&frm=8&ife=1&pv=1&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.1e0bozjdbm9m&fsb=1&dtd=145
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453820&bpp=35&bdt=94&idt=136&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4671767059969&frm=8&ife=1&pv=1&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.1e0bozjdbm9m&fsb=1&dtd=145
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
script-src 'none'; object-src 'none'
date
Mon, 26 Jun 2023 00:47:34 GMT
x-content-type-options
nosniff
server
cafe
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 95A8
1 KB
643 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
41304
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=86400
content-encoding
br
content-length
618
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sun, 25 Jun 2023 13:19:10 GMT
etag
48472445140208031
expires
Mon, 26 Jun 2023 13:19:10 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
truncated
/ Frame 6ED2
214 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
60056bf4f70d5edcf3ecf9d7124a462cf99852d33cf60980b969259dce057e69

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
index.html
s0.2mdn.net/sadbundle/11934569601524222564/ Frame 8BD3
13 KB
3 KB
Document
General
Full URL
https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=ybHb7UDSck&t=1&renderingType=2&ev=01_250
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
293c4dc30efea546e286c0185dce44c51099dd75f3486716f08547a8df84d6a7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
2688
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:47:34 GMT
expires
Tue, 25 Jun 2024 00:47:34 GMT
last-modified
Thu, 30 Mar 2023 10:59:02 GMT
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-xss-protection
0
view
googleads4.g.doubleclick.net/pcs/ Frame 7DEF
0
0
Fetch
General
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuO-Sez763x_vAMjZzo0c7WOTJZUmRJRy9Y9Em0zmjEN6Taaf-4Sxq1LWuSugagpis0uBebnNf55Z1ZrRBBSZLgzuvEbRtvvfBeQN_q9SkHjAu48nyd995GKFO9ulc-8PJ1wZnVfEVIRP9qpxjTGDMWr8sy-aPd3zEeXmliG5qNGfEUaJQ1ismKwIRXrBvGYp36Mmdi4Px-ybo7eHN9zLZ1QebvcfvHw2FPRAarACBnK0feV95pOuZ2HFkwL0b6y8Su7-GQvAJuB3qMNksSKjbxXGAQP6H1bgIBV-Z-31OB9DAViM5HwclwtX3D47WdUS5lhwRiWWgSlsbmWC2CMZWv_kWJfbQCO1JFVGdvQbm0L4QILjEea21hPj6CvniQk9-4ZpWcy4qf8-Nr3zRVUrnRDPvjn8MfFsQfM4OCHhGD9E4IW5hUGQE1WlL_JWTH4G4ekyyF7Zb9qfbwXIH65BX3lvT8tkKqYlrwvWAbrNOAj-Gu2slELEZltf8A1WmcQ4uiD7e4Kw7YZ9e6vflVnRIN9DVAhnCeXt2SEOnQw1fn_xQ7PFtLU9StCReTVn8B1MxkS1bHo4OnFe1c8pROsW3Y5wsvCMltxB9RRmIUp9_FQtV9mrb_y0VCmTS1RJJcEf-slxKnmTNXBBadWAs1VgpTVTW2N5hqLaqKt0hWHiE2tRPwqEjK2aaa-LvofkH6huOYw3K8j3L1KgF0-3E4O_c3x7U4jo7HiJAqgTZHIJSwyFPru3YX-4lPfRPz_tgYJp_HUXfXgtTnS3SMYMrygfbBtjzWw_J5LMUf3-FvlGkCrDrYSjRdQJXUCGcVpJ9Z7pRDfkNz9GPkMFjqzOGOu2FoYQ7bdQiq2VATNer1qw1OQnPLSN85hf7k_WyYcZSIc0OkelTt87zqqqZjrFmUylWqHBymBfBebG6oHwxl0FpM0hYV1Uxa47xacxXUz6DjN2YxdVDmI6KMaoqLJuY2CRzl1q-w8EsPnrUAi0eUjlJCdP8g-nLhQxzbzIMFa-HFjUiAwnyXMLDrnJ7nt0KiGnh9RolkZuQVhloE9Ahk8HNtkfvNSJBQnWcm1P6jxDsFVYbpg2lvmqILUKdTM_vyQ39MbhvB_1iRBavc2fAlCdmqjOlKmQTdVWqXrMgxiK5xHMZGiJgpscQnSOjGC-9ZgWJJZ5gt_I2XCD-e-AeuWQ93XvzR0BgAJuj461gHUuHSj4mYsNTRlxPimVS7czgr33wdjggRBavt5AyyWeitlBXEIMSSpM7CS2R9tY7IlTOW4flXJPQGb4Yu5_HbQbxyz0FOVrnQnQl4UoE6QYJ8JA&sai=AMfl-YTlkOk2HuPDblVHTunj2xwDRwYdpTZaOTmeXXBhOPgmjjLK9yMEzZ7NSaEGVQOnNB2hVlQNQKoa9DfaQfUFL2dJ4W3S-cIEY6xNbn2BM28RKJPrIZ_M0sZcT5yq0Pmj_tiU9OgRJ5zadwSw4uKd9y2y0sO1vaxXwk-q5kKWCaIodp_RXWWzQmb8MBUr10RcRttQZMGkDhwbyrbMqOut__WYOE7Ga5oRBFsjN8SEDOnpAs2xh54wo4ITKgTwUraGcmCcCV6liBU_hesHKLYB9YPBFRIAfg&sig=Cg0ArKJSzOutgFhfFah1EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=185&cbvp=1&cstd=174&cisv=r20230620.44014&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
script-src 'none'; object-src 'none'
date
Mon, 26 Jun 2023 00:47:34 GMT
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
cache-control
private
access-control-allow-credentials
true
timing-allow-origin
*
expires
Mon, 26 Jun 2023 00:47:34 GMT
pixel
cm.g.doubleclick.net/ Frame 9A07
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESENglKzaAGvAbF7rfscjzi_Y&google_cver=1&google_push=ATf1kGOtK4_2FI6l_rObSB0LRtLGiR4W2vM2M7svy1JDOHeTabtncWEfHkRHxc82ZRYf3Og0ccI17lGM6WHBmq9GtzlgKmM...
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGOtK4_2FI6l_rObSB0LRtLGiR4W2vM2M7svy1JDOHeTabtncWEfHkRHxc82ZRYf3Og0ccI17lGM6WHBmq9GtzlgKmM9Jpw&google_hm=eS1mSWhMaDNKRTJwR01CRDF...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGOtK4_2FI6l_rObSB0LRtLGiR4W2vM2M7svy1JDOHeTabtncWEfHkRHxc82ZRYf3Og0ccI17lGM6WHBmq9GtzlgKmM9Jpw&google_hm=eS1mSWhMaDNKRTJwR01CRDFOR1NDYkR3R1NOSzhaNGtSN35B
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Mon, 26 Jun 2023 00:47:34 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
location
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGOtK4_2FI6l_rObSB0LRtLGiR4W2vM2M7svy1JDOHeTabtncWEfHkRHxc82ZRYf3Og0ccI17lGM6WHBmq9GtzlgKmM9Jpw&google_hm=eS1mSWhMaDNKRTJwR01CRDFOR1NDYkR3R1NOSzhaNGtSN35B
content-length
0
pixel
cm.g.doubleclick.net/ Frame 9A07
Redirect Chain
  • https://d5p.de17a.com/cookies/google?google_gid=CAESEF7lBAKD5G-6XM_B--ZiZu8&google_cver=1&google_push=ATf1kGMMsckoKHJZlwbmFpDvhs9VteeiBbOSskS4v4k80nKJoya475ykN51_rQij4yvBnCLvWZa1K0ZJnMvIFTEA5ToSvmo...
  • https://d5p.de17a.com/cookies/google;c?google_gid=CAESEF7lBAKD5G-6XM_B--ZiZu8&google_cver=1&google_push=ATf1kGMMsckoKHJZlwbmFpDvhs9VteeiBbOSskS4v4k80nKJoya475ykN51_rQij4yvBnCLvWZa1K0ZJnMvIFTEA5ToSv...
  • https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGMMsckoKHJZlwbmFpDvhs9VteeiBbOSskS4v4k80nKJoya475ykN51_rQij4yvBnCLvWZa1K0ZJnMvIFTEA5ToSvmoBcJs
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGMMsckoKHJZlwbmFpDvhs9VteeiBbOSskS4v4k80nKJoya475ykN51_rQij4yvBnCLvWZa1K0ZJnMvIFTEA5ToSvmoBcJs
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGMMsckoKHJZlwbmFpDvhs9VteeiBbOSskS4v4k80nKJoya475ykN51_rQij4yvBnCLvWZa1K0ZJnMvIFTEA5ToSvmoBcJs
content-length
0
p3p
CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV
pixel
cm.g.doubleclick.net/ Frame 9A07
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESELkkPXHlyITuQHaSzIBNFlo&google_cver=1&google_push=ATf1kGOWVGtjOki9DcutlkVuVZTj92xngM7QZGvxK2ICuN3M1P2oulfHcUanGenuUOXHiLsVKd5...
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEpDNTM5QlYtWS1DQVNQ&google_push=ATf1kGOWVGtjOki9DcutlkVuVZTj92xngM7QZGvxK2ICuN3M1P2oulfHcUanGenuUOXHiLsVKd541rq5acjLqWMPeRmwgZt5W4Y6
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEpDNTM5QlYtWS1DQVNQ&google_push=ATf1kGOWVGtjOki9DcutlkVuVZTj92xngM7QZGvxK2ICuN3M1P2oulfHcUanGenuUOXHiLsVKd541rq5acjLqWMPeRmwgZt5W4Y6
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEpDNTM5QlYtWS1DQVNQ&google_push=ATf1kGOWVGtjOki9DcutlkVuVZTj92xngM7QZGvxK2ICuN3M1P2oulfHcUanGenuUOXHiLsVKd541rq5acjLqWMPeRmwgZt5W4Y6
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
cc9654c54e9aa67bf2b10be1073297a8
Expires
0
pixel
cm.g.doubleclick.net/ Frame 9A07
Redirect Chain
  • https://match.360yield.com/match/ebda?google_gid=CAESEJjCUy7b6Q121-IlBrRDPLM&google_cver=1&google_push=ATf1kGOTuTJ-Dl7Uw4dldA1DsouBpYz4h2hOfPC0BB_tDJfA8Swrt1Xomo_5KAW5NpxJcU49F84b7rc8OQkM5maHe-FOE0...
  • https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEJjCUy7b6Q121-IlBrRDPLM&google_cver=1&google_push=ATf1kGOTuTJ-Dl7Uw4dldA1DsouBpYz4h2hOfPC0BB_tDJfA8Swrt1Xomo_5KAW5NpxJcU49F84b7rc8OQkM5maH...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=uac6qD-HRKOXN8fMj7mMtQ&google_push=ATf1kGOTuTJ-Dl7Uw4dldA1DsouBpYz4h2hOfPC0BB_tDJfA8Swrt1Xomo_5KAW5NpxJcU49F84b7rc8OQkM5ma...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=uac6qD-HRKOXN8fMj7mMtQ&google_push=ATf1kGOTuTJ-Dl7Uw4dldA1DsouBpYz4h2hOfPC0BB_tDJfA8Swrt1Xomo_5KAW5NpxJcU49F84b7rc8OQkM5maHe-FOE0ZoQkn_
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=uac6qD-HRKOXN8fMj7mMtQ&google_push=ATf1kGOTuTJ-Dl7Uw4dldA1DsouBpYz4h2hOfPC0BB_tDJfA8Swrt1Xomo_5KAW5NpxJcU49F84b7rc8OQkM5maHe-FOE0ZoQkn_
access-control-allow-origin
*
date
Mon, 26 Jun 2023 00:47:34 GMT
content-type
text/plain
content-length
0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
pixel
cm.g.doubleclick.net/ Frame 9A07
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEB...
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&zcc=1&google_push=ATf1kGNIV-9XyzH5Y9EJmcTVEQWPzmH-EBpcm6K3EiR5g0PDGEj7Lf4fH92JLUMpDI3NVxYHa-fTAl9oL-LgZEssO12yL18i525t&redir=https%3A%2F%2Fcm.g.doubl...
  • https://sync.targeting.unrulymedia.com/csync/RX-49bea114-ddba-49a5-86ec-f45632124bba-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DATf1kGNIV-9XyzH5Y9EJmcTVE...
  • https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGNIV-9XyzH5Y9EJmcTVEQWPzmH-EBpcm6K3EiR5g0PDGEj7Lf4fH92JLUMpDI3NVxYHa-fTAl9oL-LgZEssO12yL18i525t&google_hm=A0m-oRTdukmlhuz0VjISS7o
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGNIV-9XyzH5Y9EJmcTVEQWPzmH-EBpcm6K3EiR5g0PDGEj7Lf4fH92JLUMpDI3NVxYHa-fTAl9oL-LgZEssO12yL18i525t&google_hm=A0m-oRTdukmlhuz0VjISS7o
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGNIV-9XyzH5Y9EJmcTVEQWPzmH-EBpcm6K3EiR5g0PDGEj7Lf4fH92JLUMpDI3NVxYHa-fTAl9oL-LgZEssO12yL18i525t&google_hm=A0m-oRTdukmlhuz0VjISS7o
date
Mon, 26 Jun 2023 00:47:34 GMT
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag
RX49bea114ddba49a586ecf45632124bba003
content-type
text/html
sync
ups.analytics.yahoo.com/ups/58281/ Frame 9A07
0
125 B
Image
General
Full URL
https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEJOq3dn7NrXg2hPhr7eYLow&google_cver=1&google_push=ATf1kGMJC7JAaRSz68SmmIeZy9ug29PvSUVfite1Ee5LNK6-Q6gGxV0PQglhiF4_xkOUUyNhXh7RJyk3MpXQ9Oi9VNGQYI0OjUlVBQ
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.71.149.231 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-71-149-231.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.10.57 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.57
age
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
0.gif
id5-sync.com/i/495/ Frame 9A07
Redirect Chain
  • https://sync.inmobi.com/gob?google_gid=CAESEMJmKHQY2BOQ-XznuTD881o&google_cver=1&google_push=ATf1kGO3bAF5mPwu5-pFX5HnolWZ026a8XLcXvrirq798cr-OtZf3NorjARTa0YmQ16ehS-Fyx6fWjVMfmieHetzl_ILz6hi9KOe
  • https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGO3bAF5mPwu5-pFX5HnolWZ026a8XLcXvrirq798cr-...
43 B
1 KB
Image
General
Full URL
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGO3bAF5mPwu5-pFX5HnolWZ026a8XLcXvrirq798cr-OtZf3NorjARTa0YmQ16ehS-Fyx6fWjVMfmieHetzl_ILz6hi9KOe
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
HTTP/1.1
Server
141.95.98.64 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3216658.ip-141-95-98.eu
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif;charset=UTF-8
date
Mon, 26 Jun 2023 00:47:34 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding
chunked
p3p
CP="CAO PSA OUR"

Redirect headers

date
Mon, 26 Jun 2023 00:47:34 GMT
content-security-policy
default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies
none
referrer-policy
no-referrer
expect-ct
max-age=0
x-dns-prefetch-control
off
x-frame-options
SAMEORIGIN
content-type
text/plain; charset=utf-8
location
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGO3bAF5mPwu5-pFX5HnolWZ026a8XLcXvrirq798cr-OtZf3NorjARTa0YmQ16ehS-Fyx6fWjVMfmieHetzl_ILz6hi9KOe
x-download-options
noopen
vary
Accept
content-length
271
x-xss-protection
0
attr
cm.g.doubleclick.net/pixel/ Frame 9A07
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JsLL9jwByh9EyJiTj4mIE48zDogyr4WmTK3jkRClqB6ViA9GhcMRlZzjNsEWHTS3k4NML93qM
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
pixel
cm.g.doubleclick.net/ Frame 88D6
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEGtHSCIBAMISum6zw62rBdk&google_cver=1&google_push=ATf1kGNG3F8wWZbcm9tnqN4FoVJgzoZAFhiysV2KX8T87MOui_cH4s1TIPQwXllEa2OIAXRRm84cdFKtRzz-zLH5...
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=8ZhkmOAmTgGpXGsPjTC64w&google_push=ATf1kGNG3F8wWZbcm9tnqN4FoVJgzoZAFhiysV2KX8T87MOui_cH4s1TIPQwXllEa2OIAXRRm84cdFKtRzz-zLH5xBHyYRbq...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=8ZhkmOAmTgGpXGsPjTC64w&google_push=ATf1kGNG3F8wWZbcm9tnqN4FoVJgzoZAFhiysV2KX8T87MOui_cH4s1TIPQwXllEa2OIAXRRm84cdFKtRzz-zLH5xBHyYRbqtTerFA
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Mon, 26 Jun 2023 00:47:34 GMT
Server
MT3 1031 59fd23a master zrh zrh-pixel-x4 config_version:"1524"
Content-Type
image/gif
Access-Control-Allow-Origin
*
location
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=8ZhkmOAmTgGpXGsPjTC64w&google_push=ATf1kGNG3F8wWZbcm9tnqN4FoVJgzoZAFhiysV2KX8T87MOui_cH4s1TIPQwXllEa2OIAXRRm84cdFKtRzz-zLH5xBHyYRbqtTerFA
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
0
Expires
Mon, 26 Jun 2023 00:47:33 GMT
pixel
cm.g.doubleclick.net/ Frame 88D6
Redirect Chain
  • https://ads.travelaudience.com/google_pixel?google_gid=CAESEL-ksOoENgw1EsupGYPM6B8&google_cver=1&google_push=ATf1kGOsdAUKO3iqpgnT5vdwGr40v90A5XXalIOrZ5dnrsTmEf6y0Avvf4p38ovNM8xZoetBB71_3XWQm83X9eRU...
  • https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=WGS3T-SUSc-9zC_lT_zwYQ2&google_push=ATf1kGOsdAUKO3iqpgnT5vdwGr40v90A5XXalIOrZ5dnrsTmEf6y0Avvf4p38ovNM8xZoetBB71_3XWQm83X9eRUrGN2fAAZZPo7tQ
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=WGS3T-SUSc-9zC_lT_zwYQ2&google_push=ATf1kGOsdAUKO3iqpgnT5vdwGr40v90A5XXalIOrZ5dnrsTmEf6y0Avvf4p38ovNM8xZoetBB71_3XWQm83X9eRUrGN2fAAZZPo7tQ
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Mon, 26 Jun 2023 00:47:34 GMT
via
1.1 google
x-engine-version
0.0.0
server
nginx/1.21.6
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW CUR DEV PSA PSD IVA OUR BUS UNI COM NAV INT CNT LOC"
location
https://cm.g.doubleclick.net/pixel?google_nid=ta&google_hm=WGS3T-SUSc-9zC_lT_zwYQ2&google_push=ATf1kGOsdAUKO3iqpgnT5vdwGr40v90A5XXalIOrZ5dnrsTmEf6y0Avvf4p38ovNM8xZoetBB71_3XWQm83X9eRUrGN2fAAZZPo7tQ
x-host
tde-deliveryengine-production-6d45dff558-jhdwc
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
pixel
cm.g.doubleclick.net/ Frame 88D6
Redirect Chain
  • https://d5p.de17a.com/cookies/google?google_gid=CAESEP4MqeA5fzloO2Ck3iaFTP8&google_cver=1&google_push=ATf1kGP2iZjDPs1TUSrGFPPiMUJ6dn6Ng1KlwpdE3O-hniMC3Nmb4tvgTjfakagFR8X0k7Y-R7AdpX9HBxAEP_fQ_VUNFUf...
  • https://d5p.de17a.com/cookies/google;c?google_gid=CAESEP4MqeA5fzloO2Ck3iaFTP8&google_cver=1&google_push=ATf1kGP2iZjDPs1TUSrGFPPiMUJ6dn6Ng1KlwpdE3O-hniMC3Nmb4tvgTjfakagFR8X0k7Y-R7AdpX9HBxAEP_fQ_VUNF...
  • https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGP2iZjDPs1TUSrGFPPiMUJ6dn6Ng1KlwpdE3O-hniMC3Nmb4tvgTjfakagFR8X0k7Y-R7AdpX9HBxAEP_fQ_VUNFUfSKO_P0A
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGP2iZjDPs1TUSrGFPPiMUJ6dn6Ng1KlwpdE3O-hniMC3Nmb4tvgTjfakagFR8X0k7Y-R7AdpX9HBxAEP_fQ_VUNFUfSKO_P0A
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGP2iZjDPs1TUSrGFPPiMUJ6dn6Ng1KlwpdE3O-hniMC3Nmb4tvgTjfakagFR8X0k7Y-R7AdpX9HBxAEP_fQ_VUNFUfSKO_P0A
content-length
0
p3p
CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV
dds
rtb.openx.net/sync/ Frame 88D6
43 B
245 B
Image
General
Full URL
https://rtb.openx.net/sync/dds?google_gid=CAESELgVr7GsXuentyGTr_QLrq0&google_cver=1&google_push=ATf1kGOOwvJ1bI5o_e2KAEVTnNQuc4NejdQFNW-btYYMG1O2T_AXbzpVxC9Zkxczln1S6yVNaQU7tu07AEk2_1PNyALAayscknWV
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
103.252.227.35.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
via
1.1 google
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
pixel
cm.g.doubleclick.net/ Frame 88D6
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WKr6BDP-Rq6qIc1XsD0i6g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WKr6BDP-Rq6qIc1XsD0i6g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGP2wlTqaMgEmkjPQalUkosFWGSRNKdcXIV3wXRXQqhdjmfMdJfJrAQ-R-E0XXGtDYI9kEtjP2fQLWu3-1G695lN4a1Dh8H3Lg
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WKr6BDP-Rq6qIc1XsD0i6g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGP2wlTqaMgEmkjPQalUkosFWGSRNKdcXIV3wXRXQqhdjmfMdJfJrAQ-R-E0XXGtDYI9kEtjP2fQLWu3-1G695lN4a1Dh8H3Lg
date
Mon, 26 Jun 2023 00:47:33 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
pixel
cm.g.doubleclick.net/ Frame 88D6
Redirect Chain
  • https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEHw1FHOr0_5VGnSHsGQ4KcE&google_cver=1&googl...
  • https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEHw1FHOr0_5VGnSHsGQ4KcE&google_hm=ZJjgJuzYkefU3A3c3kdCJQAADS8AAAIB&google_nid=index&google_push=ATf1kGP7dSJe_UpjZc_BtpdX4RaF3oDNrzei-...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEHw1FHOr0_5VGnSHsGQ4KcE&google_hm=ZJjgJuzYkefU3A3c3kdCJQAADS8AAAIB&google_nid=index&google_push=ATf1kGP7dSJe_UpjZc_BtpdX4RaF3oDNrzei-7bTBkTPPBA7m3Z5qe_vujXlojT20dz-nQv_1LrmTq5scfT1Oqb6q7m4JbZjtID7Qw
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 26 Jun 2023 00:47:34 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEHw1FHOr0_5VGnSHsGQ4KcE&google_hm=ZJjgJuzYkefU3A3c3kdCJQAADS8AAAIB&google_nid=index&google_push=ATf1kGP7dSJe_UpjZc_BtpdX4RaF3oDNrzei-7bTBkTPPBA7m3Z5qe_vujXlojT20dz-nQv_1LrmTq5scfT1Oqb6q7m4JbZjtID7Qw
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=500
Content-Length
0
Expires
0
0.gif
id5-sync.com/i/495/ Frame 88D6
Redirect Chain
  • https://sync.inmobi.com/gob?google_gid=CAESEFHDrJ0XGS4485zhfcqU1WI&google_cver=1&google_push=ATf1kGMqJDtdIKOR9uZCkmDPr8UYsoe9JSJ3Wo971HQRsGV3Tq_mdGqPD_mrAAdASzXO4reuFYoRE91aQhaCZ3qopE5pbjMcCMvBIac
  • https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGMqJDtdIKOR9uZCkmDPr8UYsoe9JSJ3Wo971HQRsGV3...
43 B
1 KB
Image
General
Full URL
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGMqJDtdIKOR9uZCkmDPr8UYsoe9JSJ3Wo971HQRsGV3Tq_mdGqPD_mrAAdASzXO4reuFYoRE91aQhaCZ3qopE5pbjMcCMvBIac
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
HTTP/1.1
Server
141.95.98.64 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3216658.ip-141-95-98.eu
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif;charset=UTF-8
date
Mon, 26 Jun 2023 00:47:34 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding
chunked
p3p
CP="CAO PSA OUR"

Redirect headers

date
Mon, 26 Jun 2023 00:47:34 GMT
content-security-policy
default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies
none
referrer-policy
no-referrer
expect-ct
max-age=0
x-dns-prefetch-control
off
x-frame-options
SAMEORIGIN
content-type
text/plain; charset=utf-8
location
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGMqJDtdIKOR9uZCkmDPr8UYsoe9JSJ3Wo971HQRsGV3Tq_mdGqPD_mrAAdASzXO4reuFYoRE91aQhaCZ3qopE5pbjMcCMvBIac
x-download-options
noopen
vary
Accept
content-length
274
x-xss-protection
0
attr
cm.g.doubleclick.net/pixel/ Frame 88D6
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KgrZFiVHnpct7UA2vv3riog-c3VPjH2fH_fPU9Hw6Z3wWf66QkEdRY9rhoflGi-vnhJfYKWw
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
pixel
cm.g.doubleclick.net/ Frame F2BA
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&google_gid=CAESE...
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEAR2Pn3PGbF2daPykWLI7i8&google_push=ATf1kGNKfZgQLrFsa4lrz6Px4jZA4E_Ln-vP8V0zh4NKzE0QRN_z1jb_dN...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEAR2Pn3PGbF2daPykWLI7i8&google_push=ATf1kGNKfZgQLrFsa4lrz6Px4jZA4E_Ln-vP8V0zh4NKzE0QRN_z1jb_dNhdUBJDQEHFviaUBwVsUZBAiZMq8yQ3mHoo5VCvPJWgIA
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by
cache-fra-eddf8230062-FRA
pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
via
1.1 varnish
server
Jetty(9.4.35.v20201120)
x-timer
S1687740455.640845,VS0,VE94
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin
*
location
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_hm=&google_cver=1&google_gid=CAESEAR2Pn3PGbF2daPykWLI7i8&google_push=ATf1kGNKfZgQLrFsa4lrz6Px4jZA4E_Ln-vP8V0zh4NKzE0QRN_z1jb_dNhdUBJDQEHFviaUBwVsUZBAiZMq8yQ3mHoo5VCvPJWgIA
cache-control
no-cache
accept-ranges
bytes
content-length
0
x-cache-hits
0
pixel
cm.g.doubleclick.net/ Frame F2BA
Redirect Chain
  • https://d5p.de17a.com/cookies/google?google_gid=CAESEKkwuYKJDQnoUL0nNRgGdmw&google_cver=1&google_push=ATf1kGMrR7M3V8Y6Nogd44OdL9kxhz5GZXia9MAzioY5rsXuxegFLjP79eTG_okk1WiAubfxV-scpxgIgj1uR_CQL6L6HHi...
  • https://d5p.de17a.com/cookies/google;c?google_gid=CAESEKkwuYKJDQnoUL0nNRgGdmw&google_cver=1&google_push=ATf1kGMrR7M3V8Y6Nogd44OdL9kxhz5GZXia9MAzioY5rsXuxegFLjP79eTG_okk1WiAubfxV-scpxgIgj1uR_CQL6L6H...
  • https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGMrR7M3V8Y6Nogd44OdL9kxhz5GZXia9MAzioY5rsXuxegFLjP79eTG_okk1WiAubfxV-scpxgIgj1uR_CQL6L6HHiVS0M3Iw
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGMrR7M3V8Y6Nogd44OdL9kxhz5GZXia9MAzioY5rsXuxegFLjP79eTG_okk1WiAubfxV-scpxgIgj1uR_CQL6L6HHiVS0M3Iw
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGMrR7M3V8Y6Nogd44OdL9kxhz5GZXia9MAzioY5rsXuxegFLjP79eTG_okk1WiAubfxV-scpxgIgj1uR_CQL6L6HHiVS0M3Iw
content-length
0
p3p
CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV
dds
rtb.openx.net/sync/ Frame F2BA
43 B
103 B
Image
General
Full URL
https://rtb.openx.net/sync/dds?google_gid=CAESED7iP-kw9IhaUYmWe8B_n2Y&google_cver=1&google_push=ATf1kGMDi6kBuLyN5gmR6Uicd3KoageQaJtEblRtMpVXz4vWEaacJajGs6EcHXrb7rqp7SQMmYjVUixh8VKZA4QggIBZf9fN4FKNDQ
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
103.252.227.35.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
via
1.1 google
content-type
image/gif
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache, must-revalidate
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
pixel
cm.g.doubleclick.net/ Frame F2BA
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=dSD5l0uaQqaENtaMD40_Bw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=dSD5l0uaQqaENtaMD40_Bw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGM5jdZa6opxdYJ3F4D2tWdNvLxtBsfd3bKBwvZGNwBWaNwjcwWhVhcLqzmjXaq1UeLXEqVLgft__e0hAS-tHRHzH1k0gZU6BQ
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=dSD5l0uaQqaENtaMD40_Bw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGM5jdZa6opxdYJ3F4D2tWdNvLxtBsfd3bKBwvZGNwBWaNwjcwWhVhcLqzmjXaq1UeLXEqVLgft__e0hAS-tHRHzH1k0gZU6BQ
date
Mon, 26 Jun 2023 00:47:33 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
pixel
cm.g.doubleclick.net/ Frame F2BA
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEDFf3RQhKR9EG6CFBIoyVRo&google_cver=1&google_push=ATf1kGMaGIFdx_zqOQMbs2QL3ESW3DdvtwOwgKOMUzR2ADAM3Rp76HISDwGnkKFwq0mShdgfHpu...
  • https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEpDNTM5QlgtQS1MUTEz&google_push=ATf1kGMaGIFdx_zqOQMbs2QL3ESW3DdvtwOwgKOMUzR2ADAM3Rp76HISDwGnkKFwq0mShdgfHpuxEXTYavluE9Tr2lgr4pl85o_9
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEpDNTM5QlgtQS1MUTEz&google_push=ATf1kGMaGIFdx_zqOQMbs2QL3ESW3DdvtwOwgKOMUzR2ADAM3Rp76HISDwGnkKFwq0mShdgfHpuxEXTYavluE9Tr2lgr4pl85o_9
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type
text/html
Location
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TEpDNTM5QlgtQS1MUTEz&google_push=ATf1kGMaGIFdx_zqOQMbs2QL3ESW3DdvtwOwgKOMUzR2ADAM3Rp76HISDwGnkKFwq0mShdgfHpuxEXTYavluE9Tr2lgr4pl85o_9
Cache-Control
no-cache,no-store,must-revalidate
content-length
0
X-RPHost
37b22a0c36bd84993dd2cda4a5e04b1d
Expires
0
pixel
cm.g.doubleclick.net/ Frame F2BA
Redirect Chain
  • https://onetag-sys.com/match/?int_id=19&redir=1&google_gid=CAESEA0Qs9U_nh6cwrKW8vQMcW4&google_cver=1&google_push=ATf1kGMr0TIEK77uEVM0hyttaBHofj0HmNP83vq1gZsHQ6DrlhW_kd4nMVtXygYRnI-7QRWaglr0hjvQpLNi...
  • https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGMr0TIEK77uEVM0hyttaBHofj0HmNP83vq1gZsHQ6DrlhW_kd4nMVtXygYRnI-7QRWaglr0hjvQpLNiYIZ2NPlSMT6DvKqSvg
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGMr0TIEK77uEVM0hyttaBHofj0HmNP83vq1gZsHQ6DrlhW_kd4nMVtXygYRnI-7QRWaglr0hjvQpLNiYIZ2NPlSMT6DvKqSvg
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGMr0TIEK77uEVM0hyttaBHofj0HmNP83vq1gZsHQ6DrlhW_kd4nMVtXygYRnI-7QRWaglr0hjvQpLNiYIZ2NPlSMT6DvKqSvg
strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
report
sync.teads.tv/um/ Frame F2BA
Redirect Chain
  • https://sync.teads.tv/um?eid=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEOmwCr4GE6j5IzB91hLkF1Y&...
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=ATf1kGOK8SHMEMy_qa6HGdtBNTjMvgmpFpWJ4n49Md0hy9BI3vKmzHAS7AeP2vb6ScQAlwFls6NXdAzzKxGExy4fepL019gaNMggE0k
  • https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
23 B
163 B
Image
General
Full URL
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H2
Server
2.18.161.51 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-161-51.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.10 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

expires
Mon, 26 Jun 2023 00:47:34 GMT
pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
cache-control
max-age=0, no-cache, no-store
server
akka-http/10.2.10
content-length
23
content-type
image/gif

Redirect headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
260
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
attr
cm.g.doubleclick.net/pixel/ Frame F2BA
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13ItTafwq8Q6jKrS2Ex3c7W1DaRS5lzQAJS3Fqa4X9LQ1blxEKBV6jm1U1w3zCsgSmq62fSncA
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
si
googleads.g.doubleclick.net/pagead/drt/ Frame 2D66
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
17 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:47:34 GMT
expires
Mon, 26 Jun 2023 00:47:34 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:47:34 GMT
location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
si
googleads.g.doubleclick.net/pagead/drt/ Frame EA1D
Redirect Chain
  • https://www.google.com/pagead/drt/ui
  • https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
0
17 B
Document
General
Full URL
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/pagead/drt/s?v=r20120211
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:47:34 GMT
expires
Mon, 26 Jun 2023 00:47:34 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:47:34 GMT
location
https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 969D
22 KB
8 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
471267
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 13:53:07 GMT
expires
Wed, 19 Jun 2024 13:53:07 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
styles.css
s0.2mdn.net/sadbundle/11934569601524222564/css/ Frame 8BD3
5 KB
1 KB
Stylesheet
General
Full URL
https://s0.2mdn.net/sadbundle/11934569601524222564/css/styles.css
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=ybHb7UDSck&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
889f2bab730d916ae6b55451a2f2fcdb173b310e29306103ece5b4c545a38156
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=ybHb7UDSck&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 03:41:23 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
162371
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1412
x-xss-protection
0
last-modified
Thu, 30 Mar 2023 10:59:02 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 23 Jun 2024 03:41:23 GMT
Enabler_01_247.js
s0.2mdn.net/879366/ Frame 8BD3
118 KB
40 KB
Script
General
Full URL
https://s0.2mdn.net/879366/Enabler_01_247.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=ybHb7UDSck&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=ybHb7UDSck&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 10:36:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
51073
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
41099
x-xss-protection
0
last-modified
Mon, 27 Sep 2021 18:45:07 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Mon, 26 Jun 2023 10:36:21 GMT
logo.svg
s0.2mdn.net/sadbundle/11934569601524222564/img/ Frame 8BD3
6 KB
3 KB
Image
General
Full URL
https://s0.2mdn.net/sadbundle/11934569601524222564/img/logo.svg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=ybHb7UDSck&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7b1bfbac0178604f4dce665117d962743d2916a2a37968438f3d49d7e9c04445
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=ybHb7UDSck&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 01:50:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
169033
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2563
x-xss-protection
0
last-modified
Thu, 30 Mar 2023 10:59:02 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 23 Jun 2024 01:50:21 GMT
gsap_3.5.1_min.js
s0.2mdn.net/ads/studio/cached_libs/ Frame 8BD3
60 KB
24 KB
Script
General
Full URL
https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=ybHb7UDSck&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=ybHb7UDSck&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
24155
x-xss-protection
0
last-modified
Mon, 31 Aug 2020 21:23:17 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=0
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Mon, 26 Jun 2023 00:47:34 GMT
ajk4xlebn4mw
hal9000.redintelligence.net/zone/ Frame 1BE1
10 KB
3 KB
Script
General
Full URL
https://hal9000.redintelligence.net/zone/ajk4xlebn4mw?subid=&gdpr=1&gdpr_consent=li&rnd=7591843182207691145&extVar[]=DOUBLEBORDER:1&extVar[]=MMA_SSP:adx&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DdlER_-FlOBWmPx-MLQrOfA%26exch_seat%3D20035004448%26mt_aid%3D7591843182207691145%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_cid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCBozlJeCYZLLqO7WorASStLroBM-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTY1OTM1MjMyMTAwMTAxNTTIAQmoAwHIAwKqBLEBT9BIzp8KKGxHN-xNRUFbet6WdVxpNpuSqNV5IE4CNRIG3oa1ddFitq_4z99lBDiFUhFE_IVHMhIDihml9_MkyJQ8eMuIrwEkDyDXYeIyklDvn4irP8InVh2cbKg8-Lak96dkVSTA9z1WnxditH6BGeVhzrwha3yarTt0R2YCgveOv9j3RHH3bC6yhsviHbNCHoNcpFhj7ubDaEVnVraGCSxF5WTE5s9xJLrWR9lXI7R7gAa-1Nb82ZronagBoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_3gH9kcgYGyyOhepiMRuKehIoRS9g%2526client%253Dca-pub-6593523210010154%2526adurl%253D%26mt_lp%3Dhttps%253A%2F%2Fwww.soberberlin.com%2F%26redirect%3D
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.150.63.201.138.clients.your-server.de
Software
Apache /
Resource Hash
e0f47df7bb45f68b28b454119c52f21b8a11be6edaec103be7cccd2db4218587

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:34 GMT
Content-Encoding
gzip
Server
Apache
Connection
close
Content-Length
3331
Vary
Accept-Encoding
Content-Type
text/html; charset=UTF-8
img
pixel.mathtag.com/event/ Frame 1BE1
43 B
418 B
Image
General
Full URL
https://pixel.mathtag.com/event/img?mt_id=1368875&mt_adid=216764&v1=4&v2=7591843182207691145&v3=651871&v4=4562306&v5=6622332&mt_nsync=1&no_attr=1
Requested by
Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvWXpWaU1EUTJObU10WlRSaU9TMHpPR1U0TFRBd01EQXRNREF3TURBd01EQXdNREF3Lzc1OTE4NDMxODIyMDc2OTExNDUvNjYyMjMzMi80NTYyMzA2LzQvREhTQzNzbG9TcnFoOXpyclIxRHU1Nk1VU3lhcTJMNlFpWXkxZnByM29Lcy8xLzQvMC8wLzk1NjgwMy8wLzIxNjUzNi82NTE4NzEvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC83NTkxODQzMTgyMjA3NjkxMTQ1L2Ftcy8wLzg0LzExLzk5OS8xNjIvMmEwMDpjOTg6MjAzMDo6LzAuMDAwLzE2ODc3NDA0NTQvMTY4Nzc1MzA1NC80L3B1Yi02NTkzNTIzMjEwMDEwMTU0Lw/Yj5byie7u23R2pKFD_cjVSGftJA&nodeid=4015&group=cdg&auctionid=7591843182207691145&pbs_auctionid=7591843182207691145&shardkey=7591843182207691145&sid=4562306&cid=6622332&bp=a_aiebbd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.132.25&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCBozlJeCYZLLqO7WorASStLroBM-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTY1OTM1MjMyMTAwMTAxNTTIAQmoAwHIAwKqBLEBT9BIzp8KKGxHN-xNRUFbet6WdVxpNpuSqNV5IE4CNRIG3oa1ddFitq_4z99lBDiFUhFE_IVHMhIDihml9_MkyJQ8eMuIrwEkDyDXYeIyklDvn4irP8InVh2cbKg8-Lak96dkVSTA9z1WnxditH6BGeVhzrwha3yarTt0R2YCgveOv9j3RHH3bC6yhsviHbNCHoNcpFhj7ubDaEVnVraGCSxF5WTE5s9xJLrWR9lXI7R7gAa-1Nb82ZronagBoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3gH9kcgYGyyOhepiMRuKehIoRS9g%26client%3Dca-pub-6593523210010154%26adurl%3D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.101.148.198 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-101-148-198.deploy.static.akamaitechnologies.com
Software
MT3 1031 59fd23a master zrh zrh-pixel-x24 config_version:"1524" /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:34 GMT
Server
MT3 1031 59fd23a master zrh zrh-pixel-x24 config_version:"1524"
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
*
Content-Type
image/gif
Cache-Control
no-cache
Connection
keep-alive
Content-Length
43
Expires
Mon, 26 Jun 2023 00:47:33 GMT
img
tags.mathtag.com/event/ Frame 1BE1
49 B
330 B
Image
General
Full URL
https://tags.mathtag.com/event/img?type=mmImpTrack&exch=adx&bid=7591843182207691145&st=4562306&time=1687740454&nodeid=4015
Requested by
Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvWXpWaU1EUTJObU10WlRSaU9TMHpPR1U0TFRBd01EQXRNREF3TURBd01EQXdNREF3Lzc1OTE4NDMxODIyMDc2OTExNDUvNjYyMjMzMi80NTYyMzA2LzQvREhTQzNzbG9TcnFoOXpyclIxRHU1Nk1VU3lhcTJMNlFpWXkxZnByM29Lcy8xLzQvMC8wLzk1NjgwMy8wLzIxNjUzNi82NTE4NzEvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC83NTkxODQzMTgyMjA3NjkxMTQ1L2Ftcy8wLzg0LzExLzk5OS8xNjIvMmEwMDpjOTg6MjAzMDo6LzAuMDAwLzE2ODc3NDA0NTQvMTY4Nzc1MzA1NC80L3B1Yi02NTkzNTIzMjEwMDEwMTU0Lw/Yj5byie7u23R2pKFD_cjVSGftJA&nodeid=4015&group=cdg&auctionid=7591843182207691145&pbs_auctionid=7591843182207691145&shardkey=7591843182207691145&sid=4562306&cid=6622332&bp=a_aiebbd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.132.25&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCBozlJeCYZLLqO7WorASStLroBM-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTY1OTM1MjMyMTAwMTAxNTTIAQmoAwHIAwKqBLEBT9BIzp8KKGxHN-xNRUFbet6WdVxpNpuSqNV5IE4CNRIG3oa1ddFitq_4z99lBDiFUhFE_IVHMhIDihml9_MkyJQ8eMuIrwEkDyDXYeIyklDvn4irP8InVh2cbKg8-Lak96dkVSTA9z1WnxditH6BGeVhzrwha3yarTt0R2YCgveOv9j3RHH3bC6yhsviHbNCHoNcpFhj7ubDaEVnVraGCSxF5WTE5s9xJLrWR9lXI7R7gAa-1Nb82ZronagBoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3gH9kcgYGyyOhepiMRuKehIoRS9g%26client%3Dca-pub-6593523210010154%26adurl%3D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.29.132.242 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software
MMBD/3.392.6 /
Resource Hash
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:34 GMT
Server
MMBD/3.392.6
Content-Type
image/gif
Cache-Control
no-cache
x-mm-host
zrh-router-x64, cdg-bidder-x162
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
49
Expires
Mon, 26 Jun 2023 00:47:33 GMT
js
sync.mathtag.com/sync/ Frame 1BE1
641 B
767 B
Script
General
Full URL
https://sync.mathtag.com/sync/js?sync=auto&source=bidder&mt_lim=1&type=1&synclist=4
Requested by
Host: tags.mathtag.com
URL: https://tags.mathtag.com/notify/js?exch=adx&s_exch=adx&id=5aW95q2jLzIzLyAvWXpWaU1EUTJObU10WlRSaU9TMHpPR1U0TFRBd01EQXRNREF3TURBd01EQXdNREF3Lzc1OTE4NDMxODIyMDc2OTExNDUvNjYyMjMzMi80NTYyMzA2LzQvREhTQzNzbG9TcnFoOXpyclIxRHU1Nk1VU3lhcTJMNlFpWXkxZnByM29Lcy8xLzQvMC8wLzk1NjgwMy8wLzIxNjUzNi82NTE4NzEvMS8wLzAvTURBd01EQXdNREF0TURBd01DMHdNREF3TFRBd01EQXRNREF3TURBd01EQXdNREF3LzAvMC8wLzAvMC83NTkxODQzMTgyMjA3NjkxMTQ1L2Ftcy8wLzg0LzExLzk5OS8xNjIvMmEwMDpjOTg6MjAzMDo6LzAuMDAwLzE2ODc3NDA0NTQvMTY4Nzc1MzA1NC80L3B1Yi02NTkzNTIzMjEwMDEwMTU0Lw/Yj5byie7u23R2pKFD_cjVSGftJA&nodeid=4015&group=cdg&auctionid=7591843182207691145&pbs_auctionid=7591843182207691145&shardkey=7591843182207691145&sid=4562306&cid=6622332&bp=a_aiebbd&nfy_act=LD5weg&type=adm&client=c2s&bfip=185.29.132.25&3pck=https://adclick.g.doubleclick.net/aclk%3Fsa%3DL%26ai%3DCBozlJeCYZLLqO7WorASStLroBM-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTY1OTM1MjMyMTAwMTAxNTTIAQmoAwHIAwKqBLEBT9BIzp8KKGxHN-xNRUFbet6WdVxpNpuSqNV5IE4CNRIG3oa1ddFitq_4z99lBDiFUhFE_IVHMhIDihml9_MkyJQ8eMuIrwEkDyDXYeIyklDvn4irP8InVh2cbKg8-Lak96dkVSTA9z1WnxditH6BGeVhzrwha3yarTt0R2YCgveOv9j3RHH3bC6yhsviHbNCHoNcpFhj7ubDaEVnVraGCSxF5WTE5s9xJLrWR9lXI7R7gAa-1Nb82ZronagBoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%26num%3D1%26sig%3DAOD64_3gH9kcgYGyyOhepiMRuKehIoRS9g%26client%3Dca-pub-6593523210010154%26adurl%3D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.29.132.245 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software
MT3 1031 59fd23a master zrh zrh-pixel-x13 config_version:"1524" /
Resource Hash
6ac43ef3f239c57999c8b9358f3579302dccae849254e535b44cd3c8f4f19ba2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:34 GMT
Content-Encoding
gzip
Server
MT3 1031 59fd23a master zrh zrh-pixel-x13 config_version:"1524"
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin
*
Content-Type
text/javascript
Cache-Control
no-cache
Connection
close
Expires
Mon, 26 Jun 2023 00:47:33 GMT
index.html
s0.2mdn.net/sadbundle/7493198391404092334/ Frame AFC3
13 KB
3 KB
Document
General
Full URL
https://s0.2mdn.net/sadbundle/7493198391404092334/index.html?e=69&leftOffset=0&topOffset=0&c=8VazJQu393&t=1&renderingType=2&ev=01_250
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_278.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6c6d900511c502a6d0b97a298ecab07040eb48a8756ec785beddb35006825f0a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
2701
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:47:34 GMT
expires
Tue, 25 Jun 2024 00:47:34 GMT
last-modified
Thu, 30 Mar 2023 10:59:12 GMT
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-dns-prefetch-control
off
x-xss-protection
0
view
googleads4.g.doubleclick.net/pcs/ Frame 6ED2
0
0
Fetch
General
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuJ5I8hv4_Tv454Wwf9Jc2ZxCGWQNqqjgOnbqPc34NCmRpl1DcM-Cv24G-IJkgX36DqLtEG6xYcTV2ui5Qi36nrtWP2glS3ajucWFwvVl7h76Zum9DlLHxvnpJRKcXPhHWIx_SJOv_cxg9nIrGxmlQllKuSdTmcPfcsXl4IetoinMjiWkViAICa3aChOgNFOTW3VHudfSvgYB4Uxn8VfM5nBku8ygLPaCcvNUY2ZShbeLPGpUX4u0Vr-TeNIYHaBm6cBGOHnb97-5Ux2OMmHBU0uhqpXo5lKVNUiP9E5KfJWAEPUoqflPuB-khvFWToL2-lif9ZGBi27pQqccUPIrcsNrxlM1re_e4nzLv_mq50Ph506gq_fk25Kh8O7Me3UDUc8fsdnEr8g_fQTHqNan60TsY6bt00uUr5UkSB-2K6UHXfNx_81JaET4jJyAvHyXDOrvJiCDzM9FQnG678tz6RWEG3k_yBlTk2jKAtm9S69uXZLYCCtMKgWtIGS9f2JPp8UbZmA30zNZ45FisrvyaQDfwp5Cpw0A04vJ4WgoNhwwK9hnlvFdqPb6RJaTq4W5412gMiC4JUudsP80IJsRsPaGYCU0M1Ec93eAGCOj36lRWlFPogKTCDmJDGC_lPCU1st_BVYe4XFyhxmEtdtFlMBzU-ArLbZcV1E7l2alsngjpRSMmnHR9o9mht8E6PbKjiBzHzs1s6zmnxjKCE-7tWyVI0V24Kjjt6uXbietmXtajNOODcwcDMr0j3JXVGRM5Xkf2l3F9xqyYEANDPaJIpGnBM_kmU52gM5MSjkAoDh9OhnZ2LQ0niz4aKv3ONg_AjMX8zyrDpWupPu7ri5cFIwH9yyLWfbkXDwxcO6_o1RV-pnmmx8a4P0ojSI_L4ugizT9Bs-4pRMCNISWugGbD7n_k-ix5JLGhSrYGg_JJ-pddKx_WZ3N2AdmbnDkQh7rcmAhu8zB87y9dIDjl0K1oAP1wEwnghuk0agSV6-6M5zTIyKbl3w9B6hiCy6w6xEIuME8TWkuGvtH8kcFRs6yYXpApshKXS0h2Q64vidf27DZZqWhhYa_30RFXY2TpN67d_cQ8-h-g-kgu-c6IukCvJIgl8rlaYu7CWWy16lxcnBwCJzNPvooDmH91LNL26-yPJ42bg1Xzuj8HWGstFukScaKge00LHx5qjB8Cs-Cuz2QbDoBIqkXm7ICpOG37an9P3qlDRCvSZMOlgN1wXRj4Mpehi0Hr9BtstStEQedyt8P2go7U-P8VgWuaKTXM2wTgz3IZEPWTXsRT0eNhJWggueieHhlnEgkgFRC09EWGK1FpXbzxaljU&sai=AMfl-YSVRY3MlUBFSHSNYZ5nGrSjgD95arGTvqfGDPvEN5NH3nVZtlX1SjX29lqODKp1xV-DgfcjaC-fsK2rfV7KjNOO1MQs-qRn9hBF7u1V76hk61wfpFqe7-sXd9uMvpzEZYX2jcvJjjovoLeispEm4zQOhhKjFa2VyBVnsD4x9v821FIWUhDgN0EW-5wZBd_q-AsMfv5b_lAp0jSRzc7Suu8cUt96QtwPKvlbwwegVp7ucJl-Kuja_SePk0sZRgsSd4co8XXo_WkZMd0cyXf_-mSehSbJ4A&sig=Cg0ArKJSzNPfZnaI04v-EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=143&cbvp=1&cstd=138&cisv=r20230620.30957&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-security-policy
script-src 'none'; object-src 'none'
date
Mon, 26 Jun 2023 00:47:34 GMT
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
cache-control
private
access-control-allow-credentials
true
timing-allow-origin
*
expires
Mon, 26 Jun 2023 00:47:34 GMT
dpixel
cms.quantserve.com/ Frame 95A8
35 B
464 B
Image
General
Full URL
https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESELn3MWpkDaWCNiZVxoSjJCw&google_cver=1&google_push=ATf1kGM-g_dUfYIpYcB2ijyxIwGOr9CfhWP0cb5ly-d1i4Me7EOzTp0GqoiSistmV5E4-4bXwEg7oGwSzuNT--8D-EOw_WHDGxL3
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:93ca:31d8:d86e:38f6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type
image/gif
cache-control
private, no-cache, no-store, proxy-revalidate
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 95A8
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEK49SuFDrDuOviPm1Wax20g&google_cve...
  • https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEK49SuFDrDuOviPm1Wax20g&goog...
  • https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=M054Snk3SGsxUWRBb2U1&google_gid=CAESEK49SuFDrDuOviPm1Wax20g&google_cver=1&google_push=ATf1kGM_XqDI59rrJ1jSNxePPwBwmYxLmM0HuvHki_4aZgG...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=M054Snk3SGsxUWRBb2U1&google_gid=CAESEK49SuFDrDuOviPm1Wax20g&google_cver=1&google_push=ATf1kGM_XqDI59rrJ1jSNxePPwBwmYxLmM0HuvHki_4aZgGlleCroUZl5CGYPL4rtwlc4z8mSkkmHTk9hfZhUj-A9GBBFgDCjsGR
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 26 Jun 2023 00:47:34 GMT
Strict-Transport-Security
max-age=2592000; includeSubDomains
Server
PingMatch/v2.0.30-782-g97d928b#rel-ec2-master i-008a7b4f528d14c6d@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=M054Snk3SGsxUWRBb2U1&google_gid=CAESEK49SuFDrDuOviPm1Wax20g&google_cver=1&google_push=ATf1kGM_XqDI59rrJ1jSNxePPwBwmYxLmM0HuvHki_4aZgGlleCroUZl5CGYPL4rtwlc4z8mSkkmHTk9hfZhUj-A9GBBFgDCjsGR
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame 95A8
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/adx?google_gid=CAESEG0Mex24B1Ko7ViBD-xfHpg&google_cver=1&google_push=ATf1kGOtGyNtrme1U10XIdflTBSxqq_mCuXXpEIV_IaKz2YHcUwwBbCHINcqCtWgWc2pmViFV9cbGVjPCiN3AI2LNGu598l...
  • https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGOtGyNtrme1U10XIdflTBSxqq_mCuXXpEIV_IaKz2YHcUwwBbCHINcqCtWgWc2pmViFV9cbGVjPCiN3AI2LNGu598leZF-r&google_hm=eS14QlJLX1lORTJwR1o0OX...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGOtGyNtrme1U10XIdflTBSxqq_mCuXXpEIV_IaKz2YHcUwwBbCHINcqCtWgWc2pmViFV9cbGVjPCiN3AI2LNGu598leZF-r&google_hm=eS14QlJLX1lORTJwR1o0OXdEcEN2WmdwM0RqcDZGemxvNH5B
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Mon, 26 Jun 2023 00:47:34 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
location
https://cm.g.doubleclick.net/pixel?google_nid=yahoo&google_push=ATf1kGOtGyNtrme1U10XIdflTBSxqq_mCuXXpEIV_IaKz2YHcUwwBbCHINcqCtWgWc2pmViFV9cbGVjPCiN3AI2LNGu598leZF-r&google_hm=eS14QlJLX1lORTJwR1o0OXdEcEN2WmdwM0RqcDZGemxvNH5B
content-length
0
pixel
cm.g.doubleclick.net/ Frame 95A8
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=JmVRfPtNSQW_bx3qTqNciw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=JmVRfPtNSQW_bx3qTqNciw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGN7Glhc7NGZYwOJFIQj8lZNQ4jSodAhYKb-2MYMlBDiDHlIWdN29eWDgwlBZmTn775Je9-ymavCK5HB7MQklF_ldDSZ-gOr
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=JmVRfPtNSQW_bx3qTqNciw%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGN7Glhc7NGZYwOJFIQj8lZNQ4jSodAhYKb-2MYMlBDiDHlIWdN29eWDgwlBZmTn775Je9-ymavCK5HB7MQklF_ldDSZ-gOr
date
Mon, 26 Jun 2023 00:47:34 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
pixel
cm.g.doubleclick.net/ Frame 95A8
Redirect Chain
  • https://match.360yield.com/match/ebda?google_gid=CAESEAubchAGfiybN-_znYEJCrI&google_cver=1&google_push=ATf1kGNuoil6vYEajmOdkaBmDlykToa2E4cGnuivBt3W8tTvw47sxRbrQFSJRjuIIiQxe5TzC5N9402Jdw0OQ4lxjJSQoE...
  • https://match.360yield.com/ul_cb/match/ebda?google_gid=CAESEAubchAGfiybN-_znYEJCrI&google_cver=1&google_push=ATf1kGNuoil6vYEajmOdkaBmDlykToa2E4cGnuivBt3W8tTvw47sxRbrQFSJRjuIIiQxe5TzC5N9402Jdw0OQ4lx...
  • https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=uac6qD-HRKOXN8fMj7mMtQ&google_push=ATf1kGNuoil6vYEajmOdkaBmDlykToa2E4cGnuivBt3W8tTvw47sxRbrQFSJRjuIIiQxe5TzC5N9402Jdw0OQ4l...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=uac6qD-HRKOXN8fMj7mMtQ&google_push=ATf1kGNuoil6vYEajmOdkaBmDlykToa2E4cGnuivBt3W8tTvw47sxRbrQFSJRjuIIiQxe5TzC5N9402Jdw0OQ4lxjJSQoEgZE5s
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=improve_digital_eb&google_hm=uac6qD-HRKOXN8fMj7mMtQ&google_push=ATf1kGNuoil6vYEajmOdkaBmDlykToa2E4cGnuivBt3W8tTvw47sxRbrQFSJRjuIIiQxe5TzC5N9402Jdw0OQ4lxjJSQoEgZE5s
access-control-allow-origin
*
date
Mon, 26 Jun 2023 00:47:34 GMT
content-type
text/plain
content-length
0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
pixel
cm.g.doubleclick.net/ Frame 95A8
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEJ...
  • https://sync.targeting.unrulymedia.com/csync/RX-49bea114-ddba-49a5-86ec-f45632124bba-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DATf1kGMbJkDEAc5vVJAeFufUi...
  • https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGMbJkDEAc5vVJAeFufUioO0Ajv1vgQ1PAvmjAoBCnIvn4GslQIENK9C1CegB1XS_T_-MC7SmqyQBoLF4KHbsTKMxxFxBJeW&google_hm=A0m-oRTdukmlhuz0VjISS7o
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGMbJkDEAc5vVJAeFufUioO0Ajv1vgQ1PAvmjAoBCnIvn4GslQIENK9C1CegB1XS_T_-MC7SmqyQBoLF4KHbsTKMxxFxBJeW&google_hm=A0m-oRTdukmlhuz0VjISS7o
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGMbJkDEAc5vVJAeFufUioO0Ajv1vgQ1PAvmjAoBCnIvn4GslQIENK9C1CegB1XS_T_-MC7SmqyQBoLF4KHbsTKMxxFxBJeW&google_hm=A0m-oRTdukmlhuz0VjISS7o
date
Mon, 26 Jun 2023 00:47:34 GMT
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag
RX49bea114ddba49a586ecf45632124bba003
content-type
text/html
0.gif
id5-sync.com/i/495/ Frame 95A8
Redirect Chain
  • https://sync.inmobi.com/gob?google_gid=CAESEIAo0okaXFxo9zc5TkB2KaQ&google_cver=1&google_push=ATf1kGPlsp3kgw3JzDbEJYcJ54RJlppZqX7_Y4YhXCdWzbuWsZmBzz-EyFYNnc7XjnLa7ACS58uP21P6DW9VPbTsmR05qbSa8-xfLg
  • https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGPlsp3kgw3JzDbEJYcJ54RJlppZqX7_Y4YhXCdWzbuW...
43 B
1 KB
Image
General
Full URL
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGPlsp3kgw3JzDbEJYcJ54RJlppZqX7_Y4YhXCdWzbuWsZmBzz-EyFYNnc7XjnLa7ACS58uP21P6DW9VPbTsmR05qbSa8-xfLg
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
HTTP/1.1
Server
141.95.98.64 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3216658.ip-141-95-98.eu
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

content-type
image/gif;charset=UTF-8
date
Mon, 26 Jun 2023 00:47:34 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding
chunked
p3p
CP="CAO PSA OUR"

Redirect headers

date
Mon, 26 Jun 2023 00:47:34 GMT
content-security-policy
default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; includeSubDomains
x-permitted-cross-domain-policies
none
referrer-policy
no-referrer
expect-ct
max-age=0
x-dns-prefetch-control
off
x-frame-options
SAMEORIGIN
content-type
text/plain; charset=utf-8
location
https://id5-sync.com/i/495/0.gif?gdpr_consent=&gdpr=&callback=https%3A%2F%2Fsync.inmobi.com%2FgobRedirectFromId5%3Fid%3D%7BID5UID%7D%26google_push%3DATf1kGPlsp3kgw3JzDbEJYcJ54RJlppZqX7_Y4YhXCdWzbuWsZmBzz-EyFYNnc7XjnLa7ACS58uP21P6DW9VPbTsmR05qbSa8-xfLg
x-download-options
noopen
vary
Accept
content-length
273
x-xss-protection
0
attr
cm.g.doubleclick.net/pixel/ Frame 95A8
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KLTObITFEoTP8Ays9dvazWu6DMlMnTmcOPYH2gmdAJjcguk3X7MYVk9js6k8bC1uG6_kc5Ow
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
Enqz_20U.html
tpc.googlesyndication.com/sodar/ Frame 7796
22 KB
8 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
471267
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
8395
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Tue, 20 Jun 2023 13:53:07 GMT
expires
Wed, 19 Jun 2024 13:53:07 GMT
last-modified
Tue, 03 Mar 2020 20:15:00 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
styles.css
s0.2mdn.net/sadbundle/7493198391404092334/css/ Frame AFC3
6 KB
1 KB
Stylesheet
General
Full URL
https://s0.2mdn.net/sadbundle/7493198391404092334/css/styles.css
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7493198391404092334/index.html?e=69&leftOffset=0&topOffset=0&c=8VazJQu393&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ac2429c9dd60bbe0eeab4fb4322667db2a3566125b4a1d772c488381de05b9e6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/7493198391404092334/index.html?e=69&leftOffset=0&topOffset=0&c=8VazJQu393&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 00:00:16 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
175638
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1446
x-xss-protection
0
last-modified
Thu, 30 Mar 2023 10:59:12 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 23 Jun 2024 00:00:16 GMT
Enabler_01_247.js
s0.2mdn.net/879366/ Frame AFC3
118 KB
40 KB
Script
General
Full URL
https://s0.2mdn.net/879366/Enabler_01_247.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7493198391404092334/index.html?e=69&leftOffset=0&topOffset=0&c=8VazJQu393&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/7493198391404092334/index.html?e=69&leftOffset=0&topOffset=0&c=8VazJQu393&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 10:36:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
51073
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
41099
x-xss-protection
0
last-modified
Mon, 27 Sep 2021 18:45:07 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=86400
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Mon, 26 Jun 2023 10:36:21 GMT
overlay.png
s0.2mdn.net/sadbundle/7493198391404092334/img/ Frame AFC3
95 B
128 B
Image
General
Full URL
https://s0.2mdn.net/sadbundle/7493198391404092334/img/overlay.png
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7493198391404092334/index.html?e=69&leftOffset=0&topOffset=0&c=8VazJQu393&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/7493198391404092334/index.html?e=69&leftOffset=0&topOffset=0&c=8VazJQu393&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 17:47:53 GMT
x-content-type-options
nosniff
age
111581
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95
x-xss-protection
0
last-modified
Thu, 30 Mar 2023 10:59:12 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 23 Jun 2024 17:47:53 GMT
logo.svg
s0.2mdn.net/sadbundle/7493198391404092334/img/ Frame AFC3
6 KB
3 KB
Image
General
Full URL
https://s0.2mdn.net/sadbundle/7493198391404092334/img/logo.svg
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7493198391404092334/index.html?e=69&leftOffset=0&topOffset=0&c=8VazJQu393&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
7b1bfbac0178604f4dce665117d962743d2916a2a37968438f3d49d7e9c04445
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/7493198391404092334/index.html?e=69&leftOffset=0&topOffset=0&c=8VazJQu393&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 11:00:17 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
136037
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
2563
x-xss-protection
0
last-modified
Thu, 30 Mar 2023 10:59:12 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/svg+xml
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 23 Jun 2024 11:00:17 GMT
gsap_3.5.1_min.js
s0.2mdn.net/ads/studio/cached_libs/ Frame AFC3
60 KB
24 KB
Script
General
Full URL
https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7493198391404092334/index.html?e=69&leftOffset=0&topOffset=0&c=8VazJQu393&t=1&renderingType=2&ev=01_250
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/7493198391404092334/index.html?e=69&leftOffset=0&topOffset=0&c=8VazJQu393&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
24155
x-xss-protection
0
last-modified
Mon, 31 Aug 2020 21:23:17 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=0
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Mon, 26 Jun 2023 00:47:34 GMT
e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/epv/ Frame ED26
0
366 B
Document
General
Full URL
https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=24394400004294500951389012367005&t=htlp&gdpr=1&consent=1&gdpr_consent=li
Requested by
Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=8c0b5788f2&subid=&uid=d859959d4fc5aab9&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DWl7tkedum3B-P5FulDCt_A%26exch_seat%3D20035004448%26mt_aid%3D674314148130887506%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_cid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCqH4bJeCYZNOeK9GSrATA37jgC8-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTc5ODM2NTEyNTc4MzgyODLIAQngAgCoAwHIAwKqBPgBT9A9nD7P7nONlnsmRbQBldQQh0N8bzRlNVQGG5rDOvOuY-c_ENZOI-NmiJUhoFicC_Ee4GExScmmBm_UTQP8dsRr-QYrnT5mKquvlw9yWUxFywpyfxWKsOBI8y8QfhxjXbcCTSQY4gjVKhrMq-fjdHzDQvWz0vUf3vb7RZkfTLqxTI9VscK_ZcXpHrxD6CVm4A42GbzgxHtmWlUHpd4qapmo5GeummdTxSIjwht9YtJSGiTLTQMlSnwA8-AtLQJbWlSeSCkqJDhHO2P4RV9kkiAO9b7Qxg7yfqVDF3es7IEHIukJmoEoIyZvvHcWzWXIX04f-lmV4-bgBAGABr7U1vzZmuidqAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA8ggbYWR4LXN1YnN5bi03Mjc1NTI4NDUzMTYyMzA5-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_0kRp_ZrM1lJgXF0K7UVuDO8nWDIQ%2526client%253Dca-pub-7983651257838282%2526adurl%253D%26mt_lp%3Dhttps%253A%2F%2Fwww.soberberlin.com%2F%26redirect%3D&documentReferer=https%3A%2F%2Fe171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html%3Fn%3D1&ancestorOrigins=null&random=6651112481175&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
145.239.193.130 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx/1.17.5 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Content-Length
0
Content-Type
application/javascript; charset=utf-8
Date
Mon, 26 Jun 2023 00:47:34 GMT
Host
pv.medialead.de
Keep-Alive
timeout=20
Proxy-Host
pv.medialead.de
Server
nginx/1.17.5
Strict-Transport-Security
max-age=15768000
X-IPLB-Instance
40027
X-IPLB-Request-ID
253A3AF8:8D00_91EFC182:01BB_6498E026_3DF8D18:25BD0
/
adv.office-partner.de/ Frame 9CA1
930 B
931 B
Document
General
Full URL
https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by
Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=8c0b5788f2&subid=&uid=d859959d4fc5aab9&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DWl7tkedum3B-P5FulDCt_A%26exch_seat%3D20035004448%26mt_aid%3D674314148130887506%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_cid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCqH4bJeCYZNOeK9GSrATA37jgC8-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTc5ODM2NTEyNTc4MzgyODLIAQngAgCoAwHIAwKqBPgBT9A9nD7P7nONlnsmRbQBldQQh0N8bzRlNVQGG5rDOvOuY-c_ENZOI-NmiJUhoFicC_Ee4GExScmmBm_UTQP8dsRr-QYrnT5mKquvlw9yWUxFywpyfxWKsOBI8y8QfhxjXbcCTSQY4gjVKhrMq-fjdHzDQvWz0vUf3vb7RZkfTLqxTI9VscK_ZcXpHrxD6CVm4A42GbzgxHtmWlUHpd4qapmo5GeummdTxSIjwht9YtJSGiTLTQMlSnwA8-AtLQJbWlSeSCkqJDhHO2P4RV9kkiAO9b7Qxg7yfqVDF3es7IEHIukJmoEoIyZvvHcWzWXIX04f-lmV4-bgBAGABr7U1vzZmuidqAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA8ggbYWR4LXN1YnN5bi03Mjc1NTI4NDUzMTYyMzA5-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_0kRp_ZrM1lJgXF0K7UVuDO8nWDIQ%2526client%253Dca-pub-7983651257838282%2526adurl%253D%26mt_lp%3Dhttps%253A%2F%2Fwww.soberberlin.com%2F%26redirect%3D&documentReferer=https%3A%2F%2Fe171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html%3Fn%3D1&ancestorOrigins=null&random=6651112481175&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software
keycdn-engine /
Resource Hash
384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
cache-control
max-age=604800
content-encoding
gzip
content-length
552
content-type
text/html
date
Mon, 26 Jun 2023 00:47:34 GMT
etag
"3a2-5c1ab16b3be00-gzip"
expires
Mon, 03 Jul 2023 00:47:34 GMT
last-modified
Thu, 06 May 2021 15:37:28 GMT
link
<https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server
keycdn-engine
vary
Accept-Encoding
x-accel-version
0.01
x-cache
HIT
x-edge-location
defr
htlp
futalis.de/ Frame 6167
Redirect Chain
  • https://cdn.retailads.net/tb.php?t=150337V2172132532M&subid=24394400004294500951389012367005&ra_cnt_active=1&ra_cnt=1
  • https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=2818862324
350 B
401 B
Document
General
Full URL
https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=2818862324
Requested by
Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=8c0b5788f2&subid=&uid=d859959d4fc5aab9&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DWl7tkedum3B-P5FulDCt_A%26exch_seat%3D20035004448%26mt_aid%3D674314148130887506%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_cid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCqH4bJeCYZNOeK9GSrATA37jgC8-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTc5ODM2NTEyNTc4MzgyODLIAQngAgCoAwHIAwKqBPgBT9A9nD7P7nONlnsmRbQBldQQh0N8bzRlNVQGG5rDOvOuY-c_ENZOI-NmiJUhoFicC_Ee4GExScmmBm_UTQP8dsRr-QYrnT5mKquvlw9yWUxFywpyfxWKsOBI8y8QfhxjXbcCTSQY4gjVKhrMq-fjdHzDQvWz0vUf3vb7RZkfTLqxTI9VscK_ZcXpHrxD6CVm4A42GbzgxHtmWlUHpd4qapmo5GeummdTxSIjwht9YtJSGiTLTQMlSnwA8-AtLQJbWlSeSCkqJDhHO2P4RV9kkiAO9b7Qxg7yfqVDF3es7IEHIukJmoEoIyZvvHcWzWXIX04f-lmV4-bgBAGABr7U1vzZmuidqAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA8ggbYWR4LXN1YnN5bi03Mjc1NTI4NDUzMTYyMzA5-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_0kRp_ZrM1lJgXF0K7UVuDO8nWDIQ%2526client%253Dca-pub-7983651257838282%2526adurl%253D%26mt_lp%3Dhttps%253A%2F%2Fwww.soberberlin.com%2F%26redirect%3D&documentReferer=https%3A%2F%2Fe171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html%3Fn%3D1&ancestorOrigins=null&random=6651112481175&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
49.12.22.42 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
lb-3.futalis.de
Software
/
Resource Hash
582e283baa4cce4006055beb2eb8fe257c1ec5ef573a40f173b880636089e8cd

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-length
350
content-type
text/html; charset=utf-8

Redirect headers

content-length
0
content-type
text/html; charset=utf-8
date
Mon, 26 Jun 2023 00:47:34 GMT
location
https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=2818862324
p3p
policyref="https://www.retailads.net/w3c/p3p.xml",CP="NOI CUR OUR STP"
server
Apache
xphp81
true
e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/epv/ Frame 1A21
0
366 B
Script
General
Full URL
https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=24394400004294500951389012367005&t=htlp&gdpr=1&consent=1&gdpr_consent=li
Requested by
Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=8c0b5788f2&subid=&uid=d859959d4fc5aab9&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DWl7tkedum3B-P5FulDCt_A%26exch_seat%3D20035004448%26mt_aid%3D674314148130887506%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_cid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCqH4bJeCYZNOeK9GSrATA37jgC8-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTc5ODM2NTEyNTc4MzgyODLIAQngAgCoAwHIAwKqBPgBT9A9nD7P7nONlnsmRbQBldQQh0N8bzRlNVQGG5rDOvOuY-c_ENZOI-NmiJUhoFicC_Ee4GExScmmBm_UTQP8dsRr-QYrnT5mKquvlw9yWUxFywpyfxWKsOBI8y8QfhxjXbcCTSQY4gjVKhrMq-fjdHzDQvWz0vUf3vb7RZkfTLqxTI9VscK_ZcXpHrxD6CVm4A42GbzgxHtmWlUHpd4qapmo5GeummdTxSIjwht9YtJSGiTLTQMlSnwA8-AtLQJbWlSeSCkqJDhHO2P4RV9kkiAO9b7Qxg7yfqVDF3es7IEHIukJmoEoIyZvvHcWzWXIX04f-lmV4-bgBAGABr7U1vzZmuidqAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA8ggbYWR4LXN1YnN5bi03Mjc1NTI4NDUzMTYyMzA5-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_0kRp_ZrM1lJgXF0K7UVuDO8nWDIQ%2526client%253Dca-pub-7983651257838282%2526adurl%253D%26mt_lp%3Dhttps%253A%2F%2Fwww.soberberlin.com%2F%26redirect%3D&documentReferer=https%3A%2F%2Fe171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html%3Fn%3D1&ancestorOrigins=null&random=6651112481175&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
145.239.193.130 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx/1.17.5 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:34 GMT
Strict-Transport-Security
max-age=15768000
Server
nginx/1.17.5
Host
pv.medialead.de
X-IPLB-Request-ID
253A3AF8:8D02_91EFC182:01BB_6498E026_3E5AF24:1ECFE
X-IPLB-Instance
40028
Content-Type
application/javascript; charset=utf-8
Keep-Alive
timeout=20
Content-Length
0
Proxy-Host
pv.medialead.de
e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/eview/ Frame 1A21
43 B
382 B
Image
General
Full URL
https://pv.medialead.de/trck/eview/e99aace94e6e58733936cdd965d03e75?subid=24394400004294500951389012367005&t=htlp&gdpr=1&consent=1&gdpr_consent=li
Requested by
Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=8c0b5788f2&subid=&uid=d859959d4fc5aab9&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DWl7tkedum3B-P5FulDCt_A%26exch_seat%3D20035004448%26mt_aid%3D674314148130887506%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_cid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCqH4bJeCYZNOeK9GSrATA37jgC8-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTc5ODM2NTEyNTc4MzgyODLIAQngAgCoAwHIAwKqBPgBT9A9nD7P7nONlnsmRbQBldQQh0N8bzRlNVQGG5rDOvOuY-c_ENZOI-NmiJUhoFicC_Ee4GExScmmBm_UTQP8dsRr-QYrnT5mKquvlw9yWUxFywpyfxWKsOBI8y8QfhxjXbcCTSQY4gjVKhrMq-fjdHzDQvWz0vUf3vb7RZkfTLqxTI9VscK_ZcXpHrxD6CVm4A42GbzgxHtmWlUHpd4qapmo5GeummdTxSIjwht9YtJSGiTLTQMlSnwA8-AtLQJbWlSeSCkqJDhHO2P4RV9kkiAO9b7Qxg7yfqVDF3es7IEHIukJmoEoIyZvvHcWzWXIX04f-lmV4-bgBAGABr7U1vzZmuidqAGgBiGoB6a-G6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7EC2AcA0ggPCIDhgBAQATICqgI6AoBA8ggbYWR4LXN1YnN5bi03Mjc1NTI4NDUzMTYyMzA5-gsCCAGADAHQFQGAFwE%2526num%253D1%2526sig%253DAOD64_0kRp_ZrM1lJgXF0K7UVuDO8nWDIQ%2526client%253Dca-pub-7983651257838282%2526adurl%253D%26mt_lp%3Dhttps%253A%2F%2Fwww.soberberlin.com%2F%26redirect%3D&documentReferer=https%3A%2F%2Fe171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html%3Fn%3D1&ancestorOrigins=null&random=6651112481175&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
145.239.193.130 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx/1.17.5 /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:34 GMT
Strict-Transport-Security
max-age=15768000
Server
nginx/1.17.5
Host
pv.medialead.de
X-IPLB-Request-ID
253A3AF8:8D04_91EFC182:01BB_6498E026_3E53A54:1ECFB
X-IPLB-Instance
40028
Content-Type
image/gif
Keep-Alive
timeout=20
Content-Length
43
Proxy-Host
pv.medialead.de
FordAntennaCondMedium.subline.woff
s0.2mdn.net/sadbundle/11934569601524222564/fonts/ Frame 8BD3
13 KB
13 KB
Font
General
Full URL
https://s0.2mdn.net/sadbundle/11934569601524222564/fonts/FordAntennaCondMedium.subline.woff
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11934569601524222564/css/styles.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e83314d333416d003a14ff991793feefefe12184980a4f081c0465cda5dc8da
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/sadbundle/11934569601524222564/css/styles.css
Origin
https://s0.2mdn.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 00:37:40 GMT
x-content-type-options
nosniff
age
173394
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13336
x-xss-protection
0
last-modified
Thu, 30 Mar 2023 10:59:02 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 23 Jun 2024 00:37:40 GMT
FordAntennaBlack.headline.woff
s0.2mdn.net/sadbundle/11934569601524222564/fonts/ Frame 8BD3
12 KB
12 KB
Font
General
Full URL
https://s0.2mdn.net/sadbundle/11934569601524222564/fonts/FordAntennaBlack.headline.woff
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11934569601524222564/css/styles.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4d97d2f204c48ceadcc2f5b86ba6bf25987c6f7c43c8dd7fee7a2847e6a71f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/sadbundle/11934569601524222564/css/styles.css
Origin
https://s0.2mdn.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 11:59:55 GMT
x-content-type-options
nosniff
age
132459
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11876
x-xss-protection
0
last-modified
Thu, 30 Mar 2023 10:59:02 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 23 Jun 2024 11:59:55 GMT
FordAntennaRegular.legal.woff
s0.2mdn.net/sadbundle/11934569601524222564/fonts/ Frame 8BD3
14 KB
14 KB
Font
General
Full URL
https://s0.2mdn.net/sadbundle/11934569601524222564/fonts/FordAntennaRegular.legal.woff
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/11934569601524222564/css/styles.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ff1ea82759f4df729f7ee24dac62805f05a2fc79c7ca4cb518a072a11835e884
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/sadbundle/11934569601524222564/css/styles.css
Origin
https://s0.2mdn.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 19:27:35 GMT
x-content-type-options
nosniff
age
105599
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14468
x-xss-protection
0
last-modified
Thu, 30 Mar 2023 10:59:02 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 23 Jun 2024 19:27:35 GMT
IQSFUkhUGxVfAIopecFKbiTYCckszFTcFsmN0yEW6wM.js
pagead2.googlesyndication.com/bg/ Frame 969D
38 KB
14 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/IQSFUkhUGxVfAIopecFKbiTYCckszFTcFsmN0yEW6wM.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2104855248541b155f008a2979c14a6e24d809c92ccc54dc16c98dd32116eb03
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 00:46:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
86448
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14804
x-xss-protection
0
last-modified
Mon, 19 Jun 2023 09:38:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Mon, 24 Jun 2024 00:46:46 GMT
request.php
hal900030.redintelligence.net/ Frame 1BE1
3 KB
2 KB
Script
General
Full URL
https://hal900030.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=f69b8348c1&subid=&uid=a76b93ff4828b491&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DdlER_-FlOBWmPx-MLQrOfA%26exch_seat%3D20035004448%26mt_aid%3D7591843182207691145%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_cid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCBozlJeCYZLLqO7WorASStLroBM-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTY1OTM1MjMyMTAwMTAxNTTIAQmoAwHIAwKqBLEBT9BIzp8KKGxHN-xNRUFbet6WdVxpNpuSqNV5IE4CNRIG3oa1ddFitq_4z99lBDiFUhFE_IVHMhIDihml9_MkyJQ8eMuIrwEkDyDXYeIyklDvn4irP8InVh2cbKg8-Lak96dkVSTA9z1WnxditH6BGeVhzrwha3yarTt0R2YCgveOv9j3RHH3bC6yhsviHbNCHoNcpFhj7ubDaEVnVraGCSxF5WTE5s9xJLrWR9lXI7R7gAa-1Nb82ZronagBoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_3gH9kcgYGyyOhepiMRuKehIoRS9g%2526client%253Dca-pub-6593523210010154%2526adurl%253D%26mt_lp%3Dhttps%253A%2F%2Fwww.soberberlin.com%2F%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6593523210010154%26output%3Dhtml%26h%3D90%26slotname%3D9586219513%26adk%3D1165138949%26adf%3D4198790052%26pi%3Dt.ma~as.9586219513%26w%3D728%26format%3D728x90%26url%3Dhttps%253A%252F%252Fye-mek.net%252F%26ea%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1687740453820%26bpp%3D35%26bdt%3D94%26idt%3D136%26shv%3Dr20230620%26mjsv%3Dm202306160901%26ptt%3D9%26saldr%3Daa%26prev_fmts%3D0x0%26nras%3D1%26correlator%3D4671767059969%26frm%3D8%26ife%3D1%26pv%3D1%26ga_vid%3D1306040764.1687740454%26ga_sid%3D1687740454%26ga_hid%3D909608545%26ga_fc%3D0%26nhd%3D2%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D-12245933%26ady%3D-12245933%26biw%3D-12245933%26bih%3D-12245933%26isw%3D728%26ish%3D90%26ifk%3D3557580378%26scr_x%3D-12245933%26scr_y%3D-12245933%26eid%3D44759926%252C44759875%252C42532277%252C44759842%252C42532279%252C31075431%252C44788442%26oid%3D2%26pvsid%3D3529474187045799%26tmod%3D1811170121%26uas%3D0%26nvt%3D1%26top%3Dhttps%253A%252F%252Fpcloak.blob.core.windows.net%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C728%252C90%26vis%3D1%26rsz%3D%257C%257CeE%257C%26abl%3DCS%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D2%26uci%3D2.1e0bozjdbm9m%26fsb%3D1%26dtd%3D145&ancestorOrigins=null&random=5724654310507&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Requested by
Host: hal9000.redintelligence.net
URL: https://hal9000.redintelligence.net/zone/ajk4xlebn4mw?subid=&gdpr=1&gdpr_consent=li&rnd=7591843182207691145&extVar[]=DOUBLEBORDER:1&extVar[]=MMA_SSP:adx&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DdlER_-FlOBWmPx-MLQrOfA%26exch_seat%3D20035004448%26mt_aid%3D7591843182207691145%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_cid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCBozlJeCYZLLqO7WorASStLroBM-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTY1OTM1MjMyMTAwMTAxNTTIAQmoAwHIAwKqBLEBT9BIzp8KKGxHN-xNRUFbet6WdVxpNpuSqNV5IE4CNRIG3oa1ddFitq_4z99lBDiFUhFE_IVHMhIDihml9_MkyJQ8eMuIrwEkDyDXYeIyklDvn4irP8InVh2cbKg8-Lak96dkVSTA9z1WnxditH6BGeVhzrwha3yarTt0R2YCgveOv9j3RHH3bC6yhsviHbNCHoNcpFhj7ubDaEVnVraGCSxF5WTE5s9xJLrWR9lXI7R7gAa-1Nb82ZronagBoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_3gH9kcgYGyyOhepiMRuKehIoRS9g%2526client%253Dca-pub-6593523210010154%2526adurl%253D%26mt_lp%3Dhttps%253A%2F%2Fwww.soberberlin.com%2F%26redirect%3D
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
136.243.149.243 Radeberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.243.149.243.136.clients.your-server.de
Software
Apache /
Resource Hash
276e9a7ff17680462b468808b14e35c5eebbf471ac8303bd2ed0c5eadd225faa

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 26 Jun 2023 00:47:34 GMT
Content-Encoding
gzip
Server
Apache
Vary
Accept-Encoding
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Content-Type
application/x-javascript; charset=utf-8
Cache-Control
no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId
75958800006171300951389012367030
Connection
close
Content-Length
1145
Expires
Mon, 26 Jun 2023 01:47:34 +0200
sodar
pagead2.googlesyndication.com/getconfig/ Frame 8BD3
7 KB
6 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
245fd92be5daab80ecdff8c423379abcbfd5b6ceba3deb73bb2d9cf30148252a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
5642
x-xss-protection
0
view
googleads4.g.doubleclick.net/pcs/ Frame 7DEF
0
0
Fetch
General
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuO-Sez763x_vAMjZzo0c7WOTJZUmRJRy9Y9Em0zmjEN6Taaf-4Sxq1LWuSugagpis0uBebnNf55Z1ZrRBBSZLgzuvEbRtvvfBeQN_q9SkHjAu48nyd995GKFO9ulc-8PJ1wZnVfEVIRP9qpxjTGDMWr8sy-aPd3zEeXmliG5qNGfEUaJQ1ismKwIRXrBvGYp36Mmdi4Px-ybo7eHN9zLZ1QebvcfvHw2FPRAarACBnK0feV95pOuZ2HFkwL0b6y8Su7-GQvAJuB3qMNksSKjbxXGAQP6H1bgIBV-Z-31OB9DAViM5HwclwtX3D47WdUS5lhwRiWWgSlsbmWC2CMZWv_kWJfbQCO1JFVGdvQbm0L4QILjEea21hPj6CvniQk9-4ZpWcy4qf8-Nr3zRVUrnRDPvjn8MfFsQfM4OCHhGD9E4IW5hUGQE1WlL_JWTH4G4ekyyF7Zb9qfbwXIH65BX3lvT8tkKqYlrwvWAbrNOAj-Gu2slELEZltf8A1WmcQ4uiD7e4Kw7YZ9e6vflVnRIN9DVAhnCeXt2SEOnQw1fn_xQ7PFtLU9StCReTVn8B1MxkS1bHo4OnFe1c8pROsW3Y5wsvCMltxB9RRmIUp9_FQtV9mrb_y0VCmTS1RJJcEf-slxKnmTNXBBadWAs1VgpTVTW2N5hqLaqKt0hWHiE2tRPwqEjK2aaa-LvofkH6huOYw3K8j3L1KgF0-3E4O_c3x7U4jo7HiJAqgTZHIJSwyFPru3YX-4lPfRPz_tgYJp_HUXfXgtTnS3SMYMrygfbBtjzWw_J5LMUf3-FvlGkCrDrYSjRdQJXUCGcVpJ9Z7pRDfkNz9GPkMFjqzOGOu2FoYQ7bdQiq2VATNer1qw1OQnPLSN85hf7k_WyYcZSIc0OkelTt87zqqqZjrFmUylWqHBymBfBebG6oHwxl0FpM0hYV1Uxa47xacxXUz6DjN2YxdVDmI6KMaoqLJuY2CRzl1q-w8EsPnrUAi0eUjlJCdP8g-nLhQxzbzIMFa-HFjUiAwnyXMLDrnJ7nt0KiGnh9RolkZuQVhloE9Ahk8HNtkfvNSJBQnWcm1P6jxDsFVYbpg2lvmqILUKdTM_vyQ39MbhvB_1iRBavc2fAlCdmqjOlKmQTdVWqXrMgxiK5xHMZGiJgpscQnSOjGC-9ZgWJJZ5gt_I2XCD-e-AeuWQ93XvzR0BgAJuj461gHUuHSj4mYsNTRlxPimVS7czgr33wdjggRBavt5AyyWeitlBXEIMSSpM7CS2R9tY7IlTOW4flXJPQGb4Yu5_HbQbxyz0FOVrnQnQl4UoE6QYJ8JA&sai=AMfl-YTlkOk2HuPDblVHTunj2xwDRwYdpTZaOTmeXXBhOPgmjjLK9yMEzZ7NSaEGVQOnNB2hVlQNQKoa9DfaQfUFL2dJ4W3S-cIEY6xNbn2BM28RKJPrIZ_M0sZcT5yq0Pmj_tiU9OgRJ5zadwSw4uKd9y2y0sO1vaxXwk-q5kKWCaIodp_RXWWzQmb8MBUr10RcRttQZMGkDhwbyrbMqOut__WYOE7Ga5oRBFsjN8SEDOnpAs2xh54wo4ITKgTwUraGcmCcCV6liBU_hesHKLYB9YPBFRIAfg&sig=Cg0ArKJSzOutgFhfFah1EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=389&vt=11&dtpt=204&dett=3&cstd=174&cisv=r20230620.44014&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.185.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Mon, 26 Jun 2023 00:47:34 GMT
IQSFUkhUGxVfAIopecFKbiTYCckszFTcFsmN0yEW6wM.js
pagead2.googlesyndication.com/bg/ Frame 7796
38 KB
14 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/IQSFUkhUGxVfAIopecFKbiTYCckszFTcFsmN0yEW6wM.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2104855248541b155f008a2979c14a6e24d809c92ccc54dc16c98dd32116eb03
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 00:46:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
86448
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14804
x-xss-protection
0
last-modified
Mon, 19 Jun 2023 09:38:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Mon, 24 Jun 2024 00:46:46 GMT
FordAntennaCondMedium.subline.woff
s0.2mdn.net/sadbundle/7493198391404092334/fonts/ Frame AFC3
13 KB
13 KB
Font
General
Full URL
https://s0.2mdn.net/sadbundle/7493198391404092334/fonts/FordAntennaCondMedium.subline.woff
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7493198391404092334/css/styles.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9e83314d333416d003a14ff991793feefefe12184980a4f081c0465cda5dc8da
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/sadbundle/7493198391404092334/css/styles.css
Origin
https://s0.2mdn.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Thu, 22 Jun 2023 13:35:08 GMT
x-content-type-options
nosniff
age
299546
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
13336
x-xss-protection
0
last-modified
Thu, 30 Mar 2023 10:59:12 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Fri, 21 Jun 2024 13:35:08 GMT
FordAntennaBlack.headline.woff
s0.2mdn.net/sadbundle/7493198391404092334/fonts/ Frame AFC3
12 KB
12 KB
Font
General
Full URL
https://s0.2mdn.net/sadbundle/7493198391404092334/fonts/FordAntennaBlack.headline.woff
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7493198391404092334/css/styles.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4d97d2f204c48ceadcc2f5b86ba6bf25987c6f7c43c8dd7fee7a2847e6a71f4f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/sadbundle/7493198391404092334/css/styles.css
Origin
https://s0.2mdn.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 08:50:42 GMT
x-content-type-options
nosniff
age
143812
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11876
x-xss-protection
0
last-modified
Thu, 30 Mar 2023 10:59:12 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 23 Jun 2024 08:50:42 GMT
FordAntennaRegular.legal.woff
s0.2mdn.net/sadbundle/7493198391404092334/fonts/ Frame AFC3
14 KB
14 KB
Font
General
Full URL
https://s0.2mdn.net/sadbundle/7493198391404092334/fonts/FordAntennaRegular.legal.woff
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7493198391404092334/css/styles.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ff1ea82759f4df729f7ee24dac62805f05a2fc79c7ca4cb518a072a11835e884
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://s0.2mdn.net/sadbundle/7493198391404092334/css/styles.css
Origin
https://s0.2mdn.net
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Wed, 21 Jun 2023 21:25:00 GMT
x-content-type-options
nosniff
age
357754
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14468
x-xss-protection
0
last-modified
Thu, 30 Mar 2023 10:59:12 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
font/woff
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Thu, 20 Jun 2024 21:25:00 GMT
gtm.js
www.googletagmanager.com/ Frame 9CA1
113 KB
44 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF
Requested by
Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
f806d5eadd804055a5cb71215a33dbd0707bef14792a5134842126a75a2d68d3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adv.office-partner.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
44490
x-xss-protection
0
last-modified
Mon, 26 Jun 2023 00:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 26 Jun 2023 00:47:34 GMT
visual.jpg
s0.2mdn.net/sadbundle/11934569601524222564/img/ Frame 8BD3
81 KB
81 KB
Image
General
Full URL
https://s0.2mdn.net/sadbundle/11934569601524222564/img/visual.jpg
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c07684aa8b5395431f3b243baad78a2ddac988833fed866fa18b7d9cb6e1fdce
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=ybHb7UDSck&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sat, 24 Jun 2023 00:51:45 GMT
x-content-type-options
nosniff
age
172549
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
82828
x-xss-protection
0
last-modified
Thu, 30 Mar 2023 10:59:02 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sun, 23 Jun 2024 00:51:45 GMT
overlay.png
s0.2mdn.net/sadbundle/11934569601524222564/img/ Frame 8BD3
95 B
129 B
Image
General
Full URL
https://s0.2mdn.net/sadbundle/11934569601524222564/img/overlay.png
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/11934569601524222564/index.html?e=69&leftOffset=0&topOffset=0&c=ybHb7UDSck&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Tue, 20 Jun 2023 14:10:41 GMT
x-content-type-options
nosniff
age
470213
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
95
x-xss-protection
0
last-modified
Thu, 30 Mar 2023 10:59:02 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Wed, 19 Jun 2024 14:10:41 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 8BD3
17 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 26 Jun 2023 00:47:34 GMT
view
googleads4.g.doubleclick.net/pcs/ Frame 6ED2
0
0
Fetch
General
Full URL
https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuJ5I8hv4_Tv454Wwf9Jc2ZxCGWQNqqjgOnbqPc34NCmRpl1DcM-Cv24G-IJkgX36DqLtEG6xYcTV2ui5Qi36nrtWP2glS3ajucWFwvVl7h76Zum9DlLHxvnpJRKcXPhHWIx_SJOv_cxg9nIrGxmlQllKuSdTmcPfcsXl4IetoinMjiWkViAICa3aChOgNFOTW3VHudfSvgYB4Uxn8VfM5nBku8ygLPaCcvNUY2ZShbeLPGpUX4u0Vr-TeNIYHaBm6cBGOHnb97-5Ux2OMmHBU0uhqpXo5lKVNUiP9E5KfJWAEPUoqflPuB-khvFWToL2-lif9ZGBi27pQqccUPIrcsNrxlM1re_e4nzLv_mq50Ph506gq_fk25Kh8O7Me3UDUc8fsdnEr8g_fQTHqNan60TsY6bt00uUr5UkSB-2K6UHXfNx_81JaET4jJyAvHyXDOrvJiCDzM9FQnG678tz6RWEG3k_yBlTk2jKAtm9S69uXZLYCCtMKgWtIGS9f2JPp8UbZmA30zNZ45FisrvyaQDfwp5Cpw0A04vJ4WgoNhwwK9hnlvFdqPb6RJaTq4W5412gMiC4JUudsP80IJsRsPaGYCU0M1Ec93eAGCOj36lRWlFPogKTCDmJDGC_lPCU1st_BVYe4XFyhxmEtdtFlMBzU-ArLbZcV1E7l2alsngjpRSMmnHR9o9mht8E6PbKjiBzHzs1s6zmnxjKCE-7tWyVI0V24Kjjt6uXbietmXtajNOODcwcDMr0j3JXVGRM5Xkf2l3F9xqyYEANDPaJIpGnBM_kmU52gM5MSjkAoDh9OhnZ2LQ0niz4aKv3ONg_AjMX8zyrDpWupPu7ri5cFIwH9yyLWfbkXDwxcO6_o1RV-pnmmx8a4P0ojSI_L4ugizT9Bs-4pRMCNISWugGbD7n_k-ix5JLGhSrYGg_JJ-pddKx_WZ3N2AdmbnDkQh7rcmAhu8zB87y9dIDjl0K1oAP1wEwnghuk0agSV6-6M5zTIyKbl3w9B6hiCy6w6xEIuME8TWkuGvtH8kcFRs6yYXpApshKXS0h2Q64vidf27DZZqWhhYa_30RFXY2TpN67d_cQ8-h-g-kgu-c6IukCvJIgl8rlaYu7CWWy16lxcnBwCJzNPvooDmH91LNL26-yPJ42bg1Xzuj8HWGstFukScaKge00LHx5qjB8Cs-Cuz2QbDoBIqkXm7ICpOG37an9P3qlDRCvSZMOlgN1wXRj4Mpehi0Hr9BtstStEQedyt8P2go7U-P8VgWuaKTXM2wTgz3IZEPWTXsRT0eNhJWggueieHhlnEgkgFRC09EWGK1FpXbzxaljU&sai=AMfl-YSVRY3MlUBFSHSNYZ5nGrSjgD95arGTvqfGDPvEN5NH3nVZtlX1SjX29lqODKp1xV-DgfcjaC-fsK2rfV7KjNOO1MQs-qRn9hBF7u1V76hk61wfpFqe7-sXd9uMvpzEZYX2jcvJjjovoLeispEm4zQOhhKjFa2VyBVnsD4x9v821FIWUhDgN0EW-5wZBd_q-AsMfv5b_lAp0jSRzc7Suu8cUt96QtwPKvlbwwegVp7ucJl-Kuja_SePk0sZRgsSd4co8XXo_WkZMd0cyXf_-mSehSbJ4A&sig=Cg0ArKJSzNPfZnaI04v-EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=328&vt=11&dtpt=185&dett=3&cstd=138&cisv=r20230620.30957&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=
Requested by
Host: pcloak.blob.core.windows.net
URL: https://pcloak.blob.core.windows.net/web/6x69807j0b5.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.185.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s52-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Mon, 26 Jun 2023 00:47:34 GMT
sodar
pagead2.googlesyndication.com/getconfig/ Frame AFC3
7 KB
6 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3a8e766fa2c3a738d18286638ace904a163ad9ce34b334604fbb12f8a8a589e3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
5719
x-xss-protection
0
ts.js
cdn.retailads.net/ Frame 6167
5 KB
5 KB
Script
General
Full URL
https://cdn.retailads.net/ts.js
Requested by
Host: futalis.de
URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=2818862324
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
2a01:4f8:d0a:2321::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
Apache /
Resource Hash
525e7c89461afb3f73ea7030fbceba4f9e9383570159926acee637b4f86b8148

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://futalis.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
last-modified
Wed, 05 Apr 2023 20:14:46 GMT
server
Apache
etag
"1416-5f89c717cdc2f"
content-type
application/javascript
xphp81
true
accept-ranges
bytes
content-length
5142
visual.jpg
s0.2mdn.net/sadbundle/7493198391404092334/img/ Frame AFC3
84 KB
84 KB
Image
General
Full URL
https://s0.2mdn.net/sadbundle/7493198391404092334/img/visual.jpg
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b438fcb0b6409866bcf245a57397590528a9db351cceb09953f27f9105069895
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/sadbundle/7493198391404092334/index.html?e=69&leftOffset=0&topOffset=0&c=8VazJQu393&t=1&renderingType=2&ev=01_250
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Fri, 23 Jun 2023 23:04:37 GMT
x-content-type-options
nosniff
age
178977
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
86025
x-xss-protection
0
last-modified
Thu, 30 Mar 2023 10:59:12 GMT
server
sffe
report-to
{"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-doubleclick-media"
expires
Sat, 22 Jun 2024 23:04:37 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ Frame AFC3
17 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.2mdn.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 26 Jun 2023 00:47:34 GMT
e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/epv/ Frame 154B
0
366 B
Document
General
Full URL
https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=75958800006171300951389012367030&t=htlp&gdpr=1&consent=1&gdpr_consent=li
Requested by
Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=f69b8348c1&subid=&uid=a76b93ff4828b491&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DdlER_-FlOBWmPx-MLQrOfA%26exch_seat%3D20035004448%26mt_aid%3D7591843182207691145%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_cid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCBozlJeCYZLLqO7WorASStLroBM-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTY1OTM1MjMyMTAwMTAxNTTIAQmoAwHIAwKqBLEBT9BIzp8KKGxHN-xNRUFbet6WdVxpNpuSqNV5IE4CNRIG3oa1ddFitq_4z99lBDiFUhFE_IVHMhIDihml9_MkyJQ8eMuIrwEkDyDXYeIyklDvn4irP8InVh2cbKg8-Lak96dkVSTA9z1WnxditH6BGeVhzrwha3yarTt0R2YCgveOv9j3RHH3bC6yhsviHbNCHoNcpFhj7ubDaEVnVraGCSxF5WTE5s9xJLrWR9lXI7R7gAa-1Nb82ZronagBoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_3gH9kcgYGyyOhepiMRuKehIoRS9g%2526client%253Dca-pub-6593523210010154%2526adurl%253D%26mt_lp%3Dhttps%253A%2F%2Fwww.soberberlin.com%2F%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6593523210010154%26output%3Dhtml%26h%3D90%26slotname%3D9586219513%26adk%3D1165138949%26adf%3D4198790052%26pi%3Dt.ma~as.9586219513%26w%3D728%26format%3D728x90%26url%3Dhttps%253A%252F%252Fye-mek.net%252F%26ea%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1687740453820%26bpp%3D35%26bdt%3D94%26idt%3D136%26shv%3Dr20230620%26mjsv%3Dm202306160901%26ptt%3D9%26saldr%3Daa%26prev_fmts%3D0x0%26nras%3D1%26correlator%3D4671767059969%26frm%3D8%26ife%3D1%26pv%3D1%26ga_vid%3D1306040764.1687740454%26ga_sid%3D1687740454%26ga_hid%3D909608545%26ga_fc%3D0%26nhd%3D2%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D-12245933%26ady%3D-12245933%26biw%3D-12245933%26bih%3D-12245933%26isw%3D728%26ish%3D90%26ifk%3D3557580378%26scr_x%3D-12245933%26scr_y%3D-12245933%26eid%3D44759926%252C44759875%252C42532277%252C44759842%252C42532279%252C31075431%252C44788442%26oid%3D2%26pvsid%3D3529474187045799%26tmod%3D1811170121%26uas%3D0%26nvt%3D1%26top%3Dhttps%253A%252F%252Fpcloak.blob.core.windows.net%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C728%252C90%26vis%3D1%26rsz%3D%257C%257CeE%257C%26abl%3DCS%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D2%26uci%3D2.1e0bozjdbm9m%26fsb%3D1%26dtd%3D145&ancestorOrigins=null&random=5724654310507&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
145.239.193.130 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx/1.17.5 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Content-Length
0
Content-Type
application/javascript; charset=utf-8
Date
Mon, 26 Jun 2023 00:47:34 GMT
Host
pv.medialead.de
Keep-Alive
timeout=20
Proxy-Host
pv.medialead.de
Server
nginx/1.17.5
Strict-Transport-Security
max-age=15768000
X-IPLB-Instance
40028
X-IPLB-Request-ID
253A3AF8:8D04_91EFC182:01BB_6498E026_3E53A55:1ECFB
/
adv.office-partner.de/ Frame 1959
930 B
930 B
Document
General
Full URL
https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Requested by
Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=f69b8348c1&subid=&uid=a76b93ff4828b491&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DdlER_-FlOBWmPx-MLQrOfA%26exch_seat%3D20035004448%26mt_aid%3D7591843182207691145%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_cid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCBozlJeCYZLLqO7WorASStLroBM-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTY1OTM1MjMyMTAwMTAxNTTIAQmoAwHIAwKqBLEBT9BIzp8KKGxHN-xNRUFbet6WdVxpNpuSqNV5IE4CNRIG3oa1ddFitq_4z99lBDiFUhFE_IVHMhIDihml9_MkyJQ8eMuIrwEkDyDXYeIyklDvn4irP8InVh2cbKg8-Lak96dkVSTA9z1WnxditH6BGeVhzrwha3yarTt0R2YCgveOv9j3RHH3bC6yhsviHbNCHoNcpFhj7ubDaEVnVraGCSxF5WTE5s9xJLrWR9lXI7R7gAa-1Nb82ZronagBoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_3gH9kcgYGyyOhepiMRuKehIoRS9g%2526client%253Dca-pub-6593523210010154%2526adurl%253D%26mt_lp%3Dhttps%253A%2F%2Fwww.soberberlin.com%2F%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6593523210010154%26output%3Dhtml%26h%3D90%26slotname%3D9586219513%26adk%3D1165138949%26adf%3D4198790052%26pi%3Dt.ma~as.9586219513%26w%3D728%26format%3D728x90%26url%3Dhttps%253A%252F%252Fye-mek.net%252F%26ea%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1687740453820%26bpp%3D35%26bdt%3D94%26idt%3D136%26shv%3Dr20230620%26mjsv%3Dm202306160901%26ptt%3D9%26saldr%3Daa%26prev_fmts%3D0x0%26nras%3D1%26correlator%3D4671767059969%26frm%3D8%26ife%3D1%26pv%3D1%26ga_vid%3D1306040764.1687740454%26ga_sid%3D1687740454%26ga_hid%3D909608545%26ga_fc%3D0%26nhd%3D2%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D-12245933%26ady%3D-12245933%26biw%3D-12245933%26bih%3D-12245933%26isw%3D728%26ish%3D90%26ifk%3D3557580378%26scr_x%3D-12245933%26scr_y%3D-12245933%26eid%3D44759926%252C44759875%252C42532277%252C44759842%252C42532279%252C31075431%252C44788442%26oid%3D2%26pvsid%3D3529474187045799%26tmod%3D1811170121%26uas%3D0%26nvt%3D1%26top%3Dhttps%253A%252F%252Fpcloak.blob.core.windows.net%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C728%252C90%26vis%3D1%26rsz%3D%257C%257CeE%257C%26abl%3DCS%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D2%26uci%3D2.1e0bozjdbm9m%26fsb%3D1%26dtd%3D145&ancestorOrigins=null&random=5724654310507&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a0b:4d07:102::1 , Switzerland, ASN44239 (PROINITY PROINITY, CH),
Reverse DNS
Software
keycdn-engine /
Resource Hash
384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
access-control-allow-origin
*
cache-control
max-age=604800
content-encoding
gzip
content-length
552
content-type
text/html
date
Mon, 26 Jun 2023 00:47:34 GMT
etag
"3a2-5c1ab16b3be00-gzip"
expires
Mon, 03 Jul 2023 00:47:34 GMT
last-modified
Thu, 06 May 2021 15:37:28 GMT
link
<https://adv-srv.office-partner.de/?utm_source=webgains&utm_campaign=webgains>; rel="canonical"
server
keycdn-engine
vary
Accept-Encoding
x-accel-version
0.01
x-cache
HIT
x-edge-location
defr
htlp
futalis.de/ Frame 6561
Redirect Chain
  • https://cdn.retailads.net/tb.php?t=150337V2172132532M&subid=75958800006171300951389012367030&ra_cnt_active=1&ra_cnt=1
  • https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=2818862325
350 B
400 B
Document
General
Full URL
https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=2818862325
Requested by
Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=f69b8348c1&subid=&uid=a76b93ff4828b491&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DdlER_-FlOBWmPx-MLQrOfA%26exch_seat%3D20035004448%26mt_aid%3D7591843182207691145%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_cid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCBozlJeCYZLLqO7WorASStLroBM-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTY1OTM1MjMyMTAwMTAxNTTIAQmoAwHIAwKqBLEBT9BIzp8KKGxHN-xNRUFbet6WdVxpNpuSqNV5IE4CNRIG3oa1ddFitq_4z99lBDiFUhFE_IVHMhIDihml9_MkyJQ8eMuIrwEkDyDXYeIyklDvn4irP8InVh2cbKg8-Lak96dkVSTA9z1WnxditH6BGeVhzrwha3yarTt0R2YCgveOv9j3RHH3bC6yhsviHbNCHoNcpFhj7ubDaEVnVraGCSxF5WTE5s9xJLrWR9lXI7R7gAa-1Nb82ZronagBoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_3gH9kcgYGyyOhepiMRuKehIoRS9g%2526client%253Dca-pub-6593523210010154%2526adurl%253D%26mt_lp%3Dhttps%253A%2F%2Fwww.soberberlin.com%2F%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6593523210010154%26output%3Dhtml%26h%3D90%26slotname%3D9586219513%26adk%3D1165138949%26adf%3D4198790052%26pi%3Dt.ma~as.9586219513%26w%3D728%26format%3D728x90%26url%3Dhttps%253A%252F%252Fye-mek.net%252F%26ea%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1687740453820%26bpp%3D35%26bdt%3D94%26idt%3D136%26shv%3Dr20230620%26mjsv%3Dm202306160901%26ptt%3D9%26saldr%3Daa%26prev_fmts%3D0x0%26nras%3D1%26correlator%3D4671767059969%26frm%3D8%26ife%3D1%26pv%3D1%26ga_vid%3D1306040764.1687740454%26ga_sid%3D1687740454%26ga_hid%3D909608545%26ga_fc%3D0%26nhd%3D2%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D-12245933%26ady%3D-12245933%26biw%3D-12245933%26bih%3D-12245933%26isw%3D728%26ish%3D90%26ifk%3D3557580378%26scr_x%3D-12245933%26scr_y%3D-12245933%26eid%3D44759926%252C44759875%252C42532277%252C44759842%252C42532279%252C31075431%252C44788442%26oid%3D2%26pvsid%3D3529474187045799%26tmod%3D1811170121%26uas%3D0%26nvt%3D1%26top%3Dhttps%253A%252F%252Fpcloak.blob.core.windows.net%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C728%252C90%26vis%3D1%26rsz%3D%257C%257CeE%257C%26abl%3DCS%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D2%26uci%3D2.1e0bozjdbm9m%26fsb%3D1%26dtd%3D145&ancestorOrigins=null&random=5724654310507&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
49.12.22.42 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
lb-3.futalis.de
Software
/
Resource Hash
582e283baa4cce4006055beb2eb8fe257c1ec5ef573a40f173b880636089e8cd

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-length
350
content-type
text/html; charset=utf-8

Redirect headers

content-length
0
content-type
text/html; charset=utf-8
date
Mon, 26 Jun 2023 00:47:34 GMT
location
https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=2818862325
p3p
policyref="https://www.retailads.net/w3c/p3p.xml",CP="NOI CUR OUR STP"
server
Apache
xphp81
true
e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/epv/ Frame 1BE1
0
366 B
Script
General
Full URL
https://pv.medialead.de/trck/epv/e99aace94e6e58733936cdd965d03e75?subid=75958800006171300951389012367030&t=htlp&gdpr=1&consent=1&gdpr_consent=li
Requested by
Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=f69b8348c1&subid=&uid=a76b93ff4828b491&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DdlER_-FlOBWmPx-MLQrOfA%26exch_seat%3D20035004448%26mt_aid%3D7591843182207691145%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_cid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCBozlJeCYZLLqO7WorASStLroBM-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTY1OTM1MjMyMTAwMTAxNTTIAQmoAwHIAwKqBLEBT9BIzp8KKGxHN-xNRUFbet6WdVxpNpuSqNV5IE4CNRIG3oa1ddFitq_4z99lBDiFUhFE_IVHMhIDihml9_MkyJQ8eMuIrwEkDyDXYeIyklDvn4irP8InVh2cbKg8-Lak96dkVSTA9z1WnxditH6BGeVhzrwha3yarTt0R2YCgveOv9j3RHH3bC6yhsviHbNCHoNcpFhj7ubDaEVnVraGCSxF5WTE5s9xJLrWR9lXI7R7gAa-1Nb82ZronagBoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_3gH9kcgYGyyOhepiMRuKehIoRS9g%2526client%253Dca-pub-6593523210010154%2526adurl%253D%26mt_lp%3Dhttps%253A%2F%2Fwww.soberberlin.com%2F%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6593523210010154%26output%3Dhtml%26h%3D90%26slotname%3D9586219513%26adk%3D1165138949%26adf%3D4198790052%26pi%3Dt.ma~as.9586219513%26w%3D728%26format%3D728x90%26url%3Dhttps%253A%252F%252Fye-mek.net%252F%26ea%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1687740453820%26bpp%3D35%26bdt%3D94%26idt%3D136%26shv%3Dr20230620%26mjsv%3Dm202306160901%26ptt%3D9%26saldr%3Daa%26prev_fmts%3D0x0%26nras%3D1%26correlator%3D4671767059969%26frm%3D8%26ife%3D1%26pv%3D1%26ga_vid%3D1306040764.1687740454%26ga_sid%3D1687740454%26ga_hid%3D909608545%26ga_fc%3D0%26nhd%3D2%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D-12245933%26ady%3D-12245933%26biw%3D-12245933%26bih%3D-12245933%26isw%3D728%26ish%3D90%26ifk%3D3557580378%26scr_x%3D-12245933%26scr_y%3D-12245933%26eid%3D44759926%252C44759875%252C42532277%252C44759842%252C42532279%252C31075431%252C44788442%26oid%3D2%26pvsid%3D3529474187045799%26tmod%3D1811170121%26uas%3D0%26nvt%3D1%26top%3Dhttps%253A%252F%252Fpcloak.blob.core.windows.net%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C728%252C90%26vis%3D1%26rsz%3D%257C%257CeE%257C%26abl%3DCS%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D2%26uci%3D2.1e0bozjdbm9m%26fsb%3D1%26dtd%3D145&ancestorOrigins=null&random=5724654310507&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
145.239.193.130 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx/1.17.5 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:34 GMT
Strict-Transport-Security
max-age=15768000
Server
nginx/1.17.5
Host
pv.medialead.de
X-IPLB-Request-ID
253A3AF8:8D02_91EFC182:01BB_6498E026_3E5AF27:1ECFE
X-IPLB-Instance
40028
Content-Type
application/javascript; charset=utf-8
Keep-Alive
timeout=20
Content-Length
0
Proxy-Host
pv.medialead.de
e99aace94e6e58733936cdd965d03e75
pv.medialead.de/trck/eview/ Frame 1BE1
43 B
382 B
Image
General
Full URL
https://pv.medialead.de/trck/eview/e99aace94e6e58733936cdd965d03e75?subid=75958800006171300951389012367030&t=htlp&gdpr=1&consent=1&gdpr_consent=li
Requested by
Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request.php?zone=ajk4xlebn4mw&nw=20&renderingType=javascript&namespace=f69b8348c1&subid=&uid=a76b93ff4828b491&screenSize=0x0&screenSizeAvail=0x0&clientSize=0x0&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&extVar[]=MMA_SSP%3Aadx&envData=&gdpr=1&gdpr_consent=li&ud=&redirectClick=https%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fexch_aid%3DdlER_-FlOBWmPx-MLQrOfA%26exch_seat%3D20035004448%26mt_aid%3D7591843182207691145%26mt_id%3D6622332%26mt_adid%3D216536%26mt_sid%3D4562306%26mt_exid%3D4%26mt_inapp%3D0%26mt_os%3DWindows%26mt_uuid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_cid%3Df1986498-e026-4e01-a95c-6b0f8d30bae3%26mt_3pck%3Dhttps%253A%2F%2Fadclick.g.doubleclick.net%2Faclk%253Fsa%253DL%2526ai%253DCBozlJeCYZLLqO7WorASStLroBM-HjptcwIbZgsYCwI23ARABIABglYKAgJgHggEXY2EtcHViLTY1OTM1MjMyMTAwMTAxNTTIAQmoAwHIAwKqBLEBT9BIzp8KKGxHN-xNRUFbet6WdVxpNpuSqNV5IE4CNRIG3oa1ddFitq_4z99lBDiFUhFE_IVHMhIDihml9_MkyJQ8eMuIrwEkDyDXYeIyklDvn4irP8InVh2cbKg8-Lak96dkVSTA9z1WnxditH6BGeVhzrwha3yarTt0R2YCgveOv9j3RHH3bC6yhsviHbNCHoNcpFhj7ubDaEVnVraGCSxF5WTE5s9xJLrWR9lXI7R7gAa-1Nb82ZronagBoAYhqAemvhuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIDwiA4YAQEAEyAqoCOgKAQPoLAggBgAwB0BUBgBcB%2526num%253D1%2526sig%253DAOD64_3gH9kcgYGyyOhepiMRuKehIoRS9g%2526client%253Dca-pub-6593523210010154%2526adurl%253D%26mt_lp%3Dhttps%253A%2F%2Fwww.soberberlin.com%2F%26redirect%3D&documentReferer=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fpagead%2Fads%3Fclient%3Dca-pub-6593523210010154%26output%3Dhtml%26h%3D90%26slotname%3D9586219513%26adk%3D1165138949%26adf%3D4198790052%26pi%3Dt.ma~as.9586219513%26w%3D728%26format%3D728x90%26url%3Dhttps%253A%252F%252Fye-mek.net%252F%26ea%3D0%26wgl%3D1%26uach%3DWyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..%26dt%3D1687740453820%26bpp%3D35%26bdt%3D94%26idt%3D136%26shv%3Dr20230620%26mjsv%3Dm202306160901%26ptt%3D9%26saldr%3Daa%26prev_fmts%3D0x0%26nras%3D1%26correlator%3D4671767059969%26frm%3D8%26ife%3D1%26pv%3D1%26ga_vid%3D1306040764.1687740454%26ga_sid%3D1687740454%26ga_hid%3D909608545%26ga_fc%3D0%26nhd%3D2%26u_tz%3D0%26u_his%3D2%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_sd%3D1%26dmc%3D8%26adx%3D-12245933%26ady%3D-12245933%26biw%3D-12245933%26bih%3D-12245933%26isw%3D728%26ish%3D90%26ifk%3D3557580378%26scr_x%3D-12245933%26scr_y%3D-12245933%26eid%3D44759926%252C44759875%252C42532277%252C44759842%252C42532279%252C31075431%252C44788442%26oid%3D2%26pvsid%3D3529474187045799%26tmod%3D1811170121%26uas%3D0%26nvt%3D1%26top%3Dhttps%253A%252F%252Fpcloak.blob.core.windows.net%26brdim%3D0%252C0%252C0%252C0%252C1600%252C0%252C1600%252C1200%252C728%252C90%26vis%3D1%26rsz%3D%257C%257CeE%257C%26abl%3DCS%26pfx%3D0%26fu%3D0%26bc%3D31%26ifi%3D2%26uci%3D2.1e0bozjdbm9m%26fsb%3D1%26dtd%3D145&ancestorOrigins=null&random=5724654310507&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
145.239.193.130 , France, ASN16276 (OVH, FR),
Reverse DNS
Software
nginx/1.17.5 /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:34 GMT
Strict-Transport-Security
max-age=15768000
Server
nginx/1.17.5
Host
pv.medialead.de
X-IPLB-Request-ID
253A3AF8:8D00_91EFC182:01BB_6498E026_3DF8D1A:25BD0
X-IPLB-Instance
40027
Content-Type
image/gif
Keep-Alive
timeout=20
Content-Length
43
Proxy-Host
pv.medialead.de
IQSFUkhUGxVfAIopecFKbiTYCckszFTcFsmN0yEW6wM.js
pagead2.googlesyndication.com/bg/ Frame BAC1
38 KB
14 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/IQSFUkhUGxVfAIopecFKbiTYCckszFTcFsmN0yEW6wM.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2104855248541b155f008a2979c14a6e24d809c92ccc54dc16c98dd32116eb03
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 00:46:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
86448
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14804
x-xss-protection
0
last-modified
Mon, 19 Jun 2023 09:38:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Mon, 24 Jun 2024 00:46:46 GMT
link.html
track.webgains.com/ Frame 1A21
2 KB
2 KB
Script
General
Full URL
https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=24394400004294500951389012367005&nw=1
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.11.176.98 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-11-176-98.eu-west-2.compute.amazonaws.com
Software
nginx / PHP/7.4.26
Resource Hash
bf24c2885c14e10f2afdbf6a26fc1c04be45c472b579c0cb823070666ba075b6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:35 GMT
last-modified
Mon, 26 Jun 2023 00:47:35 GMT
server
nginx
x-powered-by
PHP/7.4.26
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=60
access-control-allow-headers
Authorization
expires
Mon, 26 Jun 2023 00:48:35 GMT
request_content.php
hal90005.redintelligence.net/ Frame 1B02
7 KB
2 KB
Document
General
Full URL
https://hal90005.redintelligence.net/request_content.php?s=24394400004294500951389012367005&a=f78ecc3d
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.201.63.165 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.165.63.201.138.clients.your-server.de
Software
Apache /
Resource Hash
48f5ad52120fd93930c6d21cf400781a4fb406231550a02f98a98e67339675d7

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate, max-age=0
Connection
close
Content-Encoding
gzip
Content-Length
2073
Content-Type
text/html; charset=utf-8
Date
Mon, 26 Jun 2023 00:47:34 GMT
Expires
Mon, 26 Jun 2023 01:47:34 +0200
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma
no-cache
Server
Apache
Vary
Accept-Encoding
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame 8296
1 KB
643 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
41304
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=86400
content-encoding
br
content-length
618
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sun, 25 Jun 2023 13:19:10 GMT
etag
48472445140208031
expires
Mon, 26 Jun 2023 13:19:10 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
truncated
/ Frame 1A21
216 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
8d2002de9b776f8982c9a1d721006eb6a8e22547b871cb522d8abd21215dc7df

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
ts.js
cdn.retailads.net/ Frame 6561
5 KB
5 KB
Script
General
Full URL
https://cdn.retailads.net/ts.js
Requested by
Host: futalis.de
URL: https://futalis.de/htlp?utm_medium=affiliate&utm_source=retailads&utm_campaign=150337&ra_id=2818862325
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
2a01:4f8:d0a:2321::2 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
Software
Apache /
Resource Hash
525e7c89461afb3f73ea7030fbceba4f9e9383570159926acee637b4f86b8148

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://futalis.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:34 GMT
last-modified
Wed, 05 Apr 2023 20:14:46 GMT
server
Apache
etag
"1416-5f89c717cdc2f"
content-type
application/javascript
xphp81
true
accept-ranges
bytes
content-length
5142
gtm.js
www.googletagmanager.com/ Frame 1959
113 KB
43 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TBMT2SF
Requested by
Host: adv.office-partner.de
URL: https://adv.office-partner.de/?utm_source=webgains&utm_campaign=webgains
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:829::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
f806d5eadd804055a5cb71215a33dbd0707bef14792a5134842126a75a2d68d3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://adv.office-partner.de/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:35 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
44490
x-xss-protection
0
last-modified
Mon, 26 Jun 2023 00:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Mon, 26 Jun 2023 00:47:35 GMT
css
fonts.googleapis.com/ Frame 1B02
2 KB
844 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Titillium+Web:400,700
Requested by
Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request_content.php?s=24394400004294500951389012367005&a=f78ecc3d
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
7fb07880fe0e8c6a59441a5eb71aed95f6542a8c4bc1ed859984d2e8efe054e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hal90005.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 26 Jun 2023 00:47:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sun, 25 Jun 2023 23:41:59 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 26 Jun 2023 00:47:35 GMT
/
hal9000.redintelligence.net/scale/ Frame 1B02
16 KB
16 KB
Image
General
Full URL
https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/postbank_pool_privatkredit_1200x627.jpg
Requested by
Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request_content.php?s=24394400004294500951389012367005&a=f78ecc3d
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.150.63.201.138.clients.your-server.de
Software
Apache /
Resource Hash
f9fcf6e0bf29f819b1dfd98a5300d7efb2163381a60b93cd86b768bf18483031

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hal90005.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:35 GMT
Content-Encoding
gzip
Server
Apache
Connection
close
Content-Length
16230
Vary
Accept-Encoding
Content-Type
image/png
/
hal9000.redintelligence.net/scale/ Frame 1B02
16 KB
16 KB
Image
General
Full URL
https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/1200x627_Office-Partner.jpg
Requested by
Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request_content.php?s=24394400004294500951389012367005&a=f78ecc3d
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.150.63.201.138.clients.your-server.de
Software
Apache /
Resource Hash
e8ba49651b9ef414b0da906e022189ea9096dc0fd0f2c87b08287fa273b883e6

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hal90005.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:35 GMT
Content-Encoding
gzip
Server
Apache
Connection
close
Content-Length
16510
Vary
Accept-Encoding
Content-Type
image/png
/
hal9000.redintelligence.net/scale/ Frame 1B02
13 KB
13 KB
Image
General
Full URL
https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=120&height=60&url=https://cdn.contentspread.net/24i/advertiser/55487/creativesup/1200x627.jpg
Requested by
Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request_content.php?s=24394400004294500951389012367005&a=f78ecc3d
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.150.63.201.138.clients.your-server.de
Software
Apache /
Resource Hash
267d973654e2487e014bb01e971a3219710ed3974bd0ae7477d69fb7b46ccd38

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hal90005.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:35 GMT
Content-Encoding
gzip
Server
Apache
Connection
close
Content-Length
12998
Vary
Accept-Encoding
Content-Type
image/png
IQSFUkhUGxVfAIopecFKbiTYCckszFTcFsmN0yEW6wM.js
pagead2.googlesyndication.com/bg/ Frame CC81
38 KB
14 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/IQSFUkhUGxVfAIopecFKbiTYCckszFTcFsmN0yEW6wM.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2104855248541b155f008a2979c14a6e24d809c92ccc54dc16c98dd32116eb03
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 00:46:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
86449
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14804
x-xss-protection
0
last-modified
Mon, 19 Jun 2023 09:38:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Mon, 24 Jun 2024 00:46:46 GMT
current
dclk-match.dotomi.com/match/bounce/ Frame 8296
0
104 B
Image
General
Full URL
https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEHGQqlF1ZPNHLzG6V552Mwc&google_cver=1&google_push=ATf1kGMbYW2l40rT3WcBiAbMPqGpG01eYtFWmjMm9MnL5agelMwBGFoyizwc3H8L-QyHf6I3hoO6qT4xbVC4rlnSpnIGtQFRYSjM
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:fa8:8806:12::1370 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:35 GMT
cache-control
no-cache, private, max-age=0, no-store
server
nginx
expires
0
pixel
cm.g.doubleclick.net/ Frame 8296
Redirect Chain
  • https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEHqSZukttyvxROyP0mX5OZQ&google_cver=1&google_push=ATf1kGP77wggCPGEnB35xAlG-mzhsjIcnz0bGtUADNg1l9omiXKA9MuDlrgTb2e_qiuEYhcnK2IiWzTp...
  • https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEHqSZukttyvxROyP0mX5OZQ&google_cver=1&google_push=ATf1kGP77wggCPGEnB35xAlG-mzhsjIcnz0bGtUADNg1l9omiXKA9MuDlrgTb2e_qiuEYhcnK2I...
  • https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjQyNjE3MjY0MTI0MDU5MjE0OQ&google_push=ATf1kGP77wggCPGEnB35xAlG-mzhsjIcnz0bGtUADNg1l9omiXKA9MuDlrgTb2e_qiuEYhcnK2IiWz...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjQyNjE3MjY0MTI0MDU5MjE0OQ&google_push=ATf1kGP77wggCPGEnB35xAlG-mzhsjIcnz0bGtUADNg1l9omiXKA9MuDlrgTb2e_qiuEYhcnK2IiWzTpJdCW1lNxxpyMyPvBufAr
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:35 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:35 GMT
strict-transport-security
max-age=31536000; includeSubDomains
server
nginx
accept-ch
Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age
86400
access-control-allow-methods
GET
location
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjQyNjE3MjY0MTI0MDU5MjE0OQ&google_push=ATf1kGP77wggCPGEnB35xAlG-mzhsjIcnz0bGtUADNg1l9omiXKA9MuDlrgTb2e_qiuEYhcnK2IiWzTpJdCW1lNxxpyMyPvBufAr
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials
true
access-control-allow-headers
Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length
0
expires
-1
pixel
cm.g.doubleclick.net/ Frame 8296
Redirect Chain
  • https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
  • https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WKr6BDP-Rq6qIc1XsD0i6g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WKr6BDP-Rq6qIc1XsD0i6g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGOYH6R-KVW7-vC3-JiRgLhespGySaksAReWrEAiTFLIDrEjmW7sWmEvczortvkyBt0qOQzU-uZgVWQRC9akJOKzYzbH65U1
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:35 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=WKr6BDP-Rq6qIc1XsD0i6g%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGOYH6R-KVW7-vC3-JiRgLhespGySaksAReWrEAiTFLIDrEjmW7sWmEvczortvkyBt0qOQzU-uZgVWQRC9akJOKzYzbH65U1
date
Mon, 26 Jun 2023 00:47:35 GMT
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length
0
content-type
text/html; charset=UTF-8
pixel
cm.g.doubleclick.net/ Frame 8296
Redirect Chain
  • https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESEP2YPXv-m3bwo5qegap0uXk&google_cver=1&google_push=ATf1kGPwO69tzDiPEqYgzGuBct4qaFfBv7V6r-8R5c5NzLxNpfdxGlbttcF_7tUh9K3p4weI_oPww3GyrpPjQm6f...
  • https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGPwO69tzDiPEqYgzGuBct4qaFfBv7V6r-8R5c5NzLxNpfdxGlbttcF_7tUh9K3p4weI_oPww3GyrpPjQm6fVr-0Ql-JpKsR
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGPwO69tzDiPEqYgzGuBct4qaFfBv7V6r-8R5c5NzLxNpfdxGlbttcF_7tUh9K3p4weI_oPww3GyrpPjQm6fVr-0Ql-JpKsR
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:35 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Mon, 26 Jun 2023 00:47:35 GMT
via
1.1 92ab13182d4b89ed20b3b5c10adc4f22.cloudfront.net (CloudFront)
server
CloudFront
x-amz-cf-pop
FRA6-C1
x-cache
FunctionGeneratedResponse from cloudfront
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGPwO69tzDiPEqYgzGuBct4qaFfBv7V6r-8R5c5NzLxNpfdxGlbttcF_7tUh9K3p4weI_oPww3GyrpPjQm6fVr-0Ql-JpKsR
cache-control
no-cache, must-revalidate
content-length
0
x-amz-cf-id
h9e79dDWdFSwV4HWYvv73yOCf7X29wrXs5EBtF_GFz0VSIkS0KLhJA==
pixel
cm.g.doubleclick.net/ Frame 8296
Redirect Chain
  • https://sync.1rx.io/usersync2/rmpssp?sub=google&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3D%5BRX_SPD%5D%26google_hm%3D%5BRX_UUID_B64_BIN%5D&google_gid=CAESEK...
  • https://sync.targeting.unrulymedia.com/csync/RX-49bea114-ddba-49a5-86ec-f45632124bba-003?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dr1%26google_push%3DATf1kGOY2fVc-wJH-6KtqTlkK...
  • https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGOY2fVc-wJH-6KtqTlkKk_Y3SlZqZyeQAGlpw4OOHmU6AuQMqc2gWsuRFRphBPWdX871qDFZqcfNFIkCP7baZq8qkfHt6X8&google_hm=A0m-oRTdukmlhuz0VjISS7o
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGOY2fVc-wJH-6KtqTlkKk_Y3SlZqZyeQAGlpw4OOHmU6AuQMqc2gWsuRFRphBPWdX871qDFZqcfNFIkCP7baZq8qkfHt6X8&google_hm=A0m-oRTdukmlhuz0VjISS7o
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:35 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=r1&google_push=ATf1kGOY2fVc-wJH-6KtqTlkKk_Y3SlZqZyeQAGlpw4OOHmU6AuQMqc2gWsuRFRphBPWdX871qDFZqcfNFIkCP7baZq8qkfHt6X8&google_hm=A0m-oRTdukmlhuz0VjISS7o
date
Mon, 26 Jun 2023 00:47:35 GMT
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag
RX49bea114ddba49a586ecf45632124bba003
content-type
text/html
pixel
cm.g.doubleclick.net/ Frame 8296
Redirect Chain
  • https://eb2.3lift.com/ebda?sync=1&google_gid=CAESEP2-VqpIgGqQgeHipb5Z82I&google_cver=1&google_push=ATf1kGNyrFFh1842hLMfAgYzThYa9aktA0Q95TDD91BDXzCfhuC6rfF8Qp95xD4oOV5XwNIA2KCMY0q9Qnhk08Jtih-5HIUVNUQ
  • https://eb2.3lift.com/sync/google/supply?ld=1&gdpr=1&gdpr_consent=&us_privacy=&sync=1&google_push=ATf1kGNyrFFh1842hLMfAgYzThYa9aktA0Q95TDD91BDXzCfhuC6rfF8Qp95xD4oOV5XwNIA2KCMY0q9Qnhk08Jtih-5HIUVNUQ...
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzA2ODQzMTAxNDE0MDM0ODc0OTIxNA%3D%3D&google_push=ATf1kGNyrFFh1842hLMfAgYzThYa9aktA0Q95TDD91BDXzCfhuC6rfF8...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzA2ODQzMTAxNDE0MDM0ODc0OTIxNA%3D%3D&google_push=ATf1kGNyrFFh1842hLMfAgYzThYa9aktA0Q95TDD91BDXzCfhuC6rfF8Qp95xD4oOV5XwNIA2KCMY0q9Qnhk08Jtih-5HIUVNUQ
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:35 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=1&gdpr_consent=&us_privacy=&google_hm=MzA2ODQzMTAxNDE0MDM0ODc0OTIxNA%3D%3D&google_push=ATf1kGNyrFFh1842hLMfAgYzThYa9aktA0Q95TDD91BDXzCfhuC6rfF8Qp95xD4oOV5XwNIA2KCMY0q9Qnhk08Jtih-5HIUVNUQ
date
Mon, 26 Jun 2023 00:47:35 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
report
sync.teads.tv/um/ Frame 8296
Redirect Chain
  • https://sync.teads.tv/um?eid=3&uid=&google_nid=teadstv_ab&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_ab%26google_hm%3D%5BVID_B64%5D&google_gid=CAESEMs85DogOzTUqvkp4GbVvWA&...
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_ab&google_hm=&google_push=ATf1kGMl0n8E2uYB5_NbzNlNvm4iqmVnzA6WJdwmqoToJKtMw-1AmW1IF0TyDW5eyKJV6bccK3PuPCDXPSHSp71JK_JuwFalEauS
  • https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
23 B
163 B
Image
General
Full URL
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H2
Server
2.18.161.51 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-161-51.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.10 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

expires
Mon, 26 Jun 2023 00:47:35 GMT
pragma
no-cache
date
Mon, 26 Jun 2023 00:47:35 GMT
cache-control
max-age=0, no-cache, no-store
server
akka-http/10.2.10
content-length
23
content-type
image/gif

Redirect headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:35 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://sync.teads.tv/um/report?eid=3&google_nid=teadstv_ab
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
260
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
attr
cm.g.doubleclick.net/pixel/ Frame 8296
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13JL18ZJBUnZsIsFXa6jk6aFU9YVzPdRABl6dvuPbPir-zOL2bm41Ne4eI4VyMJw74FGh1yjcg
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:35 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
link.html
track.webgains.com/ Frame 1BE1
2 KB
2 KB
Script
General
Full URL
https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=75958800006171300951389012367030&nw=1
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453820&bpp=35&bdt=94&idt=136&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4671767059969&frm=8&ife=1&pv=1&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.1e0bozjdbm9m&fsb=1&dtd=145
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.11.176.98 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-11-176-98.eu-west-2.compute.amazonaws.com
Software
nginx / PHP/7.4.26
Resource Hash
9bca0e23f8982c6e459c56d67236bed10262af147cc3f18e4e1c68951d8e9c5b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:35 GMT
last-modified
Mon, 26 Jun 2023 00:47:35 GMT
server
nginx
x-powered-by
PHP/7.4.26
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
content-type
text/html; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=60
access-control-allow-headers
Authorization
expires
Mon, 26 Jun 2023 00:48:35 GMT
request_content.php
hal900030.redintelligence.net/ Frame 45A4
7 KB
2 KB
Document
General
Full URL
https://hal900030.redintelligence.net/request_content.php?s=75958800006171300951389012367030&a=e491a2c0
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453820&bpp=35&bdt=94&idt=136&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4671767059969&frm=8&ife=1&pv=1&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.1e0bozjdbm9m&fsb=1&dtd=145
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
136.243.149.243 Radeberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.243.149.243.136.clients.your-server.de
Software
Apache /
Resource Hash
77ae1f5909dd3b8c62dd96d0f21f0eb9560227fb94c96f3050b91c0dcef798db

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache, must-revalidate, max-age=0
Connection
close
Content-Encoding
gzip
Content-Length
2071
Content-Type
text/html; charset=utf-8
Date
Mon, 26 Jun 2023 00:47:35 GMT
Expires
Mon, 26 Jun 2023 01:47:35 +0200
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Pragma
no-cache
Server
Apache
Vary
Accept-Encoding
cookie_push_onload.html
pagead2.googlesyndication.com/pagead/s/ Frame CB2F
1 KB
647 B
Document
General
Full URL
https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453820&bpp=35&bdt=94&idt=136&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4671767059969&frm=8&ife=1&pv=1&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.1e0bozjdbm9m&fsb=1&dtd=145
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://googleads.g.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
41305
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=86400
content-encoding
br
content-length
618
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Sun, 25 Jun 2023 13:19:10 GMT
etag
48472445140208031
expires
Mon, 26 Jun 2023 13:19:10 GMT
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server
cafe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
truncated
/ Frame 1BE1
216 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
9dbfcaca8392549262d507f5118955e502089926595e449f9a8690832dbd8e7d

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Content-Type
image/png
viewability
hal90005.redintelligence.net/ Frame 1B02
0
150 B
Script
General
Full URL
https://hal90005.redintelligence.net/viewability?s=24394400004294500951389012367005&a=330201be&vb=m
Requested by
Host: hal90005.redintelligence.net
URL: https://hal90005.redintelligence.net/request_content.php?s=24394400004294500951389012367005&a=f78ecc3d
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.201.63.165 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.165.63.201.138.clients.your-server.de
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hal90005.redintelligence.net/request_content.php?s=24394400004294500951389012367005&a=f78ecc3d
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:35 GMT
Server
Apache
Connection
close
Content-Length
0
Content-Type
text/html; charset=UTF-8
img
sync.mathtag.com/comp/ Frame 1BE1
0
519 B
Image
General
Full URL
https://sync.mathtag.com/comp/img?mt_id=99&ns=xx&bcdv=0
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453820&bpp=35&bdt=94&idt=136&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4671767059969&frm=8&ife=1&pv=1&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.1e0bozjdbm9m&fsb=1&dtd=145
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.29.132.245 , United Kingdom, ASN30419 (MEDIAMATH-INC, US),
Reverse DNS
Software
MT3 1031 59fd23a master zrh zrh-pixel-x30 config_version:"1524" /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:35 GMT
Server
MT3 1031 59fd23a master zrh zrh-pixel-x30 config_version:"1524"
Content-Type
image/gif
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
0
Expires
Mon, 26 Jun 2023 00:47:34 GMT
5ed76f76e4b07a92411bc03a
ng2.virgul.com/tck/imp/ Frame 1DCE
0
209 B
Image
General
Full URL
https://ng2.virgul.com/tck/imp/5ed76f76e4b07a92411bc03a?g=1&t=gb&r=153377@site_geneli@yemek_net:site_geneli&l=&c=%2Cas%2Crc0%2Chf1%2Cvv1%2Cgprec%3Dyemek%26rec_ing%3D&info=&mt=1687740453081&userId=vnet634f4ce2-00c5-4905-8c8e-c86254eb39f9
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software
openresty/1.15.8.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://ye-mek.net
date
Mon, 26 Jun 2023 00:47:35 GMT
access-control-allow-credentials
true
expires
Tue, 04 Jan 2022 10:49:40 GMT
server
openresty/1.15.8.3
content-length
0
p3p
CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'
pvClk.min.js
analytics.webgains.io/ Frame 1A21
85 KB
31 KB
Script
General
Full URL
https://analytics.webgains.io/pvClk.min.js
Requested by
Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2513145&wgcampaignid=99582&js=1&viewref=24394400004294500951389012367005&nw=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.120 -, , ASN (),
Reverse DNS
Software
AmazonS3 /
Resource Hash
00c5621a3f56c052959f8f0591b65e893f132b49b1447fde20767966cacbfbfe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:08:33 GMT
content-encoding
gzip
via
1.1 18c9dea802c00b7c060142aad49f7288.cloudfront.net (CloudFront)
last-modified
Wed, 15 Mar 2023 17:26:29 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P4
age
2343
etag
W/"876c293e6c37046ecb0c11ce2e276942"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
x-amz-cf-id
g9OrdL-hgxSGARULrApOAZQ1Q5i0Nm1gDrt0IQjx_dlDdQp8BZf76Q==
1x1_0.png
cdn.track.production.webgains.team/7121/ Frame 1A21
3 KB
3 KB
Image
General
Full URL
https://cdn.track.production.webgains.team/7121/1x1_0.png?Expires=1687740755&Signature=U7N3cMOytCsT5AZ15A34RH1Yv8IYAoojF2i0PGvFAjjnnLp~013ZIY5t6jve~Jch6g3uktaYo2MJF-JQ4bBa9oRD7Yb9Oc7hHk6gtqthZ-CauBeKuxskBTlIsUBztGBBWV2mO86~qCs1XplEyRH9qEsyO0J3nrseF-gJ-nfniiPpXm~bZlImgUgvgWyBmbbSlHVveewiBHuziIom1DQt4dNS4j-XRKSk7XuU3bDU2hfowkDrt-WUQR1WO09AqlAxcfXoA2tjvL-bXtlXl7PG8EVSYwYgw9GD8xKWBtxsUmeNMY~SxV1hp-BCmypbloGyrh0rbLAqy0Kv4kov-0kwCQ__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by
Host: e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
URL: https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html?n=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.52 -, , ASN (),
Reverse DNS
Software
AmazonS3 /
Resource Hash
232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
null
date
Sun, 25 Jun 2023 05:12:24 GMT
via
1.1 7ce1191b390045e05b9cc74f7514b77a.cloudfront.net (CloudFront)
last-modified
Fri, 06 May 2022 11:40:06 GMT
server
AmazonS3
x-amz-cf-pop
FRA6-C1
age
70511
etag
"4e57de0506fbdb487ffcd53b450caee1"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/png
accept-ranges
bytes
content-length
2808
x-amz-cf-id
le7KPVzVN4uHZlm-nDDDt3tGHWwArokOMFPDcPI75MVVyPNbiTJjaQ==
gen_204
pagead2.googlesyndication.com/pagead/ Frame 969D
0
22 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BRVcFJuCYZPL8Dpi79u8PuquriA0AAAAAOAHgBAI&bg=!z8ylzJjNAAYQ3eRoMN07ADkAdvg8WgPLitMKwkMEOj_D165BLtDqdDXtHji4RwGHSr-2jlDxHsB6zoWKNk2Jk-UIJSo1Aw-2wwsCAAABbVIAAAACaAEHmQMSTmhEv2WkPw282eFzPqxH_xE1HMavFZBPPjpHInLND5h63ujPw1vAK4stb9NJegC_IC6JCDl5GSGYlAQU6maWf3KWK5G3lAi1FwQhWISzaR0p4eX1Yu4M2YalD7UpveYdXGUTr---FfVz0uzUjctsC87-VObEX2KbV0JITaiRxWvIkiByup8H7KxXDKukWQrEyOw9tssZD6wLNb6MdEoUdKpUShJVS8ACbV7O3Imku1KCM0IDJkGiwjcW-bR1cMAJAgDnfuQV_XPFKjmkdGmO_uqHdkyDsT_EltWZgOOrXOK2nhrZaLTCpEiYIlOtcBp0NG5yNZhRqGVvNT7EnWf9zV-HPnf0pHRbu8gFCsoltf9Bv5HRfSO7FcWSCTV7jZJMZMnGaKFe8cZhJoRb7GflcEweNlZoYR8hIf9BP8Nj2h_2SUiOJDNuOx0es9-CEPpYImnEI2eC-7X4x2SO0F03vZG2YV7Cq4Ksv_oEqq3eIV7tFlllg6_1ll5U-1kXYI1Z4syNFyQiYw9MzTDbqK2w-edO09Ci5ApjNsLxagRNF5fcFOj5x7pOkPAMR6m6WO23vb4W2OkWZ_vouwIFvWg8fThwdf2DmnM8GRihU9twmA1ARwqzbLK5BBQSQQGMjV-kTUddLc1sKo2oEF-N3ZB20EMY6sppAQ2jmsd34QdY0HTL5nqnLZ8-8twbmzoMZw2Cr7KPKR6bbL7qfNdkG2gts2nFQ6oEiiLdUVWryCmhO73NYU6ZuIf-tvt2hrDutmvsxt5DdGYkqdTNQn056-9_PuLpMD-n98M4GFtJ3pq_oH74D7onSrkI8kFBd2jjKbXaoT8VZVlBY0KRS4FJUiJLFwRv3elkzyeFIYpG5zUMbCOVOwmwbNGBw_yF7dvQhgVlon7-yduzJJ43-_3LIgpEAnBA3etlnSWtPPCaV9kdwisBKDY6SLphiq9GC8WUuejxQCuVcpUcYh0cNVM3eM77PEMqrRTieAezljFp-bsghK-AUuankoAz6qgsqgtnKum-qzwb89zfKNQ6Z3eermBUGF2A
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:35 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
gen_204
pagead2.googlesyndication.com/pagead/ Frame 7796
0
22 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B18iyJuCYZIC1FfuOjuwPiLGfuA8AAAAAOAHgBAI&bg=!ubqluu7NAAYQ3eRoMN07ADkAdvg8WnbKS_Fi15xARoNfoo0vvHOmE0YAdvPrXPjnYoCFSFd2vgb_rYTaXYD87Kh4xDj5BQTkZLUCAAABi1IAAAADaAEHCgBG0ChcDVA1rp4TBvx6q3HtHnR5bbDw_GGWlJ1NComvsSutjwFEEGhlJMRZ6F-3Benw7lyVSqvwhsgoqnn2yZgiXraAOI1RyZkDBx-3E50f0TE9cJMjN6rx0YZVZ0zQbav8W24cEdd2fFVPrZaF8ywSFFtFCvZiaY-XwfqrQbwFGRzig2D-FYfKW45vdwk-zAu7MQ7OoueUXJJb-TYXR3_Jv0oYif01CC0h56BpuFr55x2-6dgd3jJBKdRkn4eVfndZaUQrahN1xfgJNxUonU_wAc8ZLWUZ2SjcLsec9WScXKLRcUo4kFH1kaBYjn9z4SZnsEcRfCwj1_OePA3vpQ6KUjGYh-d0Y9DahbUrAmik667Rh7juuGT9BvArfmp3CasHLEsq491S1wcdQtMaVQAlAxnN3O_uh0DPqcbjhkFUBs4I0DpnrXmtPvSrDWYYaahfnjTXCi3BpyE0F3DtNQzfZ4GS5KQLcFoOzunNX6li1IJQvoIaToPkXIkY-_pPxcV9MfPsJa1mA-tFB2ejUv5tuggDRJcGYZ-lvauhx9FT95Pkkk48-90-VFO_cBDmnCOu2AhVnKXED_cGv--59imYnVh3uTs3K2ON_WpVLsNbpYLORHT_g26sRxf1U9bcsdlI95Bc4N3ReWtB23hHQKCRDDtA1s6bNraS3aRRV1BnavYETdvjpLi1BaHh0TArfplPgh4mESnyq_oJhKFjGIWy2bIe9vUnhTE1wN4oRkFAToUnYr2kNKkFwiyboZBf9XFSTGDiN2NRspbDz9ipuWYN2dH_7RqEVo8P_UPuc2pV_7V1RLMV8cB3OKpHae216usynp61_MMimdq3smWmmx9p8eB-ch-sLkXhAptpZodqinSCbdyCOY05EMjbsIzFFYLCCecC2FpGUKX1jGEf0S3hHZ3YStgMkXDUqNki_bbaLd2I9VRHM2SwLoNIFH50d92G9lbv-qP8_AmH5neWzEosr5tghGx_0I0aurewdIFLavtXqacX8C2wWHStgbyP9u6-Vx0j_2qsuLP9fWkq5AjF-h2ybf4vL_PZep_h_z9kFOVVpAxYS_aXIi6vIRGZDgJ39pzUhuYOMoDeoyg7jJ3-w08zXhtjswTl8utvLIZMXW0
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:35 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pvClk.min.js
analytics.webgains.io/ Frame 1BE1
85 KB
31 KB
Script
General
Full URL
https://analytics.webgains.io/pvClk.min.js
Requested by
Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=498343&wgcampaignid=99582&js=1&viewref=75958800006171300951389012367030&nw=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.147.120 -, , ASN (),
Reverse DNS
Software
AmazonS3 /
Resource Hash
00c5621a3f56c052959f8f0591b65e893f132b49b1447fde20767966cacbfbfe

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:08:33 GMT
content-encoding
gzip
via
1.1 18c9dea802c00b7c060142aad49f7288.cloudfront.net (CloudFront)
last-modified
Wed, 15 Mar 2023 17:26:29 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P4
age
2343
etag
W/"876c293e6c37046ecb0c11ce2e276942"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
x-amz-cf-id
U7nxucpnfR3vvEQFtRII2u8L5nUssLEAvmIgo3KDbWqzMSwQJ8xoYA==
1x1.gif
cdn.track.production.webgains.team/7121/ Frame 1BE1
85 B
436 B
Image
General
Full URL
https://cdn.track.production.webgains.team/7121/1x1.gif?Expires=1687740755&Signature=LpKZs5NoDJWyw5C8n8UJNpFjeux2PLO12aSVLbA~4zTAnajt51RCHc79-r3sY~oYZR9ncT2dqCZn~DYTyVWfXyRMMiVuoDVNEDGng~ATcoRR-2YgxhI-EOUH~~~dd0XBijuomH398bkKstyzDc2LxpuadQNo3M~sODHiMEIBhmQolkDfOIHVEyH535nyjBKpTCvK91RQRsUmo8Tm7ljRmhsmYcVgPX2wNBhEPz6i4ISuRnPSaizBKUEPfpHRucaiKpytuOgFu1-BZUgsUb5zobr4BIYo2FD5FkNvJVnE9VqiRfj~LLdWrOuvOKo56~vLZsOluWgqS-iQq8DEJpzhoQ__&Key-Pair-Id=K28VXAGA7VWE0O
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453820&bpp=35&bdt=94&idt=136&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4671767059969&frm=8&ife=1&pv=1&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.1e0bozjdbm9m&fsb=1&dtd=145
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.4.52 -, , ASN (),
Reverse DNS
Software
AmazonS3 /
Resource Hash
08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://googleads.g.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

x-amz-version-id
null
date
Sun, 25 Jun 2023 02:36:42 GMT
via
1.1 7ce1191b390045e05b9cc74f7514b77a.cloudfront.net (CloudFront)
last-modified
Fri, 06 May 2022 11:40:06 GMT
server
AmazonS3
x-amz-cf-pop
FRA6-C1
age
79855
etag
"70af33d70b6810475aae19743c8c435b"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/gif
accept-ranges
bytes
content-length
85
x-amz-cf-id
ZPug4qdz-JLXDQ7qUXvxeit-V-E_NpPesejG4KM8PG85g_a1-9Bo9A==
css
fonts.googleapis.com/ Frame 45A4
2 KB
507 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Titillium+Web:400,700
Requested by
Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request_content.php?s=75958800006171300951389012367030&a=e491a2c0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
7fb07880fe0e8c6a59441a5eb71aed95f6542a8c4bc1ed859984d2e8efe054e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hal900030.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Mon, 26 Jun 2023 00:47:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Sun, 25 Jun 2023 23:19:50 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Mon, 26 Jun 2023 00:47:35 GMT
/
hal9000.redintelligence.net/scale/ Frame 45A4
9 KB
9 KB
Image
General
Full URL
https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=62&height=62&url=https://cdn.contentspread.net/24i/advertiser/6383/creativesup/postbank_pool_privatkredit_627x627.jpg
Requested by
Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request_content.php?s=75958800006171300951389012367030&a=e491a2c0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.150.63.201.138.clients.your-server.de
Software
Apache /
Resource Hash
dfc9380de982fd5fa87d936103e90142934042a335d99676588f885df70e7612

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hal900030.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:35 GMT
Content-Encoding
gzip
Server
Apache
Connection
close
Content-Length
9325
Vary
Accept-Encoding
Content-Type
image/png
/
hal9000.redintelligence.net/scale/ Frame 45A4
9 KB
9 KB
Image
General
Full URL
https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=62&height=62&url=https://cdn.contentspread.net/24i/advertiser/30229/creativesup/627x627_Office-Partner.jpg
Requested by
Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request_content.php?s=75958800006171300951389012367030&a=e491a2c0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.150.63.201.138.clients.your-server.de
Software
Apache /
Resource Hash
7131454e6a55a44e5ce30bacd748addad2637502648b4e123af9220c69ccde08

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hal900030.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:35 GMT
Content-Encoding
gzip
Server
Apache
Connection
close
Content-Length
9248
Vary
Accept-Encoding
Content-Type
image/png
/
hal9000.redintelligence.net/scale/ Frame 45A4
7 KB
8 KB
Image
General
Full URL
https://hal9000.redintelligence.net/scale/?nw=20&mode=bb&width=62&height=62&url=https://cdn.contentspread.net/24i/advertiser/55487/creativesup/627x627.jpg
Requested by
Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request_content.php?s=75958800006171300951389012367030&a=e491a2c0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
138.201.63.150 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.150.63.201.138.clients.your-server.de
Software
Apache /
Resource Hash
c946f55898889d6fb54a5d17796a56eb2c322ed460df7dd8e94f0730b7beeb45

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hal900030.redintelligence.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:35 GMT
Content-Encoding
gzip
Server
Apache
Connection
close
Content-Length
7632
Vary
Accept-Encoding
Content-Type
image/png
pixel
cm.g.doubleclick.net/ Frame CB2F
Redirect Chain
  • https://cms.quantserve.com/dpixel?a=p-n5vvLvRdjg0ek&eid=0&qc_google_push=&google_gid=CAESEKY-0yslzkXLZGu4kTYAHh0&google_cver=1&google_push=ATf1kGNAthQhogJcsy8IMpYhFbLkT6SW-MHRhOavS-CGfzv9fSk3VPvtUN...
  • https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ATf1kGNAthQhogJcsy8IMpYhFbLkT6SW-MHRhOavS-CGfzv9fSk3VPvtUNFY3hNhKjClxOBrGFhIgatsRwdRhmuWrCB0RGqhl1LzO9E&google_hm=DA921SCXJ...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ATf1kGNAthQhogJcsy8IMpYhFbLkT6SW-MHRhOavS-CGfzv9fSk3VPvtUNFY3hNhKjClxOBrGFhIgatsRwdRhmuWrCB0RGqhl1LzO9E&google_hm=DA921SCXJnTPBFq4A_sVUA
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453820&bpp=35&bdt=94&idt=136&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4671767059969&frm=8&ife=1&pv=1&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.1e0bozjdbm9m&fsb=1&dtd=145
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:35 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?&google_nid=B765081F39B1F7&google_push=ATf1kGNAthQhogJcsy8IMpYhFbLkT6SW-MHRhOavS-CGfzv9fSk3VPvtUNFY3hNhKjClxOBrGFhIgatsRwdRhmuWrCB0RGqhl1LzO9E&google_hm=DA921SCXJnTPBFq4A_sVUA
date
Mon, 26 Jun 2023 00:47:35 GMT
cache-control
private, no-store, proxy-revalidate
strict-transport-security
max-age=86400
content-length
0
pixel
cm.g.doubleclick.net/ Frame CB2F
Redirect Chain
  • https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEKuR8bHHwASmsenc_Plbe0k&google_cve...
  • https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=M054Snk3SGsxUWRBb2U1&google_gid=CAESEKuR8bHHwASmsenc_Plbe0k&google_cver=1&google_push=ATf1kGPGw5qbEBAZxLU0fzknLY2uE4_xfYNjxB3z4sIaXFX...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=M054Snk3SGsxUWRBb2U1&google_gid=CAESEKuR8bHHwASmsenc_Plbe0k&google_cver=1&google_push=ATf1kGPGw5qbEBAZxLU0fzknLY2uE4_xfYNjxB3z4sIaXFXj1qtIZjs9UOdsVlKwCtUMd50WvtcXsA9Snx5CvaIggP2Im0m2aRKIbg
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453820&bpp=35&bdt=94&idt=136&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4671767059969&frm=8&ife=1&pv=1&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.1e0bozjdbm9m&fsb=1&dtd=145
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:35 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Mon, 26 Jun 2023 00:47:34 GMT
Strict-Transport-Security
max-age=2592000; includeSubDomains
Server
PingMatch/v2.0.30-782-g97d928b#rel-ec2-master i-0caa68a19e3c1fdac@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Location
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=M054Snk3SGsxUWRBb2U1&google_gid=CAESEKuR8bHHwASmsenc_Plbe0k&google_cver=1&google_push=ATf1kGPGw5qbEBAZxLU0fzknLY2uE4_xfYNjxB3z4sIaXFXj1qtIZjs9UOdsVlKwCtUMd50WvtcXsA9Snx5CvaIggP2Im0m2aRKIbg
Cache-Control
no-cache, must-revalidate
Connection
keep-alive
Content-Length
0
Expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame CB2F
Redirect Chain
  • https://sync.mathtag.com/sync/img?mt_exid=4&google_gid=CAESEGtHSCIBAMISum6zw62rBdk&google_cver=1&google_push=ATf1kGM85gkmSEdNWfpROOGxr0FnJT2KimkGtsPgjkZWXatSLzZt1A3OrzxwK9sRl0Z2vAmc6iuEXU3m7Aeuwkt7...
  • https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=8ZhkmOAmTgGpXGsPjTC64w&google_push=ATf1kGM85gkmSEdNWfpROOGxr0FnJT2KimkGtsPgjkZWXatSLzZt1A3OrzxwK9sRl0Z2vAmc6iuEXU3m7Aeuwkt7eO7UNIP4...
170 B
188 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=8ZhkmOAmTgGpXGsPjTC64w&google_push=ATf1kGM85gkmSEdNWfpROOGxr0FnJT2KimkGtsPgjkZWXatSLzZt1A3OrzxwK9sRl0Z2vAmc6iuEXU3m7Aeuwkt7eO7UNIP42rIJOdQ
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453820&bpp=35&bdt=94&idt=136&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4671767059969&frm=8&ife=1&pv=1&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.1e0bozjdbm9m&fsb=1&dtd=145
Protocol
H3
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:35 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date
Mon, 26 Jun 2023 00:47:35 GMT
Server
MT3 1031 59fd23a master zrh zrh-pixel-x27 config_version:"1524"
Content-Type
image/gif
Access-Control-Allow-Origin
*
location
https://cm.g.doubleclick.net/pixel?google_nid=mediamath&google_hm=8ZhkmOAmTgGpXGsPjTC64w&google_push=ATf1kGM85gkmSEdNWfpROOGxr0FnJT2KimkGtsPgjkZWXatSLzZt1A3OrzxwK9sRl0Z2vAmc6iuEXU3m7Aeuwkt7eO7UNIP42rIJOdQ
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control
no-cache
Connection
keep-alive
Keep-Alive
timeout=360
Content-Length
0
Expires
Mon, 26 Jun 2023 00:47:34 GMT
usersync.aspx
dis.criteo.com/dis/ Frame CB2F
43 B
363 B
Image
General
Full URL
https://dis.criteo.com/dis/usersync.aspx?r=4&p=14&cp=google&cu=1&url=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcjp%26google_hm%3D%40%40CRITEO_USERID%40%40%26google_push%3DPUSH_DATA&google_gid=CAESEKqQLh42T1xsvNuXwysigUY&google_cver=1&google_push=ATf1kGMQCgaXtY06NRgesAlzUBc6cFiLvhUe4MHnfa2Pd9QKOftYkgXysVhY0TvEpJrPFV1iIEE85shYDB9-qmjB-DK4tmVwY5NpamQ
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453820&bpp=35&bdt=94&idt=136&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4671767059969&frm=8&ife=1&pv=1&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.1e0bozjdbm9m&fsb=1&dtd=145
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
178.250.1.9 -, , ASN (),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:34 GMT
x-errorlevel
0
strict-transport-security
max-age=31536000; preload;
server
Kestrel
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
content-type
image/gif
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
206977
expires
Mon, 26 Jun 2023 00:00:00 GMT
attr
cm.g.doubleclick.net/pixel/ Frame CB2F
0
12 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KSvtGv5ZUzpeps5uopJdjR5uM7Zf7H3AgXQCQDCju8OHFMC_ym
Requested by
Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&h=90&slotname=9586219513&adk=1165138949&adf=4198790052&pi=t.ma~as.9586219513&w=728&format=728x90&url=https%3A%2F%2Fye-mek.net%2F&ea=0&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453820&bpp=35&bdt=94&idt=136&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&prev_fmts=0x0&nras=1&correlator=4671767059969&frm=8&ife=1&pv=1&ga_vid=1306040764.1687740454&ga_sid=1687740454&ga_hid=909608545&ga_fc=0&nhd=2&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=728&ish=90&ifk=3557580378&scr_x=-12245933&scr_y=-12245933&eid=44759926%2C44759875%2C42532277%2C44759842%2C42532279%2C31075431%2C44788442&oid=2&pvsid=3529474187045799&tmod=1811170121&uas=0&nvt=1&top=https%3A%2F%2Fpcloak.blob.core.windows.net&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C728%2C90&vis=1&rsz=%7C%7CeE%7C&abl=CS&pfx=0&fu=0&bc=31&ifi=2&uci=2.1e0bozjdbm9m&fsb=1&dtd=145
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.186.34 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s04-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pagead2.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:35 GMT
server
HTTP server (unknown)
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
content-type
text/html
viewability
hal900030.redintelligence.net/ Frame 45A4
0
150 B
Script
General
Full URL
https://hal900030.redintelligence.net/viewability?s=75958800006171300951389012367030&a=d9d13c75&vb=m
Requested by
Host: hal900030.redintelligence.net
URL: https://hal900030.redintelligence.net/request_content.php?s=75958800006171300951389012367030&a=e491a2c0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
136.243.149.243 Radeberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS
static.243.149.243.136.clients.your-server.de
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://hal900030.redintelligence.net/request_content.php?s=75958800006171300951389012367030&a=e491a2c0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

Date
Mon, 26 Jun 2023 00:47:35 GMT
Server
Apache
Connection
close
Content-Length
0
Content-Type
text/html; charset=UTF-8
activeview
pagead2.googlesyndication.com/pcs/ Frame 5622
42 B
66 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstw9q2DVeY-iAhcKkIeOKoaaMWHfveD9g5EgEyhssb949j-_Vh_BLN9T2-bgxYIF9o6xwjDkFi-GlABKnJDe0SqniTFRm13CvIzSpgEOxCwfYLgWUWHw5pa08CspA11EyYNusyUYHabfKWZ&sai=AMfl-YSenRk85nd4QVw12PDvlJsBM_p3SgdYt6dpUOOhqNYclBBlmymUesUIpX7rGlo4J2j5jJgN5dIRIEWM0_wsruwi_652pe4hNPD1H1SvPLtqJFc7xOZYmpQZKwM&sig=Cg0ArKJSzHYTBiD7lLpSEAE&cid=CAQSOwBygQiDcN2yCWRQ7PRY2NttP0LamLUhmNoWMpjEf3R0T7_Oz2sQaKGjj31H0wTXKUiVdp9pkcB4yM53GAE&id=ampim&o=0,229&d=160,228&ss=1600,1200&bs=160,228&mcvt=1000&mtos=0,0,0,1000,1000&tos=0,0,0,1000,0&tfs=454&tls=1454&g=100&h=100&tt=1455&r=v&avms=ampa&uap=&uapv=&uaa=&uam=&uafv=&uab=&uafvl=%5B%5D&uaw=false&adk=0
Requested by
Host: ye-mek.net
URL: https://ye-mek.net/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:35 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 578A
42 B
64 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsueCtIcr3KtBwsobMXgnSpIMr3cjW3_ZuDWnYDo2of3aIWFLODSEe5E3aOzxMOnNw0iyVrhUgBCzbgvUzTRSsvqPjHCUrK8iTnh2_yjXdD_5w0GykHvLlBb8L6Z8XTNsxP8nlKpdRfoi_u0&sai=AMfl-YRDjyk3_kHdqAzIUPOxCxBQgQDpl_eJzUJGR7_5sY0hDw7kiRByUX3BTep6I776NNP_f8uPoaN2QZyem0E71YKo66y4VWvV0yP08fN4RzFrL2Sz0woIWhnuu60&sig=Cg0ArKJSzMgCwOJ5TtPIEAE&cid=CAQSOwBygQiDvVEaJaX6CuYYX77-byyUXqAUykH1jGIKFnr6X7yFN0vvxfx9xpoGXZiDI0B-PG_ihqtyjbleGAE&id=lidar2&mcvt=1000&p=1,1,70,729&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230621&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=9&adk=456810305&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687740454019&rpt=417&met=mue&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:35 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame 7DEF
42 B
64 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssc7vJC6qgHwIpOsm0DxSfLJloz7bf7Rz0S7m-okJJH4jyOs3267iwQacWrp4xB7susflRJ821rfsvdph7K1mHHK42EWNUV_iK4PQHJw6Pw0EWad5A3YnME1BZ0iC2SMxQ05TL9kAiFZ9W3&sai=AMfl-YT5WnVEeYP01UtdVIsQXslP_AeSYRcTzFbJIz4bBmRhQ6SISCmqLV41HT7x02Dr9UZXj0zSmf7WFZJ1tYb9JtxxiV0wSnO_tDEQ_k7vlJhDsLNIjJlqSmJ7BNo&sig=Cg0ArKJSzDjtWQr8ZX8rEAE&cid=CAQSOwBygQiDs7BmK0K-MwR-e_kxgxi3y3s9MZ_xMZW5V_e2MN-pD6sYQw5pBvu2nhNuJlYJOPBrlpM3dLkPGAE&id=lidar2&mcvt=1003&p=0,0,250,300&mtos=1003,1003,1003,1003,1003&tos=1003,0,0,0,0&v=20230621&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3050045420&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687740453997&rpt=465&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:35 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 8E30
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssAY8TnIKEwMe5ZD4LdahxKHYIOQ-ezMPyz_o4Dcq9LogEriex1rryuB_wGUG8VWvxw96cz93LIJ8ThtXUxCICRNcKN-sxpKS_VBHBxNyqXDzDgUi6IJiOgMSfXNgHpIj28oZg-SXQXcP9uaHTYnCmoLnbh9DWIHVG2y0YwKf5ijeatv5p6Tyg2XIDyp-w22PpJkluprr60EcoqeQXM1O8s1dRYZiuHEg-6-qfQ7J34Orv6HANlNO0od8AqFu5pIOQv3tgOCwge8yBKOPDHxcPlLHvZTZhaB7juNbftZxKkP7-uZh6ZaunRar_Sd4r5FAb7Q8Yp_h88maqW42DK96fkoFwHzM6DRi9ZumDoTDSlLpfOReV3baHcxkcm&sai=AMfl-YTxcsP24jX7iE7Jv6oNTpmsDTm4iLESxMWoJm3fXkOa7NJwuGGFLBMgcctpwM6BOxLsMM64RX4dS3fT_HsgXAmhtHbEtkSH4jPG8ry3WZM&sig=Cg0ArKJSzMG8WlGKPCDSEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:35 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Mon, 26 Jun 2023 00:47:35 GMT
sodar
pagead2.googlesyndication.com/getconfig/ Frame 8E30
14 KB
11 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230620&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306160901/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6593523210010154&plah=e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ccde397c209c50740248f2238b06088f9b3ff5d4946191e9517c410ccaa976ab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:35 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11188
x-xss-protection
0
sodar
pagead2.googlesyndication.com/getconfig/ Frame 1DCE
15 KB
11 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gda&tv=r20230620&st=env
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306160901/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6593523210010154&plah=ye-mek.net&bust=31075473
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
35665554c497720c982a62c92c4bdfc94445f46ce724401ba0981b3b7a17f42f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:35 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
11222
x-xss-protection
0
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 8E30
17 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306160901/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6593523210010154&plah=e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 26 Jun 2023 00:47:35 GMT
sodar2.js
tpc.googlesyndication.com/sodar/ Frame 1DCE
17 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202306160901/show_ads_impl_with_ama_fy2021.js?client=ca-pub-6593523210010154&plah=ye-mek.net&bust=31075473
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Mon, 26 Jun 2023 00:47:35 GMT
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 3932
13 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
120592
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Sat, 24 Jun 2023 15:17:43 GMT
expires
Sun, 23 Jun 2024 15:17:43 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame A1E8
783 B
537 B
Document
General
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
416f1794bf14d4d001e721b2bb681935c168b13c01799b1d2c7f039db2fc2249
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-3Pd41U90xm200ajDWqD-4Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
gzip
content-length
515
content-security-policy
script-src 'report-sample' 'nonce-3Pd41U90xm200ajDWqD-4Q' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:47:35 GMT
expires
Mon, 26 Jun 2023 00:47:35 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame CD3A
13 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ye-mek.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
120592
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Sat, 24 Jun 2023 15:17:43 GMT
expires
Sun, 23 Jun 2024 15:17:43 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame BCBF
783 B
534 B
Document
General
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
42f24ceb01997b399d6512c9e8265f5d776b2360b7445353cb60a7475a0130be
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-pTHf4fNtNnycg8CF5vJWbQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ye-mek.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=300
content-encoding
gzip
content-length
512
content-security-policy
script-src 'report-sample' 'nonce-pTHf4fNtNnycg8CF5vJWbQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Mon, 26 Jun 2023 00:47:35 GMT
expires
Mon, 26 Jun 2023 00:47:35 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
IQSFUkhUGxVfAIopecFKbiTYCckszFTcFsmN0yEW6wM.js
pagead2.googlesyndication.com/bg/ Frame 3932
38 KB
14 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/IQSFUkhUGxVfAIopecFKbiTYCckszFTcFsmN0yEW6wM.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2104855248541b155f008a2979c14a6e24d809c92ccc54dc16c98dd32116eb03
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 00:46:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
86449
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14804
x-xss-protection
0
last-modified
Mon, 19 Jun 2023 09:38:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Mon, 24 Jun 2024 00:46:46 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame A1E8
0
0
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230620&jk=3529474187045799&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

activeview
pagead2.googlesyndication.com/pcs/ Frame 6ED2
42 B
64 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstcajwJgtVKjqeGcJdYr8cSc1dkGsROAs8kXxEJ86oaIOaZmMPr2QEJa2rgJs6X26YogGdD83zV3QTSo7IC2hmU1NcD5CdvL-NOJQhz-FQ35PU0VieLs3R4jq6qgneviFPwCCkXq6vy4YZE&sai=AMfl-YSinoizjQCJ1SJs4KVecztCRnukpA6iMxsu4sBksKY47UqBYrVG99RU-PQddVYPwIi3YUxUOXicVFYtzvr6MhHJhMaw5WPsUQK3z0lMY5eVsHnjD3p8pIFmYz4&sig=Cg0ArKJSzBZuzrLS8oA7EAE&cid=CAQSOwBygQiDXmAqvXuuookQYDfhJ6ej_lHZbYI8f4L7HHZBlLAkW6EF0jymtdZt-uRWBoKSOdcnTEXeR1OoGAE&id=lidar2&mcvt=1003&p=0,119,40,160&mtos=1003,1003,1003,1003,1003&tos=1003,0,0,0,0&v=20230621&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3299242717&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1687740454006&rpt=531&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0&io2=14
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:35 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
access-control-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame BCBF
0
0
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gda_r20230620&jk=4006622124605617&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

IQSFUkhUGxVfAIopecFKbiTYCckszFTcFsmN0yEW6wM.js
pagead2.googlesyndication.com/bg/ Frame CD3A
38 KB
14 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/IQSFUkhUGxVfAIopecFKbiTYCckszFTcFsmN0yEW6wM.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2104855248541b155f008a2979c14a6e24d809c92ccc54dc16c98dd32116eb03
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Sun, 25 Jun 2023 00:46:46 GMT
content-encoding
br
x-content-type-options
nosniff
age
86449
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
14804
x-xss-protection
0
last-modified
Mon, 19 Jun 2023 09:38:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Mon, 24 Jun 2024 00:46:46 GMT
generate_204
tpc.googlesyndication.com/ Frame CD3A
0
11 B
Image
General
Full URL
https://tpc.googlesyndication.com/generate_204?piLvMg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:35 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
gen_204
pagead2.googlesyndication.com/pagead/ Frame 7DEF
0
22 B
Ping
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=1161698462532&version=m202301230201&ct=76&x=1&cor=4246618124978499600
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:35 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
generate_204
tpc.googlesyndication.com/ Frame 3932
0
11 B
Image
General
Full URL
https://tpc.googlesyndication.com/generate_204?MGnXqg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date
Mon, 26 Jun 2023 00:47:35 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
gen_204
pagead2.googlesyndication.com/pagead/ Frame 6ED2
0
22 B
Ping
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=2692466427256&version=m202301300101&ct=76&x=1&cor=14270463404999264000
Requested by
Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 26 Jun 2023 00:47:35 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
5ed7702fe4b07a92411bc03e
ng2.virgul.com/tck/imp/ Frame 1DCE
0
209 B
Image
General
Full URL
https://ng2.virgul.com/tck/imp/5ed7702fe4b07a92411bc03e?g=1&t=gb&r=153378@site_geneli@yemek_net:site_geneli&l=&c=%2Cas%2Crc0%2Chf1%2Cvv1%2Cgprec%3Dyemek%26rec_ing%3D&info=&mt=1687740453081&userId=vnet634f4ce2-00c5-4905-8c8e-c86254eb39f9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software
openresty/1.15.8.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://ye-mek.net
date
Mon, 26 Jun 2023 00:47:36 GMT
access-control-allow-credentials
true
expires
Tue, 04 Jan 2022 10:49:40 GMT
server
openresty/1.15.8.3
content-length
0
p3p
CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'
tracking-event
api.webgains.io/ Frame
0
0
Preflight
General
Full URL
https://api.webgains.io/tracking-event
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.247.104 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://googleads.g.doubleclick.net
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers
Authorization, Content-Type
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
*
date
Mon, 26 Jun 2023 00:47:36 GMT
server
nginx
tracking-event
api.webgains.io/ Frame 1BE1
16 B
209 B
Fetch
General
Full URL
https://api.webgains.io/tracking-event
Requested by
Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.247.104 -, , ASN (),
Reverse DNS
Software
nginx / PHP/8.1.14
Resource Hash
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://googleads.g.doubleclick.net/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
application/json

Response headers

date
Mon, 26 Jun 2023 00:47:36 GMT
x-content-type-options
nosniff
server
nginx
x-powered-by
PHP/8.1.14
content-type
application/json
access-control-allow-origin
*
cache-control
no-cache, private
x-xss-protection
1; mode=block
tracking-event
api.webgains.io/ Frame
0
0
Preflight
General
Full URL
https://api.webgains.io/tracking-event
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.247.104 -, , ASN (),
Reverse DNS
Software
nginx /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-headers
Authorization, Content-Type
access-control-allow-methods
GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin
*
date
Mon, 26 Jun 2023 00:47:36 GMT
server
nginx
tracking-event
api.webgains.io/ Frame 1A21
16 B
209 B
Fetch
General
Full URL
https://api.webgains.io/tracking-event
Requested by
Host: analytics.webgains.io
URL: https://analytics.webgains.io/pvClk.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.56.247.104 -, , ASN (),
Reverse DNS
Software
nginx / PHP/8.1.14
Resource Hash
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type
application/json

Response headers

date
Mon, 26 Jun 2023 00:47:36 GMT
x-content-type-options
nosniff
server
nginx
x-powered-by
PHP/8.1.14
content-type
application/json
access-control-allow-origin
*
cache-control
no-cache, private
x-xss-protection
1; mode=block
sodar
pagead2.googlesyndication.com/pagead/ Frame 1DCE
0
0
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230620&jk=4006622124605617&bg=!nZ6lnsrNAAYQ3eRoMN07ADkAdvg8Wr42S3PXSIdkC2Hwpeb-cPYPnMyiQOpsILGkdWrkrGs3Q43xOTjxGGkW6J1V_VNx3FyvhfQCAAAAq1IAAAADaAEHmQLBM-cfwL43fr9Kc39DwIm7y9ZluGWjvL-T4uiau9uIpCWeJgffIyIsEA-RDXryDD4YXW5cnAOBAboWjTjrONWia9lpQ01gQCMqqE5XLwhfT3ngemTRv_TTIBcBjhe4ZTBcJ82VOgFL6pfbDfAfRe2l6bs8c1KN1Zhc-lnLJMnVui4RGisG7cdNFhJQXgglnw5dzOXeDss5s6DVmPf--J_ceO7RrIdPifFl83R2Ywu8-_SiR33q2hjSS9viOzYJ9Db4GkTbISVyDV0u4XIl7rXDHlIShj_PRfh89uXnnyOwfdqgsTlGUODqXfTfSxhhbA_nPw2iR38l-F8fIV6KzqEiH29rPjvy95PjZLZTv-JB9MrTAOX_x0GXLigA48sGd07V-fNW3yS3QXlPcN7lKpO5ZELzT7iPhJWhjF2HhZE2umYnLoAikzqdwyRfb3TKsPWatkpE1jbSrCxLTOMj1Ij5hAperWQNsfNllhatW0xwFCf_KFrKUgWbRw4i7zXPz0k6ano09a3E2bt6-wjHnv51uY8RfUIaaQtzu1JC9A20fDuIuvO266DDpIU2YJE-rutpgn6SrjSR2ZvTOHeO6GdTEk1lfOvQwOr3KcAqw4Ok5lLhfznpHi7si2did4qEYOnngcqm_XmbiuJclhlf_RANgm-p81tx6bezc9o_E-Y8PCpgqBAnPZHlOugL3fXIN1BTK7DryklzaEEndQyiJqFfi73Gwak2WJVAVDa9FK7zddq3lvEofyhG6BFd_83TubdEQx96OH_i3WiL_Z4fgPy_s7RVfPyEJ_CNJjGm-WKQ9_BwJdaq6cEHhSZ2XB3EfvNlVaWlsOlJvFv3hkDLgAxvrRveh6Bd6KJBQVPULKzDSZIotr_o9t7nCPW93zglo8Os-MoO5vtfnzYeQVhE3eV5pBd4VZzyQJssSdXxouIAe0CP
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

5ed7638be4b07a92411bbffe
ng.virgul.com/tck/i_vb2/ Frame 1DCE
0
209 B
Image
General
Full URL
https://ng.virgul.com/tck/i_vb2/5ed7638be4b07a92411bbffe?l=&r=153366@site_geneli@yemek_net:site_geneli&cs=1687740456395&userId=vnet634f4ce2-00c5-4905-8c8e-c86254eb39f9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software
openresty/1.15.8.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://ye-mek.net
date
Mon, 26 Jun 2023 00:47:36 GMT
access-control-allow-credentials
true
expires
Tue, 04 Jan 2022 10:49:40 GMT
server
openresty/1.15.8.3
content-length
0
p3p
CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'
5ed76f76e4b07a92411bc03a
ng.virgul.com/tck/i_vb2/ Frame 1DCE
0
209 B
Image
General
Full URL
https://ng.virgul.com/tck/i_vb2/5ed76f76e4b07a92411bc03a?l=&r=153377@site_geneli@yemek_net:site_geneli&cs=1687740456395&userId=vnet634f4ce2-00c5-4905-8c8e-c86254eb39f9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software
openresty/1.15.8.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://ye-mek.net
date
Mon, 26 Jun 2023 00:47:36 GMT
access-control-allow-credentials
true
expires
Tue, 04 Jan 2022 10:49:40 GMT
server
openresty/1.15.8.3
content-length
0
p3p
CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'
5ed771bae4b07a92411bc04c
ng.virgul.com/tck/i_vb2/ Frame 1DCE
0
209 B
Image
General
Full URL
https://ng.virgul.com/tck/i_vb2/5ed771bae4b07a92411bc04c?l=&r=153382@site_geneli@yemek_net:site_geneli&cs=1687740456395&userId=vnet634f4ce2-00c5-4905-8c8e-c86254eb39f9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software
openresty/1.15.8.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://ye-mek.net
date
Mon, 26 Jun 2023 00:47:36 GMT
access-control-allow-credentials
true
expires
Tue, 04 Jan 2022 10:49:40 GMT
server
openresty/1.15.8.3
content-length
0
p3p
CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'
5ed771e3e4b07a92411bc04e
ng.virgul.com/tck/i_vb2/ Frame 1DCE
0
209 B
Image
General
Full URL
https://ng.virgul.com/tck/i_vb2/5ed771e3e4b07a92411bc04e?l=&r=153383@site_geneli@yemek_net:site_geneli&cs=1687740456395&userId=vnet634f4ce2-00c5-4905-8c8e-c86254eb39f9
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.7.176.221 , Turkey, ASN42910 (PREMIERDC-VERI-MERKEZI-ANONIM-SIRKETI PREMIERDC - SH, TR),
Reverse DNS
Software
openresty/1.15.8.3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://ye-mek.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-origin
https://ye-mek.net
date
Mon, 26 Jun 2023 00:47:36 GMT
access-control-allow-credentials
true
expires
Tue, 04 Jan 2022 10:49:40 GMT
server
openresty/1.15.8.3
content-length
0
p3p
CP='IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT'
sodar
pagead2.googlesyndication.com/pagead/ Frame 8E30
0
0
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gda_r20230620&jk=3529474187045799&bg=!g4ClgNTNAAYQ3eRoMN07ADkAdvg8Wk9mKHpLvfmBWjP9vrrrBOInejpcAkKp_utqb-YkQuJ0bkcd357wGBuNsLiMUfh0JyVta8kCAAAAsVIAAAADaAEHmQMaEQ2Z27e6vBz-T-r2LuYXrBxw0WNwxmvsNYtZMHA0B4nhUZqF3v0DgrQA9Zsg7NGRh7DxmU0M5v-w9jl0ppBSk_XbxhB-_1G2d2_d_yuSXXHfm4nVhCx4g49zAUFFBsKa0sJUgERKQod7C3cwBtWU6hcNlzIj6wGfqCNS_IOigJ-p5U-o3kNCFJ67CdyFlEI6Ta8o_54WYmxIGS3OQOpFNwd3bY9t8qOiZJjn_qXura64VC23FgfVstwx6h9Fd750vFgI0U0pgu-g-lGZzW_0AWufYm4k6GE9bqehjFdKMcJHHz4AhQwQib5Q2_mlGk5L8VVLp4gfnf9asNxGVr5k72o0EsyHS-J0pDpJ9p1xcZi3eZzE3xN60YIRwM9JVwEqxiKbNENsnEK86pbDHQzHGEm3pjqOrjdxIS_ncy7qVPf7T7lWSe3ivFktzQu3m7jt9gRC5yeoqYLaq1qTjNDvxepbuYkrpNTJr9ybCom0j4kTcMD3MwjlteUo2S2fJxmfSalHsSFtcGnWuT4a45SwmWbmyRKK6su9ANncuqkqjYMHPTcRTWlbMmOJEq7-gavqdFkMsZNkygAiTLovufUlfN56rr_NKiKmdNESJIsf_y_lB3MFNfdkzGQpYP8ZiynaJtEK-NTHwiAZtqUDP5lBKQrX6hKvk__KB7i_e-tp-saD33uk9UUrNEa5lkvqYhA9T7Nab6hnvALn7oCK7aOSH8jXnqqQhp5-MWDLa71Prm4zU2W4oYYMr3meNqmCeAilNdiCWjc17SJ_tDOyLPyBa9BHbuqT3IOAmjFiMxcCHyPoSrDpLA1E5OuRXrusIKixtHqO_7RQctG_HUU5_fQCDcxVG6Lvpwu1D2a6-p-ukM0S9yyMsJ7sey8Cn6o-L29DVNyNi20V_geRmOYho7cYMh7dz3Msb2Q-pm8bsOlAO5AQ8Cw122swpb0kcu8hfvDsZfQzgb5SyGMl96CC4sDjddxYWuyr3BGeInmclzLrzFDjMheKdjBqgwfSRyiqtcAcN3LtkwX-gj2npsXr-Wekn0LKOS-qJRhALwQ
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

5ed7706de4b07a92411bc042
ng2.virgul.com/tck/imp/ Frame 1DCE
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
ng2.virgul.com
URL
https://ng2.virgul.com/tck/imp/5ed7706de4b07a92411bc042?g=1&t=gb&r=153379@site_geneli@yemek_net:site_geneli&l=&c=%2Cas%2Crc0%2Chf1%2Cvv1%2Cgprec%3Dyemek%26rec_ing%3D&info=&mt=1687740453081&userId=vnet634f4ce2-00c5-4905-8c8e-c86254eb39f9

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 boolean| credentialless object| onbeforetoggle object| onscrollend function| cloakan string| data object| xmlHttp number| data2 string| hash object| ifrm

37 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: IDE
Value: AHWqTUnnca5fms3LzhC09ySwSbt8L6l1irruf1OUzbW2E26ECfPUaJK0rrnmCjt6WOM
.mathtag.com/ Name: uuid
Value: f1986498-e026-4e01-a95c-6b0f8d30bae3
.casalemedia.com/ Name: CMID
Value: ZJjgJuzYkefU3A3c3kdCJQAA
.casalemedia.com/ Name: CMPS
Value: 3375
.casalemedia.com/ Name: CMPRO
Value: 3375
.adnxs.com/ Name: uuid2
Value: 3781852579769477308
.doubleclick.net/ Name: DSID
Value: NO_DATA
.adnxs.com/ Name: anj
Value: dTM7k!M41.D>6NRF']wIg2E>xnZ8yh!@wnfH8K6pQK`!5=E<*L5?%K>.SifD^^dl84>T`Whs-l71p6_tAGFl8f'T(4*bpRz*qF1`*b_Y@*3*B:
.travelaudience.com/ Name: _tracker
Value: %7B%22UUID%22%3A%225864B74F-E494-49CF-BDCC-2FE54FFCF061%22%7D
.1rx.io/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-49bea114-ddba-49a5-86ec-f45632124bba-003%22%7D
.mathtag.com/ Name: mt_mop
Value: 4:1687740455
.de17a.com/ Name: guid
Value: 1.3677429462676984245
.pubmatic.com/ Name: KTPCACOOKIE
Value: YES
.yahoo.com/ Name: A3
Value: d=AQABBCbgmGQCEHGwXgt65k7bAsfti4lnmaoFEgEBAQExmmSiZAAAAAAA_eMAAA&S=AQAAAt3tQXyS0feCBY31FWCyMco
.quantserve.com/ Name: d
Value: EBgBCQGpKYEA
.quantserve.com/ Name: mc
Value: 6498e026-ad1de-a3854-2a26f
.360yield.com/ Name: tuuid_lu
Value: 1687740454
.360yield.com/ Name: tuuid
Value: b9a73aa8-3f87-44a3-9737-c7cc8fb98cb5
.w55c.net/ Name: wfivefivec
Value: 3NxJy7Hk1QdAoe5
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~ZJjgJgAAAOp1JwAz
.pubmatic.com/ Name: KADUSERCOOKIE
Value: 58AAFA04-33FE-46AE-AA21-CD57B03D22EA
.targeting.unrulymedia.com/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-49bea114-ddba-49a5-86ec-f45632124bba-003%22%7D
.w55c.net/ Name: matchgoogle
Value: 5
.retailads.net/ Name: ppb2172
Value: 2818862325
.id5-sync.com/ Name: cf
Value:
.id5-sync.com/ Name: cip
Value:
.id5-sync.com/ Name: cnac
Value:
.id5-sync.com/ Name: car
Value:
.id5-sync.com/ Name: gdpr
Value:
.id5-sync.com/ Name: callback
Value:
.futalis.de/ Name: raSIDb
Value: 2818862325
.3lift.com/ Name: tluid
Value: 3068431014140348749214
.mathtag.com/ Name: mt_misc
Value: mt_bt:1
.office-partner.de/ Name: source
Value: {"webgains_webgains":{"timestamp":1687740455200,"clickCookie":false}}
.adform.net/ Name: C
Value: 1
.quantserve.com/ Name: sp
Value: CgsI2WUSBginwOOkBg==
.adform.net/ Name: uid
Value: 6426172641240592149

3 Console Messages

Source Level URL
Text
network error URL: https://pcloak.blob.core.windows.net/web/jquery.min.js
Message:
Failed to load resource: the server responded with a status of 404 (The specified blob does not exist.)
javascript error URL: https://ye-mek.net/(Line 39)
Message:
Unsafe attempt to initiate navigation for frame with URL 'https://pcloak.blob.core.windows.net/web/6x69807j0b5.html' from frame with URL 'https://ye-mek.net/'. The frame attempting navigation is targeting its top-level window, but is neither same-origin with its target nor has it received a user gesture. See https://www.chromestatus.com/feature/5851021045661696.
network error URL: https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-6593523210010154&output=html&adk=1812271804&adf=3279755397&plat=1%3A512%2C2%3A512%2C3%3A512%2C4%3A512%2C8%3A512%2C9%3A33288%2C16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C26%3A512%2C27%3A512%2C30%3A1081856%2C32%3A32%2C41%3A32%2C42%3A32&format=0x0&url=https%3A%2F%2Fpcloak.blob.core.windows.net%2F&ea=0&pra=5&wgl=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&dt=1687740453215&bpp=5&bdt=878&idt=114&shv=r20230620&mjsv=m202306160901&ptt=9&saldr=aa&nras=1&correlator=3599492905211&frm=24&ife=1&pv=2&ga_vid=287714539.1687740453&ga_sid=1687740453&ga_hid=1928663309&ga_fc=1&nhd=1&u_tz=0&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&adx=-12245933&ady=-12245933&biw=-12245933&bih=-12245933&isw=1600&ish=1200&ifk=222437166&scr_x=-12245933&scr_y=-12245933&eid=44759876%2C44759927%2C44759837%2C31075308%2C31075413%2C31075465%2C31075473%2C42531706%2C44788442%2C44794789&oid=2&pvsid=4006622124605617&tmod=1052164672&uas=0&nvt=1&fsapi=1&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1600%2C1200&vis=1&rsz=%7C%7Cs%7C&abl=NS&fu=0&bc=31&ifi=1&uci=1.1901ez82f66&fsb=1&dtd=135
Message:
Failed to load resource: the server responded with a status of 403 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aax.amazon-adsystem.com
ads.travelaudience.com
adservice.google.com
adv.office-partner.de
ajax.googleapis.com
analytics.webgains.io
api.webgains.io
c.amazon-adsystem.com
c1.adform.net
c1.imgiz.com
cdn.ampproject.org
cdn.retailads.net
cdn.track.production.webgains.team
cdn.ye-mek.net
cm.g.doubleclick.net
cms.quantserve.com
connect.facebook.net
d5p.de17a.com
dclk-match.dotomi.com
dis.criteo.com
dsum-sec.casalemedia.com
e171bd1eea674952f9867b9edcb60f09.safeframe.googlesyndication.com
eb2.3lift.com
feed.pghub.io
fonts.googleapis.com
futalis.de
googleads.g.doubleclick.net
googleads4.g.doubleclick.net
hal9000.redintelligence.net
hal900030.redintelligence.net
hal90005.redintelligence.net
ib.adnxs.com
id5-sync.com
image6.pubmatic.com
images.dmca.com
imasdk.googleapis.com
match.360yield.com
ng.virgul.com
ng2.virgul.com
onetag-sys.com
pagead2.googlesyndication.com
pcloak.blob.core.windows.net
pghub.io
pixel.mathtag.com
pixel.rubiconproject.com
pm.w55c.net
pr-bh.ybp.yahoo.com
pv.medialead.de
rtb.openx.net
s.ad.smaato.net
s0.2mdn.net
s7.addthis.com
securepubads.g.doubleclick.net
ssum-sec.casalemedia.com
static.virgul.com
sync-tm.everesttech.net
sync.1rx.io
sync.inmobi.com
sync.mathtag.com
sync.targeting.unrulymedia.com
sync.teads.tv
tags.mathtag.com
tpc.googlesyndication.com
track.webgains.com
ups.analytics.yahoo.com
us-u.openx.net
www.cloakan.co
www.google-analytics.com
www.google.com
www.googletagmanager.com
www.googletagservices.com
ye-mek.net
ng2.virgul.com
136.243.149.243
138.201.63.150
138.201.63.165
141.95.98.64
142.250.185.194
142.250.186.34
145.239.193.130
151.101.194.49
151.139.128.10
178.250.1.9
18.66.147.120
185.29.132.242
185.29.132.245
185.64.190.78
185.7.176.221
185.80.39.216
185.89.210.20
2.18.161.51
20.127.253.7
20.60.220.36
213.155.156.169
23.206.208.114
2600:9000:2057:9200:1b:5138:8a40:93a1
2620:116:800d:21:93ca:31d8:d86e:38f6
2a00:1450:4001:806::2002
2a00:1450:4001:808::2002
2a00:1450:4001:80e::2001
2a00:1450:4001:811::200e
2a00:1450:4001:812::2006
2a00:1450:4001:828::200a
2a00:1450:4001:829::2008
2a00:1450:4001:82a::2001
2a00:1450:4001:82b::2001
2a00:1450:4001:82b::2002
2a00:1450:4001:82b::200a
2a00:1450:4001:830::200a
2a00:1450:4001:831::2002
2a00:1450:4001:831::2004
2a01:4f8:d0a:2321::2
2a02:6ea0:c700::10
2a02:fa8:8806:12::1370
2a03:2880:f083:9:face:b00c:0:3
2a05:d018:d29:3601:6386:b958:3af0:9fe1
2a0b:4d07:102::1
3.11.176.98
3.71.149.231
34.102.243.38
35.190.0.66
35.227.252.103
35.241.45.217
35.244.159.8
37.157.6.242
46.228.174.117
49.12.22.42
51.89.9.251
52.222.253.136
52.48.181.155
52.56.247.104
54.93.94.222
69.173.144.138
76.223.111.18
77.245.159.14
94.138.206.83
95.101.148.198
99.84.87.107
99.86.4.52
00c5621a3f56c052959f8f0591b65e893f132b49b1447fde20767966cacbfbfe
00daef3b4a945d15f73efa05e0ce2ca51f2f8252e1da8fae5c2efb0f6dddacce
013dea275b5a8ea557928bc40495322ac526a7a09513ca006fb336485c002c22
04894c4482c08cb1de75b81d01f59d50d9b415d69a4fddd0f7e49ce7cd533871
05c72250b7b0da8e896799e32f88440d53848a083665b797629e25bad1bde6fd
063f8f4e188f3fa9e65377bc04b667d77880ee000d6704882a8cfd0a61503421
06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844
08204982c484faf6890c60557a4e642971f17625ddddc0559dc0e3ca728ac9e0
08409d08d8d118c6c6d1c375e079bfce656ac367ff4d1dd9551fff110033c185
0b29697868cd68cfd1b5650054cc96ea755016b3242bd26469cdbd4e4f6fc18a
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
120fdf7c1e8de286b8c6ad005bd52d7b3d71cfa17bd6d1f72d023fe952d03708
125b17989b8b3fcf3e154506845bec4b8689ff825416ab4ba80ddd66e8cfa94d
127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b
13b4bb0bb059eee9a7ddf5b8ae3f395e28e7f81918eeac0ec934f3d050c4d0a2
15b18f906b7ca778339817ae6b31289687188a5cb4ca6904865544e48324686c
18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421
187574c8a3cf0026b633b356842e03d60450be911027b697e9542a650d1049c8
1b5fe5917523b0287c18a0f30935db770aa86246028eee151fe53c281d05d138
1c67a7d5bd4eeea4dac61fdb402693f5ecce11630369d396bd6ec60516bda492
1c850554971fd0815ab530813c41947b41fd5485122fcc6ddad7e52554ca4c5f
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944
1e5a886321d0e00c13f7abff03ca39fd782f42997fd34bcbf4fc93718f3670cc
1e6b480f7b684675c28af3af9fdbfa38aa03eb189057159d9ef58a59c1f04ef8
2104855248541b155f008a2979c14a6e24d809c92ccc54dc16c98dd32116eb03
217a55bff68c2e16ef6e1cb42c3afecef0253183c569e3f8bfb79dc7b02fa371
232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98
23d58172a13a810fa151cb35f5f0bee205d2294327be9d8b7172553719cf3e66
245fd92be5daab80ecdff8c423379abcbfd5b6ceba3deb73bb2d9cf30148252a
25b451f3cad26104f57800c79546bf5a40295d0cecf5623e623f4479b94d0ddd
267d973654e2487e014bb01e971a3219710ed3974bd0ae7477d69fb7b46ccd38
276e9a7ff17680462b468808b14e35c5eebbf471ac8303bd2ed0c5eadd225faa
27961ab8c37cddad89230364167c048c6377a80e38542a5ffbca600faf4098ea
27b521443caa2567c561c9a2bd377929f40cf7fb68113ccbc4b42669c6841e79
27b62f116d3964364a5054f01a59e237c576d204d47cded37d221f39beed4397
293c4dc30efea546e286c0185dce44c51099dd75f3486716f08547a8df84d6a7
2af1b8e91e1ea0f27fab2f6bac1dd1d81867b7a2a8d7cef1084fa39309e0ac6f
2d3ebc5963c3ba449fc6f11b2d5ac883abaf7dbc046ac7c1b267518e0ca5fa27
30df855503fd1c0baa970732174d0d9be85866235d99bfd2f2341be57e966a8c
3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5
319caa83ea9ebbcba230cbd1f27e850f6a57bac0dbabababfed010cdbd9d2d2f
31c1b28c2195aab6e2ebe11ebdbe1631fe4fd7481e1af41c78227affa1b0c61b
324a9c1f26949a62b89c5846de23826737bf3b14443e3f5a969b1799604a0588
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a
341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f
34caa61fc8a8d83d86b9a0f6d8b17fe3edfe249e6204b6bb59bd298bb41fdd2c
35665554c497720c982a62c92c4bdfc94445f46ce724401ba0981b3b7a17f42f
384179ee8fb1fd393558e28ea811532ea776e8cd69f9e94f379ddefb78948bd7
388c4ce7ac700d765099cb846265b5173e783e236491f03597b8a54adc676df4
3a8e766fa2c3a738d18286638ace904a163ad9ce34b334604fbb12f8a8a589e3
3d8139674dae70e3d6825845bd963841ab4ce23d55252685fe8061f6276bdc1e
3e9569df702eb478e6e7699775a0f555b64ef9e89d89a81742bc97c7803dba96
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
3ed559a849229d0ba1622b39b2343f2307a91aae5bab1f08e55c89e50874c980
40732e9dcfa704cf615e4691bb07aecfd1cc5e063220a46e4a7ff6560c77f5db
416f1794bf14d4d001e721b2bb681935c168b13c01799b1d2c7f039db2fc2249
42577d21f831d4abd1a55f6217fded0ef0b4b90aa0a1f2fdd67011978c21505a
42f24ceb01997b399d6512c9e8265f5d776b2360b7445353cb60a7475a0130be
43531e83c15a96469ab4c9157633196740214b7303c1f34cd46930a3a97bfd8f
45352935afb3119009abbfa8ed5bf7b67fc4edf64e8b718a134975410823ace9
4651fd93f167c3620b534c30bc23ae2a2e7cf742621d8e6d12553c09c388284a
468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99
48f5ad52120fd93930c6d21cf400781a4fb406231550a02f98a98e67339675d7
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4bff962fb085bc7a7d81b7a59a2dceb2a6dd7f44a6d25af7040fd62f86393a05
4c6847d6c187314e234ace1a963c78c659d2429c0790444c674b5d72180822bb
4c89e14d3c19403c9d589468af36666cd11ee8147e67018962960b4b4dfc1b01
4d4ade47e7e34a0fb1e94299ab2892a2d226f8a11fee5ca00d6d81ae663aeb5d
4d97d2f204c48ceadcc2f5b86ba6bf25987c6f7c43c8dd7fee7a2847e6a71f4f
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f4d88e24a0e7c039f02682664c5b83aaf89afc0e5e2093c31bbd23a6f4b6c39
5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f
5103b27b55207be49f024a501641c7cb93e6469073ccbe194cd5963b53716184
525e7c89461afb3f73ea7030fbceba4f9e9383570159926acee637b4f86b8148
53b99e4bde7498900885e58f9d6c383258f8a59b04389d6b54d3d4b89537b6f2
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54b5a96d1e72c83e7f67ed666929ad684643a20eea80c1910e64551dbfcb3a62
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
5804cd3bfdf7f7b00ae1f2beef50b9ac7bbdcadcb47e8c3454e8609a52096b92
582e283baa4cce4006055beb2eb8fe257c1ec5ef573a40f173b880636089e8cd
5a9863314577494b778cade4d77d719a27fca818d6091efe35b972cac31026f8
5f465103fbc289c19d4e8e2b69a5db092b99e2050809018e6b407992135ff9d3
6003a2f2c3891e74c7e2f6b11f46977551c5543bc59b3f4d11fbdacc7321797e
60056bf4f70d5edcf3ecf9d7124a462cf99852d33cf60980b969259dce057e69
60553b12e1cecec323684ec8158d0fdcc8cc22ae5ee712fc104390e70637df74
613b97a3f938c5185dc5fcb46ec9c9488f460fdf8a9765eea9f05aebe46a0c50
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
63715e8ffb3d4efab913b95b9369dc96445bde93529cdc97909bdf57a8134300
63b3428dab8c9858bfec0fdd1766207549e01494b99c89a230937546c926592d
66413d92e3b48b21f37de7968a4c6ee6dafb956f4963d0557959a3d10db2c492
6ac43ef3f239c57999c8b9358f3579302dccae849254e535b44cd3c8f4f19ba2
6c6d900511c502a6d0b97a298ecab07040eb48a8756ec785beddb35006825f0a
6cc106510fe7cd2e3a163255575eebc60d198038a9d2ac7192dc3f42d7a8f9b0
7131454e6a55a44e5ce30bacd748addad2637502648b4e123af9220c69ccde08
71e65ce4266cea9dae94ee02fad3affca7a5d739d7df7893a9a9c2daf68b786b
738c833b1971e8ca2544bb7b541c638802c160f45755ad59245de6591c0eaaed
745a085b52b8371ec6705413fca70a28c6d8bff0db480e6b124bd08c54e95ef8
77ae1f5909dd3b8c62dd96d0f21f0eb9560227fb94c96f3050b91c0dcef798db
794dc48504b6e88ec8444014ba8d432c582b38965c354a8b10d41ee73a8063cc
7953fed1425101977e823b0480db597be902d342936bc4c6ce3bb0699c0aa6d4
7a9344144d755ac52f3d8405003feb8eab3b79aebc78e330537ea10861d6f32e
7b1bfbac0178604f4dce665117d962743d2916a2a37968438f3d49d7e9c04445
7fb07880fe0e8c6a59441a5eb71aed95f6542a8c4bc1ed859984d2e8efe054e0
7ff9993d3bf21821aa4aab3b5958b4d9ba3fd3a3aa92f5830a24d3ee259f4851
81f66fb840c902b62f902bc4e27a6e3dee001d2f8babf5e767f78f16136ff0b7
840f32948f13a31acb240f2481999e70efe9eabea0d423581bb2e4f9e53aafb3
87553692241e0fb8a6deffb8db12e875a48d6408ac236b29f57840a012eb563c
879d5861c9bdf530e2c9a5194305a8753fc7d7a198fbb487d6535c994e82a19f
889f2bab730d916ae6b55451a2f2fcdb173b310e29306103ece5b4c545a38156
89aaa0ce1877279f39fc4f3451e07fbbbafadc7a46827a4d56e88fcc98a7c3c1
89ed4e12076b5eded37d4463f6fffca0b3f23f5bf60a3981859a8edb28e269b7
8b81ff8571e580de0209f2f5549026d5948bed4a084d7448ff28fe5156a906b7
8bd1387deb212ba27c6a71bda54698de8377ef85b3fe2c4f3fa104e3e4381c3f
8d2002de9b776f8982c9a1d721006eb6a8e22547b871cb522d8abd21215dc7df
8d67e93b773c993230e55a3881853d5e8d399b32fb591d845c41553c0fe8c71b
8fa78a13364fe775263b0af713b452fd1de4920bdd4ac3041fd0213d73484772
923ac60ae2b51d9cb2025f34d30e8188c5bdfb61e04f7d5c88908b56800c7ed0
9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062
9bca0e23f8982c6e459c56d67236bed10262af147cc3f18e4e1c68951d8e9c5b
9cacc351a59879d938ef01e274eca7f341deaaa666237a3de94737ccc05a4b86
9dbfcaca8392549262d507f5118955e502089926595e449f9a8690832dbd8e7d
9e2ac756b7d18a0715d66cff4a48f4ba89882b3bcec6cd4fda5455387eaff84d
9e83314d333416d003a14ff991793feefefe12184980a4f081c0465cda5dc8da
9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a28b55f41413d16c71a76b7af3ff9f707323bb3906096b85f7a581415aaeff55
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a6d36aa3d742ccd6f1ca3c76dcf885af72f7bebe2fcc001ea011a7aea2f55678
a7a580492938c753648b19da1321bf7ea66d7a2e9b1fa42058c821e268fba9e1
ab0b18ffda35fd2897523716ac7f43a29c56743632551ec20c9fdeafbc5d9336
abcfc66c4fb4bb9a1493824f5acd764bd8e06bc80a03f7cc2817159b22486ba6
ac2429c9dd60bbe0eeab4fb4322667db2a3566125b4a1d772c488381de05b9e6
ad3ee286844c46dba3f0d26e100f508c410b28f52784fbeec2d513ef6c6fda7a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1701639174cb872a535071c10f17980f509ef1588d3a06bc7f8aad5ef0d25aa
b1a7eeb7772427c5d7d2a5969b662868460cd128b228d29567f0a7ae75e1c494
b28212f4baadf3c72472e06c83eeb9f674659bc3390f8279644cc35c2b3cca60
b438fcb0b6409866bcf245a57397590528a9db351cceb09953f27f9105069895
b633a587c652d02386c4f16f8c6f6aab7352d97f16367c3c40576214372dd628
bea17c8870ba8dae9515993b5c55b65437f03f0e2672e1c3d3dbe7872dd74e5c
bf24c2885c14e10f2afdbf6a26fc1c04be45c472b579c0cb823070666ba075b6
c018d9d9a7c6716218e78a7b9e458a0a31b925d725dd2ab6d21cbd73d3489c8b
c07684aa8b5395431f3b243baad78a2ddac988833fed866fa18b7d9cb6e1fdce
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
c38f3daeed83c9c8c6c87d5a279880731cedd7aac29d3c5e44d2f6722b6db654
c921bf926ea675616cac9484850459d23f98786a28299ab280181bef5b1583f4
c946f55898889d6fb54a5d17796a56eb2c322ed460df7dd8e94f0730b7beeb45
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97
c99a1db5a8ee11a2fc13ab0544e3865f781fab4515592ff6467e7273478f813d
caba686e8a0a57536805240ee1ac6b56d9f5b5add5a8bf88fd6ff83d8a860b63
ccde397c209c50740248f2238b06088f9b3ff5d4946191e9517c410ccaa976ab
cd112948bd1c9837ad3b54daa7afa4e3c009093964a2ccde3110fe48e0c75ec0
cf906196a7c1414e11983955e101a051d55a864f2bc9fd52a453d952d92fd9b5
cff57bb539a961e5816127eb4b662175d6a1c92917effe0f943de85c35911101
d036abb9b708f36c43590e94cebe3e17bae3a2cdbc8fa672e3612686241f23b1
d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2
d3f15ee61f5e412a4028b0ebbdf44c123c1ff96f54422d4ced512943d53970ed
d469330093a2cebd898628a339df6abaf5edcb89e85769ff79840371195a7d1f
d9fd0aeda423bd39a36871759ef7b17dab3d51e5981cd5839103f990b8b9ef60
dacdec6aa88bb9571d309c295248ee5b202de625eba8aaa232f863ad9ba9fed5
db378770c0af0f809c8d1f0c2dee4c831d85530c768c9ac1960f068cc4895ac5
dbc211260f3fb81e545fbebe8be8c367ebe670a585e60e1ec58524c06723ecbc
dc27a06fff02bff8a6288746f88a5e981e72bf5c6259440b5f7aed8dd7427033
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
dfc9380de982fd5fa87d936103e90142934042a335d99676588f885df70e7612
e0b1e9c2a3c1938f32d84d4e7fbcbddc828ed5cbdb2a2d8f5c362223fa13ba7d
e0f47df7bb45f68b28b454119c52f21b8a11be6edaec103be7cccd2db4218587
e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3b436a622b2ee1610a74cbaa71436e7b59d970d310fe106aee25337ef4ccaa0
e5e28786e68ee9365dbc5f4b39fa49358367e4371322c7bfc70f7b016e7cfed3
e8021f1a9dad409f7e699457ac334653bf800464df69900237c4de1c29e275d0
e8ba49651b9ef414b0da906e022189ea9096dc0fd0f2c87b08287fa273b883e6
e99b7c0ba127e7fd8f4112c7c8fbc3f0aa0582d4f33c703d7651eb6375d9b36a
e9f4eb06811b8f2c55fe2837c64b600feb5da3ce8f747707a9aa7a4e9ddc5346
ea934cb5f0a09a318af075c2d81d855c697e7773e7b7b377aab5e4ba00ccf955
eb7a209e3af2f5e7045a326f81414b39f02551eb158e859c190a7a84db7c4d5d
ecadacb686d0540a5768dae41d50597a71dfaa8135b90f1371d4bfa266e4e361
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f475c34186022ba531ebc8bba97fc10df7e4c3ea854f314a18ab0644c851620d
f806d5eadd804055a5cb71215a33dbd0707bef14792a5134842126a75a2d68d3
f8fd679d9f44bca3f206280b3e5601ccbd0a22d9d46be815a98859729a6e57f8
f9fcf6e0bf29f819b1dfd98a5300d7efb2163381a60b93cd86b768bf18483031
fce1426766d7b9cadc525e12dd5965153a69ec29ac827fcdbf525a6f50c84fdf
ff1ea82759f4df729f7ee24dac62805f05a2fc79c7ca4cb518a072a11835e884