corporateofficehq.com Open in urlscan Pro
2a05:d014:776:a63f:551c:5660:31da:fe01 Public Scan

1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 01 Jun 2023 15:18:01 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 2dcdb6db-f33b-4979-879e-ddb6dfb85382
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzAxNTM2MzYzMzgzMDU4OTQ5Ng%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 4057 41 KB
15 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BJnyCnFzGC8UkM75CDhXeOPes2KBT8FgLy6Sxtj-pqUkqDyZQi5HNbY_ZDm9LMkq6KFYM4LZmsbpFuPI6oYDWL4O9b39IzDyUZYYTd01VCaUrOOyqlaBXTSIAlrT5OCGhiL9Rof7RDfesORkbIU2_maj1z1tndPXmvHvWj9VVYPubEfEQ&cry=1&dbm_d=AKAmf-BgFZZQBOZpDEyP03lmKNDJbg1wPxn49vTh5DtCWarMKV3I8AqDzHgPKyZAdShPM2b43RTC9jtOArGhD-xl4HjwYwRHO-dcGa9HgEew6MHCyuoZaciQwAGhFd_VnA5xJjXa3_D6Hmtyym5QUW5YtpZBqpWt_2k45moIf4YLnGFaZeHGI9eXiRCXtDvqQG2iQidR_kaLUSjVIUPpSOrOjkFM2D410qedYmjzkN7Ou6H9xOb4ALHXfUOIziHdK34NV6TwA_BXErA6CDdI2J_lldPtD7hoHrKM02QcwgOtOH98-dMie6JDNxvrBgrwNe0DMmdCs3i-5JQySedEDDs4xs6eHChzkNCquXmHEnBG-TlM3Q-7aUqRz4LwVteLxqKfeyxiaCtlTDfm7tEh7qP2stEVvjuv7BmavxD12BIYUyLvj_KB_eslJ6-o61VuN3NxOwrQPkZ4KgLg6HEUcgAt-gAyOKjZ78KKyzyTy7dhFXQj7NfHlXuVLYvwxQLJyc4Jax5YxX3UA6uZ6YyJJGzv8A-_jIfkmwYFPUz2A47AhRFse24ZS55YFfp_8tkcQw2NxxZEHFJhs5r_htwfsB-RMWl1daaDvafZdYEHlYJcTkO-ht2zBbvfI8DVshxWQzppKBnctsTzANVoPCePfK9HPKAx133zo4k2tIIGI6WKvm-iBgvbwnXZLf5NW_5ndVuchJwx1Vv_u4U8ALKp8TlSceJT4T1FUzrXPFqjITKVS7qojQzi3NNnZUdffC2eNdGVgyBBvGBg9NNBBPB8UvO4Nb8Ps3QE_Fqfu-QwXgmfBKEFqD9ibJJMF2cCOeFkPmeidUAenbzXWYzQh-LnYgc7_nrAoOPJgnMKqn6ztWn2chFVyebZAmnt5W_zFlRvqP_q_MCaklIdf5ur3qpFJ4EGQN3APwa74sJOaK4Zfb0h-WAew1dZ_CUhBwDrWmlgtCfgxheSuQCWmZthoJTJ0Hbb2q0dWLw_7KKK0tVDvUpGzeN4vRSgSYlpjtbfU8d0OLz4XqCP4baVxF_6u_a_DaLnwo6vPH08fdxAjOF0KSJB7SH1432HXpmVLAViyNQB4vRiqqiF8O4PEA7DMl9bFAg9oawNlurVlc3jim6AB5dhiX2kTCejgjnuP4g-Ao4qD9mgWiUY4GxBLmRijrpC-nwg8XnkWOqlVoA8gwi2l1cZsMQVA3_A_BYFlP5DqGV8oJqoS4fcmYfJ4PAc3lAVM2X8bWh_Zqznbngqi4CG_L3UJVS79yN6pnRS1krJ0p923mA3niNuL-7EMygYEsaDdneo1i-b0xYVAJ1Zvq4MX0pMOOr0f62tlTXT6nw-HokxyMx95HhCQRibL3jjNgO_ycUBzrL_DLQe641cB5-Sp9XDd8HlrVatK4PFehkIwbLsnMz1XAExwdGG_w0M4lNoG2zR1gn6_s7Ty7uun-R5SIFOO4FezBum0O6pHYX-ZaaL__AynmfiTXHJNSCRjrtzK922lFA1bOBI48dQ3sNu9GFRZtk7GLq4P3pJp836Rp12uT5Zb16RkU1oa9UeAtQWuSKY1-VnRm9Rlt0R2_P3-gdRZmxZhkgn9YIhHzwhz7sN6PaTLIw4A9sksZnd0uC86wBVoxVGCLmvCUlC2n_bkJG11lYhTWdfn3_hxApKkW45PFXs-2T2TvAxYAY_jYWFIUQ-I7PSl59d_eR1X9yDWGDuQr8FzgV5Y4PEIB4HiXz-uM_mGumMTiMkqW-I6O5hI-pwXFtqfCO1p4YJKTn55oCUpNnQF6iTbtru7xyGTxZYj-1akEiBAQQlIv0QdBPzy_Ea0DQSMrVvugmPULpQKZ-eOw62YeBRMNJOvQbAnYYVqXp3aTF2HSSzeMHy0FwT0qNUxWHbY--0FXFWvnyid7hUfsF9-V1Sln34G2G0Ygmk_7f_tDrvkL_sSmaPzaLd5-SMuwMsAGmTX7aqCDIlzrNoBfDdMHjLTaY8NOwWsbQjwxqa16pRhklBSRXWGFxs9sdHA88dSKYm0X3WTwe9tca1nNUKlNqfXJVRlcJEaBIXBIMtHrPFU3vkLRxnlixHHAvl9fbmULgIAvP_Ku11vqRaGF3WsBJE-RlVy-j0T84flxpJ_aDyJEOAmxlr0TyVfp8hG1acATDIFejoUH2rxckwzrb2kEyvKB9Mz0IZuC3zA0hIiWbabD_s5nQdg6NCrxi7DyUbhFMaxJt1gFkvG13jU22ZoDB2D9qOAGIUyScioluPTo-vTA2Yo4p-UJNC-Mrs2jYhM9ZIanabPBQs96lAkMpYImocUOmvdn2bX5PuhABazuBL_m1QCeWaRQScqx4P7WvCbXt9TNYtUXuKnkRRUc-Ti8EZgzPxPpRbzK8vuuhSJJRAuzj0fY8bGfZh0R5xSa8KSlJzc6zO04oR60Y3AYlu9rCom-XL7ipPx_09t3Baiv97hJfjeJTauvykfISoyd-9gQk8w_nJ9hCPPDLQq_vMfH_ITz5HBHOCWh9I24Wfe1Ws7BAyen5Iom_7MgfgtPu9Pt0ABZxrMjKjqi3zlN8-vWhTm4U9Hv5u-EYi89Q7HALmjExGWVuRJ8DRyDBZsI79eZnb1c0EFEBWQtxyuAUVuRNPe7mFltwI71iGyDQFhb8EFwU4Qt_ELhUhJzzbAet0unLG24k4-z6orBbm3va2lFCOzvnJF6AgiRrZvWgs1sSrZeo4jSgicHaDSQ9gIQnI5pBBeDR3rkAKtDmqNOTOCqDiJ9O2uT1PTGitR1n_hXQbdQIrmnTGwXW2XGLOouZ0OtA7-fPSDskwvLh4Gw5z98gE7x3xsncmnUq9J8ydiT9Zb6H6da0wmscuERYtDGmw8sHKIv18n5uo_TtzwUnrjB8JiJbjQ8mpUu5uBAYB2RHbzRdH1TlMaSFGt3TtCWaS2bgowubZSFwWY-BkvIlYtRyyZQMjdnwHj4s9KwYLMNrNv0YtNTwMFuWvdzI13TBzz-Ju3eUhRIo3Jw8cB6F-VRpQyzE0B3MGcrvx4BezYKvBVYynR2uWTUR86kPcz3oeQriTSzOgs2BvGsKwepzKxsNBSV1fltd4yQ5yPI0fmWNAH27L-l8Ku5cg05_KJZcfQSmUhw&cid=CAQSSwBygQiDVz-d5MSEJH_2Kk2lJCSD60bMitRrqYBguA5I3HRQXF1wo5sLzvO8N6W8WiKQjGQNHDZsgCNaVszS259iry30xBUZeaPKVRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcorporateofficehq.com%2F&ds=l&xdt=1&iif=1&cor=6338914320264547000&adk=1964084972&idt=189&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 20:07:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 69060
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 May 2024 20:07:01 GMT

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 8A32 106 KB
37 KB 48ms
13ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Origin: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 09:27:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21048
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 09:27:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/ Frame 8A32 11 KB
4 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-A30hyxXf3UwE2Ynecg0whI6YpIVmdHu5LyLFJxL5yhVlGV-6U72vXHAqkpeS41MS-kw_GeuH4fnyddMSA_Q1dlh4QYQA&cry=1&dbm_d=AKAmf-D8UInpUWvtvQ3hjW-JGrXPEgNTCwJhMuyk-qsnJXmToT6v_ma_WXvy6Z47oGplTY_FaKaukQXSoUEqKW6_EHg_V1sOZU3JrlkfS_Fj7fdkmn8qYj2rwpfpqEKj9ZYRE96SCxEqfM3HOk-8rT81z7rQxtPJdHGy77HAMHlUJZgvsCPjRRpK5qy9J9x_DXtzKHWRKA50rM7PuU9KI5OVdkserbAdCcXGnLWpG0Wht3ZLUKfgVH-v7tysFou8lhmmnesf-UoZkDXH_Sk4D7W94Tb-ojAs81O1pUdkHWuMwfOJBokPVxmYQJlU_RNqvAjatXX9Co-WCdjBtVdwynNki_AP3N0zgjCzILR4iAWV3IOMMtzFUbfvzoOwWA8pLew0Nt1chjtcRsOFu1WepHoBpIdrJuXsnOmBnhkARfIHGgZGTCV-T-R9yhQeMlQCO_YS64BlCsGYqcgGy1QHr5voyQW-1qCwDbQ9uBaY0sDPOH_ZB1WvKTGWgAta1pTj85OF2U3s1YN7cr2A6Rmdl3B9utJAKjSEGkRA7jZbqAvwz2TUkkLy4rTzGTwQ0O58pK3SaKrPDCK7wFX5_Wphd_RB0-X4obTIm0cXkz7HGZScAQLLpGZLye7KpceVRt76xhj7FcDAMyxpfcq4Ou6mYQJVJ5hbVQrdtnLiRpwT0uq34GSuNqFlSPEfmkrJNrFZ6frINt8Tupha6HABF5vJxLxqhPLgsnAsm5WxNXISMk0Pw-wTi1bxYnUWfZVcnXYgi1WCeclnj37vlOkncmQtJc8yFReK76OR2NfXLDo6XTLhmJLepVJy9euYaAXAfD89I26FC_9JZc4W5bePLND_O0c92qmytAlEst2v0gDqX_GM4OeW1QiQxcRy0zZGsVF-2sL6R7vT4dB1IYiS_8AxdgXzai4nXKFDIN2tYM3jlSGbWC61Im9iY1Xc46284YcCgYfh4R9bIl2M2rCLbBf7L76oX40JVDmisPr1XfPhh7nGPUB8vE3hSS7-b_E4RTDDY4w7BYptjwj_TpCO1yA1HeFG6xroCUVQLycpOxSs-Os4MY1EO0uR86wzx0xcEOrd4Oy75e5-ouBU2XSxBgRSio-a-4PTObGRHLGD5CuiC04VNXJiXAeK2bk7CxyyC4xtD_UEHtLKZzRK0omp0zTmbprfATcglauMhD73mGntgASOUrpvyWxkGbubJMdSi4uQH-cuBig4ycWzvMB4Ktepp6TFckR275Dwe7jx-fll_jjmzAv0U_3Y6AfZabtqzcUXqxmrDRoQCsoBntYrhfupkTkdxnCHLZwzGE0QLSDjri3XFG1qjW6Y60PL-Bb9aDzODC83APbIzeQ6-9MwzV6MAGH1B-ddQBaq-yguLej1KsRFoRXRiZHWsGxZ0M0X-wnz5XqgTG2K61WxoF0q9ppnUCX0pusQ6R-bnK-zzZfQYm-S2jLMboAq4sqD9PvBnAKc0M5lxIdeyQmEOnvPwS9luXl6Kxth4w9LqJaF9xplh4LxKpqtQxOZniHf-NAq1iPV5W4KVLvpgnu_njs6sqf9RAqSfLcA1QzWMBTfrL1iHrJtU2zfrXK6qICqZwVdJJOIkigmp5accDBcAcTbG0oJQkUXBNfzbpX1CtbsLK8QbaVdfR50PZpJ6s9OkOMTgqc3VD5VH_JEYFR1MoRp5Gr0-0Fi4QNbo7yF1qEG-96suT8lYGLeycqSp3ojfizLfxWNQu95Tf6cd8Lih671JkuR7pwUy_RL8BCPYylLbF4T-PZjZFEIzD8UUUwUwP54KJFJiCxX8KuTBJEKQsbdqxFwK9hKIUshApu94Nbx0ok54PWh580czucVkkcd4uNdsuc-ZhCfEyptmPyABz5_zbKy6Hw4mcMtwDk5ao1AGRo7QgDu02vEe9AbspziCB_cP7KBT-S19uCj36TG4xk7ZU0us3LWi5DvRmrBWwcYMYufJeDoXXJeQoaJOEwW7KYnfE_Bnm3THPjfoK3ByB8o0i69ORpadzjZGDBv3sUzQuGlimyrgAipG09p0UlDShQWbQPeWtJpfyppupeIY2xfZl70b_5khuer2ON2WYittJWuGS9lv9a8ka44vE-7uySDRD5By6q2Hikrk3sZibHJAdFPaQbZafL300fRHV1J_etk_XBJb6VUxu_-8lwiCtU7hBheosv4b3WnJJXXtQxm2s7x0LYqDUf2L18EbhfdQSJ3p3ERrsLR27A_MsZO0GWufS9nOZhzPp4WLA8RRqlL-eYzFbiQa1Qm4b9TKzcarHNfDdBxHFnHM_JXxQdBRId0dJIAy0ZP-L3Jjo6MWKF5GVRKW7WgNoZUhpHaBIllyfL0UDxM7wtsU69XYqiFXG9A8LfwLYzPkW2AzcwEB0BYCVYP71aJQHRwvZTj7FzCZPfa6Vz8UO1R494WAOhnkBbHz_JLCQwTdivJPpUO30qh0rXHk2NHc9T8UvRNhaLj54WBgyND4nWNckb_1QxT3N6K6Jmu-ub3cBzmyXg2DG_EQ7LAHnXvcsMjLNQplBy_tOMDea-x2dVoGrlObpHowTLP0CiOlCtqpEof30bFv6YtFTE4ymuvvHNvdAJ7ZYwY1wZ0Ov-M5c3xs6U9s2QG0ljShEReaQc9IhylWmrICewOow347b9qwMOLwHrQL4CllcZ97_xEo_gpEALoxG_UGfijHRwZDykltT3qHGTY51gthsivAFZ3ASUpky6JCd_V5YNgNSreUHcaC-iQvxaFoK_42TzLs-6LdhAaXGNYttC3VwREVgd6yOEg3anSkK8dngwIhkPvEZBwStORKGlKw4BRapFsef9_jDVBveCVaXC4XadAiAhh96Mfh8MpCAvU7SEWLGy0lkuJc0PeerhRCyq26CSvKQGFffsr8b5dLi-7QwbsXLW5Q8pYUHAZ5QsiVxoAqco3wJ4m1PpuXbchr8EWq9ZxafuW2GzeR3mYhmk7bqmkFy81jvjDK9m1nPJxMKxswu2dXkquOTRX7S5KTQFxC7bhStjQuFAW3onOtMFDggGbT0NiaeRjD-e_DgHfoKc8nk_DJdj1z4vwWAk5vvIesY8IOIIkOrm1n-SNbTuzo7VEant6sZnV1HbGFKtPufSfLysm7-_T_DPu9kC-qmKFXOJmE71eV2H2iiGDN2Eiaogll7WIRUNrbXEoU1w93nW6v--_Pu9c43Cpkz-nNHrWh89oWK8vk89-KxxUcPlNoQgGVb_0ZUmZFjboi21YAFBB11eDadUmZGqpdIGagoqxINCHv-_kFMm2M3eTBzw6xNTX29v3jN53Qvzrp5ePawDD5bnzfc_cPZ8OKcJ9X3Ud1OUR2LMxUb8l8qLQcXeUH8_byQWZw1M3Qc0nM-X4m6_qX4P9CaxcsfS2egKhC5AFXbY3vOTNswbK_QLdQojk3zMcth-i16tTpZ-4mQHBqJ0I-MbrSN9Lm-zEENaQrJVAE5jABdSUNERuCSw-9yZuq5ntpLkabifAP428CcFYJQ4L19h2LeRxINRu1E1LLWXaiGgSIDso9mN_XT5_XmxGcLxnpiqjRbIq1e94OLNdGm9UsTUN5IQ6t8IwAsPi55iLO1oCu-9ZlucjVqdWaY7xzJKjNQtYNaiXGNYbQZ_2a27RzXh8Fu3gbGAmT4yCm6P9WhU6FNS7F9SNvPe4kUZQnJ_bySyV35ZymP0oWWA3meI25mM_C34Xwsg7IuA&cid=CAQSSwBygQiDZpA2PJ-OSLwyi0elo-zoStioFdaXUH0fcLQuumxdKcZVyTlcPAwrhZEwpAlyF8Vxm1jMHEnXaCFsAqBTLZ2ZqPxE6lcKPRgB&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcorporateofficehq.com%2F&ds=l&xdt=1&iif=1&cor=6191264625861048000&adk=250412560&idt=139&cac=0&dtd=21

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8017866a6744d35f26aa9da389e9771d40bcae3ee65df4c1b5e16e57b09fda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4869
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 6053914914909336730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:52 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/ Frame 8A32 29 KB
11 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4866
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:55 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 8A32 41 KB
15 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 20:07:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 69060
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 May 2024 20:07:01 GMT

GET
DATA 200
OK truncated
/ Frame 8A32 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d7f3f48392dd35de0bfea60011c3260b6538063ce11a923e66fbb7b1131d870c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 406B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE6YKHA0xdqLGTiolyi6uVk&google_cver=1

43 B
766 B

9ms
9ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE6YKHA0xdqLGTiolyi6uVk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARivm93gATAB&v=APEucNVkkjkQ1bUcp4vuVHt9xx-Yp2XiigH8zDxMrCe1ajLjGBSRHV70mh8OQqb4-a2GcuVnyKqWKh2nsWUQ6Ee7qcnQln38J043L6Js25IlwFddyFRBXs1DWL1g7T9mEulVzl-s3RHv8XF3_jc7lmuMazrxwDbuR_KwjoMPZS50mNa2H6_5YmR4fLWWZYmJBx62MN5E_gZrX_q4XeZi2BfRtUsMGP3Upg
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:18:01 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=496
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:01 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE6YKHA0xdqLGTiolyi6uVk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 406B
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZHi2qRhGZ3FohZUGusT4AwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE6YKHA0xdqLGTiolyi6uVk&google_cver=1

43 B
632 B

7ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE6YKHA0xdqLGTiolyi6uVk&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARivm93gATAB&v=APEucNVkkjkQ1bUcp4vuVHt9xx-Yp2XiigH8zDxMrCe1ajLjGBSRHV70mh8OQqb4-a2GcuVnyKqWKh2nsWUQ6Ee7qcnQln38J043L6Js25IlwFddyFRBXs1DWL1g7T9mEulVzl-s3RHv8XF3_jc7lmuMazrxwDbuR_KwjoMPZS50mNa2H6_5YmR4fLWWZYmJBx62MN5E_gZrX_q4XeZi2BfRtUsMGP3Upg
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:18:01 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:01 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEE6YKHA0xdqLGTiolyi6uVk&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 406B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEFdrqPobvgbMPiJeT9Fr4TA&google_cver=1

43 B
1 KB

30ms
30ms

Image
image/gif

37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEFdrqPobvgbMPiJeT9Fr4TA&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARivm93gATAB&v=APEucNVkkjkQ1bUcp4vuVHt9xx-Yp2XiigH8zDxMrCe1ajLjGBSRHV70mh8OQqb4-a2GcuVnyKqWKh2nsWUQ6Ee7qcnQln38J043L6Js25IlwFddyFRBXs1DWL1g7T9mEulVzl-s3RHv8XF3_jc7lmuMazrxwDbuR_KwjoMPZS50mNa2H6_5YmR4fLWWZYmJBx62MN5E_gZrX_q4XeZi2BfRtUsMGP3Upg

Protocol

HTTP/1.1

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:18:01 GMT
AN-X-Request-Uuid: 990f2684-48d7-41f4-8f68-2e710597d034
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:01 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEFdrqPobvgbMPiJeT9Fr4TA&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 406B
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzAxNTM2MzYzMzgzMDU4OTQ5Ng%3D%3D

170 B
188 B

25ms
25ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzAxNTM2MzYzMzgzMDU4OTQ5Ng%3D%3D

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 01 Jun 2023 15:18:01 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: c021e071-a6e7-4034-a560-0b4f278c65ab
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzAxNTM2MzYzMzgzMDU4OTQ5Ng%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame ED32 22 KB
8 KB 16ms
14ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 69059
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 20:07:02 GMT
expires: Thu, 30 May 2024 20:07:02 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame DA42 22 KB
8 KB 17ms
17ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 69059
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 20:07:02 GMT
expires: Thu, 30 May 2024 20:07:02 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/2417224180093824435/ Frame 9E37 16 KB
6 KB 65ms
14ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2417224180093824435/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1acea4b816c324b116939ce1c423bc71857c30c8ec8dae5a6989b98d648054e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 148793
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 6014
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 30 May 2023 21:58:08 GMT
expires: Wed, 29 May 2024 21:58:08 GMT
last-modified: Wed, 08 Feb 2023 08:26:03 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8A32 0
0 107ms
58ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssSO8LKIK9PPo5mtWdoGWYO0Ayiq1bWwYtnD-2oSCzZ1KmKDU-6xhsYpx5O6lez0eaN4bJp0w4yVhWsgcP0bq6NEOEQsS8l3R28Xv_8dm_Q_VJEYaIZDzwBKGscmFHZIb0FmtakzgWox93WZUAZYk0qt0L5nFMHA034OMxEnfmgyapMWx4m5U8Jh6UJQXkjP5P3g_eOlJOucjKepUCXLVyrs_mdydOKRzVK0hGblFkKvhGt8X0uzvUUWD8ohh8ffrUqewns5Ax9xkyYrdUhyWliXgOHWsAjUxPIgvWdOfs1dnjZ_Pf0tJcZncHcuv0BDGm_BTLJMjDxKBEv2DGBzdRUi6t3iNQnWQ0vK25Z9nnsuntfmNuFsEph9BBIc4vXkF5jjrLQfIhbYdVyOvbz-1ekJs_O63qyOrohGXXLwI_jOZavKLl2O23Cs620f6BeZXbQFXR0sOsahloizI8rh0i0eU8rq4-BxOWF5V9VYpXb95F-V2WPojZvOtYz7aBNAQ2jOztyJNrqpzoU-QhaaB-Eo-RiGZw5Xdgi6df2rOEK276V67-Vy3PvLDmOXNhmH9TGOEBbYW_ijQBcvQFugRS93sA0vcnkbj-_eWKEegXXwlWWio5XmpS6koXi-6s8kF5ga0bcye6cc6JGCe_WKyfoIcipqDZiYpAM_V_BZwZAJdwoFnDkFh7tSGWfbEA6IfbASk9ODmJ8086y386GoBi2gyLYr0Xak5ACxkDLApwiDJF3ejA6OIbik1xs01cEcHuZGdEmnfuIQUnNJ4M6Sd0vqBshgeOsefVccN71svIjQqv7I1aaYtzztWfDTTEJiS7pqxpEpYdHn15mMQMxkxZSVVNn18nlxZzp55PgIUwYbFIRSGBAMg_5LZPHOdtBrN0rzqtq5LT0Faww8guTlsGslxJ_u5ranJ750tSSpwyWEIV_jbde7x2NmxV2-skril2HFT9oY8W4GKcgcpaYkWj5QJNUZm0Gr6cR0xIWWNsszokHCRJftNRwgJoGjo6sTpuD3cVKtdficH5AZ3KTllmOSO8uoONUyVclSFs3H-clWX1OSe1Jm3iL8VIsdesbxnz3t-vwxbCZe3BUYQLJilz11inc6bvugtfsa3GbDkWWS2dla42gTyxpqDBvCptjr1dpkejzxiYGgfEncxky8vNVH3XWbMz9_6w9jLAGCjrmfuZCzow8mHntYLdqNupQGsZJHbMfsHGVx-moO5g7GQuB_w6e2RgeFEp-F9gFKwRg99Cyh39U388O7VAkcJrVhzUMLFeNcGRR0RAy0cSNHj84TDVvyaafLnxr9IT4vowC1Mzz-rHosJyH06Qmx6ZCecrxPagIg2RH5QdStgxg114cIw&sai=AMfl-YSUQVFoMgnSyNnQrrAv90iNz7zQd9sqXHlMix79lOLLOqO8oUSeN5ZLWeYwjTZ2WuWK2Hb1Tg7xuD4eirYaXIdPVHgJ4nBh1DGYjFrZbnjE-023OCIg7hy_XzS6lmAuvbIpSr-lHYybUMCdleW6FS-9W2Cs81b2W1ZDsFokRbo21fKWk8dqnjgvGt00x8A3XLC5W-KjV7e9ojJ8nns1U4BM39-DIZUzIkowKLAoXElJIyKBlghUsXFUIl6RareRTK62G6uALo1lAxszEWwzReqh4Rwc_oly&sig=Cg0ArKJSzDo4x2euOoDcEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=111&cbvp=1&cstd=102&cisv=r20230530.16746&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-security-policy: script-src 'none'; object-src 'none'
date: Thu, 01 Jun 2023 15:18:01 GMT
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
cache-control: private
access-control-allow-credentials: true
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:18:01 GMT

GET
H2

200

adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame 4057
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/1135760/69474490/xbbe/creative/adj?p=APEucNUgEbglb7RqZqb6PV3DcLAB4XDFn8vLSAe2HnuScDp2WweONOg&d=CokBAKAmf-DrEeaev9qZC_p4h4mGx0YrzrIj9i9tmi8CtBS_mzA-m9kEpbvLekg...
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNUgEbglb7RqZqb6PV3DcLAB4XDFn8vLSAe2HnuScDp2WweONOg&d=CokBAKAmf-DrEeaev9qZC_p4h4mGx0YrzrIj9i9tmi8CtBS_mzA-m9kEpbvLekgiNInAbu2K2k-XkAyrPZr1nHziA...

69 KB
24 KB

136ms
50ms

Script
text/javascript

173.194.76.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNUgEbglb7RqZqb6PV3DcLAB4XDFn8vLSAe2HnuScDp2WweONOg&d=CokBAKAmf-DrEeaev9qZC_p4h4mGx0YrzrIj9i9tmi8CtBS_mzA-m9kEpbvLekgiNInAbu2K2k-XkAyrPZr1nHziAIpEY20K5EY6AqntEZJmzzeLjhUb15dqrH6pHSqnq2d2S4ahEkgVOyvZn0YnuWzPbp66AciXaOLdcJatNd86ExUqMuXtF6IhSAQSqRUAoCZ_4EOYMycbAwMEbiRtDr_AK6z0l5A8KV9BMoJoLgV0VLLlq4al4xh1DI2lAsP9b8Niks6hkxmQ5gZzN-lVi0tlYXeSZwi8phlOYtDotPLbeF4odht9guzfT1BkqHKhlTk63nfjtsQZXCoHgIhWUMa4rkrnnqS0I7CdABy5At6MbFmTFbtk35F0zrzjENMbM2kvA7MDX4ryiELU1OfPq4gnitvp0J7LbRBAgbkznd1_Kr1nJy9390vyOY9FyB6Puj_MEtDqcIug-lhcLQUsSjQ_ciL3r_520cc2z7SSthuaWkSkwTxza1KlgsPcld3CXixnW0YmRF4vU5azt43S-Kw_s4OV9mXxOtCVgYVDCSG7iDwmvlA21fA-hEdOJyhYlV6F5yTVrK1aH_oTTpLD_Ni-H-3X-uIgzzqmYBDDKxg9dEiOBYsSwcqNRfQH5bb114y7EA4ozmYnFlGvBJrgpT4RW6iEJGg_j9sAdnOMwhdzfrlBFacjV55Z0kdeyJimktlTMdya1XNK0CyMCeC6XLycqp8PvmFY_8CLCRa1Z98LX71pML_77wf1DPljtufZG-jCQNOqI6q6MN0ZogzdfCl4KBWaENzfQEB2Q-BUEcW3SEV16XDWzNOwCwQ-iAAl9t7tHpFi9ZgpAtQQjgSnXdyPTfhQlPriK-brmUHIUoflFtdTfDBJW4v3C5MdeNGZ5l00-4krMfMWuf6KNnHm--RfzRkwBtHQeBDP4pkAAqbbwqSI6e_rQ1zRJa2Y9pow8mzgRJ1idLZFb0FiqvEGD0Bg0gS7JNg2up2UatJYM5L7QB42kxtLg30qw4ZLf0hPtAp5it9YRIw6DNn-YK3ZvfZLWPBSYoY0Pzew8Tc9s6zb-p3Fe0XY3TrDIcRlXOkw6OmqniVVqvPAj1s1EVVPKEGVq4HrPiGo5f1-E-O4z-5YbmJAW9umDDTk71aNFY5mkpcX84Bcb3EQR_H8pqjvUUO8wrcfyDElq0r6y7Xi9Vp8hg-TMo_fpXTL11zsaRioB3W2IswBPvhNJJ-ks4fisvilZ0MORETxouFUBUFtTNwhuHyP4zwAk7_QczJXHklfVJ69o66l0TZ6dWF0QJzaIq9Y8Cy3F1yuRiWnUVBF7aK0cvm3hCGOAtk2v5j_4g7w2vS1PxuQGTXoEITxUlbYaAoXkx5sAdV4Q36FdyW36nGFDSKj7VtUOdapcnZSvfPS6wVvhCWX_QywVIUVufKydTa84JMvDI81kCCBH16bkc5-WgfG9q3j7X854Au3jqLax7HUssFQxGTS1_1GHdvaMahdXUVhnVCm--lu3VI71WlbymOIKjfgAScipHXPdIwCkVARCesHe41WxB2XrI_VuXWkzkuHH3XAJReqNu5qJuKsNXfOBY72z7yOJFHtLFDaR3m7CZhYUmVS971J3-c6RxHMevuExDLrhB_scjhSpJloCmjH954P0-X2IhdIaYHalov2PaBHuLBIJUUJehPeXXxVePQ0wXTaRXveiNkbnxnkc0MrZJ_GqLD8jGPe82yTH6WneI2Dc68-1ow5IzAK_UhnvX06ON_Tns6m375zKhlRbSRHzJLyqpTd3bw8y0eeGgkCnxo0AeEZ06dO4KSwKVpbbojhfKq6bYR1r-JBfNzRYWKkQ3qUZ_HUdvk-9QA69XBo_lPNBRPZsAyA2st4rCaXf0WnIF0Y-goyDfe03vCJZiJEyRbD6JLkd7TBbTyldUNTJ9nU9mnBxazWJb0nP8HjfjwMSSwUlNgVAn7Le_j2jlmXKrek-VMltA3fqBfwBIKDGO9L-fM-yETuMKQVtRWtiBdLqL7GT9_8DDQtzo3vcmUeAQf0AtUNyZU-uFw1nnTXW3rgCx6jgPQ_coj11q9ztrvo7xJsHIxSUhrNQyiCfky45Pyh2ECg9yGBA7U6ciSfwHPRWQtfp0gz7aXM3EctFHm4b6oXs64uXBGGfG2wSWhBKs9kQak4MGtVY1NbhTd6e0MVb7bRjWzbF9tz4U4hynXM_6uM2WHge6aJijYlHr2KXn5W3PtzJkbkaHHMTrZ6XewsWNaNlDpw0yYlHoU9wSWaxGYr5x9XcTUGgHfwkddDdtB1Z-6BBvSfovoT69GJS73BSWcrv28jX4dwSlcLPjigT9UVAd0CM5ym1Xx0wScWxZnvTUTvAle-HcWUKChIukaKNG9C2r-h8xvL1VBGSZL4PRhfokNw-Pd2HgK383qVykUFYVnVOY3ppfHDFCf3WZG1gYja7Jb9QnNF0pdwjTcDPTWYQtfRH9WVZPN4_iIzfHJlwB7hWBX8zfKvbcayV5UQSgab0la3AuJuFQxd6czF8FxIs-jwHjJ9xWoiYcQQKsxGGlan6fcvicu01AVVwmci2TkMWStJ2qH7c4AXYHGGYBzWI6KqPoVad9AvfUkapKQCBtGo5AJ_Zi66PAXjIKzC3835OioA8158bnEuyxu1RlhGfuU6l7qly0FjXo8IDl0wE2usdoGhkEwUDKb_7gXw8VOtaDboxk4ml3nhSXu1on50xRQrcQ6-ZRwKrn1Yd91gqObrz9DDEqzxtja34AWnkLCJmtHdfC_A47-B3MQT5ZqsegF6iFKZgRWyuHIpiBW_6us7RqB3oUpYyYCL6ef7_kdODTUBDrYGgF4R_k-595R-U8jCSTj5S3-1uOqJBNGqtbzG0cN58xiFu1__hRgmv9C3Wgg53NcI5pDv69YMrrQF9Y8EhUsrgdtIvKKMXwCSUHAkx_BcR52nPbPgTw0FlLC7XB1rN4oaPGq9Kq88j_2298NlBrCTSiPzGNcmgwT1uy-JLsrc1XROP7sNjo5ICsSmO6bsNAhxZwjbvrzoOBSrfCZvGIX7Gjz5RHZPrA2DnQjWUTbNij2Qt3SBrskqiWUQL2kx10Jq1xQnuh5SxUsCI2y4kAtoeGqYglbkxHvCuv-cKh-60XKOk_XWPYTSr5aI9ZbFQ65lSYvC3jfQHtrFnHY4DNS-DPtFvKaarysIBuXWx-y5wCLagnRtgQGM_MudKp_d81X3WtV94amrxf35LQ6iYJ1nHGiu64RiWgT5xBuJ7ignmIlmeeq3l6DE5nkV86P6mUZCcvX4CJQOOHOzfJ79nTaUD05a7iKgdzqp6ce3nG5VqMqXZKE2DK7yBiMB4SgTa1xgr-3u23F3RtNrA6svHyYfyYf_D2v_Lt-IJuArYECT0lKWPntxB3gPeDexet4w78FcZxYN2NgvaQob1QokSqWbr1cK20qdVA8KgSwMtDsk2TI9luHaQJeg8_PIzc5YNpaFp-60rS8ylcYCRTWSXReEnR2R8fneR__b9D6TREzleLGx2h4EwrKo0tuso3FgHVaxJOgKvwvQqorwUkgmIRakg2GmUFSnsMEMCbWh9fTBlX37iKnZZQUnnQlI59rO7-LyAl165zUrqM5TgGWXFy-zabhHkBfB95SVFceJpcBa11841wAXoMsTkJjxSmxv85w7nuzmgocBaEpWdVcoVuuTXh1HIf_UPDUD_xdBfbA5j2pRlQDUZ6obtSzGdEst_Y7J_jORZrBzRz18KGT2hJfdPzNNGDe9qxHkZZwXCARdsNK-TTC7CtWR55osKThFUWpn7084dHzH1I-ctgqOX2NsU6fiNqoOAkFcaRpRCAQSSwBygQiDVz-d5MSEJH_2Kk2lJCSD60bMitRrqYBguA5I3HRQXF1wo5sLzvO8N6W8WiKQjGQNHDZsgCNaVszS259iry30xBUZeaPKVRgBYAE&bundleId=

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

173.194.76.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3e051ab1a4ec2dd70f3ab9579ad2a6cc31d6c7d7ee6770fba402ee0585b5b9dc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:01 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24144
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:01 GMT
server: nginx
x-server-name: app12.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNUgEbglb7RqZqb6PV3DcLAB4XDFn8vLSAe2HnuScDp2WweONOg&d=CokBAKAmf-DrEeaev9qZC_p4h4mGx0YrzrIj9i9tmi8CtBS_mzA-m9kEpbvLekgiNInAbu2K2k-XkAyrPZr1nHziAIpEY20K5EY6AqntEZJmzzeLjhUb15dqrH6pHSqnq2d2S4ahEkgVOyvZn0YnuWzPbp66AciXaOLdcJatNd86ExUqMuXtF6IhSAQSqRUAoCZ_4EOYMycbAwMEbiRtDr_AK6z0l5A8KV9BMoJoLgV0VLLlq4al4xh1DI2lAsP9b8Niks6hkxmQ5gZzN-lVi0tlYXeSZwi8phlOYtDotPLbeF4odht9guzfT1BkqHKhlTk63nfjtsQZXCoHgIhWUMa4rkrnnqS0I7CdABy5At6MbFmTFbtk35F0zrzjENMbM2kvA7MDX4ryiELU1OfPq4gnitvp0J7LbRBAgbkznd1_Kr1nJy9390vyOY9FyB6Puj_MEtDqcIug-lhcLQUsSjQ_ciL3r_520cc2z7SSthuaWkSkwTxza1KlgsPcld3CXixnW0YmRF4vU5azt43S-Kw_s4OV9mXxOtCVgYVDCSG7iDwmvlA21fA-hEdOJyhYlV6F5yTVrK1aH_oTTpLD_Ni-H-3X-uIgzzqmYBDDKxg9dEiOBYsSwcqNRfQH5bb114y7EA4ozmYnFlGvBJrgpT4RW6iEJGg_j9sAdnOMwhdzfrlBFacjV55Z0kdeyJimktlTMdya1XNK0CyMCeC6XLycqp8PvmFY_8CLCRa1Z98LX71pML_77wf1DPljtufZG-jCQNOqI6q6MN0ZogzdfCl4KBWaENzfQEB2Q-BUEcW3SEV16XDWzNOwCwQ-iAAl9t7tHpFi9ZgpAtQQjgSnXdyPTfhQlPriK-brmUHIUoflFtdTfDBJW4v3C5MdeNGZ5l00-4krMfMWuf6KNnHm--RfzRkwBtHQeBDP4pkAAqbbwqSI6e_rQ1zRJa2Y9pow8mzgRJ1idLZFb0FiqvEGD0Bg0gS7JNg2up2UatJYM5L7QB42kxtLg30qw4ZLf0hPtAp5it9YRIw6DNn-YK3ZvfZLWPBSYoY0Pzew8Tc9s6zb-p3Fe0XY3TrDIcRlXOkw6OmqniVVqvPAj1s1EVVPKEGVq4HrPiGo5f1-E-O4z-5YbmJAW9umDDTk71aNFY5mkpcX84Bcb3EQR_H8pqjvUUO8wrcfyDElq0r6y7Xi9Vp8hg-TMo_fpXTL11zsaRioB3W2IswBPvhNJJ-ks4fisvilZ0MORETxouFUBUFtTNwhuHyP4zwAk7_QczJXHklfVJ69o66l0TZ6dWF0QJzaIq9Y8Cy3F1yuRiWnUVBF7aK0cvm3hCGOAtk2v5j_4g7w2vS1PxuQGTXoEITxUlbYaAoXkx5sAdV4Q36FdyW36nGFDSKj7VtUOdapcnZSvfPS6wVvhCWX_QywVIUVufKydTa84JMvDI81kCCBH16bkc5-WgfG9q3j7X854Au3jqLax7HUssFQxGTS1_1GHdvaMahdXUVhnVCm--lu3VI71WlbymOIKjfgAScipHXPdIwCkVARCesHe41WxB2XrI_VuXWkzkuHH3XAJReqNu5qJuKsNXfOBY72z7yOJFHtLFDaR3m7CZhYUmVS971J3-c6RxHMevuExDLrhB_scjhSpJloCmjH954P0-X2IhdIaYHalov2PaBHuLBIJUUJehPeXXxVePQ0wXTaRXveiNkbnxnkc0MrZJ_GqLD8jGPe82yTH6WneI2Dc68-1ow5IzAK_UhnvX06ON_Tns6m375zKhlRbSRHzJLyqpTd3bw8y0eeGgkCnxo0AeEZ06dO4KSwKVpbbojhfKq6bYR1r-JBfNzRYWKkQ3qUZ_HUdvk-9QA69XBo_lPNBRPZsAyA2st4rCaXf0WnIF0Y-goyDfe03vCJZiJEyRbD6JLkd7TBbTyldUNTJ9nU9mnBxazWJb0nP8HjfjwMSSwUlNgVAn7Le_j2jlmXKrek-VMltA3fqBfwBIKDGO9L-fM-yETuMKQVtRWtiBdLqL7GT9_8DDQtzo3vcmUeAQf0AtUNyZU-uFw1nnTXW3rgCx6jgPQ_coj11q9ztrvo7xJsHIxSUhrNQyiCfky45Pyh2ECg9yGBA7U6ciSfwHPRWQtfp0gz7aXM3EctFHm4b6oXs64uXBGGfG2wSWhBKs9kQak4MGtVY1NbhTd6e0MVb7bRjWzbF9tz4U4hynXM_6uM2WHge6aJijYlHr2KXn5W3PtzJkbkaHHMTrZ6XewsWNaNlDpw0yYlHoU9wSWaxGYr5x9XcTUGgHfwkddDdtB1Z-6BBvSfovoT69GJS73BSWcrv28jX4dwSlcLPjigT9UVAd0CM5ym1Xx0wScWxZnvTUTvAle-HcWUKChIukaKNG9C2r-h8xvL1VBGSZL4PRhfokNw-Pd2HgK383qVykUFYVnVOY3ppfHDFCf3WZG1gYja7Jb9QnNF0pdwjTcDPTWYQtfRH9WVZPN4_iIzfHJlwB7hWBX8zfKvbcayV5UQSgab0la3AuJuFQxd6czF8FxIs-jwHjJ9xWoiYcQQKsxGGlan6fcvicu01AVVwmci2TkMWStJ2qH7c4AXYHGGYBzWI6KqPoVad9AvfUkapKQCBtGo5AJ_Zi66PAXjIKzC3835OioA8158bnEuyxu1RlhGfuU6l7qly0FjXo8IDl0wE2usdoGhkEwUDKb_7gXw8VOtaDboxk4ml3nhSXu1on50xRQrcQ6-ZRwKrn1Yd91gqObrz9DDEqzxtja34AWnkLCJmtHdfC_A47-B3MQT5ZqsegF6iFKZgRWyuHIpiBW_6us7RqB3oUpYyYCL6ef7_kdODTUBDrYGgF4R_k-595R-U8jCSTj5S3-1uOqJBNGqtbzG0cN58xiFu1__hRgmv9C3Wgg53NcI5pDv69YMrrQF9Y8EhUsrgdtIvKKMXwCSUHAkx_BcR52nPbPgTw0FlLC7XB1rN4oaPGq9Kq88j_2298NlBrCTSiPzGNcmgwT1uy-JLsrc1XROP7sNjo5ICsSmO6bsNAhxZwjbvrzoOBSrfCZvGIX7Gjz5RHZPrA2DnQjWUTbNij2Qt3SBrskqiWUQL2kx10Jq1xQnuh5SxUsCI2y4kAtoeGqYglbkxHvCuv-cKh-60XKOk_XWPYTSr5aI9ZbFQ65lSYvC3jfQHtrFnHY4DNS-DPtFvKaarysIBuXWx-y5wCLagnRtgQGM_MudKp_d81X3WtV94amrxf35LQ6iYJ1nHGiu64RiWgT5xBuJ7ignmIlmeeq3l6DE5nkV86P6mUZCcvX4CJQOOHOzfJ79nTaUD05a7iKgdzqp6ce3nG5VqMqXZKE2DK7yBiMB4SgTa1xgr-3u23F3RtNrA6svHyYfyYf_D2v_Lt-IJuArYECT0lKWPntxB3gPeDexet4w78FcZxYN2NgvaQob1QokSqWbr1cK20qdVA8KgSwMtDsk2TI9luHaQJeg8_PIzc5YNpaFp-60rS8ylcYCRTWSXReEnR2R8fneR__b9D6TREzleLGx2h4EwrKo0tuso3FgHVaxJOgKvwvQqorwUkgmIRakg2GmUFSnsMEMCbWh9fTBlX37iKnZZQUnnQlI59rO7-LyAl165zUrqM5TgGWXFy-zabhHkBfB95SVFceJpcBa11841wAXoMsTkJjxSmxv85w7nuzmgocBaEpWdVcoVuuTXh1HIf_UPDUD_xdBfbA5j2pRlQDUZ6obtSzGdEst_Y7J_jORZrBzRz18KGT2hJfdPzNNGDe9qxHkZZwXCARdsNK-TTC7CtWR55osKThFUWpn7084dHzH1I-ctgqOX2NsU6fiNqoOAkFcaRpRCAQSSwBygQiDVz-d5MSEJH_2Kk2lJCSD60bMitRrqYBguA5I3HRQXF1wo5sLzvO8N6W8WiKQjGQNHDZsgCNaVszS259iry30xBUZeaPKVRgBYAE&bundleId=
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 7A42 91 KB
23 KB 77ms
20ms Script
application/javascript 2600:9000:225b:2c00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225b:2c00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 0f14828b89630f6555c6372e13fc999a.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P1
age: 21858105
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: E01RcYIX_qA7vVECo5KvzKLpKRjloPmX4rxQDOrjJSFBCskZJfSGhw==

GET
H3 200 container.html Show response
4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 5A3E 6 KB
3 KB 13ms
13ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305300101/pubads_impl.js?cb=31074979

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://corporateofficehq.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:18:00 GMT
expires: Fri, 31 May 2024 15:18:00 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
62 B 11ms
11ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTE3NDkwNDIzODg5NjMxNSIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImNvcnBvcmF0ZW9mZmljZWhxX2NvbS1waXhlbDEiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjk5OTksImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjAsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjpudWxsLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoiYWRfbG9hZF90aW1lIiwidmFsIjoiMTk1OCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:01 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:01 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 4057 43 B
215 B 343ms
99ms Image
image/gif 2600:1f18:1aca:4281:ac44:4026:62a9:ef97
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1135760&asId=dd20371c-5f63-8b87-fe63-2d3c1c99a7ef&tv=%7Bc:eiEtOw,pingTime:-3,time:111,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:39%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:112,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:39,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B105~0%5D,as:%5B105~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tFWuWM9+11%7C12%7C13%7C141%7C142%7C143%7C15*.1135760-69474490%7C151%7C152,idMap:15*,rmeas:1,rend:0,renddet:IMG.us,siq:40%7D&br=c
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:ac44:4026:62a9:ef97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:01 GMT
server: nginx
x-server-name: dt16.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 4057 43 B
215 B 338ms
99ms Image
image/gif 2600:1f18:1aca:4281:ac44:4026:62a9:ef97
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1135760&asId=dd20371c-5f63-8b87-fe63-2d3c1c99a7ef&tv=%7Bc:eiEtOy,pingTime:-6,time:113,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:113,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:39,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B106~0%5D,as:%5B106~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tFWuWM9+11%7C12%7C13%7C141%7C142%7C143%7C15*.1135760-69474490%7C151%7C152,idMap:15*,rmeas:1,rend:0,renddet:IMG.us,siq:40%7D&tpiLookup=ao:corporateofficehq.com*&br=c
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:ac44:4026:62a9:ef97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:01 GMT
server: nginx
x-server-name: dt15.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 adltl.js Show response
s0.2mdn.net/sadbundle/2417224180093824435/ Frame 9E37 30 KB
11 KB 20ms
20ms Script
application/x-javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2417224180093824435/adltl.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2417224180093824435/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

11961a36e2d6b42254abd7d1486669ee9272eecdbf729e8991cbc869dc66f977

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2417224180093824435/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 23:26:41 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 402680
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 10853
x-xss-protection: 0
last-modified: Wed, 08 Feb 2023 08:26:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 23:26:41 GMT

GET
H3 200 adl.css
s0.2mdn.net/sadbundle/2417224180093824435/ Frame 9E37 3 KB
985 B 21ms
20ms Stylesheet
text/css 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2417224180093824435/adl.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2417224180093824435/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6f63063b6c9e82340f97b4dd83bb62762fa129eb451032083d872a1194f6c74a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2417224180093824435/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 29 May 2023 16:41:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 254220
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 956
x-xss-protection: 0
last-modified: Wed, 08 Feb 2023 08:26:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 May 2024 16:41:01 GMT

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
16 B 13ms
10ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTE3NDkwNDIzODg5NjMxNSIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImNvcnBvcmF0ZW9mZmljZWhxX2NvbS1waXhlbDEiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6OTk5OSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjpudWxsLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjkxNzQ5MDQyMzg4OTYzMTUiLCJkb21haW5faWQiOiIxMTQzOCIsInVuaXQiOiJjb3Jwb3JhdGVvZmZpY2VocV9jb20tcGl4ZWwxIiwidF9lcG9jaCI6MTY4NTYzMjY3OSwiYWRfcG9zaXRpb24iOjk5OTksImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMzY3NzM4MTYtZTY1OC00MTBhLTY3NmEtYjQ3Y2NjNTk2ZTBjIiwiY29tcF9pZCI6bnVsbCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6IjM1MzBmY2I2YmNjMTNkYzNjMTcxMmVhZWY3ZDkyNzAwIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5MTc0OTA0MjM4ODk2MzE1IiwiZG9tYWluX2lkIjoiMTE0MzgiLCJ1bml0IjoiY29ycG9yYXRlb2ZmaWNlaHFfY29tLXBpeGVsMSIsInRfZXBvY2giOjE2ODU2MzI2NzksInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMTYsImFkX3Bvc2l0aW9uIjo5OTk5LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDE2LCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjM1LCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMzY3NzM4MTYtZTY1OC00MTBhLTY3NmEtYjQ3Y2NjNTk2ZTBjIiwiY29tcF9pZCI6bnVsbCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImxvYWRlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjkxNzQ5MDQyMzg4OTYzMTUiLCJkb21haW5faWQiOiIxMTQzOCIsInVuaXQiOiJjb3Jwb3JhdGVvZmZpY2VocV9jb20tcGl4ZWwxIiwidF9lcG9jaCI6MTY4NTYzMjY3OSwiYWRfcG9zaXRpb24iOjk5OTksImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMzY3NzM4MTYtZTY1OC00MTBhLTY3NmEtYjQ3Y2NjNTk2ZTBjIiwiY29tcF9pZCI6bnVsbCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImNyZWF0aXZlX2lkIiwidmFsIjoiMTM4MzEwMDM0NTE2In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5MTc0OTA0MjM4ODk2MzE1IiwiZG9tYWluX2lkIjoiMTE0MzgiLCJ1bml0IjoiY29ycG9yYXRlb2ZmaWNlaHFfY29tLXBpeGVsMSIsInRfZXBvY2giOjE2ODU2MzI2NzksImFkX3Bvc2l0aW9uIjo5OTk5LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjM2NzczODE2LWU2NTgtNDEwYS02NzZhLWI0N2NjYzU5NmUwYyIsImNvbXBfaWQiOm51bGwsImxpbmVfaXRlbV9pZCI6MCwiY3JlYXRpdmVfaWQiOjAsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjI4Njg3Mjc0In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:01 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:01 GMT

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
16 B 12ms
9ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTE3NDkwNDIzODg5NjMxNSIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImNvcnBvcmF0ZW9mZmljZWhxX2NvbS1waXhlbDEiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6OTk5OSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjpudWxsLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMy0wNi0wMSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjE1In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjQifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:01 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:01 GMT

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
16 B 12ms
9ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiOTE3NDkwNDIzODg5NjMxNSIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImNvcnBvcmF0ZW9mZmljZWhxX2NvbS1waXhlbDEiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhdWN0aW9uX2Vwb2NoIjoxNjg1NjMyNjgxLCJhZF9wb3NpdGlvbiI6OTk5OSwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjM2NzczODE2LWU2NTgtNDEwYS02NzZhLWI0N2NjYzU5NmUwYyIsImJpZF9mbG9vcl9pbml0aWFsIjoxNjAsImJpZF9mbG9vcl9wcmV2IjpudWxsLCJiaWRfZmxvb3JfZmlsbGVkIjoxNjAsImF1Y3Rpb25fY291bnQiOjEsInJlZnJlc2hfYWRfY291bnQiOjAsImF1Y3Rpb25fZHVyYXRpb24iOjcyNSwibXVsdGlfYWRfdW5pdCI6bnVsbCwibXVsdGlfYWRfY291bnQiOm51bGwsIm5ldHdvcmtfY29kZSI6MTI1NDE0NCwiZGF0YSI6W3sibmFtZSI6IiIsInZhbCI6IiJ9XSwibGluZV9pdGVtX2lkIjoyODY4NzI3NH1d
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:01 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:01 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 4057 43 B
216 B 297ms
98ms Image
image/gif 2600:1f18:1aca:4281:ac44:4026:62a9:ef97
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1135760&asId=dd20371c-5f63-8b87-fe63-2d3c1c99a7ef&tv=%7Bc:eiEtPg,pingTime:-2,time:157,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:407,beZ:408,mfA:410,cmA:411,inA:412,inZ:416,prA:416,prZ:440,si:446,poA:448,poZ:474,cmZ:474,mfZ:474,loA:519,loZ:523,ltA:563,ltZ:563%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:39%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:157,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:39,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B150~0%5D,as:%5B150~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tFWuWM9+11%7C12%7C13%7C141%7C142%7C143%7C15*.1135760-69474490%7C151%7C152,idMap:15*,pd:0YtC.internal-nacl-plugin,rmeas:1,rend:0,renddet:IMG.us,siq:40,sinceFw:114,readyFired:false%7D&br=c
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:ac44:4026:62a9:ef97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:01 GMT
server: nginx
x-server-name: dt14.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 css2
fonts.googleapis.com/ Frame 5A3E 4 KB
671 B 23ms
22ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

2d0922bd18f06df3c7413fcd6a3f1c5ec9545b4b07b131e362f30df7275fc058

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 01 Jun 2023 15:18:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 15:06:01 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 01 Jun 2023 15:18:01 GMT

GET
H3 200 abg_lite_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/ Frame 656B 22 KB
9 KB 38ms
37ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/abg_lite_fy2021.js

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

551debe8c4f0db7b25699af72a204caf099af55413f90eb34b5f546330d6187c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 19:50:11 GMT
content-encoding: br
x-content-type-options: nosniff
age: 70070
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8798
x-xss-protection: 0
server: cafe
etag: 11317101923912129037
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Jun 2023 19:50:11 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame 656B 8 KB
750 B 37ms
37ms Stylesheet
text/css 2a00:1450:4001:813::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

98d2e3edd14aa506c4521125c7cdb7bb3030d7caae5803feec6d2613195ee955

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 01 Jun 2023 15:18:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 01 Jun 2023 14:51:17 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 01 Jun 2023 15:18:01 GMT

GET
H2 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20230516_RC00/ Frame 656B 15 KB
3 KB 32ms
31ms Stylesheet
text/css 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20230516_RC00/outstream.min.css

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7d4095ea226f3f80d6d4fc62e3737dd5107fd9d4aa4a443cac11378b102f64b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 23:02:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 144950
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2883
x-xss-protection: 0
last-modified: Wed, 17 May 2023 00:43:28 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 23:02:11 GMT

GET
H2 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20230516_RC00/ Frame 656B 371 KB
127 KB 33ms
32ms Script
text/javascript 2a00:1450:4001:82f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20230516_RC00/outstream.min.js

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

464be521d749b2ba1c7e8c1f87223b56a03ee0bd05484baa0e9067ce9eb9d2be

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 03:44:17 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 214424
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 130330
x-xss-protection: 0
last-modified: Wed, 17 May 2023 00:43:28 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 03:44:17 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame 656B 19 KB
8 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3735e94afb2539b14515fdd10d7cc066cffa99d4b52762959e342295e08a770e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 20:06:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 69062
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7991
x-xss-protection: 0
server: cafe
etag: 2412543371950383451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Jun 2023 20:06:59 GMT

GET
H2 204 l
www.google.com/ads/measurement/ Frame 656B 0
0 35ms
34ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSQvPJSHR7LiFLWquKijfWNEH6kTlPDX71VqlSV0cdvc5DI2fuTSH-ArK_mJLRUHsoHI4Mh2nAgkQrkO4xStcbJnTPPyA
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

GET
H3 200 interstitial_ad_frame_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/ Frame 5A3E 20 KB
8 KB 35ms
35ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/interstitial_ad_frame_fy2021.js

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

410f4228aa677eb20622c6f1e0f67966fcecca198ad07bb096f0265b2689ded7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:02:24 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4537
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8300
x-xss-protection: 0
server: cafe
etag: 2697337515266134059
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 14:02:24 GMT

GET
H3 200 9rqtaVZiiC_7YLKwh7YBfT4gwbCPSzX7QNXGZKOGVto.js Show response
pagead2.googlesyndication.com/bg/ Frame ED32 37 KB
14 KB 33ms
32ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/9rqtaVZiiC_7YLKwh7YBfT4gwbCPSzX7QNXGZKOGVto.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6baad695662882ffb60b2b087b6017d3e20c1b08f4b35fb40d5c664a38656da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 18:50:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 73641
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14729
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 30 May 2024 18:50:40 GMT

GET
H3 200 9rqtaVZiiC_7YLKwh7YBfT4gwbCPSzX7QNXGZKOGVto.js Show response
pagead2.googlesyndication.com/bg/ Frame DA42 37 KB
14 KB 33ms
33ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/9rqtaVZiiC_7YLKwh7YBfT4gwbCPSzX7QNXGZKOGVto.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6baad695662882ffb60b2b087b6017d3e20c1b08f4b35fb40d5c664a38656da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 18:50:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 73641
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14729
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 30 May 2024 18:50:40 GMT

GET
H3 200 1125_1675844751021.woff
s0.2mdn.net/sadbundle/2417224180093824435/ Frame 9E37 5 KB
5 KB 21ms
14ms Font
font/woff 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/2417224180093824435/1125_1675844751021.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/2417224180093824435/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

aa96409084eee77e5c0e5baec3ab010a756b885e32a2a1f0d9693b86c3380414

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/2417224180093824435/index.html
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 15:43:10 GMT
x-content-type-options: nosniff
age: 430491
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5104
x-xss-protection: 0
last-modified: Wed, 08 Feb 2023 08:26:03 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 15:43:10 GMT

GET
H3 200 1624967331.2899.png
s0.2mdn.net/sadbundle/2417224180093824435/ Frame 9E37 229 B
256 B 18ms
15ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2417224180093824435/1624967331.2899.png

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c3c72284b6c8eac32df87566950180e1725f16c3b4941a606c64d7a8068b8073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2417224180093824435/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 14:08:12 GMT
x-content-type-options: nosniff
age: 436189
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 229
x-xss-protection: 0
last-modified: Wed, 08 Feb 2023 08:26:03 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 14:08:12 GMT

GET
H3 200 1622636136.4958.svg
s0.2mdn.net/sadbundle/2417224180093824435/ Frame 9E37 417 B
338 B 17ms
14ms Image
image/svg+xml 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2417224180093824435/1622636136.4958.svg

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33ba8700fdd425748533bf1ee4ccd89d4012dfebcd7b61d54f87d0d0e952b8b6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2417224180093824435/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 22:49:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 404895
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 309
x-xss-protection: 0
last-modified: Wed, 08 Feb 2023 08:26:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 22:49:46 GMT

GET
H3 200 1622636136.5185.svg
s0.2mdn.net/sadbundle/2417224180093824435/ Frame 9E37 420 B
338 B 28ms
25ms Image
image/svg+xml 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2417224180093824435/1622636136.5185.svg

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef04ebd34f9d837413d0e44f7d8d778bf95a76119dfa0cd85d646306c531d430

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2417224180093824435/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 29 May 2023 20:32:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 240307
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 309
x-xss-protection: 0
last-modified: Wed, 08 Feb 2023 08:26:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 May 2024 20:32:54 GMT

GET
H3 200 1622636136.4741.svg
s0.2mdn.net/sadbundle/2417224180093824435/ Frame 9E37 483 B
382 B 27ms
25ms Image
image/svg+xml 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2417224180093824435/1622636136.4741.svg

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4a9650564960002c3a6b463e0c895f6faa3c65690a9870ea8cfa8c3811a6b2ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2417224180093824435/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:10:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 169642
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 353
x-xss-protection: 0
last-modified: Wed, 08 Feb 2023 08:26:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 May 2024 16:10:39 GMT

GET
H3 200 1622636275.7439.svg
s0.2mdn.net/sadbundle/2417224180093824435/ Frame 9E37 486 B
385 B 26ms
24ms Image
image/svg+xml 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2417224180093824435/1622636275.7439.svg

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a7dcc07d397d0bf3aa1a918b78217d7ec794a40d776abd2286a77864d23c8f41

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2417224180093824435/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Sat, 27 May 2023 23:27:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 402661
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 356
x-xss-protection: 0
last-modified: Wed, 08 Feb 2023 08:26:03 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Sun, 26 May 2024 23:27:00 GMT

GET
H3 200 423_9575e2d67b9f682fa3bc604040bacd545fac2dda_s3ca-fa_1674216344.5067.jpg
s0.2mdn.net/sadbundle/2417224180093824435/ Frame 9E37 83 KB
83 KB 17ms
15ms Image
image/jpeg 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/2417224180093824435/423_9575e2d67b9f682fa3bc604040bacd545fac2dda_s3ca-fa_1674216344.5067.jpg

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

219e7cf64a17d6e6630a9dc812ee3366e915a4d4da1436e6a9b6eaafe5c76daa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/2417224180093824435/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 16:43:04 GMT
x-content-type-options: nosniff
age: 81297
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 84831
x-xss-protection: 0
last-modified: Wed, 08 Feb 2023 08:26:03 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 May 2024 16:43:04 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8A32 0
0 54ms
52ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssSO8LKIK9PPo5mtWdoGWYO0Ayiq1bWwYtnD-2oSCzZ1KmKDU-6xhsYpx5O6lez0eaN4bJp0w4yVhWsgcP0bq6NEOEQsS8l3R28Xv_8dm_Q_VJEYaIZDzwBKGscmFHZIb0FmtakzgWox93WZUAZYk0qt0L5nFMHA034OMxEnfmgyapMWx4m5U8Jh6UJQXkjP5P3g_eOlJOucjKepUCXLVyrs_mdydOKRzVK0hGblFkKvhGt8X0uzvUUWD8ohh8ffrUqewns5Ax9xkyYrdUhyWliXgOHWsAjUxPIgvWdOfs1dnjZ_Pf0tJcZncHcuv0BDGm_BTLJMjDxKBEv2DGBzdRUi6t3iNQnWQ0vK25Z9nnsuntfmNuFsEph9BBIc4vXkF5jjrLQfIhbYdVyOvbz-1ekJs_O63qyOrohGXXLwI_jOZavKLl2O23Cs620f6BeZXbQFXR0sOsahloizI8rh0i0eU8rq4-BxOWF5V9VYpXb95F-V2WPojZvOtYz7aBNAQ2jOztyJNrqpzoU-QhaaB-Eo-RiGZw5Xdgi6df2rOEK276V67-Vy3PvLDmOXNhmH9TGOEBbYW_ijQBcvQFugRS93sA0vcnkbj-_eWKEegXXwlWWio5XmpS6koXi-6s8kF5ga0bcye6cc6JGCe_WKyfoIcipqDZiYpAM_V_BZwZAJdwoFnDkFh7tSGWfbEA6IfbASk9ODmJ8086y386GoBi2gyLYr0Xak5ACxkDLApwiDJF3ejA6OIbik1xs01cEcHuZGdEmnfuIQUnNJ4M6Sd0vqBshgeOsefVccN71svIjQqv7I1aaYtzztWfDTTEJiS7pqxpEpYdHn15mMQMxkxZSVVNn18nlxZzp55PgIUwYbFIRSGBAMg_5LZPHOdtBrN0rzqtq5LT0Faww8guTlsGslxJ_u5ranJ750tSSpwyWEIV_jbde7x2NmxV2-skril2HFT9oY8W4GKcgcpaYkWj5QJNUZm0Gr6cR0xIWWNsszokHCRJftNRwgJoGjo6sTpuD3cVKtdficH5AZ3KTllmOSO8uoONUyVclSFs3H-clWX1OSe1Jm3iL8VIsdesbxnz3t-vwxbCZe3BUYQLJilz11inc6bvugtfsa3GbDkWWS2dla42gTyxpqDBvCptjr1dpkejzxiYGgfEncxky8vNVH3XWbMz9_6w9jLAGCjrmfuZCzow8mHntYLdqNupQGsZJHbMfsHGVx-moO5g7GQuB_w6e2RgeFEp-F9gFKwRg99Cyh39U388O7VAkcJrVhzUMLFeNcGRR0RAy0cSNHj84TDVvyaafLnxr9IT4vowC1Mzz-rHosJyH06Qmx6ZCecrxPagIg2RH5QdStgxg114cIw&sai=AMfl-YSUQVFoMgnSyNnQrrAv90iNz7zQd9sqXHlMix79lOLLOqO8oUSeN5ZLWeYwjTZ2WuWK2Hb1Tg7xuD4eirYaXIdPVHgJ4nBh1DGYjFrZbnjE-023OCIg7hy_XzS6lmAuvbIpSr-lHYybUMCdleW6FS-9W2Cs81b2W1ZDsFokRbo21fKWk8dqnjgvGt00x8A3XLC5W-KjV7e9ojJ8nns1U4BM39-DIZUzIkowKLAoXElJIyKBlghUsXFUIl6RareRTK62G6uALo1lAxszEWwzReqh4Rwc_oly&sig=Cg0ArKJSzDo4x2euOoDcEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=414&vt=11&dtpt=303&dett=3&cstd=102&cisv=r20230530.16746&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:01 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 01 Jun 2023 15:18:01 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 656B 0
54 B 1075ms
317ms Ping
image/gif 2404:6800:4007:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~lida6d92&c=1915028089605&slotId=957514044802.5&qqid=COv5oomvov8CFYPJ3godxuwMfw&fb=outstream-lima&sei=44729911%2C44730425%2C44730426%2C44752538%2C75259414%2C420706098&nsei=44714510%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20230516_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4007:817::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:02 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 656B 0
20 B 50ms
48ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=Ciw3iqLZ4ZOuFL4OT-wbG2bP4B67dvd1wyPmOzNkRpqTGx588EAEg9PnGJWCV4pCCoAegAd78oIMDyAEFqQIqrM9I-fWxPqgDAcgDmwSqBI8CT9ASpLsp3puvn0MaDHcCy_afeMFwUUVrrzDkIwCbGp_0RPfXfPaym1D9EpH-NqTBpiu7iqjzIm0VOHpBapbE1LvCuUy9Vk-E4-mOD_RGPmVyoxRr4Xv8fZLf3rHRa-xvvOT6kVEEcD4zjrbaj9mpIXqFZKB97fvasfzzZS8f4Q-_0-xaMgMbIoiMC8LutIu2m-RQkaXB0439jgcZMxGwCEFyXencC93N96I6PHE60m1L5KqCxLIL2CshGM0-BkHmNIuuMc5QFvu4Qy4Rfynr5za6wbIEv4skNTVIbOsNMxW3Sr0-8ewZzcbGepVSg0YGmBMoKzpnnoH-XrFNHEzQDt06fgBUHImZ4ONORyfKusAElf2ikKsE4AQDkAYBoAZOgAeKg998qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTryCBthZHgtc3Vic3luLTkxNzU0NTU1Mjg0Mzc4MTOACgOYCwHICwGADAGwE_TAvxPQEwDYEw2IFAvYFAHQFQH4FgGAFwE&eventType=clickstring&clientTime=1685632681630&ai=Ciw3iqLZ4ZOuFL4OT-wbG2bP4B67dvd1wyPmOzNkRpqTGx588EAEg9PnGJWCV4pCCoAegAd78oIMDyAEFqQIqrM9I-fWxPqgDAcgDmwSqBI8CT9ASpLsp3puvn0MaDHcCy_afeMFwUUVrrzDkIwCbGp_0RPfXfPaym1D9EpH-NqTBpiu7iqjzIm0VOHpBapbE1LvCuUy9Vk-E4-mOD_RGPmVyoxRr4Xv8fZLf3rHRa-xvvOT6kVEEcD4zjrbaj9mpIXqFZKB97fvasfzzZS8f4Q-_0-xaMgMbIoiMC8LutIu2m-RQkaXB0439jgcZMxGwCEFyXencC93N96I6PHE60m1L5KqCxLIL2CshGM0-BkHmNIuuMc5QFvu4Qy4Rfynr5za6wbIEv4skNTVIbOsNMxW3Sr0-8ewZzcbGepVSg0YGmBMoKzpnnoH-XrFNHEzQDt06fgBUHImZ4ONORyfKusAElf2ikKsE4AQDkAYBoAZOgAeKg998qAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB5oGqAfz0RuoB5bYG6gHqpuxAqgHg62xAqgH_56xAqgH35-xAtgHANIIFgiA4YAQEAEYHTICqgI6AoBASL39wTryCBthZHgtc3Vic3luLTkxNzU0NTU1Mjg0Mzc4MTOACgOYCwHICwGADAGwE_TAvxPQEwDYEw2IFAvYFAHQFQH4FgGAFwE

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:01 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 656B 0
234 B 1063ms
316ms Ping
image/gif 2404:6800:4007:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=2~lida6d9b&c=1915028089605&slotId=957514044802.5&qqid=COv5oomvov8CFYPJ3godxuwMfw&fb=outstream-lima&ulv=1&cll=0&met.4=arp_a_s.qf&vast_v=4.0&lima_p_ich=0&lima_p_icu=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20230516_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4007:817::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:02 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame 656B 24 KB
16 KB 63ms
63ms XHR
text/xml 173.194.76.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-DgyltJGMDUGxrcmISEeBEkPALhn7lpjoWuE_L7Xokk6ZNQDjfz0PeNqB0lhpC3elwLFbV4sojX8FiqLDQRezxREfCpGg&dbm_d=AKAmf-C3WDnAUt1q0d5x1jlXtligHqjqPvcLV2isv1Md4VzKgGmGU901aTCoDO_mRhJoPegUgvB20QQq8FRJPi4Z4SAMIVakmlKLz98-GQSDQkb1gcgI3Y8zvnR0fFizO1CV5G89IZcskF8VUXQ-iR2PgEZr63sgTTLoph356bTv1ztStdNE2Nhk-gcr4CShnMAG2mnuUYC6q0jbj8lTF2pXiSlNENwZOsp2k-wLkfPqib5f4_I0-xK4bKiC7uBva6udPRCGki-p9xChUa4Fih-UXZkD26PSathgyjgl2ue2XLg7k6ol5MAY5ssnYzqliKzWjzrkuRz02gCn-wfQhp23XpquACYf-Giu56wHrPrmNcHr3CAb9KgD1SiIFPB3GpEd7bkO8MhuWSpuHoDGh8X3iRxHbVuQ4yNFibbCmw4LFK8keHZrG4qMQJtsWyc3BBLTCt72aydndJIbdNT-XEdZd_xqutYhETqHuI8xZaoJyJMuY7VfkothK9IlOH3g4R3qvZro_CE0lvZhqNhaigJxUIXxf-StGs_J2aX7ZYz7q6rkBcgbut4-lzqudIKMnzGgMdbKOiSx1N0mRAojgUpaHu9K1gmAdG4K0MfU7zCiSE69cxzZspDvOwMFxY7No_cLpLahzna0Hhxdc_krJwfu0Lc-izCHiFDg0hLO6An-gFunx7y5U1DtxAuc8dwSrFUK6Qenqs8MYAdI1gcjz8He0JaQdRlz9y7EW7-ziA6J7KVNVnWlqp7ZIRSjpOYybTDdLMg8WH67moZSvcD3u6PTNrqoOi-1lZbaSf-vnujJOO5LkEf4UlerNSR7SgZCTkgqbYThzDQJavERWD336BPhg-iueVOqQrNZhzJ-V8UbYg74TaZNGakO31qJ4v1WGh1Fzqf1A-hcN932_9VXH0aYIZOi6uatsg6c5FNhUsx_Z6kiVo7BxCwBVv6eXPwyyE-GsH-i9tou663s9-rUbzyhIrE-rmh6gO7484IdFNCmUHkGkGwL6aCokznBu9Yp32Ja2qQul-7sROh73N4B2VWFg5XWU4SyO7AuueKgadvdthL1dCZFjf7vCWVdM3-DxrEBtX5te3hQZD3GmKWpjVlotCZ5fUYoE8MGJZlijfEIof3u0xqJdnCibFbrOC4BFbQ9-LpqI7CH00OjmJwOZXF1pUmVudb22uhFM2ERfHPrCBa9rFIbODpA65_3his5uIO6Q_Zf6VXQZFkJA-TW8IW_zPFRR1hzEurYaYu1KT7OhWuwqceaxu_UYTuXh0WutBPQUbgKgt80U9e8WJjSpmBq5WCslslE59EtZF9_quJJnx1E8gyZW-oYTeMhzqI8xEWL9Q0ampK1izEKjEAFi-hym3CgUBNjJw5IXTsFQfZssaSbknBzcv3me5pURPJWbvrJmjcf5KAlcVhNqG4CPvXvNc3nPAa91xdXc8czj10EYPOy2gJczEXEu7SmZN3winCKzPy5etLTgtpN9CaQCgVDQIYgu-tk1L3zxW2bh9yvbqfQ1X13VOsRftIH5q82GxExwvGSOwW35Y2EMe9TzrIOp0mUwLVzsCmCk-8-5ViJjAaHg5ZYreJTkdb_0E9no7gPFpOLnIELH06unAveUy8TXJz6ICG0XoqSgS3660E19I1w43l2dPRSy_NFrbSyp7DFY4F6N1tHZKpkW9Xpimdzju9bT_NUI0Q56kglpkiknIH9uu-RWJMtUkwe8LviiOyLoiM7QgyylM4OUPEcn6LGmTGbsUOO01SPrQtTTrANksZS2bkhx-5_SbpwHGa4v_v4BRdJeBb0pP60X3qvVTIvGD3U5k0BclXO6vjLc1mAVxnvkiSTByCq7GYRhZqFzHj5e7TIVThtdMtWhKgAX6r_cjLi5gyAKGv_csWZxWVmVtvyjgbdBjJKijdqfSUfgYZoLMk3pjbhqeWyxvvKg6HvWK7MJppRhmrNsjcPQ5ci3eI8wn4CvjxiwD2dlFx2JFYe4mTgWzhxAvobjg8jheghsa-xertzVL5mEbE7_csnclNVlKddZvHkNzlL-hF9EEOowOtFR6wrZULgT-8wK29VXAdyowRhVqZnRrZXyDGG8lfFNOo6WwXi3Uxb9CMlfR5-JqFwm7xFvWoQy71g6OrD5lPGNRxWxbTPlxgFrArex_fhCjlTkxyb9uM661ALZD-8tCXOpPHqyMo1UqPhjGisb3Q_dBZj0_So_iKTobmnf734SDEXyxuYmD4IwWmkLDUV_6lN7B8roFbWYAwmOBF5OT785NmzyWwwl_FjubLaIWvg0oNcE9kXDnMNl_Ebvk4nhmXfTsCBhySU50GGYT9BHMHmPBIjEWjR6GKuP24QVDQJuKrHo-1_8xPrxm39XsMRRNp6dLIcfiVfXJ3TJSYK0GF_r-csEKuZ_pgET7-OJcNgnp5aufgm2TSp-z47Rqy0YkcAKfLTC8XD_T2co6ofmewMSgYqcN9F_g6i2NI0kBXUdogAzRxPeq2nj30U3q9QVsqieptvBkCZj6-WzghPoUd6gZu6WW-Nerlql7ViN_zrPRZJLxaxqumdskahI-iLSyj9oJwswKjA9LDG2hzv7FaN5DeC-9nGu9gpfmJ9UbgfA8o4aa3quLmImGPPrlcbJnTFCTyENkTkEDaqEKZPdW7tSNpuciVnIaIJ4KhtRFLHdlT-M3dLumsLurhzB2cJkRf_Vdf0BuAOztJRfFxQ6P2A8yP2aPS46ESjzPfiYFqh0Nslw4Ej18bm9uc44vZPweHU61C37tzvrapVx2C8E6gVPoGX7EeRQJ2EqgjsbReDHHfXJAfNk2Qy7uIGlaVJJQak5-qnMMJ-4LWDwe6RO5p5sS__YkbI62M95ham38V44H8YaVEuthIxrocdxtgkOnv9TqOB2g-AAOAbdYbAa5yMcLO_otqC1YEvuGsmUIGUrLbpgNQS-aEm03j3jXKYuO6ArgnZxWPawz2wTcMlJdJgSivVPAGAPbcAuCB92cifXMdU9p-08GI3GgGHkBssLZHzhMV8uYnoIE14uQG796EtH2BRpmzbwFIlL1MoqyUfTBTKKVUqvKHZZC2-KpocxlvxISWijtLZe3uPnxFbskVTELEP0PYhENeMkwi94aFKmL50a1991CAv3b_XEq42IyL1MehElq5V71uW4hj9htN4_c1f6Hpvhk5UFq9R15MwCr-lcdkp_BqHFhs8UiVq4Cef70oldmPHb6T4FDBkU_VGRjMxIYEoQPsezHdR5S-v5JslHTSoWVo_KIYeHCoGQYw13cJwjMJ8xLc4IBnv6beDC1mgq7J1HIENShm-hkRLq3-2rUmLJxsp2LH0OAmvHVQ0yPxwj2fN3tHjlfgVJ8uMEkwg5wWHe5e69K7MZnslP-2rZs0e3TvekLyt9Z5z0HTaB2LmBr9aIXVrBx86lROrJpxvN1OYxF3_wgCcg0CTXzhYcANs96b2t8xiucEjGxaEGRQREUNYG2fuiayFO9rsk5tM_iG5KAXWEaTDbrRvrvhIfJzcWfLN1xuFosJyqbr7PSwsaT2GIBhRkPWqQmZKqFmow-GBox--QLuRwsfilMqNuZhOiV9lGFDIuMbevSNul8X_FWxaVtQaRqpuXy0i6S2CAVqPLZ0EIn4gQ5g7RhwI3ds&cid=CAQSOwBygQiD2QBPxa4FRELSxMkxg0EPPvPreaJJzT1Xqupgqjjl8xqGE5jqdpQUBIIMqW9Bnsn627U88X9tGAE&sdkv=h.0.0.0&osd=2&frm=2&vis=1&sdr=1

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20230516_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

173.194.76.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e0806e1d745d9415721ec622df2f4b66f572cd1a89f0c9c1e24a84658cbd0c81

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:01 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16371
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 267D 1 KB
643 B 14ms
13ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 75770
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 18:15:11 GMT
etag: 48472445140208031
expires: Thu, 01 Jun 2023 18:15:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 si
capi.connatix.com/tr/ 0
311 B 291ms
248ms Image
application/json 172.64.154.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://capi.connatix.com/tr/si?token=dceed97a-951e-4c47-b565-c2794ffae817&cid=5f049401-746e-4449-8c27-b6b9d8e25882
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.154.204 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:01 GMT
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/json
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7d086d44cf6f0374-FRA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H2 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 4057 106 KB
37 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Origin: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 09:27:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21048
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 09:27:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/ Frame 4057 11 KB
4 KB 17ms
17ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/omrhp.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1135760/69474490/xbbe/creative/adj?p=APEucNUgEbglb7RqZqb6PV3DcLAB4XDFn8vLSAe2HnuScDp2WweONOg&d=CokBAKAmf-DrEeaev9qZC_p4h4mGx0YrzrIj9i9tmi8CtBS_mzA-m9kEpbvLekgiNInAbu2K2k-XkAyrPZr1nHziAIpEY20K5EY6AqntEZJmzzeLjhUb15dqrH6pHSqnq2d2S4ahEkgVOyvZn0YnuWzPbp66AciXaOLdcJatNd86ExUqMuXtF6IhSAQSqRUAoCZ_4EOYMycbAwMEbiRtDr_AK6z0l5A8KV9BMoJoLgV0VLLlq4al4xh1DI2lAsP9b8Niks6hkxmQ5gZzN-lVi0tlYXeSZwi8phlOYtDotPLbeF4odht9guzfT1BkqHKhlTk63nfjtsQZXCoHgIhWUMa4rkrnnqS0I7CdABy5At6MbFmTFbtk35F0zrzjENMbM2kvA7MDX4ryiELU1OfPq4gnitvp0J7LbRBAgbkznd1_Kr1nJy9390vyOY9FyB6Puj_MEtDqcIug-lhcLQUsSjQ_ciL3r_520cc2z7SSthuaWkSkwTxza1KlgsPcld3CXixnW0YmRF4vU5azt43S-Kw_s4OV9mXxOtCVgYVDCSG7iDwmvlA21fA-hEdOJyhYlV6F5yTVrK1aH_oTTpLD_Ni-H-3X-uIgzzqmYBDDKxg9dEiOBYsSwcqNRfQH5bb114y7EA4ozmYnFlGvBJrgpT4RW6iEJGg_j9sAdnOMwhdzfrlBFacjV55Z0kdeyJimktlTMdya1XNK0CyMCeC6XLycqp8PvmFY_8CLCRa1Z98LX71pML_77wf1DPljtufZG-jCQNOqI6q6MN0ZogzdfCl4KBWaENzfQEB2Q-BUEcW3SEV16XDWzNOwCwQ-iAAl9t7tHpFi9ZgpAtQQjgSnXdyPTfhQlPriK-brmUHIUoflFtdTfDBJW4v3C5MdeNGZ5l00-4krMfMWuf6KNnHm--RfzRkwBtHQeBDP4pkAAqbbwqSI6e_rQ1zRJa2Y9pow8mzgRJ1idLZFb0FiqvEGD0Bg0gS7JNg2up2UatJYM5L7QB42kxtLg30qw4ZLf0hPtAp5it9YRIw6DNn-YK3ZvfZLWPBSYoY0Pzew8Tc9s6zb-p3Fe0XY3TrDIcRlXOkw6OmqniVVqvPAj1s1EVVPKEGVq4HrPiGo5f1-E-O4z-5YbmJAW9umDDTk71aNFY5mkpcX84Bcb3EQR_H8pqjvUUO8wrcfyDElq0r6y7Xi9Vp8hg-TMo_fpXTL11zsaRioB3W2IswBPvhNJJ-ks4fisvilZ0MORETxouFUBUFtTNwhuHyP4zwAk7_QczJXHklfVJ69o66l0TZ6dWF0QJzaIq9Y8Cy3F1yuRiWnUVBF7aK0cvm3hCGOAtk2v5j_4g7w2vS1PxuQGTXoEITxUlbYaAoXkx5sAdV4Q36FdyW36nGFDSKj7VtUOdapcnZSvfPS6wVvhCWX_QywVIUVufKydTa84JMvDI81kCCBH16bkc5-WgfG9q3j7X854Au3jqLax7HUssFQxGTS1_1GHdvaMahdXUVhnVCm--lu3VI71WlbymOIKjfgAScipHXPdIwCkVARCesHe41WxB2XrI_VuXWkzkuHH3XAJReqNu5qJuKsNXfOBY72z7yOJFHtLFDaR3m7CZhYUmVS971J3-c6RxHMevuExDLrhB_scjhSpJloCmjH954P0-X2IhdIaYHalov2PaBHuLBIJUUJehPeXXxVePQ0wXTaRXveiNkbnxnkc0MrZJ_GqLD8jGPe82yTH6WneI2Dc68-1ow5IzAK_UhnvX06ON_Tns6m375zKhlRbSRHzJLyqpTd3bw8y0eeGgkCnxo0AeEZ06dO4KSwKVpbbojhfKq6bYR1r-JBfNzRYWKkQ3qUZ_HUdvk-9QA69XBo_lPNBRPZsAyA2st4rCaXf0WnIF0Y-goyDfe03vCJZiJEyRbD6JLkd7TBbTyldUNTJ9nU9mnBxazWJb0nP8HjfjwMSSwUlNgVAn7Le_j2jlmXKrek-VMltA3fqBfwBIKDGO9L-fM-yETuMKQVtRWtiBdLqL7GT9_8DDQtzo3vcmUeAQf0AtUNyZU-uFw1nnTXW3rgCx6jgPQ_coj11q9ztrvo7xJsHIxSUhrNQyiCfky45Pyh2ECg9yGBA7U6ciSfwHPRWQtfp0gz7aXM3EctFHm4b6oXs64uXBGGfG2wSWhBKs9kQak4MGtVY1NbhTd6e0MVb7bRjWzbF9tz4U4hynXM_6uM2WHge6aJijYlHr2KXn5W3PtzJkbkaHHMTrZ6XewsWNaNlDpw0yYlHoU9wSWaxGYr5x9XcTUGgHfwkddDdtB1Z-6BBvSfovoT69GJS73BSWcrv28jX4dwSlcLPjigT9UVAd0CM5ym1Xx0wScWxZnvTUTvAle-HcWUKChIukaKNG9C2r-h8xvL1VBGSZL4PRhfokNw-Pd2HgK383qVykUFYVnVOY3ppfHDFCf3WZG1gYja7Jb9QnNF0pdwjTcDPTWYQtfRH9WVZPN4_iIzfHJlwB7hWBX8zfKvbcayV5UQSgab0la3AuJuFQxd6czF8FxIs-jwHjJ9xWoiYcQQKsxGGlan6fcvicu01AVVwmci2TkMWStJ2qH7c4AXYHGGYBzWI6KqPoVad9AvfUkapKQCBtGo5AJ_Zi66PAXjIKzC3835OioA8158bnEuyxu1RlhGfuU6l7qly0FjXo8IDl0wE2usdoGhkEwUDKb_7gXw8VOtaDboxk4ml3nhSXu1on50xRQrcQ6-ZRwKrn1Yd91gqObrz9DDEqzxtja34AWnkLCJmtHdfC_A47-B3MQT5ZqsegF6iFKZgRWyuHIpiBW_6us7RqB3oUpYyYCL6ef7_kdODTUBDrYGgF4R_k-595R-U8jCSTj5S3-1uOqJBNGqtbzG0cN58xiFu1__hRgmv9C3Wgg53NcI5pDv69YMrrQF9Y8EhUsrgdtIvKKMXwCSUHAkx_BcR52nPbPgTw0FlLC7XB1rN4oaPGq9Kq88j_2298NlBrCTSiPzGNcmgwT1uy-JLsrc1XROP7sNjo5ICsSmO6bsNAhxZwjbvrzoOBSrfCZvGIX7Gjz5RHZPrA2DnQjWUTbNij2Qt3SBrskqiWUQL2kx10Jq1xQnuh5SxUsCI2y4kAtoeGqYglbkxHvCuv-cKh-60XKOk_XWPYTSr5aI9ZbFQ65lSYvC3jfQHtrFnHY4DNS-DPtFvKaarysIBuXWx-y5wCLagnRtgQGM_MudKp_d81X3WtV94amrxf35LQ6iYJ1nHGiu64RiWgT5xBuJ7ignmIlmeeq3l6DE5nkV86P6mUZCcvX4CJQOOHOzfJ79nTaUD05a7iKgdzqp6ce3nG5VqMqXZKE2DK7yBiMB4SgTa1xgr-3u23F3RtNrA6svHyYfyYf_D2v_Lt-IJuArYECT0lKWPntxB3gPeDexet4w78FcZxYN2NgvaQob1QokSqWbr1cK20qdVA8KgSwMtDsk2TI9luHaQJeg8_PIzc5YNpaFp-60rS8ylcYCRTWSXReEnR2R8fneR__b9D6TREzleLGx2h4EwrKo0tuso3FgHVaxJOgKvwvQqorwUkgmIRakg2GmUFSnsMEMCbWh9fTBlX37iKnZZQUnnQlI59rO7-LyAl165zUrqM5TgGWXFy-zabhHkBfB95SVFceJpcBa11841wAXoMsTkJjxSmxv85w7nuzmgocBaEpWdVcoVuuTXh1HIf_UPDUD_xdBfbA5j2pRlQDUZ6obtSzGdEst_Y7J_jORZrBzRz18KGT2hJfdPzNNGDe9qxHkZZwXCARdsNK-TTC7CtWR55osKThFUWpn7084dHzH1I-ctgqOX2NsU6fiNqoOAkFcaRpRCAQSSwBygQiDVz-d5MSEJH_2Kk2lJCSD60bMitRrqYBguA5I3HRQXF1wo5sLzvO8N6W8WiKQjGQNHDZsgCNaVszS259iry30xBUZeaPKVRgBYAE&bundleId=&ias_dspID=3&ias_campId=1010773593&ias_pubId=pub-6396844742497208&ias_chanId=1&ias_placementId=19749079322&bidurl=https://corporateofficehq.com/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0gVgWCIrTZtBGqL4_hZarKG&adsafe_url=https%3A%2F%2Fcorporateofficehq.com&adsafe_type=y&adsafe_url=https%3A%2F%2Fcorporateofficehq.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:dd20371c-5f63-8b87-fe63-2d3c1c99a7ef,c:eiEtNm,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-5b89c49c56-5rl7s,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tFWuWM9+11%7C12%7C13%7C141%7C142%7C143%7C15*.1135760-69474490%7C151%7C152,idMap:15*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:40,oid:7f59aa43-008f-11ee-b1e4-2e494c61570f,v:19.8.415,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8017866a6744d35f26aa9da389e9771d40bcae3ee65df4c1b5e16e57b09fda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4869
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 6053914914909336730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:52 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/ Frame 4057 29 KB
11 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4866
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:55 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 656B 0
54 B 968ms
316ms Ping
image/gif 2404:6800:4007:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=3~lida6d9m&c=1915028089605&slotId=957514044802.5&qqid=COv5oomvov8CFYPJ3godxuwMfw&fb=outstream-lima&vast_v=2.0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20230516_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4007:817::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:02 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK 70111041 Show response
unified.adsafeprotected.com/v2/1135760/ Frame 656B 17 KB
5 KB 345ms
80ms XHR
text/xml 52.19.186.154
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://unified.adsafeprotected.com/v2/1135760/70111041?mon=70111042&omidPartner=[OMIDPARTNER]&apiframeworks=[APIFRAMEWORKS]&bundleId=&ias_xappb=&ias_dspId=3&ias_campId=&ias_pubId=&ias_chanId=&ias_placementId=&bidurl=&ias_dealId=&adsafe_par&ias_impId=v4~~&originalVast=https://ad.doubleclick.net/ddm/pfadx/N7442.1972103DOUBLECLICKBIDMANAG/B28358795.343480232%3Bsz%3D0x0%3BAUCTIONID%3DABAjH0ga_y6XEZ93xeWyxmaU2kzL%3BEXCHANGEID%3D1%3BSELLERID%3D61599794514%3Bord%3D%5Btimestamp%5D%3Bdc_lat%3D%3Bdc_rdid%3D%3Btag_for_child_directed_treatment%3D%3Btfua%3D%3Bdcmt%3Dtext/xml%3Bdc_sdkv%3Dh.0.0.0%3Bdc_osd%3D2%3Bdc_frm%3D2%3Bdc_sdr%3D1%3Bdc_ref%3Dhttps://corporateofficehq.com/%3Fves%3DdGltZXN0YW1wOiAxNjg1NjMyNjgxNjc4CmNsaWNrX3Rocm91Z2hfdXJsOiAiaHR0cHM6Ly9hZGNsaWNrLmcuZG91YmxlY2xpY2submV0L3Bjcy9jbGljaz94YWk9QUtBT2pzc244eEpNa1R3S0J1bFRFMTlmT21EVWZieTA3U3NPVWNNWjFJbHdxbWhyZE9DVWdqbGpCRGJMMVcwdkhGWFJka2tiWDVmeVkzamI3ME04b1hYUHlGVVBRd29yZk04QjBGU3REWm5iZ3U3S1N6NkpQc1g3UjZpTGRLOGdoZmtIMEtHU1VYUTNsTEZpWExpQjVQOHNVQ0pRUFBrMXBuWFRtWU9ReHpKTEY1dG0wSm9DTFJuRFRzcFFFSm8zNzh2a2VMSjZodVA4WXdfbFVWbmE0RkNOMW9DbVRxQmY2R3FzbVZVWDNqakNWM01FQXJFQTdXT0ZQX1Y0ZkhNY1ppSngxN0lIVjQ2aFdRcTAxQjhDZ0JRaEtJTUk1UEVLQVV3UlJMQnFoT0l0SjZ4clBueTQ3cFhCQXFJVklfSlprdjNIWEtVTkJBUjBsRTVXUmVMdEE4TTNWRW82ZEdfN010WmxDUktfS253bmo1Y1lQWU5MWF9VN0pkcHZzV3hRLTM4NVJvc09kcmZuUFZqOGtnWERCeGZFb2tMUE9pbEw3MGMwazh1OXFYS2ZzR2lBeS1NVTJENlhJWUZGU0s5TXBzSkpqWjlrb3p0SWFkZmxiVzV3MDdMa0dqMThCVFJvNElCV1NDOTVucEl2cTZ5bXhNTHNtdEpEM0h2ZzE2TjJKbkxKczl1N1hJN3lnWm5Ic19lbXFfWHhlNkRGb0pUQ1pyQ2lpQldyNGktZWR5N2lXbnpDS0R2V18xUVJaVlhYZ2trTmpweUFKUkhuYTBYcHVhbzJWZl8wNGhRLWJIV1I0eWkwM182bGMyV0lGeW1NdnBQd25jRHI2N2lNRndFeG5PQjI2dWJneTAtSjZIN1d5alBQanBRMm4tc2ZTQ2VjMUdLWklIRllqb3paWkIzS1R1NkU4RlJMQ3lMVWFITF9xR1lyRE9UZGYtV2ZZaW1KUEl0MVZwUTJ2QVJVcE5adlI0YkJ5UmZ0M0ZQamxyYjdxc2R1SEdsOUlCSGFBd0hNQzB6Y09lblZVWS1LRHFTNFEwNEZtZUFUV2xpM3BFQ3dXQ1plcGhjc2ctTEdYNWo1OFRBYnhlMGViRHd4QWZaeWNaZi1SSGNON0pWczlyN0NHeTExUWl2b1I1aFp3d0YyUmFRRndFVTFhT2tVQkY1am5HdHB5ckZ5NzlxVTFrbGg1MzlVa2JnOVVkLWdhQzlNRUx5T1FpbzRlY3BPSWZBM0FrTm1abF9PRmtKQ0x3cXRsV0g5by1sY1pNd245SFAydzlnSGdSek1laE9IMkcxeDFIQVRNQXBiOXNvcVVKTDlRQzBxZndRRi1DQjZfV3hNMThGQVE3anZ3WE5hNmY1X2JOYW5TMl9rNDdKdGQ1UDhpLU9qWXpMV3FDMFRhT1UtbGI5dE85TEg4aTViNVlaYmo4T2ttYVNDbmg4bmE0UE5SVHQwYXNJLXQ5VERyeUFocUFHalphc09JNHVzMXFyVkU1NGNLb0d3WU85YTE0SEdnRFBZMC11ZjJ2SnBiS2g5NE9aeEl0anktekNXbmJneEJIbnpJVnF5emtxRDFsUmpLR0tPaVc3Sm1Ybm5hVU5UWllrZDJMdm13eVRjVXlSQW5FVTcyUnhMR1BRbDRfR2s5UmkzOGRyNnJ6aVlJLURSRVl6ZDFyOXBZaUxhMjFlUG5DTjVpRHc0SXpRV2VWVmFBZWlhS04wT3dGRTlLQjBzSHRlcHRGdVJrSWdGNlRRMWplMWVCSG4zVFJ2SDdzcHVDMDVwdEpVVkEwcnMtM3BIUVppMTZlWVFjTTJhNUNQZTlYYTBHUEx5MnA5Yk5FX1hCaDhSYkxCSnlKamZFVlVaZmNGbHhvS0JVZU44WE9oSHhBU3kmc2FpPUFNZmwtWVQ1Q0szN2MzWmNRcHBHaVE1RDFVTmZRNVpOY0w2cXU4by00YThlXzBVT3VfNXJjVXVLVlM2bVBJRVpjcVg4ZnNvRzQzc3B0R0owOXM0bWVlZ2Jtc25oZ1dYdlJhaWpLUlpkMkxfb216RnU3dGRRaHNxcktSYjkxcmRvdXAxQzZxTlRabFJZN25GRXdZQXgtd0ozaE92NTE4VUw5dlVRX1BlcWF3cWZWeExNWGtQbF90eEpYQlZhU3dGaWdqTUNURXBGVHNmZDgtaVZCOGRBSWVRZzhtMWtMV05xc1EtMDNRV2hkSVlQUloxUDVCZldSLVN3elFLUDJvQkpRY24tTlFOVXhOeFhVYl9xNXZNdzN6RlFQREJ0NmFucklnRGJ2MEdJb0VISiZzaWc9Q2cwQXJLSlN6SWdZSXNxbVJMY2VFQUUmY3J5PTEmZmJzX2FlaWQ9W2d3X2Zic2FlaWRdJnVybGZpeD0xJmFkdXJsPWh0dHBzOi8vd3d3LmNpc2NvLmNvbS9jL2RlX2RlL3NvbHV0aW9ucy9zZWN1cmUtdGhlLWVudGVycHJpc2UvaW5kZXguaHRtbCUzRkNDSUQlM0RjYzAwMzA1MiUyNk9JRCUzRDAlMjZEVElEJTNEcGRpcHJnMDAwMDAxJTI2ZGNsaWQlM0QlMjVlZGNsaWQhIgo%26dc_cid%3D186445559%26dc_adid%3D535164779
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20230516_RC00/outstream.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.19.186.154 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-19-186-154.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 7100470a2ad150e35c62d3a3c79d1c65cb2f72d0b7101ccf9d5670c7932a2288

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Thu, 01 Jun 2023 15:18:02 GMT
Content-Encoding: gzip
Vary: Origin
Content-Type: text/xml; charset=UTF-8
Access-Control-Allow-Origin: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
Cache-Control: private, no-cache, no-store, must-revalidate, proxy-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Request-Id: chsbdajn1sgbb7k7cnmg
Content-Length: 5188

GET
DATA 200
OK truncated
/ Frame 4057 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d66ec48469739168d6f9398e4d0a2f845bbe2684a629a5ca45ab78d7f722293c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 267D
Redirect Chain

https://pm.w55c.net/ping_match.gif?ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEL-llqYoaIOXLXbv9Xx3sV0&google_cve...
https://pm.w55c.net/ping_match.gif?scc=1&ei=GOOGLE&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3D9675309%26google_hm%3D_wfivefivec64esc_&google_gid=CAESEL-llqYoaIOXLXbv9Xx3sV0&goog...
https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=aEJOY2pjZkExUTRLM1Q1&google_gid=CAESEL-llqYoaIOXLXbv9Xx3sV0&google_cver=1&google_push=ATf1kGO5g3gZHAoUDcKPNp6VULvBwYROgPy44Z0c9j3DcaZ...

170 B
188 B

25ms
25ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=aEJOY2pjZkExUTRLM1Q1&google_gid=CAESEL-llqYoaIOXLXbv9Xx3sV0&google_cver=1&google_push=ATf1kGO5g3gZHAoUDcKPNp6VULvBwYROgPy44Z0c9j3DcaZ9KB6dlL_qdtxT_azmnGLQhp1I0x86lsfIErJS70Pap4nJWsvMVu7Q

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:18:00 GMT
Strict-Transport-Security: max-age=2592000; includeSubDomains
Server: PingMatch/v2.0.30-777-g304ac51#rel-ec2-master i-0943143fd00beb9c6@eu-central-1b@dxedge-app-eu-central-1-prod-asg
Location: https://cm.g.doubleclick.net/pixel?google_nid=9675309&google_hm=aEJOY2pjZkExUTRLM1Q1&google_gid=CAESEL-llqYoaIOXLXbv9Xx3sV0&google_cver=1&google_push=ATf1kGO5g3gZHAoUDcKPNp6VULvBwYROgPy44Z0c9j3DcaZ9KB6dlL_qdtxT_azmnGLQhp1I0x86lsfIErJS70Pap4nJWsvMVu7Q
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

i.match
s.tribalfusion.com/z/ Frame 267D
Redirect Chain

https://a.tribalfusion.com/i.match?p=b6&u=CAESEGLGuLeRM3wzHpncUx8ZwcM&google_cver=1&google_push=ATf1kGPYQeMsUPrpro2rhSFlFXFK2pGr5zTgIh-HsnRb1m-uNavhXxcI-8kEIx8bphjG_wcNfyfyfLPJIldcOJPK9rtYV1je8IY&r...
https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEGLGuLeRM3wzHpncUx8ZwcM&google_cver=1&google_push=ATf1kGPYQeMsUPrpro2rhSFlFXFK2pGr5zTgIh-HsnRb1m-uNavhXxcI-8kEIx8bphjG_wcNfyfyfLPJIldcOJPK9rtYV1je8IY...

43 B
414 B

206ms
188ms

Image
image/gif

2606:4700::6812:18ad
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEGLGuLeRM3wzHpncUx8ZwcM&google_cver=1&google_push=ATf1kGPYQeMsUPrpro2rhSFlFXFK2pGr5zTgIh-HsnRb1m-uNavhXxcI-8kEIx8bphjG_wcNfyfyfLPJIldcOJPK9rtYV1je8IY&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DATf1kGPYQeMsUPrpro2rhSFlFXFK2pGr5zTgIh-HsnRb1m-uNavhXxcI-8kEIx8bphjG_wcNfyfyfLPJIldcOJPK9rtYV1je8IY%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
Protocol: H2
Server: 2606:4700::6812:18ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:02 GMT
cf-cache-status: DYNAMIC
x-function: 302
server: cloudflare
content-type: image/gif; charset=utf-8
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7d086d482a3c9170-FRA
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:02 GMT
cf-cache-status: DYNAMIC
x-function: 206
server: cloudflare
x-reuse-index: 1
content-type: text/html
location: https://s.tribalfusion.com/z/i.match?p=b6&u=CAESEGLGuLeRM3wzHpncUx8ZwcM&google_cver=1&google_push=ATf1kGPYQeMsUPrpro2rhSFlFXFK2pGr5zTgIh-HsnRb1m-uNavhXxcI-8kEIx8bphjG_wcNfyfyfLPJIldcOJPK9rtYV1je8IY&redirect=https%3A//cm.g.doubleclick.net/pixel%3Fgoogle_nid%3Dexp%26google_push%3DATf1kGPYQeMsUPrpro2rhSFlFXFK2pGr5zTgIh-HsnRb1m-uNavhXxcI-8kEIx8bphjG_wcNfyfyfLPJIldcOJPK9rtYV1je8IY%26google_ula%3D2786954%26google_hm%3D%24TF_USER_ID_ENC%24
p3p: CP="NOI DEVo TAIa OUR BUS"
cache-control: no-cache, private
cf-ray: 7d086d454e789170-FRA
alt-svc: h3=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 267D
Redirect Chain

https://a.c.appier.net/gcm?google_gid=CAESED8l0Pnyh410O5WY6EkYDCA&google_cver=1&google_push=ATf1kGNwULKmwBcgy33Tho8MpJXo9-2BK7arDEpgtHX-2vbaBF-IF2C2uXpwoaRvs3QdZldRFSecC2dCyQd_19tM08wOYOR8-ooz
https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=d3ZUQ2s3UjFDUlc3Qmc4OHFyWjRaQQ%3D%3D&google_push=ATf1kGNwULKmwBcgy33Tho8MpJXo9-2BK7arDEpgtHX-2vbaBF-IF2C2uXpwoaRvs3QdZldRFSecC2dCyQd_1...

170 B
188 B

24ms
23ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=d3ZUQ2s3UjFDUlc3Qmc4OHFyWjRaQQ%3D%3D&google_push=ATf1kGNwULKmwBcgy33Tho8MpJXo9-2BK7arDEpgtHX-2vbaBF-IF2C2uXpwoaRvs3QdZldRFSecC2dCyQd_19tM08wOYOR8-ooz

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=appier&google_hm=d3ZUQ2s3UjFDUlc3Qmc4OHFyWjRaQQ%3D%3D&google_push=ATf1kGNwULKmwBcgy33Tho8MpJXo9-2BK7arDEpgtHX-2vbaBF-IF2C2uXpwoaRvs3QdZldRFSecC2dCyQd_19tM08wOYOR8-ooz
date: Thu, 01 Jun 2023 15:18:02 GMT
cache-control: no-store
content-type: text/html; charset=utf-8
server: nginx
content-length: 243
p3p: CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 267D
Redirect Chain

https://d5p.de17a.com/cookies/google?google_gid=CAESEBztJJA3fO8gdziz848BNU4&google_cver=1&google_push=ATf1kGNHlzcpDKRuiYzNuQyV7QulYgz6N4jVFi_BjJajrCcOgYvaOffRobLac01cXMNyxk9x_k5hn0Y5C0FodSi_bKss4j2...
https://d5p.de17a.com/cookies/google;c?google_gid=CAESEBztJJA3fO8gdziz848BNU4&google_cver=1&google_push=ATf1kGNHlzcpDKRuiYzNuQyV7QulYgz6N4jVFi_BjJajrCcOgYvaOffRobLac01cXMNyxk9x_k5hn0Y5C0FodSi_bKss4...
https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGNHlzcpDKRuiYzNuQyV7QulYgz6N4jVFi_BjJajrCcOgYvaOffRobLac01cXMNyxk9x_k5hn0Y5C0FodSi_bKss4j296KM_

170 B
188 B

23ms
23ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGNHlzcpDKRuiYzNuQyV7QulYgz6N4jVFi_BjJajrCcOgYvaOffRobLac01cXMNyxk9x_k5hn0Y5C0FodSi_bKss4j296KM_

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:02 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=delta_projects_ab&google_ula=668382&google_push=ATf1kGNHlzcpDKRuiYzNuQyV7QulYgz6N4jVFi_BjJajrCcOgYvaOffRobLac01cXMNyxk9x_k5hn0Y5C0FodSi_bKss4j296KM_
content-length: 0
p3p: CP=NON CURa ADMa DEVa TAIa OUR STP IND UNI COM NAV

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 267D
Redirect Chain

https://pixel.rubiconproject.com/exchange/sync.php?p=dfp&google_gid=CAESEHmS-5rCtP1vGlGyuz0fG5g&google_cver=1&google_push=ATf1kGMzSsYuWLGtAy-goZmcPI-l1w0ZKV57WEg5aQBBpi7jP6d7CoT632PVYriQfRKMjja5CLj...
https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TElEQTZERTktRy1BUFdM&google_push=ATf1kGMzSsYuWLGtAy-goZmcPI-l1w0ZKV57WEg5aQBBpi7jP6d7CoT632PVYriQfRKMjja5CLjqtBzpaT2bgwZCaFCqubjxZbng

170 B
188 B

23ms
22ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TElEQTZERTktRy1BUFdM&google_push=ATf1kGMzSsYuWLGtAy-goZmcPI-l1w0ZKV57WEg5aQBBpi7jP6d7CoT632PVYriQfRKMjja5CLjqtBzpaT2bgwZCaFCqubjxZbng

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Type: text/html
Location: https://cm.g.doubleclick.net/pixel?google_nid=rp&google_hm=TElEQTZERTktRy1BUFdM&google_push=ATf1kGMzSsYuWLGtAy-goZmcPI-l1w0ZKV57WEg5aQBBpi7jP6d7CoT632PVYriQfRKMjja5CLjqtBzpaT2bgwZCaFCqubjxZbng
Cache-Control: no-cache,no-store,must-revalidate
content-length: 0
X-RPHost: 66ef90d06496cfd000aab8206f2b6221
Expires: 0

GET
H2 204 v1
match.sharethrough.com/E4rooAtA/ Frame 267D 0
362 B 44ms
7ms Image
text/plain 52.28.18.50
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.sharethrough.com/E4rooAtA/v1?google_gid=CAESEMPaO-V14_nZKFwH8KBTdeg&google_cver=1&google_push=ATf1kGM4mXVldaIvmpw1C3aJc6F7yeJOb2amn7JdKzw_mkrM0B-coUl5hmCZz3Q0dbWfVD5MiElSsUfmoQzeiWEbgQ8y6cHRNxfBPQ
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.28.18.50 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-28-18-50.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:01 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 267D
Redirect Chain

https://a.rfihub.com/cm?pub=445&in=1&google_gid=CAESEFXHX7Bwqw27EWbAsqB2hH8&google_cver=1&google_push=ATf1kGPkuy7ofWnVFvlzS8_3wzgqeOtR2_24TUz1BWVDkSiEzS60O4oQzWDH6A_QGRfGGQJ3soBUtPLCbJ_DFY7e6ZpJHHH...
https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ATf1kGPkuy7ofWnVFvlzS8_3wzgqeOtR2_24TUz1BWVDkSiEzS60O4oQzWDH6A_QGRfGGQJ3soBUtPLCbJ_DFY7e6ZpJHHHTqf4R-w&google_hm=ODAwODUyN...

170 B
188 B

24ms
24ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ATf1kGPkuy7ofWnVFvlzS8_3wzgqeOtR2_24TUz1BWVDkSiEzS60O4oQzWDH6A_QGRfGGQJ3soBUtPLCbJ_DFY7e6ZpJHHHTqf4R-w&google_hm=ODAwODUyNTQ1NjgyNzQ4NTU4OA==

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:01 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=zeta_interactive&google_push=ATf1kGPkuy7ofWnVFvlzS8_3wzgqeOtR2_24TUz1BWVDkSiEzS60O4oQzWDH6A_QGRfGGQJ3soBUtPLCbJ_DFY7e6ZpJHHHTqf4R-w&google_hm=ODAwODUyNTQ1NjgyNzQ4NTU4OA==
Date: Thu, 01 Jun 2023 15:18:01 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 267D 0
12 B 22ms
20ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LLLqJlMPkSsL7BdDyO7c77lZYMgglrXUyWvTEv8aiJi3pOxLuAdsJ6rkiFRONCTjmyI7cLH8A

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:01 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/10280066017482758390/DE-DEU_XA-10_0_160x600_BAN-A_HTML5%20_BOFU-no-Security-FirewallSubHubBanners-Security-ALL_0_105/ Frame 24B4 165 KB
92 KB 17ms
13ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10280066017482758390/DE-DEU_XA-10_0_160x600_BAN-A_HTML5%20_BOFU-no-Security-FirewallSubHubBanners-Security-ALL_0_105/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c9ef1a131b4b3e1d3c7f40727b13ecfa33ded98e5e84c91e1f07d20bd6a0989c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 299703
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 94090
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 29 May 2023 04:02:58 GMT
expires: Tue, 28 May 2024 04:02:58 GMT
last-modified: Wed, 08 Feb 2023 09:20:18 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4057 0
0 53ms
53ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsviix1-AOGVsj2OlnxfzhSqzU63cyv76oDUfTlr9evXgqlN-KL3BkS-4uVkmwKTby9s_aIe455Qa7-ThvPu7wX_uHOcxXJcVkpdEKEzCFv0zJu4HSI4u6UFizYSfGPXvU4_uAbaS9JJ303fed94DBf2K05zH_4It9vXfFhBQnzpCu_tWoRPetept7bFWfSD1gfx1IVKsOqgWzG1M1YCBaZXug&sai=AMfl-YSl5VzdZXRA8J1o0w59A3ReOAwpDVzr8ZcjS6pI-irrDHNo_n1i5prDJCw15JgWom9DVDBC1n6lMiLycTbBybZoZmLyrfGhPez3lnOxDeySG2y3hxzY10YAxzmb06v0zHCS9W2uDJ-d55J8TJNsmEVNWg&sig=Cg0ArKJSzMH2CBTALCX9EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=144&cbvp=1&cstd=142&cisv=r20230530.55237&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:01 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 01 Jun 2023 15:18:01 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 4057 43 B
215 B 98ms
98ms Image
image/gif 2600:1f18:1aca:4281:ac44:4026:62a9:ef97
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1135760&asId=dd20371c-5f63-8b87-fe63-2d3c1c99a7ef&tv=%7Bc:eiEtVN,pingTime:-10,time:562,type:s,mvn:ZnNjPTEzLHNkPTMsbm89OCxhc3A9MQ--,sd:MTcuNi4ydjEyMDB8fDE2MDB8fDF8fDF8fDI0fHwxMjAwfHwwfHwwfHwxfHxsYW5kc2NhcGUtcHJpbWFyeXx8MjR8fDQvM3x8NC8zfHwwfHwxNjAw,no:MTcuNi4ydk1vemlsbGF8fE5ldHNjYXBlfHxufHxufHwwfHxufHxXaW4zMnx8R2Vja298fDIwMDMwMTA3fHwwfHxNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvMTE0LjAuNTczNS45MCBTYWZhcmkvNTM3LjM2fHwxfHwxfHxHb29nbGUgSW5jLnx8bg--,ch:n,fsc:17.6.2v222222220002222202222222220222222222202222222220222202000022000220222222220000222202002222202222222220222222220000020022222200022222220200000222200022220002022022022222202002220222022222022220000220200000022220222220222222222222202222222222222222222222222222222222222200000022022020020000002022202022022022222222000000000020222202022022222000000020000000000000000000020220202220000022200222202220022200200222022202220022220222200202222020002200002222022222202222000002002002222222202220022202200022002220222202,asp:1685632681875%7C%7Ce45bf70128bab68ddcbf9807f276392e%7C%7Ce2cb1dcbe7da8721e3ae9a3fd2b4449b%7C%7C06d2ea021d189e6567e74f006077ada7%7C%7Cb9d0f90beb09f87d32875997b2c4c772%7C%7Ca9a04dfcc4d730f877da61c3cd683e3a%7C%7C6891f417ce88c2588dcc9f0bac446c5e%7C%7C7acbba673ec39cb06a3546dff05e7f77%7C%7C1663701684%7D
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:ac44:4026:62a9:ef97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:01 GMT
server: nginx
x-server-name: dt16.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 Cisco_Logo_no_TM_White-RGB.svg.js Show response
s0.2mdn.net/sadbundle/10280066017482758390/DE-DEU_XA-10_0_160x600_BAN-A_HTML5%20_BOFU-no-Security-FirewallSubHubBanners-Security-ALL_0_105/ Frame 24B4 2 KB
931 B 14ms
14ms Script
application/x-javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/10280066017482758390/DE-DEU_XA-10_0_160x600_BAN-A_HTML5%20_BOFU-no-Security-FirewallSubHubBanners-Security-ALL_0_105/Cisco_Logo_no_TM_White-RGB.svg.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10280066017482758390/DE-DEU_XA-10_0_160x600_BAN-A_HTML5%20_BOFU-no-Security-FirewallSubHubBanners-Security-ALL_0_105/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0ec058db34cc59a88a28a614511985cd3629885c221e962499640dd6cb46a2fc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10280066017482758390/DE-DEU_XA-10_0_160x600_BAN-A_HTML5%20_BOFU-no-Security-FirewallSubHubBanners-Security-ALL_0_105/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 29 May 2023 04:02:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 299704
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 902
x-xss-protection: 0
last-modified: Wed, 08 Feb 2023 09:20:18 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 May 2024 04:02:58 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame DA42 0
20 B 52ms
52ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BqWp0qbZ4ZIHFAsTgx_APyca3-A0AAAAAOAHgBAI&bg=!Dg2lDVnNAAZu7ficTu07ADkAdvg8WvSqelcCnNOUb-hZtCiwft7RJ1H_w9i9zTPihYfE7eVJPkM4YrX_gh6ORaNo2d0753g1Ja4CAAABoVIAAAADaAEHCgAIoZ8Js5jUNO-ZA0kZtAM2o-eRGr9ESIrNyBX4PgPFrVD3woncX_C5XZ7eeMLZAZs0uQeYjjek3E7cRbyom4WBYaFDt3x185_Zdprn7Y52nrfEQX2rWLqKUQBeC-R-5m5AiaferMqh7gH70TAO3nMjoDIFKOhvNWMtsUrELlPNuKbY4s-EB6dzax_JOD3_I-574iJl42O_BVvxgOjMH2qIemuoPV7MkbXXEugi5gYmulKogmaToGXkDjX8QbqZWADFAOchGLpFd4wE3ABj_mLuRtjmT_H53VBNVemUmlEe7tH7_5sFe6X_1hjG2F8sD6TjSeaN1E4h9wrdfZVKPx1ydIFNmb54DNrryqnpkTmfKeKptNkBUJGfsW-ytqOlSnLBurc6mnkItfOnYC4JhJxhJfj6bfg4eMQe4hf4CU-R_IdmSbgFUTeRQA3JqlyqfTZV492TanCTty6-hUiqFOLS9diZpbOuoj6r9vwdhl0gMzjGetG--p0OvapufFbFZP_4VpaGmJJ-kplpxgz3508btQ8su6bn20QiJCMUpozemfov-6XlpNngzlM7nK0EczFsCgccwQLzoWNdB9LQLw_uOnbVHyFHxoakXASpwc0OkboiEJceuUo4Fh03ytMo9fzGvj0L2lVpxsAo-iDxdFM-mWF-I8DtKsg7665NcLwfzMZglL9dbXiyA7K7nIZGsbyXb7DLcLWSm-UEf-eNU5WEqFyNXdLprLHKZjsZ8Wt5ioosnrIgIOBpp-5tPakINBkY7BrwwE8xiWkoCb0xoFsl_an1JF5v2iAnVSFENoNm9kPDMjrujJf-s5uhmDTILXtk891zBn3dSiFKf4wcENwjPYbYP9inlqVNzmz8ZCErvz_4i27229Jsv5NdZpqfNFWr1EJEKbzQiEx_DA30fOdrPHGUEEm7FsRS3iv2M4Vf4cMg2EmuLpTLe9C4FlcekjqE0kF3Abd_ZzNCTmZ1ooy1rfmixtBqlBFAZi-JxpI5zoDNG1XMf3kZGar3CE3zQy5d0zqUB5ApW1CsFCZqr2BR3BhS5g2NK_oiPCYhp03M8245k8L7V9IKvSvqNHWTY2AVYzfhYuiRTOPMWB8aHR2-2yTsxdimCiP9_SZ_29yWjg_ASRx7

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ Frame 24B4 73 KB
73 KB Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 24366c51064fc57cb419cc93db561f43bf3461affb1d04deb4d552a7e2ba4956

Request headers

Referer
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 4057 0
0 52ms
51ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsviix1-AOGVsj2OlnxfzhSqzU63cyv76oDUfTlr9evXgqlN-KL3BkS-4uVkmwKTby9s_aIe455Qa7-ThvPu7wX_uHOcxXJcVkpdEKEzCFv0zJu4HSI4u6UFizYSfGPXvU4_uAbaS9JJ303fed94DBf2K05zH_4It9vXfFhBQnzpCu_tWoRPetept7bFWfSD1gfx1IVKsOqgWzG1M1YCBaZXug&sai=AMfl-YSl5VzdZXRA8J1o0w59A3ReOAwpDVzr8ZcjS6pI-irrDHNo_n1i5prDJCw15JgWom9DVDBC1n6lMiLycTbBybZoZmLyrfGhPez3lnOxDeySG2y3hxzY10YAxzmb06v0zHCS9W2uDJ-d55J8TJNsmEVNWg&sig=Cg0ArKJSzMH2CBTALCX9EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=331&vt=11&dtpt=187&dett=3&cstd=142&cisv=r20230530.55237&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:02 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 01 Jun 2023 15:18:02 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame ED32 0
20 B 51ms
51ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BAoftqbZ4ZJC9CZTMgAfd4ZeQBAAAAAA4AeAEAg&bg=!ysmlyZ3NAAZu7ficTu07ADkAdvg8WvBH-DmMrwYthwo2JWsevTqoKOh3ZNtmUDXVot2my6pAaQKg4oUGnAT1VH6hvq2_VML8cFYCAAABwVIAAAADaAEHmQMpBjzq_gUkAnrEifSaPq-QyvH-0PVxpuoWrxZ6GoOe1QsGicWuP-L-sKl_mnqSFRAo7nhiufnn2ZfFOeZ-0pXDa9rTQT-MXhK9ezA2ig4IkCkvPXeVwx0ujFPliwaBm7deJn-jxOEpEZgo0l-mL-BeQbxNyIxgzOtaO088j5rutP0Ql4NuM1b-VBKxZ-JfN5n1vaXOLciBYrqCoEtivFYuCtr9R7CPA1-q_mbuD9cN9uklapST7rsVmUKDeuXC2oa7mZOrT5TVoP1vVlYoZSnKBlk02kYez2VcMDIKe6qMt1GsO25his4BD29ADkvuO4Rk0SR1gLFTuhJWEkBQ04eOLEKVqrqqClLjxEP51bHWaaJCr9fwP13iyIXO-pYP95NjddofBPJiPPD5RFnUXkejA8IPZnhG54iV_Yiq0nglbobtTYBTxGSfoGWvCzbDW3TFMCrIrhIE1xIHReUP6L8Y5J-LfAPrViuG8fadtsl9u7LWJ43OlNcC59MVuSFPMijtCztAGaGZItR3hBCRmgjfaM-_GNCrhtEdHGlbIcMVTsuByA9sHjgV72ISRWDOkTk-pHE_fIGbPkVQ2kqS1XYjaVlzJfhS-6JChY0vU931jazMwNT9lg1Mjt6zuNRa12ogHIjqF8QdmjaGhQ8r5JyHrE3jrh2J0aDGFsCq-YqqgjoLVq6S913zuxREJTo7eQLadD4Jh0ECi79BXMo-15Xij5yhRaDKvZZeJwTsDJSlSmZ7lL9ZetpcAfIi1lEpDOm1xYiE2zW0GWj0Qi1qcnJpsP4RjRgJvSTuV9eB9SFdepI8Rl58X6ZUXAtuF-UkZo116-1RNJFpLbKg9r0ApmkY8yjAuXpRI7cOCE3Aa83HUOC_Ez04XB7_ytlivD0e8jWoSEV2_ftgIZzL5ybeRzRtaPHUgG4sd1P6W1z_32zxgJE1erDSJk4wZBl_NkMD60jTlkPPz3YYoDfqTthpRwELmKAkGO8yJFqccfH3c-1LDr9PiPpxNTN2yibSDny723aiYnSFgsudR0TScmbKq781nXMCOOKEPLAayL2wnPBG7xJr0559P1oblCk

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 GettyImages-1014150936black.png
s0.2mdn.net/sadbundle/10280066017482758390/DE-DEU_XA-10_0_160x600_BAN-A_HTML5%20_BOFU-no-Security-FirewallSubHubBanners-Security-ALL_0_105/ Frame 24B4 108 KB
109 KB 14ms
13ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10280066017482758390/DE-DEU_XA-10_0_160x600_BAN-A_HTML5%20_BOFU-no-Security-FirewallSubHubBanners-Security-ALL_0_105/GettyImages-1014150936black.png?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

da7e9ca8324b1937280b0008f307062af5a1c553195931c8bd112e2cdc784093

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10280066017482758390/DE-DEU_XA-10_0_160x600_BAN-A_HTML5%20_BOFU-no-Security-FirewallSubHubBanners-Security-ALL_0_105/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 04:00:11 GMT
x-content-type-options: nosniff
age: 127071
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 111064
x-xss-protection: 0
last-modified: Wed, 08 Feb 2023 09:20:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 May 2024 04:00:11 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 4057 43 B
215 B 98ms
98ms Image
image/gif 2600:1f18:1aca:4281:ac44:4026:62a9:ef97
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1135760&asId=dd20371c-5f63-8b87-fe63-2d3c1c99a7ef&tv=%7Bc:eiEtYM,time:747,type:e,im:%7Bpci:%7Btdr:537%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:72,o:675,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:39,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B668~0%5D,as:%5B668~160.600%5D%7D%7D,%7Bsl:i,t:675,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B72~100%5D,as:%5B72~160.600%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:133,fm:tFWuWM9+11%7C12%7C13%7C141%7C142%7C143%7C15*.1135760-69474490%7C151%7C152,idMap:15*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:40,sis:397%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:ac44:4026:62a9:ef97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:02 GMT
server: nginx
x-server-name: dt04.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 GettyImages-1014150936black.png
s0.2mdn.net/sadbundle/10280066017482758390/DE-DEU_XA-10_0_160x600_BAN-A_HTML5%20_BOFU-no-Security-FirewallSubHubBanners-Security-ALL_0_105/ Frame 24B4 108 KB
109 KB 13ms
13ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/10280066017482758390/DE-DEU_XA-10_0_160x600_BAN-A_HTML5%20_BOFU-no-Security-FirewallSubHubBanners-Security-ALL_0_105/GettyImages-1014150936black.png?

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/10280066017482758390/DE-DEU_XA-10_0_160x600_BAN-A_HTML5%20_BOFU-no-Security-FirewallSubHubBanners-Security-ALL_0_105/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

da7e9ca8324b1937280b0008f307062af5a1c553195931c8bd112e2cdc784093

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/10280066017482758390/DE-DEU_XA-10_0_160x600_BAN-A_HTML5%20_BOFU-no-Security-FirewallSubHubBanners-Security-ALL_0_105/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 04:00:11 GMT
x-content-type-options: nosniff
age: 127071
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 111064
x-xss-protection: 0
last-modified: Wed, 08 Feb 2023 09:20:18 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 30 May 2024 04:00:11 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 656B 0
54 B 617ms
316ms Ping
image/gif 2404:6800:4007:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=4~lida6dc9&c=1915028089605&slotId=957514044802.5&qqid=COv5oomvov8CFYPJ3godxuwMfw&fb=outstream-lima&vmfc=12&vhc=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20230516_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4007:817::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:02 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame 656B 41 KB
15 KB 18ms
18ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20230516_RC00/outstream.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 21:33:59 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 150243
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 29 May 2024 21:33:59 GMT

HEAD
H/1.1

200
OK

file.mp4
r4---sn-5hnednsz.c.2mdn.net/videoplayback/id/d1fb3328759e6223/itag/344/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3820060612/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 656B
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/d1fb3328759e6223/itag/344/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3820060612/sparams/id,itag,source,ctier,acao,ip,ipbits,expire/signa...
https://r4---sn-5hnednsz.c.2mdn.net/videoplayback/id/d1fb3328759e6223/itag/344/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3820060612/sparams/acao,ctier,expire,id,ip,ipbits,ita...

0
0

313ms
102ms

Fetch
video/mp4

2a00:1450:400e:11::9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r4---sn-5hnednsz.c.2mdn.net/videoplayback/id/d1fb3328759e6223/itag/344/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3820060612/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/02E095341D2BC3F14CD3F4212AF9713BE02D8989.0F33F577495DEDEC63F5EF69D3989AD22FCC8D12/key/cms1/cms_redirect/yes/mh/Qi/mip/2a00:c98:2050:a007:2::13/mm/42/mn/sn-5hnednsz/ms/onc/mt/1685632375/mv/m/mvi/4/pl/44/file/file.mp4

Protocol

HTTP/1.1

Server

2a00:1450:400e:11::9 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Thu, 01 Jun 2023 15:18:02 GMT
X-Content-Type-Options: nosniff
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Content-Length: 804957
Last-Modified: Sun, 05 Feb 2023 15:56:19 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: null
Expires: Thu, 01 Jun 2023 15:18:02 GMT

Redirect headers

date: Thu, 01 Jun 2023 15:18:02 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 654
x-xss-protection: 0
pragma: no-cache
server: ClientMapServer
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
location: https://r4---sn-5hnednsz.c.2mdn.net/videoplayback/id/d1fb3328759e6223/itag/344/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3820060612/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,source/signature/02E095341D2BC3F14CD3F4212AF9713BE02D8989.0F33F577495DEDEC63F5EF69D3989AD22FCC8D12/key/cms1/cms_redirect/yes/mh/Qi/mip/2a00:c98:2050:a007:2::13/mm/42/mn/sn-5hnednsz/ms/onc/mt/1685632375/mv/m/mvi/4/pl/44/file/file.mp4
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame 837C 23 KB
9 KB 13ms
13ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 197431
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8727
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Tue, 30 May 2023 08:27:31 GMT
expires: Wed, 29 May 2024 08:27:31 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js Show response
pagead2.googlesyndication.com/bg/ Frame 837C 37 KB
14 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/WucCaKvgDQ9fmljOI_WvgP1fjZ6LWmR4VZAfUyHL0jo.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5ae70268abe00d0f5f9a58ce23f5af80fd5f8d9e8b5a647855901f5321cbd23a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 14:09:39 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4103
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14660
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 31 May 2024 14:09:39 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 8A32 42 B
64 B 78ms
51ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsvGI_uSUdDlf8ozyp-wAs6sZD2lpZtoloKCZntgoKJicEj-pVF-vfAXlR4n_QiDt--pnByeV50WL4iOd6Aa57VU1PqQrO0LQB0x5EJpMMA8plalqod3S6NYSn1JGBHrlbH9j8vH3w&sai=AMfl-YSdNO-pdwhmBg2u5ojQbHPFjVkAPitilCmLd2W7xA5_ksjAuFNTJxZ3lk_rXLt_JPOJC9lH0KbKxax3EQTNW27LKbq_yhB3VN9BJuJvbDSKfcbMcfwkurGgwP7Cd8oC-CCac1yMGcpOucye&sig=Cg0ArKJSzOwjH-VZS4wpEAE&cid=CAQSSwBygQiDZpA2PJ-OSLwyi0elo-zoStioFdaXUH0fcLQuumxdKcZVyTlcPAwrhZEwpAlyF8Vxm1jMHEnXaCFsAqBTLZ2ZqPxE6lcKPRgB&id=lidar2&mcvt=1001&p=80,315,330,1285&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20230531&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=1446165449&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1685632680824&rpt=412&isd=0&lsd=0&met=ce&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 lcpel.go Show response
corporateofficehq.com/cheetah/ 0
37 B 12ms
12ms XHR
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/cheetah/lcpel.go
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.39 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://corporateofficehq.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 01 Jun 2023 15:18:02 GMT
server: Apache/2.4.39 (Ubuntu)
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://corporateofficehq.com
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
content-length: 0
expires: Wed, 31 May 2023 15:18:02 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 837C 0
20 B 51ms
51ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.0.0.0&bgai=BOEolqbZ4ZLanKOuQ9fgPzdSj2A4AAAAAOAHgBAI&bg=!9Pel96PNAAZu7ficTu07ADkAdvg8WmomD1ge-0wbCWwNniueg8Ovw7bkARyG8w-_ynlHhhvoKhgXxG_tJY9_UBOwsoES0x8xITgCAAAAWlIAAAABaAEHmQN5BkFllSmAiIAbIK4mE0Y9qrHrwvqjgAUEkxY1IwLbBlFYTAS83B8rMU74PRpny4InCvt7128ZDsme319MWQ7swAVHpEEnIaTiYpPvF75dYyW0Za2mUh1yGK0aL93wOgQja7c4dnTgMbXGFiTloFWimYkPjYEHEREzdPrDI43FyEvNLEG6KwkqKde25PvDb-VtOvGb-2XH_NsS2Thhv7cw7ZixnfO30fjK4wyr7dZ7wVm6UYsCUUZVyVzOZHAB5OJLa0YPhgPpReK3NfW650IB0jGQJ96k25hsWGJ5UpzfiJ_26GeL8QW2ICSTDGdbvu8VEemkHGUHK0TQ7-c5SGee9dY9b-y_ur87FbbkHtmMihVM9m9hXzXqSGJgBG-769ssK8PzjYxqk3KvQm9BTn2cnHjPvPN751AAJDfgp66mB3N3ya-59OSJt1CdS4eIsoP_jqh4lz9cd5T55W4MvlfxVJgyD3MoprusyznFM3tAnO-2jRG20MUQw38IYwDU3z2gE_bbmCBp6rj3m-nqMkhv8m-f1JNA7_vZzhyzRbJ4O0k8hpyNqEAMeGPjzJvi4_Tare5Z2tKSal372qs0r0LnozGh_PoM4kbx4FQR2OQ0qfEzbAQQyRv5gHhTjkNckfaKmyhZMF0n5X88CfUremT87eI9MTzdr07YID5qNHRsFaX-JJHkaiNsgRDpvcq7_rVNbawP_mUpSb7NJVObXq3NWMjANJotWPCoyR_H1pzLooLWYKpbzrZ27mzrlxRGOV8Gkj90-TqKJ9nHUEIfd2qq3S5ycXAcoo4EYrOPSTGoFiOZ-VkZ-LD8tRBQBAYoUzyMIFLemR_zNKr9MlvPWOLi8q28xthjcHoXoZdy6lGrgFI8j8B3pQ3LwGtE75mah64nxeZjCm1Od8BZBc4wz5kv9VZ8C3lg6NvpBIYb-i5k03nGq57kAJLooRjKF5bLA7Yzkt_xrIjxLqQONoC8zmUJJ_TrqUEKuBwdKqr2MXggAmxjgCaXSoPPsn-n671l8Vq2IgJl_Aj6cKtV5y6eSnR1S3hWwKF0XcjO7_En--RRL2GRDK3j4bWViJ3SnDRyHyJUeWNbfWi4hNmfQBzlkom7hHLlxQ1FyXRwHl7gfS7KL4c29ZnUtr9PrPQOd3ZiIXf1_Cqb-EnhIT1w_9u-ZgbL0VIU41DKetY3EA

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
16 B 9ms
9ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1NjY5MzYwODg1MzUzNiIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6MTE0NywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbOTcwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjExNTY2OTM2MDg4NTM1MzYiLCJkb21haW5faWQiOiIxMTQzOCIsInVuaXQiOiJkaXYtZ3B0LWFkLWNvcnBvcmF0ZW9mZmljZWhxX2NvbS1ib3gtMi0wIiwidF9lcG9jaCI6MTY4NTYzMjY3OSwiYWRfcG9zaXRpb24iOjExNDcsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMzY3NzM4MTYtZTY1OC00MTBhLTY3NmEtYjQ3Y2NjNTk2ZTBjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiIxMTU2NjkzNjA4ODUzNTM2IiwiZG9tYWluX2lkIjoiMTE0MzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1jb3Jwb3JhdGVvZmZpY2VocV9jb20tYm94LTItMCIsInRfZXBvY2giOjE2ODU2MzI2NzksImFkX3Bvc2l0aW9uIjoxMTQ3LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjM2NzczODE2LWU2NTgtNDEwYS02NzZhLWI0N2NjYzU5NmUwYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTMsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMTkyIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:02 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:02 GMT

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
16 B 10ms
10ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNTI0NDE4OTU2ODg2NjU1MCIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLWVkZ2UtMi0wIiwidF9lcG9jaCI6MTY4NTYzMjY3OSwiYWRfcG9zaXRpb24iOjE5NzYsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMzY3NzM4MTYtZTY1OC00MTBhLTY3NmEtYjQ3Y2NjNTk2ZTBjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MCwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9zaXplIiwidmFsIjoiWzE2MCw2MDBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI1MjQ0MTg5NTY4ODY2NTUwIiwiZG9tYWluX2lkIjoiMTE0MzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1jb3Jwb3JhdGVvZmZpY2VocV9jb20tZWRnZS0yLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6MTk3NiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjUyNDQxODk1Njg4NjY1NTAiLCJkb21haW5faWQiOiIxMTQzOCIsInVuaXQiOiJkaXYtZ3B0LWFkLWNvcnBvcmF0ZW9mZmljZWhxX2NvbS1lZGdlLTItMCIsInRfZXBvY2giOjE2ODU2MzI2NzksImFkX3Bvc2l0aW9uIjoxOTc2LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjM2NzczODE2LWU2NTgtNDEwYS02NzZhLWI0N2NjYzU5NmUwYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NTAsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMzEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:02 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:02 GMT

GET
H3 206 file.mp4
r4---sn-5hnednsz.c.2mdn.net/videoplayback/id/d1fb3328759e6223/itag/344/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/3820060612/sparams/acao,ctier,expire,id,ip,ipbits,itag,mh,mip... Frame 656B 786 KB
786 KB 204ms
187ms Media
video/mp4 2a00:1450:400e:11::9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400e:11::9 , Ireland, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

5e84c10951b1716b6d0ad50ef25fef26627f509f5ab6cc92ad9eab21176cf596

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Range: bytes=0-

Response headers

expires: Thu, 01 Jun 2023 15:18:02 GMT
date: Thu, 01 Jun 2023 15:18:02 GMT
x-content-type-options: nosniff
Content-Range: bytes 0-804956/804957
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,quic=":443"; ma=2592000; v="46"
Content-Length: 804957
last-modified: Sun, 05 Feb 2023 15:56:19 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
access-control-allow-origin: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
client-protocol: quic

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8A32 0
20 B 122ms
122ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=8063570358290&version=m202301230201&ct=76&x=1&cor=6191264625861048000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
62 B 13ms
13ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1NjY5MzYwODg1MzUzNiIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJyZXZlbnVlIjowLCJlc3RfcmV2ZW51ZSI6MCwiYWRfcG9zaXRpb24iOjExNDcsImFkX3NpemUiOiIiLCJiaWRfZmxvb3JfZmlsbGVkIjowLCJiaWRfZmxvb3JfcHJldiI6MCwic3RhdF9zb3VyY2VfaWQiOjAsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoidmlld2VkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:04 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:04 GMT

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 4057 42 B
64 B 51ms
51ms Fetch
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst0ROjUZ8WOirtek57udNokOXe9Mym8hYZZMt1yIDdeQpc_JprzyafaRO-ZughyP_V134hePv9QQ70B1zD7jbwP_57wcOosU7vNFkahcIn42K4aPz7IDS0eIaJgU5iUCpyBmOMqrw&sai=AMfl-YQ3ZvzOEwaOJlbZGXS3aS_8W616-SqzajnItGRSgz7xaKGX0CYcbIjDcPXN6tbhMHpzRc3hS-XeeR2q-Pu1n8vFpcE0Jl6RAJ8WBf5ke9gEkk2Hx34psIO9ntkBNXmWvwyo2gIxkM5b5DyI&sig=Cg0ArKJSzPv-L4uyCM49EAE&cid=CAQSSwBygQiDVz-d5MSEJH_2Kk2lJCSD60bMitRrqYBguA5I3HRQXF1wo5sLzvO8N6W8WiKQjGQNHDZsgCNaVszS259iry30xBUZeaPKVRgB&id=lidar2&mcvt=1000&p=302,1559,342,1600&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20230531&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=2316602925&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ%3D%3D&vs=4&r=v&rst=1685632680907&rpt=849&isd=0&lsd=0&met=ie&wmsd=0&pbe=0&vae=0&spb=0&ffslot=0&reach=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:02 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame 656B 0
54 B 317ms
317ms Ping
image/gif 2404:6800:4007:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=5~lida6dm1&c=1915028089605&slotId=957514044802.5&qqid=COv5oomvov8CFYPJ3godxuwMfw&fb=outstream-lima&gpm_i=9&gpm_c=9&gpm_a=9&smb=1000&br=870&mt=video%2Fmp4&vs=640x360&msm=1&aits=18%2C22%2C37%2C692%2C59%2C342%2C343%2C344%2C345%2C346%2C347&webm=0&vp9=0&vamt=video%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4&hvmf=false&vms=1&bit=344&vsrc=web_video_ads&hcn=0&met.4=arp_a_e.130&ape=1&ple=1&umsem=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20230516_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2404:6800:4007:817::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:03 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
16 B 9ms
9ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTE3NDkwNDIzODg5NjMxNSIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImNvcnBvcmF0ZW9mZmljZWhxX2NvbS1waXhlbDEiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6OTk5OSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjpudWxsLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMTYwMCwxMjAwXSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTE3NDkwNDIzODg5NjMxNSIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImNvcnBvcmF0ZW9mZmljZWhxX2NvbS1waXhlbDEiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6OTk5OSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjpudWxsLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjkxNzQ5MDQyMzg4OTYzMTUiLCJkb21haW5faWQiOiIxMTQzOCIsInVuaXQiOiJjb3Jwb3JhdGVvZmZpY2VocV9jb20tcGl4ZWwxIiwidF9lcG9jaCI6MTY4NTYzMjY3OSwiYWRfcG9zaXRpb24iOjk5OTksImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMzY3NzM4MTYtZTY1OC00MTBhLTY3NmEtYjQ3Y2NjNTk2ZTBjIiwiY29tcF9pZCI6bnVsbCwibGluZV9pdGVtX2lkIjowLCJjcmVhdGl2ZV9pZCI6MCwiZGF0YSI6W3sibmFtZSI6ImRvbWFpbl9kZnBfc3R5bGVfaWQiLCJ2YWwiOiJ1bmRlZmluZWQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:02 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:02 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 4057 43 B
215 B 99ms
99ms Image
image/gif 2600:1f18:1aca:4281:ac44:4026:62a9:ef97
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1135760&asId=dd20371c-5f63-8b87-fe63-2d3c1c99a7ef&tv=%7Bc:eiEuee,pingTime:1,time:1705,type:p,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:39%7D,%7Bpiv:100,vs:i,r:,t:675%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:1030,o:675,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:39,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B668~0%5D,as:%5B668~160.600%5D%7D%7D,%7Bsl:i,t:675,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1030~100%5D,as:%5B1030~160.600%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:100,fm:tFWuWM9+11%7C12%7C13%7C141%7C142%7C143%7C15*.1135760-69474490%7C151%7C152,idMap:15*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:40,sis:397%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:ac44:4026:62a9:ef97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:03 GMT
server: nginx
x-server-name: dt09.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 4057 43 B
215 B 99ms
99ms Image
image/gif 2600:1f18:1aca:4281:ac44:4026:62a9:ef97
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1135760&asId=dd20371c-5f63-8b87-fe63-2d3c1c99a7ef&tv=%7Bc:eiEuee,pingTime:1,time:1705,type:pf,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:39%7D,%7Bpiv:100,vs:i,r:,t:675%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:1031,o:675,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:39,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B668~0%5D,as:%5B668~160.600%5D%7D%7D,%7Bsl:i,t:675,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:100,obst:0,th:0,reas:,bkn:%7Bpiv:%5B1031~100%5D,as:%5B1031~160.600%5D%7D%7D%5D,slEventCount:2,em:true,fr:false,e:,tt:rjss,dtt:100,fm:tFWuWM9+11%7C12%7C13%7C141%7C142%7C143%7C15*.1135760-69474490%7C151%7C152,idMap:15*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:40,sis:397%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:ac44:4026:62a9:ef97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:03 GMT
server: nginx
x-server-name: dt11.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4057 0
20 B 46ms
46ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tler&ord=4152078870957&version=m202301230201&ct=76&x=1&cor=6338914320264547000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
16 B 9ms
9ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNTI0NDE4OTU2ODg2NjU1MCIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLWVkZ2UtMi0wIiwidF9lcG9jaCI6MTY4NTYzMjY3OSwicmV2ZW51ZSI6MCwiZXN0X3JldmVudWUiOjAsImFkX3Bvc2l0aW9uIjoxOTc2LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MCwiYmlkX2Zsb29yX3ByZXYiOjAsInN0YXRfc291cmNlX2lkIjowLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMzY3NzM4MTYtZTY1OC00MTBhLTY3NmEtYjQ3Y2NjNTk2ZTBjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU1MCwiZGF0YSI6W3sibmFtZSI6InZpZXdlZCIsInZhbCI6IjEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:02 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:02 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 24ms
23ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=corporateofficehq.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305300101/pubads_impl.js?cb=31074979

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 22ms
22ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=corporateofficehq.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305300101/pubads_impl.js?cb=31074979

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 35 KB
14 KB 687ms
687ms XHR
text/plain 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=566361812916587&correlator=1581179486028480&eid=31074925%2C31074979%2C31074987%2C31068366%2C676982996&output=ldjh&gdfp_req=1&vrg=202305300101&ptt=17&impl=fifs&iu_parts=1254144%3A29527787%2Ccorporateofficehq_com-edge-1&enc_prev_ius=%2F0%2F1&prev_iu_szs=160x600&ifi=7&adks=1144191278&didk=1929496555&sfv=1-0-40&ris=3&rcs=1&prev_scp=a%3D%257C0%257C%26iid1%3D9049253034881175%26eid%3D9049253034881175%26t%3D134%26d%3D11438%26t1%3D134%26pvc%3D0%26ap%3D1975%26sap%3D1975%26as%3Drevenue%26plat%3D1%26bra%3Dmod62-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D1%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D38%26al%3D1038%26compid%3D0%26tap%3Dcorporateofficehq_com-edge-1-9049253034881175%26eb_br%3D3ba982fc4238dd4197b1d51b345478dc%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C10015%2C10063%2C11304%2C11307%26asau%3D8206438403%26bv%3D3%26bvm%3D0%26bvr%3D8%26avc%3D485%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D50%26br2%3D50%26ezoic%3D1%26nmau%3D0%26mau%3D0%26sticky%3D1%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C4184%2C4185%2C4186%2C1893%2C783%2C5534%2C19%2C2688%2C3045%2C4276%26ax_ssid%3D10082%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2%26lb%3D100%26reqt%3D1685632683231&eri=1&sc=1&cookie=ID%3D41ad7ed754f81817%3AT%3D1685632680%3ART%3D1685632680%3AS%3DALNI_MaRj92dmnm8OptM6obT4Qstrzu0ug&gpic=UID%3D00000c3a8d5c66bf%3AT%3D1685632680%3ART%3D1685632680%3AS%3DALNI_MYAeuJ3Er27BT8t3XIiqLlx67gm6A&abxe=1&dt=1685632683235&lmt=1685632683&dlt=1685632679437&idt=353&adxs=0&adys=302&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fcorporateofficehq.com%2F&frm=20&vis=1&psz=160x-1&msz=160x-1&fws=512&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1290599683.1685632680&ga_sid=1685632680&ga_hid=1089242052&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYk_-lvIcxSABSAghkEhkKCnB1YmNpZC5vcmcY_YCmvIcxSABSAghqEsIBCghydGJob3VzZRKsAUc4QmlVWGc4NWNBbW05Rko1Q1gxK2E3SGd1U0REUHh4b1cvTk02dTVTZlFTWXFXcWRxMXJjMmorS0hnNS9OQkV4RWY2d20vVVF3T09JRlNHOVpqMjJKWU8yN0RVQjRKaEoyNnVqR292NG5qVTV6SU9zVjRWcURydjkvS1N1bjV2NGhhVXhBMjcvdXBTYW0xdXI5YUtZeXlrM1RCZ0NtWUZvei9hdlJTSXJzcz0Y9oGmvIcxSAASHQoOZXNwLmNyaXRlby5jb20Yk_-lvIcxSABSAghkEhkKCnVpZGFwaS5jb20Yk_-lvIcxSABSAghkEj4KBW9wZW54EixleUpwSWpvaU5VNW9VbVJHVXpGU04ybDVLMEowYVhFeWRqVmFRVDA5SW4wPRjgg6a8hzFIABIbCgxpZDUtc3luYy5jb20Yh4KmvIcxSABSAghq

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305300101/pubads_impl.js?cb=31074979

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

2ce0f8913bd32948aec2a18fb3ae676e0297c795faaa2823734680033fc874f4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:03 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14114
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://corporateofficehq.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 35 KB
14 KB 743ms
742ms XHR
text/plain 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=566361812916587&correlator=1565544663034557&eid=31074925%2C31074979%2C31074987%2C31068366%2C676982996&output=ldjh&gdfp_req=1&vrg=202305300101&ptt=17&impl=fifs&iu_parts=1254144%3A29527787%2Ccorporateofficehq_com-large-billboard-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=320x50%7C250x250%7C300x250%7C200x200%7C180x150%7C234x60%7C336x280%7C320x50%7C320x100%7C120x240%7C125x125&fluid=height&ifi=8&adks=1596314567&didk=389929810&sfv=1-0-40&ris=3&rcs=1&prev_scp=a%3D%257C0%257C%26iid1%3D7647899346843253%26eid%3D7647899346843253%26t%3D134%26d%3D11438%26t1%3D134%26pvc%3D0%26ap%3D1154%26sap%3D1154%26as%3Drevenue%26plat%3D1%26bra%3Dmod62-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D5%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D34%26al%3D1034%26compid%3D0%26tap%3Dcorporateofficehq_com-large-billboard-2-7647899346843253%26eb_br%3Dc352ba581bd3ffd8cea608cf2d55f519%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C10015%2C10063%2C11304%2C11307%26asau%3D8206438403%26bv%3D3%26bvm%3D0%26bvr%3D8%26avc%3D485%26shp%3D2%26ftsn%3D12%26ftsng%3D12%26br1%3D60%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D157%2C168%2C0%2C67%2C0%2C131%2C196%2C0%2C192%2C30%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C815%2C816%2C817%2C818%2C893%2C899%2C903%2C919%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3915%2C3919%2C3933%2C4184%2C4185%2C4186%2C4604%2C4605%2C1893%2C783%2C5534%2C19%2C2688%2C3045%2C4276%26ax_ssid%3D10082%26amznbid%3D2%26amznp%3D2%26amznsz%3D0x0%26lb%3D120%26reqt%3D1685632683227&eri=1&sc=1&cookie=ID%3D41ad7ed754f81817%3AT%3D1685632680%3ART%3D1685632680%3AS%3DALNI_MaRj92dmnm8OptM6obT4Qstrzu0ug&gpic=UID%3D00000c3a8d5c66bf%3AT%3D1685632680%3ART%3D1685632680%3AS%3DALNI_MYAeuJ3Er27BT8t3XIiqLlx67gm6A&abxe=1&dt=1685632683241&lmt=1685632683&dlt=1685632679437&idt=353&adxs=1120&adys=453&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fcorporateofficehq.com%2F&frm=20&vis=1&psz=300x269&msz=300x250&fws=0&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1290599683.1685632680&ga_sid=1685632680&ga_hid=1089242052&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYk_-lvIcxSABSAghkEhkKCnB1YmNpZC5vcmcY_YCmvIcxSABSAghqEsIBCghydGJob3VzZRKsAUc4QmlVWGc4NWNBbW05Rko1Q1gxK2E3SGd1U0REUHh4b1cvTk02dTVTZlFTWXFXcWRxMXJjMmorS0hnNS9OQkV4RWY2d20vVVF3T09JRlNHOVpqMjJKWU8yN0RVQjRKaEoyNnVqR292NG5qVTV6SU9zVjRWcURydjkvS1N1bjV2NGhhVXhBMjcvdXBTYW0xdXI5YUtZeXlrM1RCZ0NtWUZvei9hdlJTSXJzcz0Y9oGmvIcxSAASHQoOZXNwLmNyaXRlby5jb20Yk_-lvIcxSABSAghkEhkKCnVpZGFwaS5jb20Yk_-lvIcxSABSAghkEj4KBW9wZW54EixleUpwSWpvaU5VNW9VbVJHVXpGU04ybDVLMEowYVhFeWRqVmFRVDA5SW4wPRjgg6a8hzFIABIbCgxpZDUtc3luYy5jb20Yh4KmvIcxSABSAghq

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305300101/pubads_impl.js?cb=31074979

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cf79273259810e02904debb8c7951600f776a81ae90e32079694742cbee56fc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:03 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14342
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://corporateofficehq.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 35 KB
14 KB 841ms
841ms XHR
text/plain 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=566361812916587&correlator=1719204081418442&eid=31074925%2C31074979%2C31074987%2C31068366%2C676982996&output=ldjh&gdfp_req=1&vrg=202305300101&ptt=17&impl=fifs&iu_parts=1254144%3A29527787%2Ccorporateofficehq_com-medrectangle-2&enc_prev_ius=%2F0%2F1&prev_iu_szs=728x90&ifi=9&adks=314460937&didk=997376991&sfv=1-0-40&ris=3&rcs=1&prev_scp=a%3D%257C0%257C%26iid1%3D6764778640868367%26eid%3D6764778640868367%26t%3D134%26d%3D11438%26t1%3D134%26pvc%3D0%26ap%3D1108%26sap%3D1108%26as%3Drevenue%26plat%3D1%26bra%3Dmod62-c%26ic%3D2%26at%3Dmbf%26adr%3D399%26ezosn%3D2%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D5%26al%3D1005%26compid%3D0%26tap%3Dcorporateofficehq_com-medrectangle-2-6764778640868367%26eb_br%3Dc352ba581bd3ffd8cea608cf2d55f519%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C10015%2C10063%2C11304%2C11307%26asau%3D8206438403%26bv%3D3%26bvm%3D0%26bvr%3D8%26avc%3D485%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D60%26br2%3D60%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D77%2C168%2C0%2C67%2C0%2C131%2C196%2C0%2C192%2C30%2C187%2C0%2C901%2C182%2C901%2C902%2C903%26deal1%3D17%2C20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C28%2C29%2C30%2C760%2C761%2C813%2C814%2C815%2C816%2C817%2C818%2C819%2C893%2C899%2C903%2C917%2C918%2C919%2C1794%2C2310%2C2339%2C2351%2C2526%2C2527%2C2610%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3915%2C3919%2C3933%2C4184%2C4185%2C4186%2C4604%2C4605%2C1893%2C783%2C5534%2C19%2C2688%2C3045%2C4276%26ax_ssid%3D10082%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2%26lb%3D120%26reqt%3D1685632683220&eri=1&sc=1&cookie=ID%3D41ad7ed754f81817%3AT%3D1685632680%3ART%3D1685632680%3AS%3DALNI_MaRj92dmnm8OptM6obT4Qstrzu0ug&gpic=UID%3D00000c3a8d5c66bf%3AT%3D1685632680%3ART%3D1685632680%3AS%3DALNI_MYAeuJ3Er27BT8t3XIiqLlx67gm6A&abxe=1&dt=1685632683245&lmt=1685632683&dlt=1685632679437&idt=353&adxs=436&adys=1110&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fcorporateofficehq.com%2F&frm=20&vis=1&psz=728x-1&msz=728x-1&fws=512&ohw=0&psts=ABHeCvhldhvV4TW_scWGrI9ycJUN%2CABHeCvhldhvV4TW_scWGrI9ycJUN&ga_vid=1290599683.1685632680&ga_sid=1685632680&ga_hid=1089242052&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYk_-lvIcxSABSAghkEhkKCnB1YmNpZC5vcmcY_YCmvIcxSABSAghqEsIBCghydGJob3VzZRKsAUc4QmlVWGc4NWNBbW05Rko1Q1gxK2E3SGd1U0REUHh4b1cvTk02dTVTZlFTWXFXcWRxMXJjMmorS0hnNS9OQkV4RWY2d20vVVF3T09JRlNHOVpqMjJKWU8yN0RVQjRKaEoyNnVqR292NG5qVTV6SU9zVjRWcURydjkvS1N1bjV2NGhhVXhBMjcvdXBTYW0xdXI5YUtZeXlrM1RCZ0NtWUZvei9hdlJTSXJzcz0Y9oGmvIcxSAASHQoOZXNwLmNyaXRlby5jb20Yk_-lvIcxSABSAghkEhkKCnVpZGFwaS5jb20Yk_-lvIcxSABSAghkEj4KBW9wZW54EixleUpwSWpvaU5VNW9VbVJHVXpGU04ybDVLMEowYVhFeWRqVmFRVDA5SW4wPRjgg6a8hzFIABIbCgxpZDUtc3luYy5jb20Yh4KmvIcxSABSAghq

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305300101/pubads_impl.js?cb=31074979

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d21446a896fabd863952fc06534bd7a6deea4261d93017e04a541211b5b89c0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:04 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14038
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://corporateofficehq.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 9786 6 KB
3 KB 13ms
13ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305300101/pubads_impl.js?cb=31074979

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://corporateofficehq.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:18:00 GMT
expires: Fri, 31 May 2024 15:18:00 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
74 B 9ms
8ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTA0OTI1MzAzNDg4MTE3NSIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLWVkZ2UtMS0wIiwidF9lcG9jaCI6MTY4NTYzMjY3OSwiYWRfcG9zaXRpb24iOjE5NzUsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMzY3NzM4MTYtZTY1OC00MTBhLTY3NmEtYjQ3Y2NjNTk2ZTBjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6InJlZnJlc2hfY291bnQiLCJ2YWwiOiIyIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5MDQ5MjUzMDM0ODgxMTc1IiwiZG9tYWluX2lkIjoiMTE0MzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1jb3Jwb3JhdGVvZmZpY2VocV9jb20tZWRnZS0xLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6MTk3NSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2JpZF9oYXNoIiwidmFsIjoiM2JhOTgyZmM0MjM4ZGQ0MTk3YjFkNTFiMzQ1NDc4ZGMifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjkwNDkyNTMwMzQ4ODExNzUiLCJkb21haW5faWQiOiIxMTQzOCIsInVuaXQiOiJkaXYtZ3B0LWFkLWNvcnBvcmF0ZW9mZmljZWhxX2NvbS1lZGdlLTEtMCIsInRfZXBvY2giOjE2ODU2MzI2NzksInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDUsImFkX3Bvc2l0aW9uIjoxOTc1LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDA1LCJiaWRfZmxvb3JfcHJldiI6MC4wMDEsInN0YXRfc291cmNlX2lkIjozNSwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjM2NzczODE2LWU2NTgtNDEwYS02NzZhLWI0N2NjYzU5NmUwYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1MTYsImRhdGEiOlt7Im5hbWUiOiJsb2FkZWQiLCJ2YWwiOiIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5MDQ5MjUzMDM0ODgxMTc1IiwiZG9tYWluX2lkIjoiMTE0MzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1jb3Jwb3JhdGVvZmZpY2VocV9jb20tZWRnZS0xLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6MTk3NSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwMzQ1MTYifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjkwNDkyNTMwMzQ4ODExNzUiLCJkb21haW5faWQiOiIxMTQzOCIsInVuaXQiOiJkaXYtZ3B0LWFkLWNvcnBvcmF0ZW9mZmljZWhxX2NvbS1lZGdlLTEtMCIsInRfZXBvY2giOjE2ODU2MzI2NzksImFkX3Bvc2l0aW9uIjoxOTc1LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjM2NzczODE2LWU2NTgtNDEwYS02NzZhLWI0N2NjYzU5NmUwYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1MTYsImRhdGEiOlt7Im5hbWUiOiJsaW5laXRlbV9pZCIsInZhbCI6IjI4Njg3Mjc0In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:03 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:03 GMT

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
16 B 9ms
9ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTA0OTI1MzAzNDg4MTE3NSIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLWVkZ2UtMS0wIiwidF9lcG9jaCI6MTY4NTYzMjY3OSwiYWRfcG9zaXRpb24iOjE5NzUsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMzY3NzM4MTYtZTY1OC00MTBhLTY3NmEtYjQ3Y2NjNTk2ZTBjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6InRfbG9jYWxfZGF0ZSIsInZhbCI6IjIwMjMtMDYtMDEifSx7Im5hbWUiOiJ0X2xvY2FsX2hvdXIiLCJ2YWwiOiIxNSJ9LHsibmFtZSI6InRfbG9jYWxfZGF5X29mX3dlZWsiLCJ2YWwiOiI0In0seyJuYW1lIjoidF9sb2NhbF90aW1lem9uZSIsInZhbCI6IjAifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:03 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:03 GMT

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
16 B 9ms
9ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiOTA0OTI1MzAzNDg4MTE3NSIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLWVkZ2UtMS0wIiwidF9lcG9jaCI6MTY4NTYzMjY3OSwiYXVjdGlvbl9lcG9jaCI6MTY4NTYzMjY4NCwiYWRfcG9zaXRpb24iOjE5NzUsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJiaWRfZmxvb3JfaW5pdGlhbCI6MTAwLCJiaWRfZmxvb3JfcHJldiI6MTAwLCJiaWRfZmxvb3JfZmlsbGVkIjo1MCwiYXVjdGlvbl9jb3VudCI6MiwicmVmcmVzaF9hZF9jb3VudCI6MCwiYXVjdGlvbl9kdXJhdGlvbiI6NzA2LCJtdWx0aV9hZF91bml0IjowLCJtdWx0aV9hZF9jb3VudCI6MCwibmV0d29ya19jb2RlIjoxMjU0MTQ0LCJkYXRhIjpbeyJuYW1lIjoiIiwidmFsIjoiIn1dLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0fV0=
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:03 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:03 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 9C6A 624 B
242 B 55ms
54ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARiLq6DRATAB&v=APEucNWo39bYvMft7jYxK8JMxK7TBHJoPqkifDyLyg4O3O2l6_gulgN1m0rQajOHLTn4BPDP5XVvLr6niQsCqKrWFGdGwJh55gql-7iMWt0jlscTsgujfIdD-Y3U6J12q64Qy5lzbQTOP-ggahMRANaPvViuqLxUbgqALkjpC3l8Gjek6biMNnYFLPXCztFposfMTFFT7xVXlraPq3bcuYjqhzh0XRl-qw

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 222
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:18:03 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 9786 78 KB
27 KB 87ms
86ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:04 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:18:04 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9786 42 B
63 B 48ms
48ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-CF-gga5GhPFV284GG6ofDpw6-LZJTz-QAzWfhI7cejfBEg1JRyi69mSgF0dKTVoN6Tf9pCmvfzcsqZT4qtdTxul5eva41ndlLDh496VY6bESNsSb0

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9786 0
20 B 49ms
48ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=1972743277243848225&x=1&ct=76

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:03 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adj Show response
fw.adsafeprotected.com/rjss/bgd/1135760/65089090/xbbe/creative/ Frame 9786 252 KB
77 KB 36ms
35ms Script
application/javascript 54.194.221.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/bgd/1135760/65089090/xbbe/creative/adj?p=APEucNXsUMOiyaueGNBp86tgt7fpK1wE2sWqjeSextzlesOlMi_yMJw&d=CokBAKAmf-CdB0LC_gr9eDTO2GK9lyig__Lipxa19-Kq0u9yHXbtpjI9-aesroSJuLmvlBUd7rhdBhvHqRLgLpSd3biLNl79RyPiBG42iYjomwPKh216NgGBjGPOsvh0SVo9mjoXVMrzuM-iRhkayq32neAgLfZuvKlA5kqBh6-vADHRreMGLuupWfES2RUAoCZ_4DiVGVQdcJ2HvVocz3OaUSODK0gy3GfX8_zWz_8jCQ9LKN77DaqbDM5uN5tuqO2K3j1HXjE5JkjGqCnh8WGqbvconRVXzvM4mOojXYWELBQ9Qnh82iL_2uNurXFLBxxXPDrkGf0weKqLuc_ob-IAas3bpE2ARdqFx0b41rAXBbiGjcqPaGeV1-2gSgWkhXReOzsClmkHW4Fz2OUhN4GCwJyXzP49WakzQaUScW46QJxIcfNckmDWroPBMtSNiSR4Or4c2k4_mrhLLoQqi4BWd1LZcwJtNDx2lF_1Vzvov5lW7_eR4D4m3jnPTQuyeMCO6gVXrvo8RmwEj-Lg3d_wWTlkB2womcixMHccTmJ7tKthkCvIznZ_uSzcQj4ybQN5ws61ZlOuLkS-TxLGg-fD6KHqo2Bx9QIyk2Dq8X9rWv4TZUMPnuqAR0ygXZshFDeYbe1KB9pw7eg6Er4FYy8Ra1uEabkxxYFxurzgifDsQ0hWxx45fy7u11DvfCSfxQPVAscwY5ZKUl7g89emMZ0bwa56BaCmeGtqwUDLcHORgWt4CChxfT4n789w_-pMwKHZBmb2haM09bVkBkK27qBGJT70sl8CvfhTyppQoxdfdIRLHjUV5WBU_F6d3ddMsIhgJevWFI6GTQs2eBx6vV94WumSHWje9mMVO1zInSVFYzxACaAeVfj0bFQMDxhyLOjXFMT22xXdfXn3q7wQJNwCwszrq6zVzPuWDd50-WM9J9E5f1ewKfhQ5OnYAn3MhdQOJRf9vyPl00cF4CjeYne1WJzOCO1SJSVJEDcaT9lFhNrMDeorW43lG1YKDitPpOFtbuys80H8ZBKST7_1Ov0lU050aB5t-2xXSzhcD-tuSUoPRpr56YMla34m6U6fbwpWXjUP_84L96oSxvR3g_UYYp_LZagtuqnaT172WgNuQUsddLaVd8wOaNqI-ygBTlmpmxdAlCQckv2l7kXUhXlB73pm0gEt4BGA81jTufn1T_dHdAuNPhMzW37_0g89Kd-rXknGl2hwgbjgiZnP0xXEz2uRKe32OIv4IhUVXUrlnJNutCUN5KiZKpEeWMQm0ZkUAOR1jbCvL4Gjru93mn1ITO_MB4VHj-ef3zER4_ZsZQlxp0Ha4Pu_nhjwbOdP-LQPSzkXgSXfEuDyX3s9VKf_n0dZTfiZ8Cki3gwhVO9jNycm6UxvoNIUFya4-YJKN1zfiJMWw_zqgUkxhLu2j_cZW4bL2SUQ31RuhEvMhZbJqzpwmAWQ2nuZhMyOQAt8Nbcl7ArlDh4zdmryTqjAT5tCsJr6M6RgGDt8af-PePQkBe5jTg47Q6C1CDxvlLSwY-Ix5wUuWtLGqqtIdqMJYMCEAVySzsF4qTtZtllZYG4GDubYu7iul1CZopHm0z2gmUUMIQioMOC1rvgKasjafZjkJJE_jJGnreZ62UnxY87Zik7PXgC1rP8EyrU5l52hPnFI6kf2wVJ2wi0kJ7LpI0KMapxU9tX82_7CbO_h2lkaYFfkgTz4qYCGeCY69LOzDSz-IZd0eGZFYGS1niBPCaAa6TH08w99U3BAbM-Ufl-s_yweD8JSt3GwqBFFkuxadNnRzQcNiKKQNMSFte-rjneUgJvthIdeV7s7s0rUyJiJJX5zJGBE1_rWyLYMXDeaaaj0BA3zCal1Jl36AzkHIC3b7uYzvhRaZNe-PVkzzG0GqSkHCdTltLtASBOWHhjtIDW0M-NJIngZUC95lqPl_H14Y8JGvmuxxMnOq6HGOi3koowQqj8IxbCx4A5u5OsR0MZp1LvKFZ4Vi3a26bz5RAPrthA5_YKpnv_ymbAajJ_wYTKFaDUE-lLw_jZZ9LFcLYmZ1BCkGNOS2UPqG-o3Mz7Ghcc3RJpIWZ2BzbxyOh_RQ7Qym2fx9Qtf-lgsohhRdlkgIQ_kf-7aXeJx_OZXlwKkY0EC1mNvPnIwPW7ItTOJVDX9ZhAEau-PLpKBQWkrJuHV2DB1rCQyvO4mhXQwWSa1f6UbduuIe6drRUOIWLnqKQRvU6oE6EgV5rb8qRZK1ZqRfbWF8w6U4zOGH4zbdmg4cHsCQ2Mjh0dxu-sr7trIRi_nphyDy4rb-wzfv4g5589Tjy8j89xRoj9cc8e7cy-SoLw2yzMnm97oGiMLVNuQ2hfVG2T4zPIX1bJhA0HJll20Ol495kq8GQaAixdvM1cJp1XkzuT5NzAT17TY5cNOd4YPgSUypy-jDLeQzfC_jnznuiAGmxffypuhy4nQAozYWGWdjCUcwkjnSNZ2C_EJjbnLNiqeFeyC01QuJhazEGdj3S9pI_xl6PqJHeAjHYGEMUmjPA6vrEN2HtZoN4jm3AFZzAtmmjDarQpt82chgjFWTxrSFb_cPNaP3iOUJi_ru9oQTNgNSUEoNOcYeIDJekP-5dlMdvHRudPdzKJswBuIZbqqCEssBslXppZ28uj1jzvM4WG_-Cur83rAeYCIHuRY1dnfyRA-Y9Fo-UyTJ_n6Q70B7SdOzhgatLejOriobe9a0XINHDL6GyzN6NfDYWibf5v9QDuNjUfREt-bQUNh4Q86zIhw_wYYeYWXiv621RqGGwhQiiZFv6GNZN_MudjDfubbLZmjjOn8QTuAQFNxBb9bjK8V9ZNKb2JLqPQdrRoPSP35qAAZqJhR7fbHMO07O1yqwJZwVj1O18Lrsl5g40N9EwKh5m3OQFgOANPuE5h2tBVT0PdK_LKp1HhJFnz74lWJbIYSuFiwR1zOr3JfwluB8qyrntgJwHxIt3BjZ1BgJCxEtiVsifaxBdysM-wSjLVG3_35e4gVF89DV7NAhW7Hb7w9YnwkbayIJFa9BZ-ybAqc7C-A-cAtPxtPhzdO36Am6S5SHezVcb_0Fkvluj7ftWAMW579eHmN92C7ZLS7v3-EliC6q__pO_t5YNFW6MO90zH295zI-M7iOzZI-zqgi7sQJH2X_gU16KVxZNWyg-QhoJBtUylDJX39Cm7YqfrlZie8i-qZklFI49KwKWdAhi0kSXydS8sOuV87WIw0SrW_hnErU-TYNmAmOznGOQ1k6VzL9E_YxCNbi-evkTL7c3Okj3DZfpP0_UDjuvovMh0dRpZPzJWNUZ41KSrajoaP8wvOkkjLlN4px0bSDPK5WBQImMTQompYaajwDod7DVBA4qBLjXQFmIa-9oadyq4lLxhBv-TZIgaF0XKqY-1hBLJsvjfl98unonBHuCm7fGPYVQCkpZMhgAkia7Qw6cwdxbqI_BZqQwJ7DaLksIb-VROdcu-8lBQdOY8qGYx4pqV9Wo-UW0bc-TsfxPTPLJ4QRV313jbKOwq9xkozjE-2PV6XOFa2WlyFKqJP5n99ulhZZv7MD7aYwJsann0Je3a7iwiSeaBzYwdIybb41S5mEt4bOHLn3XW1fUjHqmO5l6CDloZk1msq-SA3yQ86rUJw5SfGs_S5aLprYxcKjzq47-tgM1QEYeVFkJJcSwnxKCaFnaz-Dej08bJc1me9vhJNDdITqt-AEhEGXcI7m7tJ6pC2fRGr1huh_waF1hEXWprD3rLFScBnrCAGw13oi2Rvl-npPfPUUsCeUnJDhWsZ-nb4kgVqnmeeiOSCdf02EBQfWTxuHeH8ixi5sDP03yi-CCakO4R1VWIufVPhBnB_lMsbdv1YkY9Jg3BR_m6XGzj4Z4FEiNGZ4wVZPnJTiC6mLxpBCAQSOwBygQiDAz1-U2GCU-Q6f9nx6mOvATHZQjmYQJu3hn8CgwGDomDeLVP_4Eu6_V1QUJ8MEMXJW4cf_REfGAFgAQ&ias_dspID=3&ias_campId=1008772806&ias_pubId=pub-6396844742497208&ias_chanId=1&ias_placementId=20163094551&bidurl=https://corporateofficehq.com/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0g_-3CkwpaB1cH7FaUba-Vb
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.221.155 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-221-155.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 3a548a3f681f8689199d387f78d29677e14817563b7186e3b386b93e7cb7cbd9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:03 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame 9786 3 KB
1 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/window_focus_fy2021.js

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:23:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6854
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:23:49 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame 9786 19 KB
8 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3735e94afb2539b14515fdd10d7cc066cffa99d4b52762959e342295e08a770e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 20:06:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 69064
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7991
x-xss-protection: 0
server: cafe
etag: 2412543371950383451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Jun 2023 20:06:59 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 9786 0
0 21ms
20ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRyokoOTSILvtKWJ68Idj47hsHbI6PV91eieze9w-YeLGzKcOiqe5qPGU4veOUMcnG2b5Sc3ZcwmgfZLLirf7rhPbvGGw
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9786 171 KB
53 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b108d10517b218ebb22d63ad00b85baf89a7b4f1884c3fd01eb03f0790b1cd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54276
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1685532878231373"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:18:03 GMT

GET
H3 200 container.html Show response
4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame A5F9 6 KB
3 KB 22ms
13ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305300101/pubads_impl.js?cb=31074979

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://corporateofficehq.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:18:00 GMT
expires: Fri, 31 May 2024 15:18:00 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
16 B 9ms
9ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzY0Nzg5OTM0Njg0MzI1MyIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLWxhcmdlLWJpbGxib2FyZC0yLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6MTE1NCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjIifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6Ijc2NDc4OTkzNDY4NDMyNTMiLCJkb21haW5faWQiOiIxMTQzOCIsInVuaXQiOiJkaXYtZ3B0LWFkLWNvcnBvcmF0ZW9mZmljZWhxX2NvbS1sYXJnZS1iaWxsYm9hcmQtMi0wIiwidF9lcG9jaCI6MTY4NTYzMjY3OSwiYWRfcG9zaXRpb24iOjExNTQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMzY3NzM4MTYtZTY1OC00MTBhLTY3NmEtYjQ3Y2NjNTk2ZTBjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU0NywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6ImMzNTJiYTU4MWJkM2ZmZDhjZWE2MDhjZjJkNTVmNTE5In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3NjQ3ODk5MzQ2ODQzMjUzIiwiZG9tYWluX2lkIjoiMTE0MzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1jb3Jwb3JhdGVvZmZpY2VocV9jb20tbGFyZ2UtYmlsbGJvYXJkLTItMCIsInRfZXBvY2giOjE2ODU2MzI2NzksInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDYsImFkX3Bvc2l0aW9uIjoxMTU0LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDA2LCJiaWRfZmxvb3JfcHJldiI6MC4wMDEyLCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzY0Nzg5OTM0Njg0MzI1MyIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLWxhcmdlLWJpbGxib2FyZC0yLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6MTE1NCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwNDM1NDcifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6Ijc2NDc4OTkzNDY4NDMyNTMiLCJkb21haW5faWQiOiIxMTQzOCIsInVuaXQiOiJkaXYtZ3B0LWFkLWNvcnBvcmF0ZW9mZmljZWhxX2NvbS1sYXJnZS1iaWxsYm9hcmQtMi0wIiwidF9lcG9jaCI6MTY4NTYzMjY3OSwiYWRfcG9zaXRpb24iOjExNTQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMzY3NzM4MTYtZTY1OC00MTBhLTY3NmEtYjQ3Y2NjNTk2ZTBjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU0NywiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiMjg2ODcyNzQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:03 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:03 GMT

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
16 B 9ms
9ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzY0Nzg5OTM0Njg0MzI1MyIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLWxhcmdlLWJpbGxib2FyZC0yLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6MTE1NCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMy0wNi0wMSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjE1In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjQifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:03 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:03 GMT

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
16 B 9ms
9ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNzY0Nzg5OTM0Njg0MzI1MyIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLWxhcmdlLWJpbGxib2FyZC0yLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhdWN0aW9uX2Vwb2NoIjoxNjg1NjMyNjg0LCJhZF9wb3NpdGlvbiI6MTE1NCwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjM2NzczODE2LWU2NTgtNDEwYS02NzZhLWI0N2NjYzU5NmUwYyIsImJpZF9mbG9vcl9pbml0aWFsIjoxMjAsImJpZF9mbG9vcl9wcmV2IjoxMjAsImJpZF9mbG9vcl9maWxsZWQiOjYwLCJhdWN0aW9uX2NvdW50IjoyLCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo3NzEsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzR9XQ==
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:03 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:03 GMT

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
62 B 9ms
9ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1NjY5MzYwODg1MzUzNiIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6MTE0NywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIzMTUifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjgwIn0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJmYWxzZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzY0Nzg5OTM0Njg0MzI1MyIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLWxhcmdlLWJpbGxib2FyZC0yLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6MTE1NCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIxMTIwIn0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiI0NTMifSx7Im5hbWUiOiJpc19mbG9hdGluZyIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI1MjQ0MTg5NTY4ODY2NTUwIiwiZG9tYWluX2lkIjoiMTE0MzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1jb3Jwb3JhdGVvZmZpY2VocV9jb20tZWRnZS0yLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6MTk3NiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIxNDQwIn0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiIzMDAifSx7Im5hbWUiOiJpc19mbG9hdGluZyIsInZhbCI6InRydWUifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjkwNDkyNTMwMzQ4ODExNzUiLCJkb21haW5faWQiOiIxMTQzOCIsInVuaXQiOiJkaXYtZ3B0LWFkLWNvcnBvcmF0ZW9mZmljZWhxX2NvbS1lZGdlLTEtMCIsInRfZXBvY2giOjE2ODU2MzI2NzksImFkX3Bvc2l0aW9uIjoxOTc1LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjM2NzczODE2LWU2NTgtNDEwYS02NzZhLWI0N2NjYzU5NmUwYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1MTYsImRhdGEiOlt7Im5hbWUiOiJwb3NfeCIsInZhbCI6IjAifSx7Im5hbWUiOiJwb3NfeSIsInZhbCI6IjMwMCJ9LHsibmFtZSI6ImlzX2Zsb2F0aW5nIiwidmFsIjoidHJ1ZSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNjc2NDc3ODY0MDg2ODM2NyIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoicG9zX3giLCJ2YWwiOiIwIn0seyJuYW1lIjoicG9zX3kiLCJ2YWwiOiIxMTA0In0seyJuYW1lIjoiaXNfZmxvYXRpbmciLCJ2YWwiOiJ0cnVlIn1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:05 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:05 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9786 0
20 B 47ms
47ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=5320244872065&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9786 0
20 B 47ms
47ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=5320244872065&version=m202301230201&ct=76&x=1&cor=1972743277243848200

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9786 15 KB
11 KB 47ms
46ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DuvYAssIokNVWL9BzFnM_pCMLio0eJGyhAcBNtP3cW--qBT83IcSUTeTOQ8VYTGIyAKAzwmXtHwAUNagamyWM2gYb1_Dbqzuv3ne0XiAytNfgHJ3itW4FFXBeYC6Mtk5Arr3NDZLx1qdyxF2wcPCbNhP5otjLj7YaxNSa791O4LKDTzC8&cry=1&dbm_d=AKAmf-BGOAzyniFq6C6nPLGsYaOZjVOk96IxLekKcHoT64DnKuhocxi8NRf-3TBLptgnl3dQE_eXMgolZnjbxUmaTVkKvQb2fflWeZwhPdLxmKXOe-JZjsKrmiLzBl_NJwLvw5Vtwt9coFu6kBP2Nqj8DEYN9ilgazE0GXpXYMduYhl6iMnxMYp2OBYyjX8Gkd2i4qc3nfD803p2-z7B9YD1K0lTK_MBXU7zAJhlZCweCUQYOsozXcqvi8DiVhkAt4ycndyVGTTykJ3PxibIOOImiasMP3Qgv1sGWdP_fPzHPC54bdo6GmracmOCVSaFZWzaV1Ioys0v1v3fzSi3vAGAgAfyuwUQIER97rMHFzz2NfvEQDMfwROvNnH1skOZg-dXxx5h24uj1kGYQvEplCbfVeS5epREbcJW38boDsRJXKmplVf7dicpHs3gc159hErclTDSYL83MbrZPY8KvUX4UyrocUYyQYkqJAps8Li_fhSaDXsBTgtesIm--Nw6_5sTqmlKLrd0288XinK3QcUlwc24qK_xLcsRVZc85tYVK_9jxTiSMsT-zClNV1t-F1NfAP3ZdPtb2SK7ZkTZLEJ1rWWjr2Nx2x28Q0Dnoe1RYS1_QFBagmy2jVnKSn-Xt5mGa1__vOOzOEvRmQi27m6SeaZfs2JT1aGGNdElaVxQOneFuYp7FDTqn0jSae4bi11fd9Qk8SjvqZvjGBEHZMUAYjDVtEzr8YV3v3-098poMoCFGMDihsXg1ser0nksrcJJNGJbI7q15kYwUAF8fsMk2cxnGp1n1ZRT9vxShoEk8VzB7SgCCA_R6Ejffg8dKdlRHmJ_bzaMYrM1kkDmmTBkk01t33zPrmO19jet3HtesAPafZWVX0V7KLLL1fl_TxRW01VdRLd_q48f0HXVJwI4uvez57n9-Ez_19goqpQ3Q4t2y8IzWeaBZmLGJZNuGk73lPK3yDR8soQDRDoLVYQ4fKkcWcdelLo8AslVVhr8b8GQKjbYW7PrPsbt6zAkCSTdi8hOvIOtP1jZjeemNPCWUlznm6y8O3oUft3f1Pqw4f5PH3QMcqTVnoeeeaRq9RIF84peWZiPSp8iF5E8Kc7ZFQtfCFhVVRSzCexduO1FkpS5emO6bUW12EVjBd_nC7xowyVPv0omkoksIvZoICH7TjQwmSIXnh4i57LRVxiL_PzFc0HztRjL8ZZxx51IIEWkwYyR-xd0VlRYrFMds3ikA-selBaZBIHIl2-n8zO7iTv1YVoB2qs7vtZTu3DCbP8nIeFhUA22Sjy1IJqmZ05KW6TYqmivre1mznv4RM8QqTYAwRdlMjmop0_XbExNDfFFuED5X60QYyUro7epXurFYf0F-FKUDlcuYn73ZDLPcsx0yPyzlecpj8KgJjCGHKY4Y39pPRuOCpVjUPdvMli2jfXXmqpLOq2rHXMCXfN9axhEaa5yYoKfKYuhGB1MyztL74cN80u5V29e2WobbEeRA4MLLWmJgQcjTx0l_Z9DWps5gpU5zmKjx_2jO_d08sT8hj1x8m6qjhr0jLZuFuDRw4008jC2YBUEG8CDgbGyRMWs9N356QP-Cyl0xF_Z_9QzuZO4kwBRkXt__aC---bYp7isrhQizXHH4FEP6JRaPVRwmiDbaGAIYAx8TYO_veHWp2lBeyx5qlFwc_W_LDUHoYk8CYCYLas5pd3wlm_-DZowzLVsxautKXwnzq2qoUHj722_7dMn17JS5W0C39SE5FSr-LuAWyxMBeCuvammTKHPQSmTO3C8RUuKD39DXYztrPRcGSrbL3aU4KzKlxq4y0sTnb6v3-3Ado88AN-fIgNCJgt9SfpmgUTWXRCe4oUmowHXOjW-S7Hu2j1-LDvayy6AHcwZGuNe3VAWk4RNWgBZJuIAKYxm3GBx_ZO7ZWHraPrCCuCs7TgRPqcs8qZqXhbGgHf3faMkfGb7SIUWcOCxi-fwWntWpZ_YVZRyMC-EMMrhtgRBMM4pj7WYKpQ-Js0fBxC3Efl3JEsULe2_cVwPJW2VXv7CSrqKoaK7gxTPzqqj5lN62IDawXe-qknoN5QjomJU1PCZcMF5b0sN9wZngDDRa5XjF-NxzHOzVp1wEowXIdXdHIMPUx6uCQ4azl4FIMSgwkk4oL7Ds4w4MIn1Vz44ZPN8GxOJdCCin1wz8UGhB-pPG9QKuc29wy5gtApE869e0dxV8v1BUm_fwedakLwVRrWGw6pX1wju3MSdzgXC3ccJB7xeVXv3mzkelZLKfGbsAvUcF_p8qbngSL-p1meuMAcjmaOGrGScdbsNgY-LqowATt-mCH_ezK7kNX1Q2uoedyGetC5M5ZOeyV4MqHNqTGPmkCHm72cTBFltwntvaqDC1ie_EqiK6WFzj5BbW9yXLm278Jw0IK12QKICatTYIee8g399YpIgVOBE5L6qfB3ByXH0uuEymdbNNP-SGM2hml3cK8_CP9TScqZSDAeAChpQb5X6l92x-cTBDdaATkAyeF00onumA1QQJhZdPSre1M9u1V74LJbv25QacF0JOowiZGr6arta00L26TmNhe1a52BrH-99sia-_LG-WO49x3Elpajthgz0BurJQUjjicm1ExNteUceo1miGOYh4FtEO88CbAQKeUf4pUI6l33bgbN6jB_8bbiNmx_5Y_N4lnrC2ZeRxgpH53dT-vlc3KJCmfWt4kTC037tAstJtqKsQrW0Nd8TVjte2dRb-lrWeVtBvoFlhyIAMepdHiatxJVcoOeoFDv8Qb2MXYmnybc-oeZHCOL2Ty46tRxzxlG2kijmx2Pmv3wmdWjDAzzJvkLX6ZssG-uY47w7X9yxhS3AFWgjvxco5nAdGxnOtBpF_w_PXSde2Xw4HNowAKZ_mtSxO01lDJl2EtcJkqMrouEa4_SumU7Cm0ks-X0hp44igynAgxLEQ2mjOtsdRrLusZR4tD0MlY33KalG25Ocm3tYwAVd2fHq8eibwLtmxLZEffRCbtb0JWgYr_iDuTRX-B3UBfLpsyl_0PjnU9rqsFuAsAZdXui10RoBnGmXv9so0bgpV2LVuPxICEhEh-RilxwDbB7devr-hQPDmVG4t9C6tg&cid=CAQSOwBygQiDAz1-U2GCU-Q6f9nx6mOvATHZQjmYQJu3hn8CgwGDomDeLVP_4Eu6_V1QUJ8MEMXJW4cf_REfGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcorporateofficehq.com%2F&ds=l&xdt=1&iif=1&cor=1972743277243848200&adk=3047537735&idt=90&cac=0&dtd=9

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

46cfb681b1a6706bd3b4191ff7678e22041411d21e297d2307e15dcad02d31bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11214
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/ Frame 03E2 6 KB
3 KB 20ms
13ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305300101/pubads_impl.js?cb=31074979

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

468959e93f9b4e6f07c6a8f8d0e93d8fcb37d76a8615a93ec153f5842247ba99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://corporateofficehq.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, immutable, max-age=31536000
content-encoding: br
content-length: 2653
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:18:00 GMT
expires: Fri, 31 May 2024 15:18:00 GMT
last-modified: Thu, 03 Nov 2022 19:10:08 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
16 B 9ms
8ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNjc2NDc3ODY0MDg2ODM2NyIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDg2LCJkYXRhIjpbeyJuYW1lIjoicmVmcmVzaF9jb3VudCIsInZhbCI6IjIifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjY3NjQ3Nzg2NDA4NjgzNjciLCJkb21haW5faWQiOiIxMTQzOCIsInVuaXQiOiJkaXYtZ3B0LWFkLWNvcnBvcmF0ZW9mZmljZWhxX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTY4NTYzMjY3OSwiYWRfcG9zaXRpb24iOjExMDgsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMzY3NzM4MTYtZTY1OC00MTBhLTY3NmEtYjQ3Y2NjNTk2ZTBjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDQ4NiwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9iaWRfaGFzaCIsInZhbCI6ImMzNTJiYTU4MWJkM2ZmZDhjZWE2MDhjZjJkNTVmNTE5In1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI2NzY0Nzc4NjQwODY4MzY3IiwiZG9tYWluX2lkIjoiMTE0MzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1jb3Jwb3JhdGVvZmZpY2VocV9jb20tbWVkcmVjdGFuZ2xlLTItMCIsInRfZXBvY2giOjE2ODU2MzI2NzksInJldmVudWUiOjAsImVzdF9yZXZlbnVlIjowLjAwMDYsImFkX3Bvc2l0aW9uIjoxMTA4LCJhZF9zaXplIjoiIiwiYmlkX2Zsb29yX2ZpbGxlZCI6MC4wMDA2LCJiaWRfZmxvb3JfcHJldiI6MC4wMDEyLCJzdGF0X3NvdXJjZV9pZCI6MzUsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDg2LCJkYXRhIjpbeyJuYW1lIjoibG9hZGVkIiwidmFsIjoiMSJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNjc2NDc3ODY0MDg2ODM2NyIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDg2LCJkYXRhIjpbeyJuYW1lIjoiY3JlYXRpdmVfaWQiLCJ2YWwiOiIxMzgzMTAwMzQ0ODYifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjY3NjQ3Nzg2NDA4NjgzNjciLCJkb21haW5faWQiOiIxMTQzOCIsInVuaXQiOiJkaXYtZ3B0LWFkLWNvcnBvcmF0ZW9mZmljZWhxX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwidF9lcG9jaCI6MTY4NTYzMjY3OSwiYWRfcG9zaXRpb24iOjExMDgsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMzY3NzM4MTYtZTY1OC00MTBhLTY3NmEtYjQ3Y2NjNTk2ZTBjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDQ4NiwiZGF0YSI6W3sibmFtZSI6ImxpbmVpdGVtX2lkIiwidmFsIjoiMjg2ODcyNzQifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:04 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:04 GMT

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
16 B 9ms
9ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNjc2NDc3ODY0MDg2ODM2NyIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDg2LCJkYXRhIjpbeyJuYW1lIjoidF9sb2NhbF9kYXRlIiwidmFsIjoiMjAyMy0wNi0wMSJ9LHsibmFtZSI6InRfbG9jYWxfaG91ciIsInZhbCI6IjE1In0seyJuYW1lIjoidF9sb2NhbF9kYXlfb2Zfd2VlayIsInZhbCI6IjQifSx7Im5hbWUiOiJ0X2xvY2FsX3RpbWV6b25lIiwidmFsIjoiMCJ9XSwiaXNfb3JpZyI6ZmFsc2V9XQ==
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:04 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:04 GMT

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
16 B 9ms
9ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImF1Y3Rpb24iLCJpbXByZXNzaW9uX2lkIjoiNjc2NDc3ODY0MDg2ODM2NyIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhdWN0aW9uX2Vwb2NoIjoxNjg1NjMyNjg0LCJhZF9wb3NpdGlvbiI6MTEwOCwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjM2NzczODE2LWU2NTgtNDEwYS02NzZhLWI0N2NjYzU5NmUwYyIsImJpZF9mbG9vcl9pbml0aWFsIjoxMjAsImJpZF9mbG9vcl9wcmV2IjoxMjAsImJpZF9mbG9vcl9maWxsZWQiOjYwLCJhdWN0aW9uX2NvdW50IjoyLCJyZWZyZXNoX2FkX2NvdW50IjowLCJhdWN0aW9uX2R1cmF0aW9uIjo4NjYsIm11bHRpX2FkX3VuaXQiOjAsIm11bHRpX2FkX2NvdW50IjowLCJuZXR3b3JrX2NvZGUiOjEyNTQxNDQsImRhdGEiOlt7Im5hbWUiOiIiLCJ2YWwiOiIifV0sImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzR9XQ==
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:04 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:04 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 9C6A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJ9LsHLRkdDvqZZNHOYELTM&google_cver=1

43 B
632 B

7ms
7ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJ9LsHLRkdDvqZZNHOYELTM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARiLq6DRATAB&v=APEucNWo39bYvMft7jYxK8JMxK7TBHJoPqkifDyLyg4O3O2l6_gulgN1m0rQajOHLTn4BPDP5XVvLr6niQsCqKrWFGdGwJh55gql-7iMWt0jlscTsgujfIdD-Y3U6J12q64Qy5lzbQTOP-ggahMRANaPvViuqLxUbgqALkjpC3l8Gjek6biMNnYFLPXCztFposfMTFFT7xVXlraPq3bcuYjqhzh0XRl-qw
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:18:04 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJ9LsHLRkdDvqZZNHOYELTM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 9C6A
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=ZHi2qRhGZ3FohZUGusT4AwAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJ9LsHLRkdDvqZZNHOYELTM&google_cver=1

43 B
632 B

8ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJ9LsHLRkdDvqZZNHOYELTM&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARiLq6DRATAB&v=APEucNWo39bYvMft7jYxK8JMxK7TBHJoPqkifDyLyg4O3O2l6_gulgN1m0rQajOHLTn4BPDP5XVvLr6niQsCqKrWFGdGwJh55gql-7iMWt0jlscTsgujfIdD-Y3U6J12q64Qy5lzbQTOP-ggahMRANaPvViuqLxUbgqALkjpC3l8Gjek6biMNnYFLPXCztFposfMTFFT7xVXlraPq3bcuYjqhzh0XRl-qw
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:18:04 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=498
Content-Length: 43
Expires: 0

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEJ9LsHLRkdDvqZZNHOYELTM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 9C6A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEIt9in8-P3Xxb7ZOo_kKwrM&google_cver=1

43 B
1 KB

15ms
14ms

Image
image/gif

37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEIt9in8-P3Xxb7ZOo_kKwrM&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARiLq6DRATAB&v=APEucNWo39bYvMft7jYxK8JMxK7TBHJoPqkifDyLyg4O3O2l6_gulgN1m0rQajOHLTn4BPDP5XVvLr6niQsCqKrWFGdGwJh55gql-7iMWt0jlscTsgujfIdD-Y3U6J12q64Qy5lzbQTOP-ggahMRANaPvViuqLxUbgqALkjpC3l8Gjek6biMNnYFLPXCztFposfMTFFT7xVXlraPq3bcuYjqhzh0XRl-qw

Protocol

HTTP/1.1

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:18:04 GMT
AN-X-Request-Uuid: 48f74c18-a758-4ad0-95e9-14d8eeb1215d
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEIt9in8-P3Xxb7ZOo_kKwrM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9C6A
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzAxNTM2MzYzMzgzMDU4OTQ5Ng%3D%3D

170 B
188 B

23ms
23ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzAxNTM2MzYzMzgzMDU4OTQ5Ng%3D%3D

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 01 Jun 2023 15:18:04 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 178.162.209.134; 178.162.209.134; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 83e383cc-5f6f-4205-b84c-a0842b55f4e5
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=MzAxNTM2MzYzMzgzMDU4OTQ5Ng%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 9786 41 KB
15 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DuvYAssIokNVWL9BzFnM_pCMLio0eJGyhAcBNtP3cW--qBT83IcSUTeTOQ8VYTGIyAKAzwmXtHwAUNagamyWM2gYb1_Dbqzuv3ne0XiAytNfgHJ3itW4FFXBeYC6Mtk5Arr3NDZLx1qdyxF2wcPCbNhP5otjLj7YaxNSa791O4LKDTzC8&cry=1&dbm_d=AKAmf-BGOAzyniFq6C6nPLGsYaOZjVOk96IxLekKcHoT64DnKuhocxi8NRf-3TBLptgnl3dQE_eXMgolZnjbxUmaTVkKvQb2fflWeZwhPdLxmKXOe-JZjsKrmiLzBl_NJwLvw5Vtwt9coFu6kBP2Nqj8DEYN9ilgazE0GXpXYMduYhl6iMnxMYp2OBYyjX8Gkd2i4qc3nfD803p2-z7B9YD1K0lTK_MBXU7zAJhlZCweCUQYOsozXcqvi8DiVhkAt4ycndyVGTTykJ3PxibIOOImiasMP3Qgv1sGWdP_fPzHPC54bdo6GmracmOCVSaFZWzaV1Ioys0v1v3fzSi3vAGAgAfyuwUQIER97rMHFzz2NfvEQDMfwROvNnH1skOZg-dXxx5h24uj1kGYQvEplCbfVeS5epREbcJW38boDsRJXKmplVf7dicpHs3gc159hErclTDSYL83MbrZPY8KvUX4UyrocUYyQYkqJAps8Li_fhSaDXsBTgtesIm--Nw6_5sTqmlKLrd0288XinK3QcUlwc24qK_xLcsRVZc85tYVK_9jxTiSMsT-zClNV1t-F1NfAP3ZdPtb2SK7ZkTZLEJ1rWWjr2Nx2x28Q0Dnoe1RYS1_QFBagmy2jVnKSn-Xt5mGa1__vOOzOEvRmQi27m6SeaZfs2JT1aGGNdElaVxQOneFuYp7FDTqn0jSae4bi11fd9Qk8SjvqZvjGBEHZMUAYjDVtEzr8YV3v3-098poMoCFGMDihsXg1ser0nksrcJJNGJbI7q15kYwUAF8fsMk2cxnGp1n1ZRT9vxShoEk8VzB7SgCCA_R6Ejffg8dKdlRHmJ_bzaMYrM1kkDmmTBkk01t33zPrmO19jet3HtesAPafZWVX0V7KLLL1fl_TxRW01VdRLd_q48f0HXVJwI4uvez57n9-Ez_19goqpQ3Q4t2y8IzWeaBZmLGJZNuGk73lPK3yDR8soQDRDoLVYQ4fKkcWcdelLo8AslVVhr8b8GQKjbYW7PrPsbt6zAkCSTdi8hOvIOtP1jZjeemNPCWUlznm6y8O3oUft3f1Pqw4f5PH3QMcqTVnoeeeaRq9RIF84peWZiPSp8iF5E8Kc7ZFQtfCFhVVRSzCexduO1FkpS5emO6bUW12EVjBd_nC7xowyVPv0omkoksIvZoICH7TjQwmSIXnh4i57LRVxiL_PzFc0HztRjL8ZZxx51IIEWkwYyR-xd0VlRYrFMds3ikA-selBaZBIHIl2-n8zO7iTv1YVoB2qs7vtZTu3DCbP8nIeFhUA22Sjy1IJqmZ05KW6TYqmivre1mznv4RM8QqTYAwRdlMjmop0_XbExNDfFFuED5X60QYyUro7epXurFYf0F-FKUDlcuYn73ZDLPcsx0yPyzlecpj8KgJjCGHKY4Y39pPRuOCpVjUPdvMli2jfXXmqpLOq2rHXMCXfN9axhEaa5yYoKfKYuhGB1MyztL74cN80u5V29e2WobbEeRA4MLLWmJgQcjTx0l_Z9DWps5gpU5zmKjx_2jO_d08sT8hj1x8m6qjhr0jLZuFuDRw4008jC2YBUEG8CDgbGyRMWs9N356QP-Cyl0xF_Z_9QzuZO4kwBRkXt__aC---bYp7isrhQizXHH4FEP6JRaPVRwmiDbaGAIYAx8TYO_veHWp2lBeyx5qlFwc_W_LDUHoYk8CYCYLas5pd3wlm_-DZowzLVsxautKXwnzq2qoUHj722_7dMn17JS5W0C39SE5FSr-LuAWyxMBeCuvammTKHPQSmTO3C8RUuKD39DXYztrPRcGSrbL3aU4KzKlxq4y0sTnb6v3-3Ado88AN-fIgNCJgt9SfpmgUTWXRCe4oUmowHXOjW-S7Hu2j1-LDvayy6AHcwZGuNe3VAWk4RNWgBZJuIAKYxm3GBx_ZO7ZWHraPrCCuCs7TgRPqcs8qZqXhbGgHf3faMkfGb7SIUWcOCxi-fwWntWpZ_YVZRyMC-EMMrhtgRBMM4pj7WYKpQ-Js0fBxC3Efl3JEsULe2_cVwPJW2VXv7CSrqKoaK7gxTPzqqj5lN62IDawXe-qknoN5QjomJU1PCZcMF5b0sN9wZngDDRa5XjF-NxzHOzVp1wEowXIdXdHIMPUx6uCQ4azl4FIMSgwkk4oL7Ds4w4MIn1Vz44ZPN8GxOJdCCin1wz8UGhB-pPG9QKuc29wy5gtApE869e0dxV8v1BUm_fwedakLwVRrWGw6pX1wju3MSdzgXC3ccJB7xeVXv3mzkelZLKfGbsAvUcF_p8qbngSL-p1meuMAcjmaOGrGScdbsNgY-LqowATt-mCH_ezK7kNX1Q2uoedyGetC5M5ZOeyV4MqHNqTGPmkCHm72cTBFltwntvaqDC1ie_EqiK6WFzj5BbW9yXLm278Jw0IK12QKICatTYIee8g399YpIgVOBE5L6qfB3ByXH0uuEymdbNNP-SGM2hml3cK8_CP9TScqZSDAeAChpQb5X6l92x-cTBDdaATkAyeF00onumA1QQJhZdPSre1M9u1V74LJbv25QacF0JOowiZGr6arta00L26TmNhe1a52BrH-99sia-_LG-WO49x3Elpajthgz0BurJQUjjicm1ExNteUceo1miGOYh4FtEO88CbAQKeUf4pUI6l33bgbN6jB_8bbiNmx_5Y_N4lnrC2ZeRxgpH53dT-vlc3KJCmfWt4kTC037tAstJtqKsQrW0Nd8TVjte2dRb-lrWeVtBvoFlhyIAMepdHiatxJVcoOeoFDv8Qb2MXYmnybc-oeZHCOL2Ty46tRxzxlG2kijmx2Pmv3wmdWjDAzzJvkLX6ZssG-uY47w7X9yxhS3AFWgjvxco5nAdGxnOtBpF_w_PXSde2Xw4HNowAKZ_mtSxO01lDJl2EtcJkqMrouEa4_SumU7Cm0ks-X0hp44igynAgxLEQ2mjOtsdRrLusZR4tD0MlY33KalG25Ocm3tYwAVd2fHq8eibwLtmxLZEffRCbtb0JWgYr_iDuTRX-B3UBfLpsyl_0PjnU9rqsFuAsAZdXui10RoBnGmXv9so0bgpV2LVuPxICEhEh-RilxwDbB7devr-hQPDmVG4t9C6tg&cid=CAQSOwBygQiDAz1-U2GCU-Q6f9nx6mOvATHZQjmYQJu3hn8CgwGDomDeLVP_4Eu6_V1QUJ8MEMXJW4cf_REfGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcorporateofficehq.com%2F&ds=l&xdt=1&iif=1&cor=1972743277243848200&adk=3047537735&idt=90&cac=0&dtd=9

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 20:07:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 69063
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 May 2024 20:07:01 GMT

GET
H3

200

adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame 9786
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/1135760/65089090/xbbe/creative/adj?p=APEucNXsUMOiyaueGNBp86tgt7fpK1wE2sWqjeSextzlesOlMi_yMJw&d=CokBAKAmf-CdB0LC_gr9eDTO2GK9lyig__Lipxa19-Kq0u9yHXbtpjI9-aesroS...
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXsUMOiyaueGNBp86tgt7fpK1wE2sWqjeSextzlesOlMi_yMJw&d=CokBAKAmf-CdB0LC_gr9eDTO2GK9lyig__Lipxa19-Kq0u9yHXbtpjI9-aesroSJuLmvlBUd7rhdBhvHqRLgLpSd3...

69 KB
24 KB

55ms
54ms

Script
text/javascript

173.194.76.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXsUMOiyaueGNBp86tgt7fpK1wE2sWqjeSextzlesOlMi_yMJw&d=CokBAKAmf-CdB0LC_gr9eDTO2GK9lyig__Lipxa19-Kq0u9yHXbtpjI9-aesroSJuLmvlBUd7rhdBhvHqRLgLpSd3biLNl79RyPiBG42iYjomwPKh216NgGBjGPOsvh0SVo9mjoXVMrzuM-iRhkayq32neAgLfZuvKlA5kqBh6-vADHRreMGLuupWfES2RUAoCZ_4DiVGVQdcJ2HvVocz3OaUSODK0gy3GfX8_zWz_8jCQ9LKN77DaqbDM5uN5tuqO2K3j1HXjE5JkjGqCnh8WGqbvconRVXzvM4mOojXYWELBQ9Qnh82iL_2uNurXFLBxxXPDrkGf0weKqLuc_ob-IAas3bpE2ARdqFx0b41rAXBbiGjcqPaGeV1-2gSgWkhXReOzsClmkHW4Fz2OUhN4GCwJyXzP49WakzQaUScW46QJxIcfNckmDWroPBMtSNiSR4Or4c2k4_mrhLLoQqi4BWd1LZcwJtNDx2lF_1Vzvov5lW7_eR4D4m3jnPTQuyeMCO6gVXrvo8RmwEj-Lg3d_wWTlkB2womcixMHccTmJ7tKthkCvIznZ_uSzcQj4ybQN5ws61ZlOuLkS-TxLGg-fD6KHqo2Bx9QIyk2Dq8X9rWv4TZUMPnuqAR0ygXZshFDeYbe1KB9pw7eg6Er4FYy8Ra1uEabkxxYFxurzgifDsQ0hWxx45fy7u11DvfCSfxQPVAscwY5ZKUl7g89emMZ0bwa56BaCmeGtqwUDLcHORgWt4CChxfT4n789w_-pMwKHZBmb2haM09bVkBkK27qBGJT70sl8CvfhTyppQoxdfdIRLHjUV5WBU_F6d3ddMsIhgJevWFI6GTQs2eBx6vV94WumSHWje9mMVO1zInSVFYzxACaAeVfj0bFQMDxhyLOjXFMT22xXdfXn3q7wQJNwCwszrq6zVzPuWDd50-WM9J9E5f1ewKfhQ5OnYAn3MhdQOJRf9vyPl00cF4CjeYne1WJzOCO1SJSVJEDcaT9lFhNrMDeorW43lG1YKDitPpOFtbuys80H8ZBKST7_1Ov0lU050aB5t-2xXSzhcD-tuSUoPRpr56YMla34m6U6fbwpWXjUP_84L96oSxvR3g_UYYp_LZagtuqnaT172WgNuQUsddLaVd8wOaNqI-ygBTlmpmxdAlCQckv2l7kXUhXlB73pm0gEt4BGA81jTufn1T_dHdAuNPhMzW37_0g89Kd-rXknGl2hwgbjgiZnP0xXEz2uRKe32OIv4IhUVXUrlnJNutCUN5KiZKpEeWMQm0ZkUAOR1jbCvL4Gjru93mn1ITO_MB4VHj-ef3zER4_ZsZQlxp0Ha4Pu_nhjwbOdP-LQPSzkXgSXfEuDyX3s9VKf_n0dZTfiZ8Cki3gwhVO9jNycm6UxvoNIUFya4-YJKN1zfiJMWw_zqgUkxhLu2j_cZW4bL2SUQ31RuhEvMhZbJqzpwmAWQ2nuZhMyOQAt8Nbcl7ArlDh4zdmryTqjAT5tCsJr6M6RgGDt8af-PePQkBe5jTg47Q6C1CDxvlLSwY-Ix5wUuWtLGqqtIdqMJYMCEAVySzsF4qTtZtllZYG4GDubYu7iul1CZopHm0z2gmUUMIQioMOC1rvgKasjafZjkJJE_jJGnreZ62UnxY87Zik7PXgC1rP8EyrU5l52hPnFI6kf2wVJ2wi0kJ7LpI0KMapxU9tX82_7CbO_h2lkaYFfkgTz4qYCGeCY69LOzDSz-IZd0eGZFYGS1niBPCaAa6TH08w99U3BAbM-Ufl-s_yweD8JSt3GwqBFFkuxadNnRzQcNiKKQNMSFte-rjneUgJvthIdeV7s7s0rUyJiJJX5zJGBE1_rWyLYMXDeaaaj0BA3zCal1Jl36AzkHIC3b7uYzvhRaZNe-PVkzzG0GqSkHCdTltLtASBOWHhjtIDW0M-NJIngZUC95lqPl_H14Y8JGvmuxxMnOq6HGOi3koowQqj8IxbCx4A5u5OsR0MZp1LvKFZ4Vi3a26bz5RAPrthA5_YKpnv_ymbAajJ_wYTKFaDUE-lLw_jZZ9LFcLYmZ1BCkGNOS2UPqG-o3Mz7Ghcc3RJpIWZ2BzbxyOh_RQ7Qym2fx9Qtf-lgsohhRdlkgIQ_kf-7aXeJx_OZXlwKkY0EC1mNvPnIwPW7ItTOJVDX9ZhAEau-PLpKBQWkrJuHV2DB1rCQyvO4mhXQwWSa1f6UbduuIe6drRUOIWLnqKQRvU6oE6EgV5rb8qRZK1ZqRfbWF8w6U4zOGH4zbdmg4cHsCQ2Mjh0dxu-sr7trIRi_nphyDy4rb-wzfv4g5589Tjy8j89xRoj9cc8e7cy-SoLw2yzMnm97oGiMLVNuQ2hfVG2T4zPIX1bJhA0HJll20Ol495kq8GQaAixdvM1cJp1XkzuT5NzAT17TY5cNOd4YPgSUypy-jDLeQzfC_jnznuiAGmxffypuhy4nQAozYWGWdjCUcwkjnSNZ2C_EJjbnLNiqeFeyC01QuJhazEGdj3S9pI_xl6PqJHeAjHYGEMUmjPA6vrEN2HtZoN4jm3AFZzAtmmjDarQpt82chgjFWTxrSFb_cPNaP3iOUJi_ru9oQTNgNSUEoNOcYeIDJekP-5dlMdvHRudPdzKJswBuIZbqqCEssBslXppZ28uj1jzvM4WG_-Cur83rAeYCIHuRY1dnfyRA-Y9Fo-UyTJ_n6Q70B7SdOzhgatLejOriobe9a0XINHDL6GyzN6NfDYWibf5v9QDuNjUfREt-bQUNh4Q86zIhw_wYYeYWXiv621RqGGwhQiiZFv6GNZN_MudjDfubbLZmjjOn8QTuAQFNxBb9bjK8V9ZNKb2JLqPQdrRoPSP35qAAZqJhR7fbHMO07O1yqwJZwVj1O18Lrsl5g40N9EwKh5m3OQFgOANPuE5h2tBVT0PdK_LKp1HhJFnz74lWJbIYSuFiwR1zOr3JfwluB8qyrntgJwHxIt3BjZ1BgJCxEtiVsifaxBdysM-wSjLVG3_35e4gVF89DV7NAhW7Hb7w9YnwkbayIJFa9BZ-ybAqc7C-A-cAtPxtPhzdO36Am6S5SHezVcb_0Fkvluj7ftWAMW579eHmN92C7ZLS7v3-EliC6q__pO_t5YNFW6MO90zH295zI-M7iOzZI-zqgi7sQJH2X_gU16KVxZNWyg-QhoJBtUylDJX39Cm7YqfrlZie8i-qZklFI49KwKWdAhi0kSXydS8sOuV87WIw0SrW_hnErU-TYNmAmOznGOQ1k6VzL9E_YxCNbi-evkTL7c3Okj3DZfpP0_UDjuvovMh0dRpZPzJWNUZ41KSrajoaP8wvOkkjLlN4px0bSDPK5WBQImMTQompYaajwDod7DVBA4qBLjXQFmIa-9oadyq4lLxhBv-TZIgaF0XKqY-1hBLJsvjfl98unonBHuCm7fGPYVQCkpZMhgAkia7Qw6cwdxbqI_BZqQwJ7DaLksIb-VROdcu-8lBQdOY8qGYx4pqV9Wo-UW0bc-TsfxPTPLJ4QRV313jbKOwq9xkozjE-2PV6XOFa2WlyFKqJP5n99ulhZZv7MD7aYwJsann0Je3a7iwiSeaBzYwdIybb41S5mEt4bOHLn3XW1fUjHqmO5l6CDloZk1msq-SA3yQ86rUJw5SfGs_S5aLprYxcKjzq47-tgM1QEYeVFkJJcSwnxKCaFnaz-Dej08bJc1me9vhJNDdITqt-AEhEGXcI7m7tJ6pC2fRGr1huh_waF1hEXWprD3rLFScBnrCAGw13oi2Rvl-npPfPUUsCeUnJDhWsZ-nb4kgVqnmeeiOSCdf02EBQfWTxuHeH8ixi5sDP03yi-CCakO4R1VWIufVPhBnB_lMsbdv1YkY9Jg3BR_m6XGzj4Z4FEiNGZ4wVZPnJTiC6mLxpBCAQSOwBygQiDAz1-U2GCU-Q6f9nx6mOvATHZQjmYQJu3hn8CgwGDomDeLVP_4Eu6_V1QUJ8MEMXJW4cf_REfGAFgAQ

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

173.194.76.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a698419773d36589ec707bf136f6d8562ee2446e296ca796e7913eac75bf80df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24109
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
server: nginx
x-server-name: app09.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXsUMOiyaueGNBp86tgt7fpK1wE2sWqjeSextzlesOlMi_yMJw&d=CokBAKAmf-CdB0LC_gr9eDTO2GK9lyig__Lipxa19-Kq0u9yHXbtpjI9-aesroSJuLmvlBUd7rhdBhvHqRLgLpSd3biLNl79RyPiBG42iYjomwPKh216NgGBjGPOsvh0SVo9mjoXVMrzuM-iRhkayq32neAgLfZuvKlA5kqBh6-vADHRreMGLuupWfES2RUAoCZ_4DiVGVQdcJ2HvVocz3OaUSODK0gy3GfX8_zWz_8jCQ9LKN77DaqbDM5uN5tuqO2K3j1HXjE5JkjGqCnh8WGqbvconRVXzvM4mOojXYWELBQ9Qnh82iL_2uNurXFLBxxXPDrkGf0weKqLuc_ob-IAas3bpE2ARdqFx0b41rAXBbiGjcqPaGeV1-2gSgWkhXReOzsClmkHW4Fz2OUhN4GCwJyXzP49WakzQaUScW46QJxIcfNckmDWroPBMtSNiSR4Or4c2k4_mrhLLoQqi4BWd1LZcwJtNDx2lF_1Vzvov5lW7_eR4D4m3jnPTQuyeMCO6gVXrvo8RmwEj-Lg3d_wWTlkB2womcixMHccTmJ7tKthkCvIznZ_uSzcQj4ybQN5ws61ZlOuLkS-TxLGg-fD6KHqo2Bx9QIyk2Dq8X9rWv4TZUMPnuqAR0ygXZshFDeYbe1KB9pw7eg6Er4FYy8Ra1uEabkxxYFxurzgifDsQ0hWxx45fy7u11DvfCSfxQPVAscwY5ZKUl7g89emMZ0bwa56BaCmeGtqwUDLcHORgWt4CChxfT4n789w_-pMwKHZBmb2haM09bVkBkK27qBGJT70sl8CvfhTyppQoxdfdIRLHjUV5WBU_F6d3ddMsIhgJevWFI6GTQs2eBx6vV94WumSHWje9mMVO1zInSVFYzxACaAeVfj0bFQMDxhyLOjXFMT22xXdfXn3q7wQJNwCwszrq6zVzPuWDd50-WM9J9E5f1ewKfhQ5OnYAn3MhdQOJRf9vyPl00cF4CjeYne1WJzOCO1SJSVJEDcaT9lFhNrMDeorW43lG1YKDitPpOFtbuys80H8ZBKST7_1Ov0lU050aB5t-2xXSzhcD-tuSUoPRpr56YMla34m6U6fbwpWXjUP_84L96oSxvR3g_UYYp_LZagtuqnaT172WgNuQUsddLaVd8wOaNqI-ygBTlmpmxdAlCQckv2l7kXUhXlB73pm0gEt4BGA81jTufn1T_dHdAuNPhMzW37_0g89Kd-rXknGl2hwgbjgiZnP0xXEz2uRKe32OIv4IhUVXUrlnJNutCUN5KiZKpEeWMQm0ZkUAOR1jbCvL4Gjru93mn1ITO_MB4VHj-ef3zER4_ZsZQlxp0Ha4Pu_nhjwbOdP-LQPSzkXgSXfEuDyX3s9VKf_n0dZTfiZ8Cki3gwhVO9jNycm6UxvoNIUFya4-YJKN1zfiJMWw_zqgUkxhLu2j_cZW4bL2SUQ31RuhEvMhZbJqzpwmAWQ2nuZhMyOQAt8Nbcl7ArlDh4zdmryTqjAT5tCsJr6M6RgGDt8af-PePQkBe5jTg47Q6C1CDxvlLSwY-Ix5wUuWtLGqqtIdqMJYMCEAVySzsF4qTtZtllZYG4GDubYu7iul1CZopHm0z2gmUUMIQioMOC1rvgKasjafZjkJJE_jJGnreZ62UnxY87Zik7PXgC1rP8EyrU5l52hPnFI6kf2wVJ2wi0kJ7LpI0KMapxU9tX82_7CbO_h2lkaYFfkgTz4qYCGeCY69LOzDSz-IZd0eGZFYGS1niBPCaAa6TH08w99U3BAbM-Ufl-s_yweD8JSt3GwqBFFkuxadNnRzQcNiKKQNMSFte-rjneUgJvthIdeV7s7s0rUyJiJJX5zJGBE1_rWyLYMXDeaaaj0BA3zCal1Jl36AzkHIC3b7uYzvhRaZNe-PVkzzG0GqSkHCdTltLtASBOWHhjtIDW0M-NJIngZUC95lqPl_H14Y8JGvmuxxMnOq6HGOi3koowQqj8IxbCx4A5u5OsR0MZp1LvKFZ4Vi3a26bz5RAPrthA5_YKpnv_ymbAajJ_wYTKFaDUE-lLw_jZZ9LFcLYmZ1BCkGNOS2UPqG-o3Mz7Ghcc3RJpIWZ2BzbxyOh_RQ7Qym2fx9Qtf-lgsohhRdlkgIQ_kf-7aXeJx_OZXlwKkY0EC1mNvPnIwPW7ItTOJVDX9ZhAEau-PLpKBQWkrJuHV2DB1rCQyvO4mhXQwWSa1f6UbduuIe6drRUOIWLnqKQRvU6oE6EgV5rb8qRZK1ZqRfbWF8w6U4zOGH4zbdmg4cHsCQ2Mjh0dxu-sr7trIRi_nphyDy4rb-wzfv4g5589Tjy8j89xRoj9cc8e7cy-SoLw2yzMnm97oGiMLVNuQ2hfVG2T4zPIX1bJhA0HJll20Ol495kq8GQaAixdvM1cJp1XkzuT5NzAT17TY5cNOd4YPgSUypy-jDLeQzfC_jnznuiAGmxffypuhy4nQAozYWGWdjCUcwkjnSNZ2C_EJjbnLNiqeFeyC01QuJhazEGdj3S9pI_xl6PqJHeAjHYGEMUmjPA6vrEN2HtZoN4jm3AFZzAtmmjDarQpt82chgjFWTxrSFb_cPNaP3iOUJi_ru9oQTNgNSUEoNOcYeIDJekP-5dlMdvHRudPdzKJswBuIZbqqCEssBslXppZ28uj1jzvM4WG_-Cur83rAeYCIHuRY1dnfyRA-Y9Fo-UyTJ_n6Q70B7SdOzhgatLejOriobe9a0XINHDL6GyzN6NfDYWibf5v9QDuNjUfREt-bQUNh4Q86zIhw_wYYeYWXiv621RqGGwhQiiZFv6GNZN_MudjDfubbLZmjjOn8QTuAQFNxBb9bjK8V9ZNKb2JLqPQdrRoPSP35qAAZqJhR7fbHMO07O1yqwJZwVj1O18Lrsl5g40N9EwKh5m3OQFgOANPuE5h2tBVT0PdK_LKp1HhJFnz74lWJbIYSuFiwR1zOr3JfwluB8qyrntgJwHxIt3BjZ1BgJCxEtiVsifaxBdysM-wSjLVG3_35e4gVF89DV7NAhW7Hb7w9YnwkbayIJFa9BZ-ybAqc7C-A-cAtPxtPhzdO36Am6S5SHezVcb_0Fkvluj7ftWAMW579eHmN92C7ZLS7v3-EliC6q__pO_t5YNFW6MO90zH295zI-M7iOzZI-zqgi7sQJH2X_gU16KVxZNWyg-QhoJBtUylDJX39Cm7YqfrlZie8i-qZklFI49KwKWdAhi0kSXydS8sOuV87WIw0SrW_hnErU-TYNmAmOznGOQ1k6VzL9E_YxCNbi-evkTL7c3Okj3DZfpP0_UDjuvovMh0dRpZPzJWNUZ41KSrajoaP8wvOkkjLlN4px0bSDPK5WBQImMTQompYaajwDod7DVBA4qBLjXQFmIa-9oadyq4lLxhBv-TZIgaF0XKqY-1hBLJsvjfl98unonBHuCm7fGPYVQCkpZMhgAkia7Qw6cwdxbqI_BZqQwJ7DaLksIb-VROdcu-8lBQdOY8qGYx4pqV9Wo-UW0bc-TsfxPTPLJ4QRV313jbKOwq9xkozjE-2PV6XOFa2WlyFKqJP5n99ulhZZv7MD7aYwJsann0Je3a7iwiSeaBzYwdIybb41S5mEt4bOHLn3XW1fUjHqmO5l6CDloZk1msq-SA3yQ86rUJw5SfGs_S5aLprYxcKjzq47-tgM1QEYeVFkJJcSwnxKCaFnaz-Dej08bJc1me9vhJNDdITqt-AEhEGXcI7m7tJ6pC2fRGr1huh_waF1hEXWprD3rLFScBnrCAGw13oi2Rvl-npPfPUUsCeUnJDhWsZ-nb4kgVqnmeeiOSCdf02EBQfWTxuHeH8ixi5sDP03yi-CCakO4R1VWIufVPhBnB_lMsbdv1YkY9Jg3BR_m6XGzj4Z4FEiNGZ4wVZPnJTiC6mLxpBCAQSOwBygQiDAz1-U2GCU-Q6f9nx6mOvATHZQjmYQJu3hn8CgwGDomDeLVP_4Eu6_V1QUJ8MEMXJW4cf_REfGAFgAQ
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 8008 91 KB
23 KB 15ms
15ms Script
application/javascript 2600:9000:225b:2c00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225b:2c00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 0f14828b89630f6555c6372e13fc999a.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P1
age: 21858108
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: clzmOZsQCgSVX1APWEjsT8SBEl7L8h-mFMLi_b0Tl1ZCyuH6EbI0kA==

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9786 43 B
215 B 100ms
100ms Image
image/gif 2600:1f18:1aca:4281:ac44:4026:62a9:ef97
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1135760&asId=6571827c-84e0-f343-9446-ecab41d3ef35&tv=%7Bc:eiEuD0,pingTime:-3,time:53,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:18%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:53,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:18,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B47~0%5D,as:%5B47~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tFWuXBz+11%7C12%7C13%7C141%7C142%7C143%7C151%7C152%7C153%7C154%7C1611%7C1612%7C1613%7C17*.1135760-65089090%7C171%7C18%7C19,idMap:17*,rmeas:1,rend:0,renddet:IMG.us,siq:19%7D&br=c
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:ac44:4026:62a9:ef97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
server: nginx
x-server-name: dt03.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9786 43 B
215 B 98ms
97ms Image
image/gif 2600:1f18:1aca:4281:ac44:4026:62a9:ef97
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1135760&asId=6571827c-84e0-f343-9446-ecab41d3ef35&tv=%7Bc:eiEuD8,pingTime:-6,time:61,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:61,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:18,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B56~0%5D,as:%5B56~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tFWuXBz+11%7C12%7C13%7C141%7C142%7C143%7C151%7C152%7C153%7C154%7C1611%7C1612%7C1613%7C17*.1135760-65089090%7C171%7C18%7C19,idMap:17*,rmeas:1,rend:0,renddet:IMG.us,siq:19%7D&tpiLookup=ao:corporateofficehq.com*&br=c
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:ac44:4026:62a9:ef97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
server: nginx
x-server-name: dt11.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 14E4 640 B
262 B 55ms
53ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARiDsKDRATAB&v=APEucNXoBJdDw6amA0Lsr3Z1KAOF1tvcMVAzI6CuBBqbyhvNtED_C3Jq-ppJdk3eAK_PRglVK6C981guFC6SAoeRjly98rm7-g6yRLqwQb_laQyBpmN4O7VKAkS_Ax6_w6Slwq0JvBZaO-b80xEJxnyAns81ZwP1edo2jogkwSIEsEpesxKINAcJNy3P9JG6nshy7H2zpKXL8YHQx26UNrqdtSzzo80r7A

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0e8821e889280c3b745b859e6b3971924723a4562bac65ba8aa0fe44bfc83b2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 242
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:18:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame A5F9 78 KB
27 KB 67ms
67ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:04 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:18:04 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame A5F9 42 B
63 B 53ms
51ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DKKEV1Jp2xPPj44U0tyXZvX1AxTyzpyADSr4PuOvQz1FrIJBi3Gsy22M6IIDetu9OG9s3WABvHe23d7-SLqZ3whVl_WWjlbM_QogWkWfJQdauCq7k

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A5F9 0
20 B 53ms
52ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=4390586098613658766&x=1&ct=76

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adj Show response
fw.adsafeprotected.com/rjss/bgd/1135760/65089092/xbbe/creative/ Frame A5F9 252 KB
77 KB 37ms
35ms Script
application/javascript 54.194.221.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/bgd/1135760/65089092/xbbe/creative/adj?p=APEucNXJ6zVKcfmOYNWnPhlQ6G5PmIikX67-eOp2ZvMylSaquzdI9-o&d=CokBAKAmf-C1VGR5_ys5-t6R26z4FIIbIByRu8KdgvorqvrCS3LUqCbLoCJcndGP4y2-SKHS3nEmshfZ--6b6Q-XJmX2tnOUBgKGKMP3lj9pM7flHidRro1_QUQZjYhyU1qNK8EtgpzHr1j8uA6NFfwoOBDumDhvVLgVhS1_H4SRHvTUy1St8cPYsMoS2RUAoCZ_4BtXpOcj4Molce7Pn4q-HkECDAmdrKLyd6p3hbI6Pt1Qr260Oqqnaex9dZc_Tu-HmxNLiOTfwo_RXe7xzK4MtF3JAmY6mk2KE7gTvqZVtY_ewkE83sVHCBJhsZDmqKD_4QUBBpAHzSzz9758fB3NsIW0F4yZh7On11lzyEGdh0nxVSoR1-mw8dg9cceWUJyLkKj1dMh6PqrxgINasqOpuYz4FWEG77bnESrlPwzJHaOCcBXVQ6pqxPTM0QL7P6klpV1gubcfo78_8ARrps84Os8dN9VhBN3T9FkaRwS4MBXsNEFVACatc10qmPQBKqlZzqpGcDBMLNixewmtMg-BZByRi4Ks4FqoYPTgJze781SUaXnJWFBzb1EyyTHQYzuhb8HesFwBnSRTp7C5_AA9G-Khe6sVp_8vFX-7YqN4fPb9qfuAlaZLXEmaA4-L_r3vS7kJab9HlHMGJEp3azYxZw_gvCDVUJCxDGCKgHnNREpO8jLFS1CuW-fKBeKF-GuSz_6cK9zNtilPru_umtfjL_yr91fqcmuD-gE34xlLzgwTdxbtfYcQfwcPtxhCzWAgQCXz3qvZAVpP50W89PLKxGpYpp8fSq3lyGT3jcifBgx8jQ_l62H8kveonCqIAfKRa5f5gTSgFnU3P4AkPoUavCK8MGVviUoMO6eHPb_PTHwXaseP1gLPCSqP8cSoWLwdMkCIQnXzY_6OZXZZCqzrOIUY4ymCua3VU5geKsZioXcJRRzZjkNuf9nhvJ2uOFMHCw9MFfMJQh5g3dxZhgr9Dw58NdH30r_p0Qo_taEKTk1y2YgDGAgdq5mtXDrS0sBnaZK0q-Wk1n4nWbfBcFTEKLssplSbx8NPz61PvEOlJWOnkEEndqRDcK7xzLBgwIu7F5uX6l__xicBCljz0V2ouzJJwFWdtw21f5pbMmmAzeYgzsDQSTDXiJtmKfvvekFyTK97gD6lVYKaBJ67hGJCe14OQa8-gltVMLH4L-Ccl_8TpUjlrSBC8u2N13MYZPm7FJr8slpAoZt1C0qdB4jQyYds9L9zqufTWifh48iZY2Gj8uT2e1jGWIG3cFBXHaDSHjo8IDWmHHbUIhEAfbPAz72CMZccn5PoQzM11cC0LO6dw0OcG5g9L5tFl8uUeo-02x7zU5vXFEo_Tv4Xjs-dRIKPC1wYD17tM6ZQrRRznQ_LehckOoAj2Zbh5NrheQO2kMbvLrkj1Kk1XNg3kzjFoeIoULHji8ocrYRYVI5SzLi5UtcuRHRA3OhNs6MyeRk5MmnGkSIkcCYhBi3X1a0mof9HmA79pH2JDfRaA0qBaqSSL1CxRZk5h1RrRC0LJlfP7WIP3HBGef86EA-8v6ZQUYH0EtEqN7WJFvJjgJUyKuK4tkYOZqHDWyDbMm5djyFsElz8d7lr0vDc1xdYL62WSEvExc3sUjLNITRttrvulAVuOigbP3sxrdK7zIE3tIZx8chO28Yhf423hmkTnrSdsw2pQ2ijnTGBDib2F2aVR2FpSgDPAp72Nph4kWnMTZNCSyjJSzTK-8ifhhKvqhV-aZU5xIQPAEtijifVwjE4av3Vi-oZtFVeNkXiZoISQHfN4c4E2xIYo3yh03MAcZ9wiPtCMA118MNlTfaLbVWJ6t4F7jK2AlvGl1VKNdv-XLzNpRStcqeOECKjf_KChouVT_uJgjEZpuTOucIQW6ya-Acjml1bsKKHPk92V1SUcihjETjs0cL2O22ixqBkzyYRKEJHo7LQ7OZbxd_wqfK4YJcfFvaIwH5QDqBg6xTgNRREcpjCK_B_V2vO4fwtyOXvoKr9kt-oiwNe3_hVso3UjUO1xK4WPxzGUBtpWWmFLEK1rLAeoZxh6aPMgPx09Nsnjud5OMXW34pdE_QGCojZcVXDy22WtMVk0xzJyu21aayqEUVSbWmIuI6A1RbyeuJ6HYwwPEZq8Ko4-HAKP3M2YM_NsVYq1UjVgDb0XmEZXaKPYosbUlPy6xOUoamD87X4w69S5BS25MsnkwlQMVpTmGsRI7rhXdu0eGcaWUGeERB1dM1nhNJAh4JKXRkP6HTYLQsU6me5f9gkLMpNFIWKeHP8NJ38V2qUn0wB5m9PWoMFsz4gzo9JvssusfQTKDD0v3s-qit8zNUrG9560kz6WSTYSMBNRgNjISC5qUu9GGVyqePA_G5iHUJy8T9ZHcB0x20STgoldRTA4TDoLnGgCO2xndBiCwqwKN5mNzoVO95cm9ryIWQm3DtomoAYWgSTnaXVDrDRdsIPV4fNLrhF59vEjXneK_WHNK2fiFgZeTiIaPDToIoG_LOQxPRyTG__MyknHRLsbz1kZw8GzegHtu7mXb7Z1ov6ZnhXm8GGRIJ0ATxMNeOoKmIpl6J-zYylRQ904fv85u7qa8n68T6xLhzio0xa3KZo8aJcSSH6h0UYWC2EjIVJZ14q417RcYacUqwZjzZf3YTrlibxOGooJ9FVVCaO8RTK4w8wQyitrMh0V33TReaSdS7h_H6xIA6F4dJh7Dddk_Un1g9ehAhhnaZCoP9WpcXEFGXPPz4SE5o4XTXyFOMi_ObEqie6tmN6K_Jlss8CNZ0YfwEX5O4bAgzFOyE7n6qX7RLUk38qutyad6RQ2z04zuzTQZ5ZtXm0P45zZ0kyVU6wSngrvykTaRITNLb5aNnaICqgNeMj8vfylpIUR9eqaaD1c5KcctkB5cKusGGci_2gF0ruyrUXEyDedpzUWKvHvxCWZWEwcSNcRBPYLiUIUqcf21h1jlv_qunu97BlFrHg8AoFFghmWpENsAQTzxoQ09xqptaomiNr-RrldeK9H2dO2lET0PDYOPE64MwK5bzeSyM2VoT0sQ4kEh6xGSzQpFdQ98fsBAqfSSDlF4gyza1waa3eMZ6Rc93dOJH0qp8D1n36EO0FQcTs9aFSuAdFNUimx-AZTtZVnf_6_7XtsRoohDERa2svl2IDNt6i3cqc2cjmXkEA5KHJvgNld9Livtbw4C-ZpCIfzmJNUW7SJGADhEEbubR1_Urthd-BiFpopZMOxB0ybNtwGwnRvMvjDJ2UXX_EDvzyMLChYyZIQfAKkgDGFRgZ3BfNdGsvksDnQC4RkYr0dKWCreHaFvRqn1V8Ghmz-ccugUH2judCM8nNKUZz5SYrp7lwC9ySKdWweWVklxnKgKm-XjBMwIiBO6rAkIV6lyWWqoqruZcL147Gipw413FrecM4-WUPvzDqFR_IopTFpb-LFuSTTW6GWbJQ4S6F_k3uQ4nCsJhz3sV58RtK-umiz-Y671mdrqnnA3txDv7QCRnFrdQW9DhJ4j1Q_3v_KJ_0jZMkoaZ2Yg1re_JG_B4NtRjEidiZ78su4c-R4Y41PfT9qo42blYXKMGa2KDEqbWLuvLlkHbwjdAeybfdCInnYooljrL2tYotuwlxGZnuw3_qy2mcUUm4HB5WsnBBQetZvFI-oAlXCJAN17QcuRbs2OxIPgUTS7BYlXIQ1uuHo0cbxOrvKCoavBYFJPW_f2pW0VxBmr_v7FNa7ygcX7tOq6qkQNKOa3Bz1KXbeP7gsvKq921DLIwY5Nvks3kFw6Izxv7w5zW52CiqHB6e-EGliBUbomIF7YvhzJamSVlGeV-cgml_0R9KC0oAO9RW1C4V-BozECJN_kK2E8RgvNaLGgPc4jQQwlBGZLr-KGfLjFv-dcX1oRpBCAQSOwBygQiDWzpQ1nGUaFY9e2-jIDLeq3js2FRQEKe1OnQXIlFoJ7MyNNiYQAHvBl9PqXkq0nEmL18PsaJ8GAFgAQ&ias_dspID=3&ias_campId=1008772806&ias_pubId=pub-6396844742497208&ias_chanId=1&ias_placementId=20163094551&bidurl=https://corporateofficehq.com/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0i_GaKWM7TA024-RdcVKEwg
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.221.155 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-221-155.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 2bfb6fb3a63d79fd0aa7cca763d6df3297a45aed757d3793575ae236dc2f8e0d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame A5F9 3 KB
1 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/window_focus_fy2021.js

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:23:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6855
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:23:49 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame A5F9 19 KB
8 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3735e94afb2539b14515fdd10d7cc066cffa99d4b52762959e342295e08a770e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 20:06:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 69065
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7991
x-xss-protection: 0
server: cafe
etag: 2412543371950383451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Jun 2023 20:06:59 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame A5F9 0
0 21ms
20ms Image
text/html 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaSAaeGvY_dDq8OqhoFg40YNDuFwBfw5YdGkIJjUhkyoq8184VbWyxkPxSeLsOYIDpeR0JhI4is3I52oNwvnl2wMeFB-Uw
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame A5F9 171 KB
53 KB 30ms
28ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b108d10517b218ebb22d63ad00b85baf89a7b4f1884c3fd01eb03f0790b1cd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54276
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1685532878231373"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:18:04 GMT

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame A859 466 B
235 B 59ms
53ms Document
text/html 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARiIs6DRATAB&v=APEucNV5BaxlzP9zpLyWjzdglUEGQddbslQK2l4yHNN2Ne8ny1YJNJeL9s67HEmsfoLZOBXXu0OfKsGtckaoqoE7A-9yvObaSRyxQaUNvAQHNlZO3Cf0iohFSX9k2fn8azr38xvHOCVbFbRzymJrrufp-7eQfSClwo0yIwH18QTtUhGzhmnWE0es-7T7Jm_EJvo5f2JRFXB-_msk11uaeNaE7jQBJVhIMQ

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

37ab5c060ae53ccda75b8bd212d874a17650f7954b11c4e31f568990ab40196b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-encoding: br
content-length: 215
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 01 Jun 2023 15:18:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 dv3.js Show response
pagead2.googlesyndication.com/pagead/js/ Frame 03E2 78 KB
27 KB 186ms
185ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/dv3.js

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

332d8e2d6964e41c92a430d24b1b469bfdcc30ad072f980b2e7adf241590886a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:04 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 28042
x-xss-protection: 0
server: cafe
etag: 3261498652431352696
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=600
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:18:04 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 03E2 42 B
63 B 50ms
49ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-AquaDlxHSZ9Mt9YGzmiWwg8092uipNI3EA1BDTTuCQGXWuHY5vyjrhW3nUXzj2hEV_7dCykDteTNPa4LQgEEqx2jQmK8bra86Gof6CnJRNjT2zSIQ

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 03E2 0
20 B 50ms
48ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=fetch&cor=15251660909149054499&x=1&ct=76

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adj Show response
fw.adsafeprotected.com/rjss/bgd/1135760/65089100/xbbe/creative/ Frame 03E2 252 KB
77 KB 38ms
36ms Script
application/javascript 54.194.221.155
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://fw.adsafeprotected.com/rjss/bgd/1135760/65089100/xbbe/creative/adj?p=APEucNXyq3IQCB_rQDbnVa--a205ZaEUI7aDdWSLdWsq7fHzkvZ8d_k&d=CokBAKAmf-BGERD5UpNaAYXLaV6IyBCdUHFEUR_VoUe_KuQWZ0Qaq9eTRdoOpmpp84nAEFsqh5lzBNvP9WJ0bo10y1jyf0mj3jR3pNEvjAsRfUi70n3-CkDEsZbQAoubdsMTrR2nuS3tSCENChbojKKbB4c2Y9Pi8FNSzlDQvu_nasR1gY82n-0SZ4QSyRUAoCZ_4D6qnPneoh4tWbqy0JPyG2KvDBj6ARqHWWOH2J6UU0OIfUltiw2cU4kpDI1okkLgrlA7CXTpLw2_13HRJYo9GH1T-eCUE568eyNgCaOHKKWvoroBhBklo43M9KqFxVAJVn5K4sPatGbeE-gr-IIIosUIL_vPeU8dgCF4rQFfXmlyoU2lBo279-T6_rHKCL_DYp7Oy3stIdT0BnNtxTOlO-TObpjDW7PJ3mZXZetLnL4XJa2cFqG0dK9yu_QKa1M_0mnSsQtX-PL7KG2X6MpzKP65LGg032SAjyxfPcFpPgbnZ4XWOfYT9lmQ1S58HmmHIwVQJQzLHdTl4nldvi3PYSuxKJ4Qi70c2q88o9fLaJSuA6pU2yG0MYoMle5M9WMIIFZSLQpS8YtkAJQJmsz-iUdFkoP7PFY0ivAHMZbLkgLb8hqWMOg9SIMi7nqqSlTTA9EZFD_KlGJn3EiQNBEy41Q0lROPQPYuxbDcgkO6GMkY8nxqrQ-JveisQE6RsLoOH6BzKbQiaM3HIYcn_amE-kwD4QrN6z8k1qTD4eLfAY-FTsnxT4EaZL8VNkDpu_nzuTrAffXWGIB6rmFfykqkCs9MaBNCusvbOdVkVpaGfJrrTv5iCi8kNp-GsscARfsIT_mufZFNumhNRZ34Fh2sx1UN44ejyvcOdABQ2909IDEudOSLbKXoOyMQOzMwVJ3nhdwx8n3tK0A1jagtWpJ5NjgXEGlsIo1idQB6Es7xwllHWbGTkZ1ab8CZ3ZqEK7lF9ycejerOvZwAHCRdqVhwA58Twh4RYCmvhkHxQoCyAT4dAsmiYgIT7R9Hbn88oQX6__X8cgxAaPWqLIxbFYJYupAmwERQJCo1RVnafg39JT8nLUfSY1CHqW34Iylh5zaN3HN2H36nbSLoFbsGrGmcViBcJ_jzhkcXIKLTu0D_EQw72X45FcrTBwOJheUlwUZSYYr1bLn1pCSmUDsjOfXYC4uYOuw1t4c8EPAYYWopYO0GJ4BcMfhAglgmJm2NRBRD01tFucxDZTqtGsH6serUJbJVE9FhnF2tkUoZzAUEqICijBNTtutJ2WC9ugWtoxvpYuUJYfLqa0q1pD0SoNnBQs318g8VX5fqX8oh2sOGnchOSwhluCLoz6axfYg_xlskcTg22KfKeC4kcOFqwtchtdAZxxoqiD_AvGcmc4efOQMZSuembGYUx2qyAy3-qtPASPxH_0IZVgiYSJf2sRHAMrlK_w6qENr_WQ6N8PGzcvne2iXOZejGZUDnX8ZVp9JANKjxTgqG5CRJ3xLh10_1v0o38di9iBW73wv7YFAsfdGzIGedyMyyGFGQDym2lRLyqioMvFQxJocupxjbUBmu1PhGe5YrVCiRqbtFu-beK-Z1KrAPGwYte0M3ZI5oZCevgyC2SJAaJmwMC79zpNJvBr418fN1KRv9D-728l-qjJ-QMwi1u4q7UiIeUx9sCjJt5LHC367qVFtN7eQ5qKPb6WIqA50TWOYIhY10R_WGHznyJSTb_qeXFBXa-stOmvHhLWW_Tpm3iYudaNazNeUDFVoHwMynYiEN4vb9PMqS-SiQx9kVUeN_i9BV6gx0AOFHladkwVk5rondRBqo6S1UlM3btHDdepUTRJl39i2QKmyhzEmI3uQ1iOPOLO-_gcuPUeSNlqNItuiG6hVda6qHuzuuIN85YdI2pMQqnf_0WsnJ9KKqwHY_tNnHQZpWqdfXjHAQTtYWb1L6-oEoY7ZOA_y4ZGRS4U87vUhIO3YnynTkIY9m1aLQ71Fx0RQr9u5bJNgyZw1eB1hhiv-Rf2zMNZ48oQEOQfF46rOjit7M69kvodgV3irFtXhBe3-ishlZGV-hDqA8KaLdbYhYN1wszlLK7jJhHpLIEuUMMpcfS-nCtdA708eXGb7vEfJ50g1SYyP2t2vPZkLxprreMsy44-W5fymm46i_GxZC1PP0TCRuCKuaM7dVRezFQL4BOGPAD4yGxLNK0JpirnD77XwuWYQz4vRkQqVqop9PrXohpfkGJqWJaCxvkuDI3Ep9gm6EhtAHkY3yIlO6RWnr3xqdCSeymY1iN3DQfA_IkB3UuNew1wqclBkoS0Y-HiQ6EJ6nWKFxpCzRFHZt8tcf4Ev7eHeLRLn0aPY8JOkNCdCIq-Do61YwXSsmSb4eeeKlG5PXNgsrs3oJxhch8VDk3oBbuGF5mvjC406qxNS_sHC13HCWwIn2uub29vN4JPzyhmm3lBfk2ViMMAyDPxp2TAoBgZYmr7hgOfnI_lcaiq-D3YQyo-n0SvWjwoAgccr1DKId9HSxwKu8mvvvL-EBlQx-XyRXJZ46ZzgwkMOgLFyo1UIDRmVPeUE8odBmAEa9zqfyVfyhfb879EKeigUo7Es9jX791KZgr8fbe5EPh9DtrDi-LlKLBUyAqI6q-3y3hjEj43WSIJ070-eUm_YwfiPuVu8c8wLTlOmlWarRfnUI3nCi2OpOHEKUwIo1tB9pxoiLRSgjvsH8hsm-fvc4WlkqSX-S5ev2Dvwvykale0SmGc7CY4B8kohZ8r1KTFNPz9AzqvzGjDWvGukAffBEiFSO-dlB7H6OIyFeLjTxcSPotimDv6K00g1h3mIJI5N1fgT_ZDeEngYC9iL_z2dFbxCWIGuv8MwJothppQm70oTcbjtY9vorJlwCSwOZxDv-GWBpNMQItlmGRp7T6aOwsX0pW9S37T8OJ5g5oGtBnlSRCRkxeAS5bAyQhdwqYayIMjd_57k2-OVIJ7Pexi4PIRdkVZBlGhbcof-9-XQRDTN_TcrfF-Iu4CpXCjVqh13e62xBZ9C3lNzC0u5YxvQuSgxZ-2LKjdjkFeeVVwy7yfTJ8jFaLGtRlnXN-utB6Wdk4yMav-dR4-zLd8pPcefb7d_CqQac7g9i1luyEmnZuOS6tKhnOXnX2vsDMgsgfXdigM2TTYlMrPAaST2nitFPLGOCP4Pa38ussPrDA1a3_wrF8h4SZFFFd-o7zBYUd4zjhKwbFlq7Ymo87tRDk2Ejyx7gqeaZIE1Mg8WVY1MCvb9iy3DeQ8Cjq5kP_aPTpWpk96ml_XEWIVex77bXua8-QdPepzUdDR0IGIptHP7dX7Do-xuuuaNp5GSbxR8B4H9RswwzcWtajfyPs3A_whsrP2yigM36QI2-pXsWuCbaaluluxVBkGIdkNRs8NPeKmX_wZa41uAl-wK_LB2aLDnQR5SnuC9t_nGzl-nJXCA1mSK_C5wuOV8dlrjHXcjJInVomtk7qNiMK6ggqrlTqa-m0kHINTNikuoGTxXshclwkwcEOqZ5Y9Aers8xwOsporexNmp003d2uUiSjxfzjeDn81kFpzGWdRrh4LcCpUVc0QbziD7xr2FDsr5A6qWduguDi8UdMHQc-lOf2oXAn5iXtWprjw29oVN_cwqxLXQY7-bhkuH1096n4UsnRH9fEN8NlAAqJuHCfnyvcyMEL1ZSJTtahziUA-_USxBDQ3sX7pH74KjSmI4ZJ1N0u6FWcS9QN-6GJxKgjbXeeqgtivwKKjoGRiZlf-FoDYcyMwaZa-dUw4dOpx1d-qiEKT_T5mCIqWsDwk43m9sAHXJR7lN0pNEidrjtuC1CSbGHGd9UTNGHY1w_9s8_f_N0DW0CDvLZCkteGnDHR0Ntnq9Ri30UkEWnAOOHP-j2GkEIBBI7AHKBCIMg8M4fSG8OMrIILNRYWHv_uGTB1CwxHdXt7drEfIiZNG8QLeY9Qp1iVJ7FoH14RotB21LSsEkYAWAB&ias_dspID=3&ias_campId=1008772806&ias_pubId=pub-6396844742497208&ias_chanId=1&ias_placementId=20163094551&bidurl=https://corporateofficehq.com/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0hSAUz3gwoC7nU28jNlLWgl
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.194.221.155 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-194-221-155.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: b311507b1b5688b7d2285efe78dd429272854b3cbaa62aa6ac7c7d8233347b55

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
content-encoding: gzip
vary: accept-encoding
content-type: application/javascript;charset=utf-8
access-control-allow-origin: fw.adsafeprotected.com
cache-control: no-cache
access-control-allow-credentials: true
expires: Wed, 31 Dec 1969 23:59:59 GMT

GET
H3 200 window_focus_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame 03E2 3 KB
1 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/window_focus_fy2021.js

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3164db7ef9efc7121ce85192340a653c6cb87e34caa05849c8fd47b7872f9fc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:23:49 GMT
content-encoding: br
x-content-type-options: nosniff
age: 6855
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
server: cafe
etag: 15004572836499977866
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:23:49 GMT

GET
H3 200 qs_click_protection_fy2021.js Show response
tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/ Frame 03E2 19 KB
8 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20230530/r20110914/client/qs_click_protection_fy2021.js

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3735e94afb2539b14515fdd10d7cc066cffa99d4b52762959e342295e08a770e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 20:06:59 GMT
content-encoding: br
x-content-type-options: nosniff
age: 69065
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7991
x-xss-protection: 0
server: cafe
etag: 2412543371950383451
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 14 Jun 2023 20:06:59 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 03E2 171 KB
53 KB 42ms
41ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4b108d10517b218ebb22d63ad00b85baf89a7b4f1884c3fd01eb03f0790b1cd6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 54276
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1685532878231373"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:18:04 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9786 43 B
215 B 100ms
100ms Image
image/gif 2600:1f18:1aca:4281:ac44:4026:62a9:ef97
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1135760&asId=6571827c-84e0-f343-9446-ecab41d3ef35&tv=%7Bc:eiEuDn,pingTime:-2,time:76,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:562,beZ:563,mfA:565,cmA:566,inA:566,inZ:569,prA:570,prZ:575,si:580,poA:582,poZ:603,cmZ:603,mfZ:603,loA:622,loZ:626,ltA:637,ltZ:637%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:160,h:600,t:18%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:76,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:18,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B70~0%5D,as:%5B70~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tFWuWM9+11%7C12%7C13%7C141%7C142%7C143%7C15.1135760-69474490%7C151%7C152%7C153%7C154%7C1611%7C1612%7C1613%7C17*.1135760-65089090%7C171%7C18%7C19,idMap:17*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:IMG.us,siq:19,sinceFw:55,readyFired:false%7D&br=c
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:ac44:4026:62a9:ef97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
server: nginx
x-server-name: dt16.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H/1.1 200
OK localstore.js Show response
script.4dex.io/ 483 B
1022 B 46ms
14ms Script
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-4-56
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Thu, 01 Jun 2023 15:18:04 GMT
Content-Encoding: br
CF-Cache-Status: HIT
Last-Modified: Wed, 23 Nov 2022 15:43:18 GMT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
Age: 603820
ETag: W/"922cffdd75f7192f75231d92684885aa"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7muwLE922MTOElQ%2FvQbMLbdX8ZRmqNiPSBBCTT%2BTmuDn1YkP%2FAm6fbr9F0pCEOFWKFe77X8f55U9MBRQg8B9hGO0rGrWwHI7G1dWAM4Kz2fhh5Ak6ua1UyGxy0F%2F4LQ1734Gg5tZ7PDz%2F0b6"}],"group":"cf-nel","max_age":604800}
Cache-Control: public, max-age=1800
Connection: keep-alive
CF-RAY: 7d086d570f665c98-FRA

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 20 KB
8 KB 300ms
221ms XHR
application/json 2602:803:c003:200::41
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=21150&site_id=351284&zone_id=1868548&size_id=9&rp_schain=1.0,1!ezoic.ai,1567cca48aa689689525ce6158e40cb9,1,,,corporateofficehq.com&eid_audigent.com=060efg99jagd8a8ci8cgc7dihhfjebk8g6kmoq66weqk4e4iu4iqi2kussowmgy4q%5E1&eid_quantcast.com=P0-642205814-1685632679966%5E1&eid_pubcid.org=a759a3d9-e1c2-4cd0-9596-4bccd6dff647%5E1&rf=https%3A%2F%2Fcorporateofficehq.com%2F&tg_i.domain=corporateofficehq.com&tg_i.page=https%3A%2F%2Fcorporateofficehq.com%2F&tk_flint=pbjs_lite_v7.46.0&x_source.tid=704bebf1-46c6-426e-ab6f-f85ed11959da&l_pb_bid_id=2ba600b9a1a159&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=704bebf1-46c6-426e-ab6f-f85ed11959da&rp_maxbids=1&slots=1&rand=0.23832017433075703
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-4-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::41 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 595c3884d050d5b09e61a7cacff5caf12088c72c5a354deb5482f2560cfd64c1

Request headers

Referer: https://corporateofficehq.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
content-encoding: gzip
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://corporateofficehq.com
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 315 B
652 B 354ms
276ms XHR
application/json 2602:803:c003:200::41
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=21150&site_id=351284&zone_id=1868548&size_id=9&rp_schain=1.0,1!ezoic.ai,1567cca48aa689689525ce6158e40cb9,1,,,corporateofficehq.com&eid_audigent.com=060efg99jagd8a8ci8cgc7dihhfjebk8g6kmoq66weqk4e4iu4iqi2kussowmgy4q%5E1&eid_quantcast.com=P0-642205814-1685632679966%5E1&eid_pubcid.org=a759a3d9-e1c2-4cd0-9596-4bccd6dff647%5E1&rf=https%3A%2F%2Fcorporateofficehq.com%2F&tg_i.domain=corporateofficehq.com&tg_i.page=https%3A%2F%2Fcorporateofficehq.com%2F&tk_flint=pbjs_lite_v7.46.0&x_source.tid=3c2d2818-ac3b-468c-bdca-dfb22d791e84&l_pb_bid_id=388991b8410e27&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=3c2d2818-ac3b-468c-bdca-dfb22d791e84&rp_maxbids=1&slots=1&rand=0.6288584302805973
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-4-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::41 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: b3528fe2fd8ac9bc2b1f8582615f3ca1dbeb39148a26c53a0a1a81e49733a339

Request headers

Referer: https://corporateofficehq.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://corporateofficehq.com
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 315
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 9 KB
5 KB 227ms
148ms XHR
application/json 2602:803:c003:200::41
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=21150&site_id=351284&zone_id=1868548&size_id=2&rp_schain=1.0,1!ezoic.ai,1567cca48aa689689525ce6158e40cb9,1,,,corporateofficehq.com&eid_audigent.com=060efg99jagd8a8ci8cgc7dihhfjebk8g6kmoq66weqk4e4iu4iqi2kussowmgy4q%5E1&eid_quantcast.com=P0-642205814-1685632679966%5E1&eid_pubcid.org=a759a3d9-e1c2-4cd0-9596-4bccd6dff647%5E1&rf=https%3A%2F%2Fcorporateofficehq.com%2F&tg_i.domain=corporateofficehq.com&tg_i.page=https%3A%2F%2Fcorporateofficehq.com%2F&tk_flint=pbjs_lite_v7.46.0&x_source.tid=d94a9327-0edb-4e0d-a79d-553c8d035972&l_pb_bid_id=4c4a1c1ecb1915&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=d94a9327-0edb-4e0d-a79d-553c8d035972&rp_maxbids=1&slots=1&rand=0.8567352624033822
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-4-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::41 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 418a467b8fd515b22448af93a94d32245c7d03cb3164b80fd75f376fca369b2f

Request headers

Referer: https://corporateofficehq.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
content-encoding: gzip
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://corporateofficehq.com
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 316 B
653 B 367ms
289ms XHR
application/json 2602:803:c003:200::41
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=21150&site_id=351284&zone_id=1868548&size_id=57&rp_schain=1.0,1!ezoic.ai,1567cca48aa689689525ce6158e40cb9,1,,,corporateofficehq.com&eid_audigent.com=060efg99jagd8a8ci8cgc7dihhfjebk8g6kmoq66weqk4e4iu4iqi2kussowmgy4q%5E1&eid_quantcast.com=P0-642205814-1685632679966%5E1&eid_pubcid.org=a759a3d9-e1c2-4cd0-9596-4bccd6dff647%5E1&rf=https%3A%2F%2Fcorporateofficehq.com%2F&tg_i.domain=corporateofficehq.com&tg_i.page=https%3A%2F%2Fcorporateofficehq.com%2F&tk_flint=pbjs_lite_v7.46.0&x_source.tid=7756f2c0-e531-49ac-86f8-c36359f2775d&l_pb_bid_id=506c56c95fb21a&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=7756f2c0-e531-49ac-86f8-c36359f2775d&rp_maxbids=1&slots=1&rand=0.6856587921078403
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-4-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::41 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 0bedaca72d624efc7200c1136e3e4ec50122cc365a6abbe711d3abb5f8d09185

Request headers

Referer: https://corporateofficehq.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://corporateofficehq.com
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 316
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 13 KB
6 KB 285ms
207ms XHR
application/json 2602:803:c003:200::41
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=21150&site_id=351284&zone_id=1868548&size_id=15&rp_schain=1.0,1!ezoic.ai,1567cca48aa689689525ce6158e40cb9,1,,,corporateofficehq.com&eid_audigent.com=060efg99jagd8a8ci8cgc7dihhfjebk8g6kmoq66weqk4e4iu4iqi2kussowmgy4q%5E1&eid_quantcast.com=P0-642205814-1685632679966%5E1&eid_pubcid.org=a759a3d9-e1c2-4cd0-9596-4bccd6dff647%5E1&rf=https%3A%2F%2Fcorporateofficehq.com%2F&tg_i.domain=corporateofficehq.com&tg_i.page=https%3A%2F%2Fcorporateofficehq.com%2F&tk_flint=pbjs_lite_v7.46.0&x_source.tid=bc9ea4c8-84dc-476b-92c4-d1ecd69dfd2a&l_pb_bid_id=643c6ab0344ce9&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=bc9ea4c8-84dc-476b-92c4-d1ecd69dfd2a&rp_maxbids=1&slots=1&rand=0.8042940763741062
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-4-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::41 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: 609e8e13c5ff2b10e0af4ca5cf1cc85565b2854e4d03182e374798d485de813a

Request headers

Referer: https://corporateofficehq.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
content-encoding: gzip
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://corporateofficehq.com
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
expires: Wed, 17 Sep 1975 21:32:10 GMT

GET
H2 200 fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 316 B
884 B 191ms
113ms XHR
application/json 2602:803:c003:200::41
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=21150&site_id=351284&zone_id=1868548&size_id=14&rp_schain=1.0,1!ezoic.ai,1567cca48aa689689525ce6158e40cb9,1,,,corporateofficehq.com&eid_audigent.com=060efg99jagd8a8ci8cgc7dihhfjebk8g6kmoq66weqk4e4iu4iqi2kussowmgy4q%5E1&eid_quantcast.com=P0-642205814-1685632679966%5E1&eid_pubcid.org=a759a3d9-e1c2-4cd0-9596-4bccd6dff647%5E1&rf=https%3A%2F%2Fcorporateofficehq.com%2F&tg_i.domain=corporateofficehq.com&tg_i.page=https%3A%2F%2Fcorporateofficehq.com%2F&tk_flint=pbjs_lite_v7.46.0&x_source.tid=1eaf5add-c9f8-4bac-99d2-bcc9346be09f&l_pb_bid_id=74d9b861130c62&p_screen_res=1600x1200&rp_secure=1&x_imp.ext.tid=1eaf5add-c9f8-4bac-99d2-bcc9346be09f&rp_maxbids=1&slots=1&rand=0.467385182986376
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-4-56
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2602:803:c003:200::41 Amsterdam, Netherlands, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: nginx/1.21.4 /
Resource Hash: bf295e4ece17fde3b99c062460dd59d47a6d65abfc7fb69143c6cb515271ffa1

Request headers

Referer: https://corporateofficehq.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
server: nginx/1.21.4
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://corporateofficehq.com
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-length: 316
expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
120 B 87ms
39ms XHR
text/plain 185.64.189.112
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-4-56
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://corporateofficehq.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://corporateofficehq.com
date: Thu, 01 Jun 2023 15:18:03 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true

POST
H2 200 pbjs Show response
htlb.casalemedia.com/openrtb/ 37 B
555 B 68ms
37ms XHR
application/json 104.18.25.185
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://htlb.casalemedia.com/openrtb/pbjs?s=305141
Requested by: Host: go.ezodn.com
URL: https://go.ezodn.com/hb/dall.js?cb=195-4-56
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.25.185 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb5c107bb9917ba7dc30e48e128262b1b7ff05909c514e2a0496b38075ec1fd6

Request headers

Referer: https://corporateofficehq.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T%2FQ0zY0pt3ik55kWq5lgKN%2BwxfY%2FqmFmRitbKcgvaz%2F7cesM7MfKwZm6Bb82dX3EOmI2ScmDJTH3nBCQsRx%2Fie13yHCsNmLZTWvGgT3x6TXs5S5YIUPqekXSQOyNcy4Gq%2FUblvh2"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: https://corporateofficehq.com
cache-control: no-cache
access-control-allow-credentials: true
cf-ray: 7d086d571ef435e8-FRA
alt-svc: h3=":443"; ma=86400
content-length: 37
expires: 0

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 1130 22 KB
8 KB 13ms
13ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 69062
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 20:07:02 GMT
expires: Thu, 30 May 2024 20:07:02 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame 14E4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=openx&google_cm&google_dbm
https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEMMZaBOHxUw3Am8DdsEdqtw&google_cver=1

43 B
114 B

31ms
27ms

Image
image/gif

34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEMMZaBOHxUw3Am8DdsEdqtw&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARiDsKDRATAB&v=APEucNXoBJdDw6amA0Lsr3Z1KAOF1tvcMVAzI6CuBBqbyhvNtED_C3Jq-ppJdk3eAK_PRglVK6C981guFC6SAoeRjly98rm7-g6yRLqwQb_laQyBpmN4O7VKAkS_Ax6_w6Slwq0JvBZaO-b80xEJxnyAns81ZwP1edo2jogkwSIEsEpesxKINAcJNy3P9JG6nshy7H2zpKXL8YHQx26UNrqdtSzzo80r7A
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://us-u.openx.net/w/1.0/sd?id=537072991&val=CAESEMMZaBOHxUw3Am8DdsEdqtw&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cm
us-u.openx.net/w/1.0/ Frame 14E4 43 B
219 B 41ms
35ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/cm?id=9ca165a9-d9fe-2ff6-d83d-d145a80b0d37&r=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dopenx%26google_hm%3D%7Bopenx_uuid_base64%7D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARiDsKDRATAB&v=APEucNXoBJdDw6amA0Lsr3Z1KAOF1tvcMVAzI6CuBBqbyhvNtED_C3Jq-ppJdk3eAK_PRglVK6C981guFC6SAoeRjly98rm7-g6yRLqwQb_laQyBpmN4O7VKAkS_Ax6_w6Slwq0JvBZaO-b80xEJxnyAns81ZwP1edo2jogkwSIEsEpesxKINAcJNy3P9JG6nshy7H2zpKXL8YHQx26UNrqdtSzzo80r7A
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
content-encoding: gzip
via: 1.1 google
server: OXGW/0.0.0
vary: Accept, Accept-Encoding
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

um
sync.teads.tv/ Frame 14E4
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_cm&google_dbm
https://sync.teads.tv/um?eid=3&uid=CAESEGUXe-JbFJdNfvZKe8Wm9O8&google_cver=1

23 B
163 B

47ms
46ms

Image
image/gif

104.102.35.84
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=CAESEGUXe-JbFJdNfvZKe8Wm9O8&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARiDsKDRATAB&v=APEucNXoBJdDw6amA0Lsr3Z1KAOF1tvcMVAzI6CuBBqbyhvNtED_C3Jq-ppJdk3eAK_PRglVK6C981guFC6SAoeRjly98rm7-g6yRLqwQb_laQyBpmN4O7VKAkS_Ax6_w6Slwq0JvBZaO-b80xEJxnyAns81ZwP1edo2jogkwSIEsEpesxKINAcJNy3P9JG6nshy7H2zpKXL8YHQx26UNrqdtSzzo80r7A
Protocol: H2
Server: 104.102.35.84 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-35-84.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

expires: Thu, 01 Jun 2023 15:18:04 GMT
pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://sync.teads.tv/um?eid=3&uid=CAESEGUXe-JbFJdNfvZKe8Wm9O8&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 281
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 um
sync.teads.tv/ Frame 14E4 23 B
163 B 78ms
42ms Image
image/gif 104.102.35.84
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.teads.tv/um?eid=3&uid=&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARiDsKDRATAB&v=APEucNXoBJdDw6amA0Lsr3Z1KAOF1tvcMVAzI6CuBBqbyhvNtED_C3Jq-ppJdk3eAK_PRglVK6C981guFC6SAoeRjly98rm7-g6yRLqwQb_laQyBpmN4O7VKAkS_Ax6_w6Slwq0JvBZaO-b80xEJxnyAns81ZwP1edo2jogkwSIEsEpesxKINAcJNy3P9JG6nshy7H2zpKXL8YHQx26UNrqdtSzzo80r7A
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.102.35.84 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-35-84.deploy.static.akamaitechnologies.com
Software: akka-http/10.2.10 /
Resource Hash: 328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

expires: Thu, 01 Jun 2023 15:18:04 GMT
pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
cache-control: max-age=0, no-cache, no-store
server: akka-http/10.2.10
content-length: 23
content-type: image/gif

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame A859
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_cm&google_dbm
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEAOBZYfh4otda6ModYYLyh0&google_cver=1
https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEAOBZYfh4otda6ModYYLyh0&google_cver=1&__user_check__=1&sync_id=8173b04c-008f-11ee-ae8c-1a404fd50206

43 B
548 B

21ms
20ms

Image
image/gif

185.94.180.125
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7025&uid=CAESEAOBZYfh4otda6ModYYLyh0&google_cver=1&__user_check__=1&sync_id=8173b04c-008f-11ee-ae8c-1a404fd50206
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARiIs6DRATAB&v=APEucNV5BaxlzP9zpLyWjzdglUEGQddbslQK2l4yHNN2Ne8ny1YJNJeL9s67HEmsfoLZOBXXu0OfKsGtckaoqoE7A-9yvObaSRyxQaUNvAQHNlZO3Cf0iohFSX9k2fn8azr38xvHOCVbFbRzymJrrufp-7eQfSClwo0yIwH18QTtUhGzhmnWE0es-7T7Jm_EJvo5f2JRFXB-_msk11uaeNaE7jQBJVhIMQ
Protocol: HTTP/1.1
Server: 185.94.180.125 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Thu, 01 Jun 2023 15:18:04 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 99
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Thu, 01 Jun 2023 15:18:04 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Location: /partner?adv_id=7025&uid=CAESEAOBZYfh4otda6ModYYLyh0&google_cver=1&__user_check__=1&sync_id=8173b04c-008f-11ee-ae8c-1a404fd50206
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 35
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A859
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID
https://sync.search.spotxchange.com/partner?adv_id=7025&redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dspotxchange_dbm%26google_hm%3D%24SPOTX_BASE64_USER_ID&__user_check__=1&sync_i...
https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=ODE3M2FmZTktMDA4Zi0xMWVlLWFlOGMtMWE0MDRmZDUwMjA2

170 B
188 B

24ms
24ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=ODE3M2FmZTktMDA4Zi0xMWVlLWFlOGMtMWE0MDRmZDUwMjA2

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CLOrkQEQupmXARiIs6DRATAB&v=APEucNV5BaxlzP9zpLyWjzdglUEGQddbslQK2l4yHNN2Ne8ny1YJNJeL9s67HEmsfoLZOBXXu0OfKsGtckaoqoE7A-9yvObaSRyxQaUNvAQHNlZO3Cf0iohFSX9k2fn8azr38xvHOCVbFbRzymJrrufp-7eQfSClwo0yIwH18QTtUhGzhmnWE0es-7T7Jm_EJvo5f2JRFXB-_msk11uaeNaE7jQBJVhIMQ

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 01 Jun 2023 15:18:04 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Location: https://cm.g.doubleclick.net/pixel?google_nid=spotxchange_dbm&google_hm=ODE3M2FmZTktMDA4Zi0xMWVlLWFlOGMtMWE0MDRmZDUwMjA2
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 21
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame A859
Redirect Chain

https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true
https://ups.analytics.yahoo.com/ups/58269/sync?_origin=1&redir=true&verify=true
https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1HcHFHRlZORTJ1RjRVSlByT1RTaGhZZm1RSmRKbWROZH5B

170 B
188 B

24ms
24ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1HcHFHRlZORTJ1RjRVSlByT1RTaGhZZm1RSmRKbWROZH5B

Requested by

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath_dbm&google_hm=eS1HcHFHRlZORTJ1RjRVSlByT1RTaGhZZm1RSmRKbWROZH5B
date: Thu, 01 Jun 2023 15:18:04 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A5F9 0
20 B 50ms
49ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=6488006069871&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame A5F9 0
20 B 49ms
49ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=6488006069871&version=m202301230201&ct=76&x=1&cor=4390586098613658600

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame A5F9 15 KB
11 KB 50ms
49ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C-8AJnDqNfx1_D4oV2akHytsFphuZ8aY4C8vs1dNg4dRz8VxM3xaGF5dbC5ihkdpfwSsNjSVALihDCcAXHdLnaEdBQf7Mn1g85MrWhpybjzEhKXw4XNS6moLqp4btv_Tn_bVh8ipXAbF1OgqTtJt-wbEsihfDrJMJhsHmsUkG9YfuTCXk&cry=1&dbm_d=AKAmf-CYBVmDXvSzy1_b_B0m14ZNg6QhatdGLjdzwbnHcdpdYeB254DDaQmk0jv6ru0_XLEUvqB73G8x5HJLk9IIGjsUsB3wue7ZzMHzZOVF7n04pKspEjlz1QkGpP0fLkyJnrHlVYUWnXRaInO45O84vFdE58LkSo_-QcQiPpOaKElc1m6AnK7eik-ecVVt-JQb0ff8EP3Z4ai502Y4G4aVUf2XPwoGct6Y1_FuE6si_xuF2VN6yvKhbpJBB8PvlVM_PLWcV9HPeeXObstjJrMQlv3GV96HDvHgtrrVf38rpizcsQGzkD4tCgDfc554-r-A6lYQPlm0xcFHVPDXLrruoaFw6JkELX3n1MLzglNb5U6ioXHXnUP3G4oDks-WswW4Wb3TrzEuX4LdLQHLth5QMZH5iadwk7jV6Ykcg85iUkIAdhhlVOHoYAGytbaHX-ozVvqo_oeP_2Cl9Z5DvgV81oT1gXB00rLJqbv_iu_b41kwJe1bPnRau-KqXy-H0wc6xrkkqfCfRLdrqZ5V0lyY7FRraUCC7SzgJSnsaY9bZfj85XKcMLUIioUTE7daGSDa8yvJ_53_uUvrBLCd7sP0RBnFaZ5dHQlynRHNQFQilikrOx3nk9wCCiZzL5ePIE0cDeAz4w3knlFl074mwEVzeqdZ4dgtmPN2ou-xgXoEwourzaxoCyCZfJydVSoymteovV7wm6esWeHvR8s7CxCzh30V8iWmQQ0_C0hRVer-Q51QH4ElU6BVLr6LaN8fyKnjNyBpD_7yFf04U4fyMb5pgaaXqGCs0g4NpC_N-fQ1TOf_pH8LaVyX2AK9GBkYs9VTXU4H6h2hYZZsHsN9vJ3WE86AZf3dSnY2GNko1qHr9P7UZIlTbkcd474AMLnCkowY8QlDSj3yUY34FwQjoqytaZ1oB2NO60jYknRidAPc53O_-yjnW0e0DiE6UiBc333udMLxBr9qTLfaNnvI1N2QaIUBi-J1v1O2g6hceVt9wJk7SawvuuGvwVO-SHbz-0ANehnOQQx3yhYBdSlYX6_YUZOEKAiRTyWnD9ZAwtY_n-xOdXRRQh6OhqQ_XNQb-cc4U8d4hh0tPA1cHXwUMa4dDs8jtypUg4W1IIcfPOvOPHD73MantWmmj0m306nPD5ZX3vPbZVjyeSidGlHx-ky1ZPgRaTBTKRvfEoCrveEzaptZ7-6oyVceRO7jsE6gr0t_9PFQYWZtJ3bf4T3Kz6vt6HjkCETM3aGdJ90xdE9yWLdvu-kzJ_CG_yqmW9xic084ILXrYwtKhnOF6bC7GGDDWYZCq8m87zZwU3O4-NiRocY3eqrS93Ql-H032tWe-gfBzZROScnTIEtbSKwBdAQ92soJ0NQmnuLzODp7dC4T-LIUo8JHwynI9e-09JLgXE4k9lhR3uopYs9uBhL-mfcq7jibhn5soFvyim4cJSF1trLxMNa4yno7QYA_EzXblsYxClpMXUSW_pfwuq5uIWsK4i4_aqQddT-CAXcfAzslb1oX3TbJ5k2NkC6Gfri47VRTSkRsjK6UW6whHhjwy8Mod-Ouak4Lucc9a0wTomeV0omDG8e3fY1mkIKZYCDjDq9aXrZxBQ7KDjHNGLE8KnoZZBcuUkpGC7aPN_uUGSLQk0Z2gZ-zI8ZYlhLSUMWpGNn-Wa9GUIy8Nz7CoYKwwyjpMLR34DxL9NjTfm2IUxLQJPZHsYGUb2lNiaUUsbSjmC5NcPYvBFXMBg_zK4OyzdCWCq4cVVK5dOuAMCNXy9Bn4o8A-XMPOz_V8TPci1ksR0xb_st9dHOafCWz8yUVkBi2jKjacm1Dg9-PpBbAzGOwtIVTbNK072wOtw3i6kuVali97PUUrGePMFb2rQG1uNyHbcdJ-VsAJwEofI13U4WAlTezVbowH8DV51aavkeh0ZI0ykpKyZ1IIsx1YxHZkCCiYmHAkStRax1JSFNjvou_FAb0-8L8ocERmtK14VzBC8k6JtuX8wImTr9LPmdoO2xiNIz25EU-w_Bc3IOgYimK1QbmW_5JujCwt4YzaqPozbnjEhysbKgX3ilsPf6yvotUMcXOtr1kYgifhjwA9ZegnMIXMn-Bge1KiORzeL20LgLN2qlQGRV0lW5sNzHKd5PZumuTh42D74uM_yMD9eX33Mphfg_ctr3K4IhuGnr-dLxgD69GNIaBQmLYrRI8E5bAdn4CErkHiw7rsUzrdD2JePX9SQ5uER_M61NlFY1kKCgjfeliZe3y3J3-ygj7qnPqvs-F7I5c8293dpAjeeonXMazclBHTvb8gQYi0ECP5FEBTx6p37qBVmgssM1fWxefuHiTYqOLlG8h0yItPXO0T2svrcbrGL9Z0wr6wR3selJbibBWuJsy1inZmLX-jAentvUsbtL8wnMTmpVy4hrksOeyU2o1-y5r353BXKGHmUsPDejT3LVvGWrxnWLYKw1LEHGVd_GgU59E0ZJqViu0qbgD3DvBtInUXZVi_8bt07MaRogBmhe_Qy2LGw6yiGgJYZI30WzzBn8J8l2ocjsH7GGFj4Fqvc3eBX4-dJ3vwDmJi2q2qrohAgApmyoNIhAu-7_c68pZ1jbFxv8uVJobOuBl7oeAEBQdCYVUZt3BRsadI_9uka4oYqCKErZWkzwk2rh6uhhxXzbI8YtRNxXH7XJ7N0KsGVSV-qvaSgA8HEGn9-CCqTJ7hUZnDP8NV6sxG08f5hbgj8ltgT3avctRO6LPOiqxMnn5CwS0USTAq1FUEn0Fk7QPcCFeGX06QLkXkGMSulZGJNCs7TEffJ6ogKp0CCSlir95WjGsnWMRQX3C0gbX12w33Sefgb5mBRMfJQeaUA2CaBLEGYC9b5CaJuhmTXbDVX9BZFGZywqFsOKq-mQaog-GYNxV8CKf_7YSbDWSTPVRBMg3Iz5yUVY8XSF4VhtyPfM_QuWRX7aEhba3TbGPfmE1XfRMJNpT25QMKTr8Fp1z2i5c46sv0JBHmYzwWCr6iQc4YjCBN8qQRe2z_0ue0aNh1G0O-geyr0NVO8kJkKC3ososK5haCuIVjwyr7h7XOg5qmQf66BpvITs2eJqySoGY2bTJ5jMvuly8yHNa6SAcPg&cid=CAQSOwBygQiDWzpQ1nGUaFY9e2-jIDLeq3js2FRQEKe1OnQXIlFoJ7MyNNiYQAHvBl9PqXkq0nEmL18PsaJ8GAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcorporateofficehq.com%2F&ds=l&xdt=1&iif=1&cor=4390586098613658600&adk=2857193498&idt=74&cac=0&dtd=19

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d6933aac1ec5a21582c93be02003cebc3fa2f201578f1bafaae6af8b2e144924

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11295
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 9rqtaVZiiC_7YLKwh7YBfT4gwbCPSzX7QNXGZKOGVto.js Show response
pagead2.googlesyndication.com/bg/ Frame 1130 37 KB
14 KB 14ms
13ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/9rqtaVZiiC_7YLKwh7YBfT4gwbCPSzX7QNXGZKOGVto.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6baad695662882ffb60b2b087b6017d3e20c1b08f4b35fb40d5c664a38656da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 18:50:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 73644
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14729
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 30 May 2024 18:50:40 GMT

GET
H/1.1 200
OK adagio.js Show response
script.4dex.io/ 74 KB
23 KB 35ms
18ms Fetch
application/javascript 2606:4700:20::ac43:4bf1
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::ac43:4bf1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed87a83a9df154b61d76e8b9b53bb9d23db3eea194e66bca6b575e3e4f7a57bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Date: Thu, 01 Jun 2023 15:18:04 GMT
Content-Encoding: br
CF-Cache-Status: HIT
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Age: 142863
Transfer-Encoding: chunked
Connection: keep-alive
Last-Modified: Wed, 23 Nov 2022 15:43:17 GMT
Server: cloudflare
ETag: W/"c56b6332dacf72f135afcd153ae22448"
Vary: Origin, Accept-Encoding
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RMJcbhZ3NWwwPsfGoFGRQJE6JqjfnW8ZODqY6%2B6hswzaEk5fYWu4ER47z2B1O0kuiZ6uZctWVYHLnYiXX8wjyu%2BGss4Kx3Siui4Ow4tO30eMIAk1F5A%2F4cNx1nj%2FlUzsbXFEDt%2BukCMNQSZO"}],"group":"cf-nel","max_age":604800}
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers
Cache-Control: public, max-age=1800
CF-RAY: 7d086d575c411d96-FRA

GET
H3 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 9786 106 KB
37 KB 15ms
15ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Origin: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 09:27:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21051
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 09:27:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/ Frame 9786 11 KB
4 KB 13ms
12ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/omrhp.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1135760/65089090/xbbe/creative/adj?p=APEucNXsUMOiyaueGNBp86tgt7fpK1wE2sWqjeSextzlesOlMi_yMJw&d=CokBAKAmf-CdB0LC_gr9eDTO2GK9lyig__Lipxa19-Kq0u9yHXbtpjI9-aesroSJuLmvlBUd7rhdBhvHqRLgLpSd3biLNl79RyPiBG42iYjomwPKh216NgGBjGPOsvh0SVo9mjoXVMrzuM-iRhkayq32neAgLfZuvKlA5kqBh6-vADHRreMGLuupWfES2RUAoCZ_4DiVGVQdcJ2HvVocz3OaUSODK0gy3GfX8_zWz_8jCQ9LKN77DaqbDM5uN5tuqO2K3j1HXjE5JkjGqCnh8WGqbvconRVXzvM4mOojXYWELBQ9Qnh82iL_2uNurXFLBxxXPDrkGf0weKqLuc_ob-IAas3bpE2ARdqFx0b41rAXBbiGjcqPaGeV1-2gSgWkhXReOzsClmkHW4Fz2OUhN4GCwJyXzP49WakzQaUScW46QJxIcfNckmDWroPBMtSNiSR4Or4c2k4_mrhLLoQqi4BWd1LZcwJtNDx2lF_1Vzvov5lW7_eR4D4m3jnPTQuyeMCO6gVXrvo8RmwEj-Lg3d_wWTlkB2womcixMHccTmJ7tKthkCvIznZ_uSzcQj4ybQN5ws61ZlOuLkS-TxLGg-fD6KHqo2Bx9QIyk2Dq8X9rWv4TZUMPnuqAR0ygXZshFDeYbe1KB9pw7eg6Er4FYy8Ra1uEabkxxYFxurzgifDsQ0hWxx45fy7u11DvfCSfxQPVAscwY5ZKUl7g89emMZ0bwa56BaCmeGtqwUDLcHORgWt4CChxfT4n789w_-pMwKHZBmb2haM09bVkBkK27qBGJT70sl8CvfhTyppQoxdfdIRLHjUV5WBU_F6d3ddMsIhgJevWFI6GTQs2eBx6vV94WumSHWje9mMVO1zInSVFYzxACaAeVfj0bFQMDxhyLOjXFMT22xXdfXn3q7wQJNwCwszrq6zVzPuWDd50-WM9J9E5f1ewKfhQ5OnYAn3MhdQOJRf9vyPl00cF4CjeYne1WJzOCO1SJSVJEDcaT9lFhNrMDeorW43lG1YKDitPpOFtbuys80H8ZBKST7_1Ov0lU050aB5t-2xXSzhcD-tuSUoPRpr56YMla34m6U6fbwpWXjUP_84L96oSxvR3g_UYYp_LZagtuqnaT172WgNuQUsddLaVd8wOaNqI-ygBTlmpmxdAlCQckv2l7kXUhXlB73pm0gEt4BGA81jTufn1T_dHdAuNPhMzW37_0g89Kd-rXknGl2hwgbjgiZnP0xXEz2uRKe32OIv4IhUVXUrlnJNutCUN5KiZKpEeWMQm0ZkUAOR1jbCvL4Gjru93mn1ITO_MB4VHj-ef3zER4_ZsZQlxp0Ha4Pu_nhjwbOdP-LQPSzkXgSXfEuDyX3s9VKf_n0dZTfiZ8Cki3gwhVO9jNycm6UxvoNIUFya4-YJKN1zfiJMWw_zqgUkxhLu2j_cZW4bL2SUQ31RuhEvMhZbJqzpwmAWQ2nuZhMyOQAt8Nbcl7ArlDh4zdmryTqjAT5tCsJr6M6RgGDt8af-PePQkBe5jTg47Q6C1CDxvlLSwY-Ix5wUuWtLGqqtIdqMJYMCEAVySzsF4qTtZtllZYG4GDubYu7iul1CZopHm0z2gmUUMIQioMOC1rvgKasjafZjkJJE_jJGnreZ62UnxY87Zik7PXgC1rP8EyrU5l52hPnFI6kf2wVJ2wi0kJ7LpI0KMapxU9tX82_7CbO_h2lkaYFfkgTz4qYCGeCY69LOzDSz-IZd0eGZFYGS1niBPCaAa6TH08w99U3BAbM-Ufl-s_yweD8JSt3GwqBFFkuxadNnRzQcNiKKQNMSFte-rjneUgJvthIdeV7s7s0rUyJiJJX5zJGBE1_rWyLYMXDeaaaj0BA3zCal1Jl36AzkHIC3b7uYzvhRaZNe-PVkzzG0GqSkHCdTltLtASBOWHhjtIDW0M-NJIngZUC95lqPl_H14Y8JGvmuxxMnOq6HGOi3koowQqj8IxbCx4A5u5OsR0MZp1LvKFZ4Vi3a26bz5RAPrthA5_YKpnv_ymbAajJ_wYTKFaDUE-lLw_jZZ9LFcLYmZ1BCkGNOS2UPqG-o3Mz7Ghcc3RJpIWZ2BzbxyOh_RQ7Qym2fx9Qtf-lgsohhRdlkgIQ_kf-7aXeJx_OZXlwKkY0EC1mNvPnIwPW7ItTOJVDX9ZhAEau-PLpKBQWkrJuHV2DB1rCQyvO4mhXQwWSa1f6UbduuIe6drRUOIWLnqKQRvU6oE6EgV5rb8qRZK1ZqRfbWF8w6U4zOGH4zbdmg4cHsCQ2Mjh0dxu-sr7trIRi_nphyDy4rb-wzfv4g5589Tjy8j89xRoj9cc8e7cy-SoLw2yzMnm97oGiMLVNuQ2hfVG2T4zPIX1bJhA0HJll20Ol495kq8GQaAixdvM1cJp1XkzuT5NzAT17TY5cNOd4YPgSUypy-jDLeQzfC_jnznuiAGmxffypuhy4nQAozYWGWdjCUcwkjnSNZ2C_EJjbnLNiqeFeyC01QuJhazEGdj3S9pI_xl6PqJHeAjHYGEMUmjPA6vrEN2HtZoN4jm3AFZzAtmmjDarQpt82chgjFWTxrSFb_cPNaP3iOUJi_ru9oQTNgNSUEoNOcYeIDJekP-5dlMdvHRudPdzKJswBuIZbqqCEssBslXppZ28uj1jzvM4WG_-Cur83rAeYCIHuRY1dnfyRA-Y9Fo-UyTJ_n6Q70B7SdOzhgatLejOriobe9a0XINHDL6GyzN6NfDYWibf5v9QDuNjUfREt-bQUNh4Q86zIhw_wYYeYWXiv621RqGGwhQiiZFv6GNZN_MudjDfubbLZmjjOn8QTuAQFNxBb9bjK8V9ZNKb2JLqPQdrRoPSP35qAAZqJhR7fbHMO07O1yqwJZwVj1O18Lrsl5g40N9EwKh5m3OQFgOANPuE5h2tBVT0PdK_LKp1HhJFnz74lWJbIYSuFiwR1zOr3JfwluB8qyrntgJwHxIt3BjZ1BgJCxEtiVsifaxBdysM-wSjLVG3_35e4gVF89DV7NAhW7Hb7w9YnwkbayIJFa9BZ-ybAqc7C-A-cAtPxtPhzdO36Am6S5SHezVcb_0Fkvluj7ftWAMW579eHmN92C7ZLS7v3-EliC6q__pO_t5YNFW6MO90zH295zI-M7iOzZI-zqgi7sQJH2X_gU16KVxZNWyg-QhoJBtUylDJX39Cm7YqfrlZie8i-qZklFI49KwKWdAhi0kSXydS8sOuV87WIw0SrW_hnErU-TYNmAmOznGOQ1k6VzL9E_YxCNbi-evkTL7c3Okj3DZfpP0_UDjuvovMh0dRpZPzJWNUZ41KSrajoaP8wvOkkjLlN4px0bSDPK5WBQImMTQompYaajwDod7DVBA4qBLjXQFmIa-9oadyq4lLxhBv-TZIgaF0XKqY-1hBLJsvjfl98unonBHuCm7fGPYVQCkpZMhgAkia7Qw6cwdxbqI_BZqQwJ7DaLksIb-VROdcu-8lBQdOY8qGYx4pqV9Wo-UW0bc-TsfxPTPLJ4QRV313jbKOwq9xkozjE-2PV6XOFa2WlyFKqJP5n99ulhZZv7MD7aYwJsann0Je3a7iwiSeaBzYwdIybb41S5mEt4bOHLn3XW1fUjHqmO5l6CDloZk1msq-SA3yQ86rUJw5SfGs_S5aLprYxcKjzq47-tgM1QEYeVFkJJcSwnxKCaFnaz-Dej08bJc1me9vhJNDdITqt-AEhEGXcI7m7tJ6pC2fRGr1huh_waF1hEXWprD3rLFScBnrCAGw13oi2Rvl-npPfPUUsCeUnJDhWsZ-nb4kgVqnmeeiOSCdf02EBQfWTxuHeH8ixi5sDP03yi-CCakO4R1VWIufVPhBnB_lMsbdv1YkY9Jg3BR_m6XGzj4Z4FEiNGZ4wVZPnJTiC6mLxpBCAQSOwBygQiDAz1-U2GCU-Q6f9nx6mOvATHZQjmYQJu3hn8CgwGDomDeLVP_4Eu6_V1QUJ8MEMXJW4cf_REfGAFgAQ&ias_dspID=3&ias_campId=1008772806&ias_pubId=pub-6396844742497208&ias_chanId=1&ias_placementId=20163094551&bidurl=https://corporateofficehq.com/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0g_-3CkwpaB1cH7FaUba-Vb&adsafe_url=https%3A%2F%2Fcorporateofficehq.com&adsafe_type=y&adsafe_url=https%3A%2F%2Fcorporateofficehq.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:6571827c-84e0-f343-9446-ecab41d3ef35,c:eiEuCr,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-5b89c49c56-mlnq2,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tFWuXBz+11%7C12%7C13%7C141%7C142%7C143%7C151%7C152%7C153%7C154%7C1611%7C1612%7C1613%7C17*.1135760-65089090%7C171%7C18%7C19,idMap:17*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:19,oid:81022a47-008f-11ee-9947-4ee8e8f3fe1e,v:19.8.415,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8017866a6744d35f26aa9da389e9771d40bcae3ee65df4c1b5e16e57b09fda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4872
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 6053914914909336730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:52 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/ Frame 9786 29 KB
11 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4869
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:55 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 5A88 1 KB
643 B 13ms
13ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 75773
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 18:15:11 GMT
etag: 48472445140208031
expires: Thu, 01 Jun 2023 18:15:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 9786 209 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5612b31834370a55ba7e966e7173537f34a6358ec2c7425ff7ac8c5166cdcad8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 wp-emoji-release.min.js Show response
corporateofficehq.com/wp-includes/js/ 18 KB
5 KB 46ms
45ms Script
text/javascript 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://corporateofficehq.com/wp-includes/js/wp-emoji-release.min.js?ver=6.1.3

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Apache/2.4.39 (Ubuntu) /

Resource Hash

5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:04 UTC
content-encoding: br
response: 200
last-modified: Sat, 14 Jan 2023 17:31:55 GMT
server: Apache/2.4.39 (Ubuntu)
strict-transport-security: max-age=15724800; includeSubDomains
display: staticcontent_sol
etag: "48b9-5f23cb9faa3f2-gzip-gzip"
x-origin-cache-control
vary: Accept-Encoding,User-Agent,Origin
x-ezoic-cdn: Hit ds;mm;e9e79bed59d1ad5e55a424bddff4c87c;2-11438-3;cdbbf686-88d8-4ea8-6817-f682608d78da
content-type: text/javascript
x-middleton-display: staticcontent_sol
cache-control: public, max-age=31536000
x-middleton-response: 200

GET
H3 200 jquery.min.js Show response
cdn-0.corporateofficehq.com/wp-includes/js/jquery/ 92 KB
32 KB 20ms
19ms Script
text/javascript 2606:4700:3030::ac43:94d9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-0.corporateofficehq.com/wp-includes/js/jquery/jquery.min.js?screx=1&sxcb=1a&ver=3.6.1

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:94d9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

db3e4aef8b833a147a6d2648ff87569b37052cb0edf6903196653d9f576077ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:04 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 276953
x-ezoic-cdn: Hit ds;dm;77c7cbcb3f0df9be2c21b8b5d22c3745;2-11438-3;270b38f1-f93a-4a41-4f0b-9e64f6e92363
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400
response: 200
last-modified: Sat, 14 Jan 2023 17:31:54 GMT
server: cloudflare
etag: W/"15e54-5f23cb9ef7f32-gzip-gzip"
x-origin-cache-control
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NPGBd9RaVD6lhcj6Pxajdo7kLYQO74Iw%2F1nFBMX0c3N6TdJkGKLolhuQecA7y7QtpMuLlHWyZn%2BSUHaPCGr3z2lQd6L0iOwqsd%2B7SeQ1GP%2FfS6VV%2FSelJH7OabjDP%2FYBCbj4JC%2FYFJONU90ZpT2yG09YoHvFlFGHaBw%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: public, max-age=31536000
cf-ray: 7d086d57cc1892c9-FRA

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame A5F9 41 KB
15 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-C-8AJnDqNfx1_D4oV2akHytsFphuZ8aY4C8vs1dNg4dRz8VxM3xaGF5dbC5ihkdpfwSsNjSVALihDCcAXHdLnaEdBQf7Mn1g85MrWhpybjzEhKXw4XNS6moLqp4btv_Tn_bVh8ipXAbF1OgqTtJt-wbEsihfDrJMJhsHmsUkG9YfuTCXk&cry=1&dbm_d=AKAmf-CYBVmDXvSzy1_b_B0m14ZNg6QhatdGLjdzwbnHcdpdYeB254DDaQmk0jv6ru0_XLEUvqB73G8x5HJLk9IIGjsUsB3wue7ZzMHzZOVF7n04pKspEjlz1QkGpP0fLkyJnrHlVYUWnXRaInO45O84vFdE58LkSo_-QcQiPpOaKElc1m6AnK7eik-ecVVt-JQb0ff8EP3Z4ai502Y4G4aVUf2XPwoGct6Y1_FuE6si_xuF2VN6yvKhbpJBB8PvlVM_PLWcV9HPeeXObstjJrMQlv3GV96HDvHgtrrVf38rpizcsQGzkD4tCgDfc554-r-A6lYQPlm0xcFHVPDXLrruoaFw6JkELX3n1MLzglNb5U6ioXHXnUP3G4oDks-WswW4Wb3TrzEuX4LdLQHLth5QMZH5iadwk7jV6Ykcg85iUkIAdhhlVOHoYAGytbaHX-ozVvqo_oeP_2Cl9Z5DvgV81oT1gXB00rLJqbv_iu_b41kwJe1bPnRau-KqXy-H0wc6xrkkqfCfRLdrqZ5V0lyY7FRraUCC7SzgJSnsaY9bZfj85XKcMLUIioUTE7daGSDa8yvJ_53_uUvrBLCd7sP0RBnFaZ5dHQlynRHNQFQilikrOx3nk9wCCiZzL5ePIE0cDeAz4w3knlFl074mwEVzeqdZ4dgtmPN2ou-xgXoEwourzaxoCyCZfJydVSoymteovV7wm6esWeHvR8s7CxCzh30V8iWmQQ0_C0hRVer-Q51QH4ElU6BVLr6LaN8fyKnjNyBpD_7yFf04U4fyMb5pgaaXqGCs0g4NpC_N-fQ1TOf_pH8LaVyX2AK9GBkYs9VTXU4H6h2hYZZsHsN9vJ3WE86AZf3dSnY2GNko1qHr9P7UZIlTbkcd474AMLnCkowY8QlDSj3yUY34FwQjoqytaZ1oB2NO60jYknRidAPc53O_-yjnW0e0DiE6UiBc333udMLxBr9qTLfaNnvI1N2QaIUBi-J1v1O2g6hceVt9wJk7SawvuuGvwVO-SHbz-0ANehnOQQx3yhYBdSlYX6_YUZOEKAiRTyWnD9ZAwtY_n-xOdXRRQh6OhqQ_XNQb-cc4U8d4hh0tPA1cHXwUMa4dDs8jtypUg4W1IIcfPOvOPHD73MantWmmj0m306nPD5ZX3vPbZVjyeSidGlHx-ky1ZPgRaTBTKRvfEoCrveEzaptZ7-6oyVceRO7jsE6gr0t_9PFQYWZtJ3bf4T3Kz6vt6HjkCETM3aGdJ90xdE9yWLdvu-kzJ_CG_yqmW9xic084ILXrYwtKhnOF6bC7GGDDWYZCq8m87zZwU3O4-NiRocY3eqrS93Ql-H032tWe-gfBzZROScnTIEtbSKwBdAQ92soJ0NQmnuLzODp7dC4T-LIUo8JHwynI9e-09JLgXE4k9lhR3uopYs9uBhL-mfcq7jibhn5soFvyim4cJSF1trLxMNa4yno7QYA_EzXblsYxClpMXUSW_pfwuq5uIWsK4i4_aqQddT-CAXcfAzslb1oX3TbJ5k2NkC6Gfri47VRTSkRsjK6UW6whHhjwy8Mod-Ouak4Lucc9a0wTomeV0omDG8e3fY1mkIKZYCDjDq9aXrZxBQ7KDjHNGLE8KnoZZBcuUkpGC7aPN_uUGSLQk0Z2gZ-zI8ZYlhLSUMWpGNn-Wa9GUIy8Nz7CoYKwwyjpMLR34DxL9NjTfm2IUxLQJPZHsYGUb2lNiaUUsbSjmC5NcPYvBFXMBg_zK4OyzdCWCq4cVVK5dOuAMCNXy9Bn4o8A-XMPOz_V8TPci1ksR0xb_st9dHOafCWz8yUVkBi2jKjacm1Dg9-PpBbAzGOwtIVTbNK072wOtw3i6kuVali97PUUrGePMFb2rQG1uNyHbcdJ-VsAJwEofI13U4WAlTezVbowH8DV51aavkeh0ZI0ykpKyZ1IIsx1YxHZkCCiYmHAkStRax1JSFNjvou_FAb0-8L8ocERmtK14VzBC8k6JtuX8wImTr9LPmdoO2xiNIz25EU-w_Bc3IOgYimK1QbmW_5JujCwt4YzaqPozbnjEhysbKgX3ilsPf6yvotUMcXOtr1kYgifhjwA9ZegnMIXMn-Bge1KiORzeL20LgLN2qlQGRV0lW5sNzHKd5PZumuTh42D74uM_yMD9eX33Mphfg_ctr3K4IhuGnr-dLxgD69GNIaBQmLYrRI8E5bAdn4CErkHiw7rsUzrdD2JePX9SQ5uER_M61NlFY1kKCgjfeliZe3y3J3-ygj7qnPqvs-F7I5c8293dpAjeeonXMazclBHTvb8gQYi0ECP5FEBTx6p37qBVmgssM1fWxefuHiTYqOLlG8h0yItPXO0T2svrcbrGL9Z0wr6wR3selJbibBWuJsy1inZmLX-jAentvUsbtL8wnMTmpVy4hrksOeyU2o1-y5r353BXKGHmUsPDejT3LVvGWrxnWLYKw1LEHGVd_GgU59E0ZJqViu0qbgD3DvBtInUXZVi_8bt07MaRogBmhe_Qy2LGw6yiGgJYZI30WzzBn8J8l2ocjsH7GGFj4Fqvc3eBX4-dJ3vwDmJi2q2qrohAgApmyoNIhAu-7_c68pZ1jbFxv8uVJobOuBl7oeAEBQdCYVUZt3BRsadI_9uka4oYqCKErZWkzwk2rh6uhhxXzbI8YtRNxXH7XJ7N0KsGVSV-qvaSgA8HEGn9-CCqTJ7hUZnDP8NV6sxG08f5hbgj8ltgT3avctRO6LPOiqxMnn5CwS0USTAq1FUEn0Fk7QPcCFeGX06QLkXkGMSulZGJNCs7TEffJ6ogKp0CCSlir95WjGsnWMRQX3C0gbX12w33Sefgb5mBRMfJQeaUA2CaBLEGYC9b5CaJuhmTXbDVX9BZFGZywqFsOKq-mQaog-GYNxV8CKf_7YSbDWSTPVRBMg3Iz5yUVY8XSF4VhtyPfM_QuWRX7aEhba3TbGPfmE1XfRMJNpT25QMKTr8Fp1z2i5c46sv0JBHmYzwWCr6iQc4YjCBN8qQRe2z_0ue0aNh1G0O-geyr0NVO8kJkKC3ososK5haCuIVjwyr7h7XOg5qmQf66BpvITs2eJqySoGY2bTJ5jMvuly8yHNa6SAcPg&cid=CAQSOwBygQiDWzpQ1nGUaFY9e2-jIDLeq3js2FRQEKe1OnQXIlFoJ7MyNNiYQAHvBl9PqXkq0nEmL18PsaJ8GAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcorporateofficehq.com%2F&ds=l&xdt=1&iif=1&cor=4390586098613658600&adk=2857193498&idt=74&cac=0&dtd=19

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 20:07:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 69063
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 May 2024 20:07:01 GMT

GET
H2

200

connatix.player.dc.js Show response
cds.connatix.com/p/276231/ Frame EDE8
Redirect Chain

https://cd.connatix.com/connatix.player.js?cid=5f049401-746e-4449-8c27-b6b9d8e25882
https://cds.connatix.com/p/276231/connatix.player.dc.js?cid=5f049401-746e-4449-8c27-b6b9d8e25882

1 MB
277 KB

61ms
33ms

Script
application/javascript

172.64.154.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/276231/connatix.player.dc.js?cid=5f049401-746e-4449-8c27-b6b9d8e25882
Protocol: H2
Server: 172.64.154.204 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ec31ac7ad58d2c6509a5205bfffaa35f481e02cecb1ad556c58aa5bfecea16d5

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:05 GMT
x-amz-version-id: xfxelOdpxM0bTdNMdvQjHGCgtwBfV2IT
content-encoding: br
cf-cache-status: HIT
x-amz-replication-status: FAILED
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 31 May 2023 14:56:29 GMT
server: cloudflare
etag: W/"d27c09a063743d04c4db2b9c92d49394"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
access-control-max-age: 86400
cf-ray: 7d086d59b87f68e9-FRA
access-control-allow-headers: range
expires: Fri, 31 May 2024 15:18:05 GMT

Redirect headers

date: Thu, 01 Jun 2023 15:18:04 GMT
cf-cache-status: DYNAMIC
server: cloudflare
surrogate-control: no-cache, no-store, must-revalidate, max-age=0
vary: Accept-Encoding
location: https://cds.connatix.com/p/276231/connatix.player.dc.js?cid=5f049401-746e-4449-8c27-b6b9d8e25882
cache-control: no-cache, no-store, must-revalidate, max-age=0
cf-ray: 7d086d585e6168e9-FRA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
content-length: 0
alt-svc: h3=":443"; ma=86400

GET
H3

200

adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame A5F9
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/1135760/65089092/xbbe/creative/adj?p=APEucNXJ6zVKcfmOYNWnPhlQ6G5PmIikX67-eOp2ZvMylSaquzdI9-o&d=CokBAKAmf-C1VGR5_ys5-t6R26z4FIIbIByRu8KdgvorqvrCS3LUqCbLoCJcndG...
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXJ6zVKcfmOYNWnPhlQ6G5PmIikX67-eOp2ZvMylSaquzdI9-o&d=CokBAKAmf-C1VGR5_ys5-t6R26z4FIIbIByRu8KdgvorqvrCS3LUqCbLoCJcndGP4y2-SKHS3nEmshfZ--6b6Q-XJ...

69 KB
24 KB

51ms
51ms

Script
text/javascript

173.194.76.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXJ6zVKcfmOYNWnPhlQ6G5PmIikX67-eOp2ZvMylSaquzdI9-o&d=CokBAKAmf-C1VGR5_ys5-t6R26z4FIIbIByRu8KdgvorqvrCS3LUqCbLoCJcndGP4y2-SKHS3nEmshfZ--6b6Q-XJmX2tnOUBgKGKMP3lj9pM7flHidRro1_QUQZjYhyU1qNK8EtgpzHr1j8uA6NFfwoOBDumDhvVLgVhS1_H4SRHvTUy1St8cPYsMoS2RUAoCZ_4BtXpOcj4Molce7Pn4q-HkECDAmdrKLyd6p3hbI6Pt1Qr260Oqqnaex9dZc_Tu-HmxNLiOTfwo_RXe7xzK4MtF3JAmY6mk2KE7gTvqZVtY_ewkE83sVHCBJhsZDmqKD_4QUBBpAHzSzz9758fB3NsIW0F4yZh7On11lzyEGdh0nxVSoR1-mw8dg9cceWUJyLkKj1dMh6PqrxgINasqOpuYz4FWEG77bnESrlPwzJHaOCcBXVQ6pqxPTM0QL7P6klpV1gubcfo78_8ARrps84Os8dN9VhBN3T9FkaRwS4MBXsNEFVACatc10qmPQBKqlZzqpGcDBMLNixewmtMg-BZByRi4Ks4FqoYPTgJze781SUaXnJWFBzb1EyyTHQYzuhb8HesFwBnSRTp7C5_AA9G-Khe6sVp_8vFX-7YqN4fPb9qfuAlaZLXEmaA4-L_r3vS7kJab9HlHMGJEp3azYxZw_gvCDVUJCxDGCKgHnNREpO8jLFS1CuW-fKBeKF-GuSz_6cK9zNtilPru_umtfjL_yr91fqcmuD-gE34xlLzgwTdxbtfYcQfwcPtxhCzWAgQCXz3qvZAVpP50W89PLKxGpYpp8fSq3lyGT3jcifBgx8jQ_l62H8kveonCqIAfKRa5f5gTSgFnU3P4AkPoUavCK8MGVviUoMO6eHPb_PTHwXaseP1gLPCSqP8cSoWLwdMkCIQnXzY_6OZXZZCqzrOIUY4ymCua3VU5geKsZioXcJRRzZjkNuf9nhvJ2uOFMHCw9MFfMJQh5g3dxZhgr9Dw58NdH30r_p0Qo_taEKTk1y2YgDGAgdq5mtXDrS0sBnaZK0q-Wk1n4nWbfBcFTEKLssplSbx8NPz61PvEOlJWOnkEEndqRDcK7xzLBgwIu7F5uX6l__xicBCljz0V2ouzJJwFWdtw21f5pbMmmAzeYgzsDQSTDXiJtmKfvvekFyTK97gD6lVYKaBJ67hGJCe14OQa8-gltVMLH4L-Ccl_8TpUjlrSBC8u2N13MYZPm7FJr8slpAoZt1C0qdB4jQyYds9L9zqufTWifh48iZY2Gj8uT2e1jGWIG3cFBXHaDSHjo8IDWmHHbUIhEAfbPAz72CMZccn5PoQzM11cC0LO6dw0OcG5g9L5tFl8uUeo-02x7zU5vXFEo_Tv4Xjs-dRIKPC1wYD17tM6ZQrRRznQ_LehckOoAj2Zbh5NrheQO2kMbvLrkj1Kk1XNg3kzjFoeIoULHji8ocrYRYVI5SzLi5UtcuRHRA3OhNs6MyeRk5MmnGkSIkcCYhBi3X1a0mof9HmA79pH2JDfRaA0qBaqSSL1CxRZk5h1RrRC0LJlfP7WIP3HBGef86EA-8v6ZQUYH0EtEqN7WJFvJjgJUyKuK4tkYOZqHDWyDbMm5djyFsElz8d7lr0vDc1xdYL62WSEvExc3sUjLNITRttrvulAVuOigbP3sxrdK7zIE3tIZx8chO28Yhf423hmkTnrSdsw2pQ2ijnTGBDib2F2aVR2FpSgDPAp72Nph4kWnMTZNCSyjJSzTK-8ifhhKvqhV-aZU5xIQPAEtijifVwjE4av3Vi-oZtFVeNkXiZoISQHfN4c4E2xIYo3yh03MAcZ9wiPtCMA118MNlTfaLbVWJ6t4F7jK2AlvGl1VKNdv-XLzNpRStcqeOECKjf_KChouVT_uJgjEZpuTOucIQW6ya-Acjml1bsKKHPk92V1SUcihjETjs0cL2O22ixqBkzyYRKEJHo7LQ7OZbxd_wqfK4YJcfFvaIwH5QDqBg6xTgNRREcpjCK_B_V2vO4fwtyOXvoKr9kt-oiwNe3_hVso3UjUO1xK4WPxzGUBtpWWmFLEK1rLAeoZxh6aPMgPx09Nsnjud5OMXW34pdE_QGCojZcVXDy22WtMVk0xzJyu21aayqEUVSbWmIuI6A1RbyeuJ6HYwwPEZq8Ko4-HAKP3M2YM_NsVYq1UjVgDb0XmEZXaKPYosbUlPy6xOUoamD87X4w69S5BS25MsnkwlQMVpTmGsRI7rhXdu0eGcaWUGeERB1dM1nhNJAh4JKXRkP6HTYLQsU6me5f9gkLMpNFIWKeHP8NJ38V2qUn0wB5m9PWoMFsz4gzo9JvssusfQTKDD0v3s-qit8zNUrG9560kz6WSTYSMBNRgNjISC5qUu9GGVyqePA_G5iHUJy8T9ZHcB0x20STgoldRTA4TDoLnGgCO2xndBiCwqwKN5mNzoVO95cm9ryIWQm3DtomoAYWgSTnaXVDrDRdsIPV4fNLrhF59vEjXneK_WHNK2fiFgZeTiIaPDToIoG_LOQxPRyTG__MyknHRLsbz1kZw8GzegHtu7mXb7Z1ov6ZnhXm8GGRIJ0ATxMNeOoKmIpl6J-zYylRQ904fv85u7qa8n68T6xLhzio0xa3KZo8aJcSSH6h0UYWC2EjIVJZ14q417RcYacUqwZjzZf3YTrlibxOGooJ9FVVCaO8RTK4w8wQyitrMh0V33TReaSdS7h_H6xIA6F4dJh7Dddk_Un1g9ehAhhnaZCoP9WpcXEFGXPPz4SE5o4XTXyFOMi_ObEqie6tmN6K_Jlss8CNZ0YfwEX5O4bAgzFOyE7n6qX7RLUk38qutyad6RQ2z04zuzTQZ5ZtXm0P45zZ0kyVU6wSngrvykTaRITNLb5aNnaICqgNeMj8vfylpIUR9eqaaD1c5KcctkB5cKusGGci_2gF0ruyrUXEyDedpzUWKvHvxCWZWEwcSNcRBPYLiUIUqcf21h1jlv_qunu97BlFrHg8AoFFghmWpENsAQTzxoQ09xqptaomiNr-RrldeK9H2dO2lET0PDYOPE64MwK5bzeSyM2VoT0sQ4kEh6xGSzQpFdQ98fsBAqfSSDlF4gyza1waa3eMZ6Rc93dOJH0qp8D1n36EO0FQcTs9aFSuAdFNUimx-AZTtZVnf_6_7XtsRoohDERa2svl2IDNt6i3cqc2cjmXkEA5KHJvgNld9Livtbw4C-ZpCIfzmJNUW7SJGADhEEbubR1_Urthd-BiFpopZMOxB0ybNtwGwnRvMvjDJ2UXX_EDvzyMLChYyZIQfAKkgDGFRgZ3BfNdGsvksDnQC4RkYr0dKWCreHaFvRqn1V8Ghmz-ccugUH2judCM8nNKUZz5SYrp7lwC9ySKdWweWVklxnKgKm-XjBMwIiBO6rAkIV6lyWWqoqruZcL147Gipw413FrecM4-WUPvzDqFR_IopTFpb-LFuSTTW6GWbJQ4S6F_k3uQ4nCsJhz3sV58RtK-umiz-Y671mdrqnnA3txDv7QCRnFrdQW9DhJ4j1Q_3v_KJ_0jZMkoaZ2Yg1re_JG_B4NtRjEidiZ78su4c-R4Y41PfT9qo42blYXKMGa2KDEqbWLuvLlkHbwjdAeybfdCInnYooljrL2tYotuwlxGZnuw3_qy2mcUUm4HB5WsnBBQetZvFI-oAlXCJAN17QcuRbs2OxIPgUTS7BYlXIQ1uuHo0cbxOrvKCoavBYFJPW_f2pW0VxBmr_v7FNa7ygcX7tOq6qkQNKOa3Bz1KXbeP7gsvKq921DLIwY5Nvks3kFw6Izxv7w5zW52CiqHB6e-EGliBUbomIF7YvhzJamSVlGeV-cgml_0R9KC0oAO9RW1C4V-BozECJN_kK2E8RgvNaLGgPc4jQQwlBGZLr-KGfLjFv-dcX1oRpBCAQSOwBygQiDWzpQ1nGUaFY9e2-jIDLeq3js2FRQEKe1OnQXIlFoJ7MyNNiYQAHvBl9PqXkq0nEmL18PsaJ8GAFgAQ

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

173.194.76.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3c970b5bf927e98d9d324e8870cf57b3c5bcda39ac886c94fcdea1de13780816

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24064
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
server: nginx
x-server-name: app13.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXJ6zVKcfmOYNWnPhlQ6G5PmIikX67-eOp2ZvMylSaquzdI9-o&d=CokBAKAmf-C1VGR5_ys5-t6R26z4FIIbIByRu8KdgvorqvrCS3LUqCbLoCJcndGP4y2-SKHS3nEmshfZ--6b6Q-XJmX2tnOUBgKGKMP3lj9pM7flHidRro1_QUQZjYhyU1qNK8EtgpzHr1j8uA6NFfwoOBDumDhvVLgVhS1_H4SRHvTUy1St8cPYsMoS2RUAoCZ_4BtXpOcj4Molce7Pn4q-HkECDAmdrKLyd6p3hbI6Pt1Qr260Oqqnaex9dZc_Tu-HmxNLiOTfwo_RXe7xzK4MtF3JAmY6mk2KE7gTvqZVtY_ewkE83sVHCBJhsZDmqKD_4QUBBpAHzSzz9758fB3NsIW0F4yZh7On11lzyEGdh0nxVSoR1-mw8dg9cceWUJyLkKj1dMh6PqrxgINasqOpuYz4FWEG77bnESrlPwzJHaOCcBXVQ6pqxPTM0QL7P6klpV1gubcfo78_8ARrps84Os8dN9VhBN3T9FkaRwS4MBXsNEFVACatc10qmPQBKqlZzqpGcDBMLNixewmtMg-BZByRi4Ks4FqoYPTgJze781SUaXnJWFBzb1EyyTHQYzuhb8HesFwBnSRTp7C5_AA9G-Khe6sVp_8vFX-7YqN4fPb9qfuAlaZLXEmaA4-L_r3vS7kJab9HlHMGJEp3azYxZw_gvCDVUJCxDGCKgHnNREpO8jLFS1CuW-fKBeKF-GuSz_6cK9zNtilPru_umtfjL_yr91fqcmuD-gE34xlLzgwTdxbtfYcQfwcPtxhCzWAgQCXz3qvZAVpP50W89PLKxGpYpp8fSq3lyGT3jcifBgx8jQ_l62H8kveonCqIAfKRa5f5gTSgFnU3P4AkPoUavCK8MGVviUoMO6eHPb_PTHwXaseP1gLPCSqP8cSoWLwdMkCIQnXzY_6OZXZZCqzrOIUY4ymCua3VU5geKsZioXcJRRzZjkNuf9nhvJ2uOFMHCw9MFfMJQh5g3dxZhgr9Dw58NdH30r_p0Qo_taEKTk1y2YgDGAgdq5mtXDrS0sBnaZK0q-Wk1n4nWbfBcFTEKLssplSbx8NPz61PvEOlJWOnkEEndqRDcK7xzLBgwIu7F5uX6l__xicBCljz0V2ouzJJwFWdtw21f5pbMmmAzeYgzsDQSTDXiJtmKfvvekFyTK97gD6lVYKaBJ67hGJCe14OQa8-gltVMLH4L-Ccl_8TpUjlrSBC8u2N13MYZPm7FJr8slpAoZt1C0qdB4jQyYds9L9zqufTWifh48iZY2Gj8uT2e1jGWIG3cFBXHaDSHjo8IDWmHHbUIhEAfbPAz72CMZccn5PoQzM11cC0LO6dw0OcG5g9L5tFl8uUeo-02x7zU5vXFEo_Tv4Xjs-dRIKPC1wYD17tM6ZQrRRznQ_LehckOoAj2Zbh5NrheQO2kMbvLrkj1Kk1XNg3kzjFoeIoULHji8ocrYRYVI5SzLi5UtcuRHRA3OhNs6MyeRk5MmnGkSIkcCYhBi3X1a0mof9HmA79pH2JDfRaA0qBaqSSL1CxRZk5h1RrRC0LJlfP7WIP3HBGef86EA-8v6ZQUYH0EtEqN7WJFvJjgJUyKuK4tkYOZqHDWyDbMm5djyFsElz8d7lr0vDc1xdYL62WSEvExc3sUjLNITRttrvulAVuOigbP3sxrdK7zIE3tIZx8chO28Yhf423hmkTnrSdsw2pQ2ijnTGBDib2F2aVR2FpSgDPAp72Nph4kWnMTZNCSyjJSzTK-8ifhhKvqhV-aZU5xIQPAEtijifVwjE4av3Vi-oZtFVeNkXiZoISQHfN4c4E2xIYo3yh03MAcZ9wiPtCMA118MNlTfaLbVWJ6t4F7jK2AlvGl1VKNdv-XLzNpRStcqeOECKjf_KChouVT_uJgjEZpuTOucIQW6ya-Acjml1bsKKHPk92V1SUcihjETjs0cL2O22ixqBkzyYRKEJHo7LQ7OZbxd_wqfK4YJcfFvaIwH5QDqBg6xTgNRREcpjCK_B_V2vO4fwtyOXvoKr9kt-oiwNe3_hVso3UjUO1xK4WPxzGUBtpWWmFLEK1rLAeoZxh6aPMgPx09Nsnjud5OMXW34pdE_QGCojZcVXDy22WtMVk0xzJyu21aayqEUVSbWmIuI6A1RbyeuJ6HYwwPEZq8Ko4-HAKP3M2YM_NsVYq1UjVgDb0XmEZXaKPYosbUlPy6xOUoamD87X4w69S5BS25MsnkwlQMVpTmGsRI7rhXdu0eGcaWUGeERB1dM1nhNJAh4JKXRkP6HTYLQsU6me5f9gkLMpNFIWKeHP8NJ38V2qUn0wB5m9PWoMFsz4gzo9JvssusfQTKDD0v3s-qit8zNUrG9560kz6WSTYSMBNRgNjISC5qUu9GGVyqePA_G5iHUJy8T9ZHcB0x20STgoldRTA4TDoLnGgCO2xndBiCwqwKN5mNzoVO95cm9ryIWQm3DtomoAYWgSTnaXVDrDRdsIPV4fNLrhF59vEjXneK_WHNK2fiFgZeTiIaPDToIoG_LOQxPRyTG__MyknHRLsbz1kZw8GzegHtu7mXb7Z1ov6ZnhXm8GGRIJ0ATxMNeOoKmIpl6J-zYylRQ904fv85u7qa8n68T6xLhzio0xa3KZo8aJcSSH6h0UYWC2EjIVJZ14q417RcYacUqwZjzZf3YTrlibxOGooJ9FVVCaO8RTK4w8wQyitrMh0V33TReaSdS7h_H6xIA6F4dJh7Dddk_Un1g9ehAhhnaZCoP9WpcXEFGXPPz4SE5o4XTXyFOMi_ObEqie6tmN6K_Jlss8CNZ0YfwEX5O4bAgzFOyE7n6qX7RLUk38qutyad6RQ2z04zuzTQZ5ZtXm0P45zZ0kyVU6wSngrvykTaRITNLb5aNnaICqgNeMj8vfylpIUR9eqaaD1c5KcctkB5cKusGGci_2gF0ruyrUXEyDedpzUWKvHvxCWZWEwcSNcRBPYLiUIUqcf21h1jlv_qunu97BlFrHg8AoFFghmWpENsAQTzxoQ09xqptaomiNr-RrldeK9H2dO2lET0PDYOPE64MwK5bzeSyM2VoT0sQ4kEh6xGSzQpFdQ98fsBAqfSSDlF4gyza1waa3eMZ6Rc93dOJH0qp8D1n36EO0FQcTs9aFSuAdFNUimx-AZTtZVnf_6_7XtsRoohDERa2svl2IDNt6i3cqc2cjmXkEA5KHJvgNld9Livtbw4C-ZpCIfzmJNUW7SJGADhEEbubR1_Urthd-BiFpopZMOxB0ybNtwGwnRvMvjDJ2UXX_EDvzyMLChYyZIQfAKkgDGFRgZ3BfNdGsvksDnQC4RkYr0dKWCreHaFvRqn1V8Ghmz-ccugUH2judCM8nNKUZz5SYrp7lwC9ySKdWweWVklxnKgKm-XjBMwIiBO6rAkIV6lyWWqoqruZcL147Gipw413FrecM4-WUPvzDqFR_IopTFpb-LFuSTTW6GWbJQ4S6F_k3uQ4nCsJhz3sV58RtK-umiz-Y671mdrqnnA3txDv7QCRnFrdQW9DhJ4j1Q_3v_KJ_0jZMkoaZ2Yg1re_JG_B4NtRjEidiZ78su4c-R4Y41PfT9qo42blYXKMGa2KDEqbWLuvLlkHbwjdAeybfdCInnYooljrL2tYotuwlxGZnuw3_qy2mcUUm4HB5WsnBBQetZvFI-oAlXCJAN17QcuRbs2OxIPgUTS7BYlXIQ1uuHo0cbxOrvKCoavBYFJPW_f2pW0VxBmr_v7FNa7ygcX7tOq6qkQNKOa3Bz1KXbeP7gsvKq921DLIwY5Nvks3kFw6Izxv7w5zW52CiqHB6e-EGliBUbomIF7YvhzJamSVlGeV-cgml_0R9KC0oAO9RW1C4V-BozECJN_kK2E8RgvNaLGgPc4jQQwlBGZLr-KGfLjFv-dcX1oRpBCAQSOwBygQiDWzpQ1nGUaFY9e2-jIDLeq3js2FRQEKe1OnQXIlFoJ7MyNNiYQAHvBl9PqXkq0nEmL18PsaJ8GAFgAQ
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame D124 91 KB
23 KB 15ms
15ms Script
application/javascript 2600:9000:225b:2c00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225b:2c00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 0f14828b89630f6555c6372e13fc999a.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P1
age: 21858108
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: J4nYyUur6v55rhFTnZ2x6mRA0nkJpGivHIJBA4QK4O3UrS-daq1huw==

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 03E2 0
20 B 46ms
46ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=running&ord=1777690058800&version=m202301230201

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 03E2 0
20 B 47ms
47ms Ping
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=dv3-render&msg=tlbr&ord=1777690058800&version=m202301230201&ct=76&x=1&cor=15251660909149055000

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 03E2 15 KB
11 KB 47ms
47ms Script
text/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DaCfzhxvwHZ64AJnnEvYvEFRX84pCR8LIUp69JulxG7znVA8ZHZfIJO6nFPqfRY1rPBpwe8Tkx0x1Cz5Yc8FIHvcyq2s6L4py-oZap15YGjoi0R1LfiG7nxmZgwN9MRsyRMl4i8Z7zDszAs_UU90reFFuas6wWE_IZlMdu7GbyZDBl1m4&cry=1&dbm_d=AKAmf-DelWYU-mvENXYWZHFtYPn-LqreT3WGtDiLvu9JdZXYYwpjnmxxddu1rZ_N5E-_Ep0ZJpXaNgo2TAHL_Bk1xl5Gyzafc37rnizt42c4mctRCj7qOUQJVRJU_3XmbAEItQkwwRLV1V2Gv_XoE1Fjg2KuPTZxCyGjMf2aQM9JC1UWRxn7ckYpObk7Sf2Lt4EvhMcz_0Q8dzYtl7Z8qM-g4o4lpaH_hpS1ezTZw72g1hn3BTvijOZgzu-5EAphvjvR0l0F-BHp8i0LJcacCeocG3PAH9bF-tRtggsaG3dWTqop5sVhrEyv-qsh4TnA4AjRqHFAJFosb1CQuvTpFYihqG-HVE0BXD74a5YdVPC9PosIeTcj0vlkIXKUQShbexVtGb1k6XtGXKvRv6ANgC7qSzgHHVhTajVYX1UcgP4Z3DJBxXcKd6qBEvJEQmRo4E2ydTqamqSItODm2QyfbraE1dtB6utOYvTn_cyZArY6hUJZY_E_WkkqG3gr60UOnItyE--Mohx8exA-gzRIpblF2FlmBLwNUIATrsuIjI4aD4GoAf0UqJEZyi5Cndfl7Y43R8tg8tLRzPzBCcGkO4yAch2dwNjU_y8RFOCxOrq0B0cjvI-JVEDVy9XpA4Y9IhzWsHXeWYh-6QUuZlEjbRUNjjufJEoSMkwR3DqH8VNlECEa8KyXUfMOeoZGxRkswmq4dfT-L0-MRh2LvJVeJRQvz5Vy9OgUmeQU0eW8iAkGEgeA1CxW647R3GfCj5lMuajGr-3xPJ1WTTlg8m57ErzmWZOYa28nQqhWSIaPOHXYJ7TkR0ycUSSj3UZOzwgwnCd4aeqQeJwlekgRC6ngXE6m-i8qdxVJKC1ybxVO1ENqlMcY7xGeC2Yar3kcIaK9apbf3Qr3UBwb1Mrb_v7UM2LHmY8a5-gb4uiUGvq94nS2iuQW_8EtRWAU5v59v_68_tGdAgJqeeFC9tg2rvYP-vsDaVt7tgcN-T_csjoChefSY-L4zLlJ_ZG5gQOiFOwCGGYFndS5cNT6oKQJ9iT_Sp7o8f5-tBPM7Lf8-HStLTLPeyBB_6wn1iggrnslCMiP1po6wAfomQqQrcVjV2g1NXiN4HwVz_r_LprH4bpPKnJe_S_IXJNgj1gMsTjjUxtRvfRP9hNgHuVTcYBf0flZ2-Ju3EToki7iNbEO9yx2RhhDWfwoAhP7po-NAYW3ZTwZv_E-_Dcd509rrGnEBUI24soc8l4wOvUq5Hfqz2Vvk7S76O7cmus06fqzuARIPX5v9FoTJwDYv3-r69WFgChkZuNkNue45r-XSdavlGbQ4ml7DAH1BFvzoDaTfYG7r91HMSse8gTTDEbiUIh3gluE1U6ZUJStLuIKdwUITXw4TfDLAIhdkJ3mAEQOQjyL23kGbRZvKJ11HJ5fNliqW2Jo4zguKBpOLZE6vN_mtCOqYGldVcOTZpkmfDBovWoRsDO6vHWvjV_lgOdvFJArVwnCGT2G8fGcnCSBdRUUAHaTbVSb_VblELRkJpHxtz9w6oBBq6wbbvshgzXXaGaZHsYgjsaNG-c9qdrbERUcv0pV4t2si-jjZ9O1QCe9PUeHSCR2fzUg782LWaaqY2niYnGzyqT1HZ7oheOBk7zkImMeq8O1fXEMY1S8qRk-gNNs62dzRgooXOu_-cU4ZxMurS1DiQLnjdXcU_XLS9KURQRl_tKok54gP0iHn7BSYdCWjqzoZdoI5fLYULAWrkZjGwS53qa7q_RXK7pHEuM638i1A3aYHJtoLTIyV3u-Pk9xrTGp8H7_KoLJU2KM9jUANU6Rtf8COiqGxKHOI6FSd5pxE1ECFjwk7jyniDkJO8Qay1r9Jn5-WOdxrFiWOSS9b1LMNRc3MdRpQYjvySR1iCzw6J9IZk-kT6TtHyiEZqZB6wKsStZFJBHZzHw0hPYoAL203xqC7g4JZrOyNzHwKb-AcCxQrFm3yhkg-uT03NVCe7iBQQ73gnhxVH8x6rV86aBbtZXHVq2taRQgpM6j51TiZJxug3jxjhIas9JpU1qbKzcUL9PyXFEqVhD8bZISOF_Vuqs6FAQYOP5-XEDGTreX4huJPfnlfuuXqoCDxGhLrFHM1eWZcH2IzvqRelIgwYjKo3rFGZ_e-3lxe-KuhC8fdyvNhvlKKct3X0-XDoQcmrqzuXwyPFob_I7R_zZcTuj-LXMYoj-7N1Ddf2k8a2Z7DaI67ncatmPysO3ZifOU1nZFGtTG7wCNpnqqdC-qP6eUuWsZUhIsTYe-U1KacF3ZpCVLSMy_7brgE1XrmTdVzCgitNvMP0TXdLlnScxtvi9BiofeD7loC9a2naPPW_URjKVGC0x97lvDvxi-qfCpdV6xvWrpCYnEzZnvlLN6I6Ex_WNKvz-hX8aGBCFIf0RnCbz81CFYKg10hrKZonGoRfDJ57Lk3SGG0-ufGNwAnVbfChaI6Aew3Uv_s-Coipo1blo33oOe61eWz_kP2_t7WYngpfy6Vn_6niqIG_RfS3nGPThUIyfrF639JMzYPoF5YOcoLvS92zYHDRbVZ9zQ5wAQAjzAwlyaqmjKT1R8PLEsustKgrT6yVzcVW4GviCBq-F7Iy_SVaGxiSfp_bFx2xPxIecLusapDBXZdrnxouoi4wecdfnb8EVOn5wKGPrhzQl9S9zGv3PGbF7uMjYvsLZ3JAHl2ciYJs2xaUq16fK7zbZQNsDgsH3AvweMp5lr0BONN23I07S8MLO6mzr80znTaRpvVJesTi_bTW90r7-fLEVGEeqf_PqLKw0dROQKHq3Qf8pq3HGimefjwzXCSuCa_wzjLi8uDJcX1V-qeifkYvRGpCTifWrETEwDQe_cryL5Cll-emAUHux-pdWt_WkHtGtDgQXAfjr0lRZ2dFEw137yvzASyOZgJnwjl2djprUFyCXT2ohqqJXJVjqJkTM6w9cvbsd5BEb29JJzNmzkaQsTmIgrJmh2x_LNdEXlCjwdBA48Dk8GgwTEJLY3xIq9XKCO8P1MdO5SXdOWVl52obqV3WOaVtWiGBD3DJgL-n0MObUn4jqFLXfqh0v_mlIXSiUc3DRSXvTR&cid=CAQSOwBygQiDIPDOH0hvDjKyCCzUWFh7_7hkwdQsMR3V7e3axHyImTRvEC3mPUKdYlSexaB9eEaLQdtS0rBJGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcorporateofficehq.com%2F&ds=l&xdt=1&iif=1&cor=15251660909149055000&adk=2086295851&idt=191&cac=0&dtd=2

Requested by

Host: pagead2.googlesyndication.com
URL: https://pagead2.googlesyndication.com/pagead/js/dv3.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

831b858ef51682f095b3b6fb9f1c48ada25a9e86f98c681775be19007f9a2975

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11245
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame A5F9 43 B
215 B 99ms
99ms Image
image/gif 2600:1f18:1aca:4281:ac44:4026:62a9:ef97
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1135760&asId=2e643bab-4ea5-3f71-781d-54e83a024c58&tv=%7Bc:eiEuI7,pingTime:-3,time:66,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:27%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:66,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:27,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B59~0%5D,as:%5B59~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tFWuXGt+11%7C12%7C13%7C141%7C142%7C143%7C151%7C152%7C153%7C154%7C1611%7C1612%7C1613%7C171%7C172%7C1731%7C174%7C18*.1135760-65089092%7C181%7C191%7C1a,idMap:18*,rmeas:1,rend:0,renddet:IMG.us,siq:29%7D&br=c
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:ac44:4026:62a9:ef97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
server: nginx
x-server-name: dt05.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame A5F9 43 B
215 B 99ms
98ms Image
image/gif 2600:1f18:1aca:4281:ac44:4026:62a9:ef97
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1135760&asId=2e643bab-4ea5-3f71-781d-54e83a024c58&tv=%7Bc:eiEuI8,pingTime:-6,time:67,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:67,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:27,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B60~0%5D,as:%5B60~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tFWuXGt+11%7C12%7C13%7C141%7C142%7C143%7C151%7C152%7C153%7C154%7C1611%7C1612%7C1613%7C171%7C172%7C1731%7C174%7C18*.1135760-65089092%7C181%7C191%7C1a,idMap:18*,rmeas:1,rend:0,renddet:IMG.us,siq:29%7D&tpiLookup=ao:corporateofficehq.com*&br=c
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:ac44:4026:62a9:ef97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
server: nginx
x-server-name: dt02.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

POST
H2 200 bluemonkey.gif Show response
corporateofficehq.com/detroitchicago/ 43 B
196 B 10ms
10ms XHR
image/gif 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/detroitchicago/bluemonkey.gif?e=eyJhZHZlcnRpc2VyX2RvbWFpbnMiOiJhdmFzdC5jb20iLCJmcm9tX2NhY2hlIjowLCJwYWdldmlld19pZCI6IjM2NzczODE2LWU2NTgtNDEwYS02NzZhLWI0N2NjYzU5NmUwYyIsImF1Y3Rpb25faWQiOiJmN2U1MzQxMi1kZTZhLTQyODUtOTRlMC1iNjQ0Mzc0MmU1YzYiLCJhZF91bml0X2NvZGUiOiJkaXYtZ3B0LWFkLWNvcnBvcmF0ZW9mZmljZWhxX2NvbS1tZWRyZWN0YW5nbGUtMi0wIiwiYWRhcHRlcl9jb2RlIjoicnViaWNvbiIsIm9yaWdpbmFsX2NwbSI6MC4xMSwiY3BtIjowLjExLCJhZGp1c3RtZW50IjoxLCJtZWRpYV90eXBlIjoiZGlzcGxheSIsInRpbWVfdG9fcmVzcG9uZCI6MjYwLCJyZXNwb25zZV9zaXplIjoiNzI4eDkwIiwicmVxdWVzdF9zaXplIjoiNzI4eDkwIiwiZG9tYWluX2lkIjoxMTQzOCwiZm9ybV9mYWN0b3JfaWQiOjEsInBvc2l0aW9uX3R5cGUiOjUsInN0YXRfc291cmNlX2lkIjoxMDA2MywicmVmcmVzaF9jb3VudCI6MCwic291cmNlIjoiY2xpZW50IiwiYWJfdGVzdF9pZCI6Im1vZDYyLWMifQ==
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.39 (Ubuntu) /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:04 GMT
content-encoding: br
server: Apache/2.4.39 (Ubuntu)
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: image/gif
access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type
content-length: 49
expires: Wed, 31 May 2023 15:18:04 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame A5F9 43 B
215 B 116ms
115ms Image
image/gif 2600:1f18:1aca:4281:ac44:4026:62a9:ef97
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1135760&asId=2e643bab-4ea5-3f71-781d-54e83a024c58&tv=%7Bc:eiEuIs,pingTime:-2,time:87,type:a,im:%7Bsf:0,pom:1,prf:%7BbeA:796,beZ:797,mfA:799,cmA:801,inA:801,inZ:805,prA:805,prZ:818,si:824,poA:825,poZ:850,cmZ:850,mfZ:850,loA:863,loZ:865,ltA:882,ltZ:882%7D%7D,sca:%7Bdfp:%7Bdf:0%7D%7D,env:%7Bgca:false,cca:false,gca2:false%7D,clog:%5B%7Bpiv:0,vs:o,r:r,w:300,h:250,t:27%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:87,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:27,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B80~0%5D,as:%5B80~300.250%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tFWuWM9+11%7C12%7C13%7C141%7C142%7C143%7C15.1135760-69474490%7C151%7C152%7C153%7C154%7C1611%7C1612%7C1613%7C17.1135760-65089090%7C171%7C172%7C1731%7C174%7C18*.1135760-65089092%7C181%7C191%7C1a,idMap:18*,pd:CV8L.internal-pdf-viewer,rmeas:1,rend:0,renddet:IMG.us,siq:29,sinceFw:56,readyFired:false%7D&br=c
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:ac44:4026:62a9:ef97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
server: nginx
x-server-name: dt18.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 5A88 70 B
265 B 96ms
30ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEIcMb0l8lAzPaqDzIH1yvYs&google_cver=1&google_push=ATf1kGNoCYHJ3ILNVGg2y8_wZXbHG06PXWhYALQVFGFGdnCdpe7MDZPns6MIsDkJcQlYjmFi1W0F1Pz-hDbZofm4rITuemrfmKtC-g
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5A88
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESELKsMUCZFWBIfejrl-cnpTM&google_cver=1&google_push=ATf1kGNQ1j2vr67pTatJdmByN8HyMBGpM0YZKVEIjrVv8kumPjJ8rlEc1U74DeNpktgnkgSJuTM6JILE6dlAG1jOXmOq...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESELKsMUCZFWBIfejrl-cnpTM&google_cver=1&google_push=ATf1kGNQ1j2vr67pTatJdmByN8HyMBGpM0YZKVEIjrVv8kumPjJ8rlEc1U74DeNpktgnkgSJuTM6JILE6dlAG1...
https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=google&bsw_custom_parameter=7f8b3891-8349-49ed-b64d-281be30aad02&gdpr=&gdpr_consent=
https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=google&bsw_custom_parameter=7f8b3891-8349-49ed-b64d-281be30aad02&gdpr=&gdpr_consent=
https://x.bidswitch.net/sync?dsp_id=4&user_id=63841a14-e41f-449d-80d3-7ab297614611&ssp=google&expires=30&user_group=5&bsw_param=7f8b3891-8349-49ed-b64d-281be30aad02
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGNQ1j2vr67pTatJdmByN8HyMBGpM0YZKVEIjrVv8kumPjJ8rlEc1U74DeNpktgnkgSJuTM6JILE6dlAG1jOXmOq-ysR8ogp&google_hm=f4s4kYNJSe22TSgb4wqtAg==

170 B
188 B

24ms
24ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGNQ1j2vr67pTatJdmByN8HyMBGpM0YZKVEIjrVv8kumPjJ8rlEc1U74DeNpktgnkgSJuTM6JILE6dlAG1jOXmOq-ysR8ogp&google_hm=f4s4kYNJSe22TSgb4wqtAg==

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=ATf1kGNQ1j2vr67pTatJdmByN8HyMBGpM0YZKVEIjrVv8kumPjJ8rlEc1U74DeNpktgnkgSJuTM6JILE6dlAG1jOXmOq-ysR8ogp&google_hm=f4s4kYNJSe22TSgb4wqtAg==
date: Thu, 01 Jun 2023 15:18:05 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5A88
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEL1rY1cFPQE3gU8Fgq6oTW8&google_cver=1&google_push=ATf1kGOmx8HsjwBudbiFm2mecExsl_rncsBFZYlMA0hafYh2tRcFNyvCQGpTN7NCTEqe4WqxKw9U6L_H...
https://c1.adform.net/serving/cookie/match/?CC=1&party=1&google_gid=CAESEL1rY1cFPQE3gU8Fgq6oTW8&google_cver=1&google_push=ATf1kGOmx8HsjwBudbiFm2mecExsl_rncsBFZYlMA0hafYh2tRcFNyvCQGpTN7NCTEqe4WqxKw9...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTY1MTE1ODcyNjQzNzgyMzQwMQ&google_push=ATf1kGOmx8HsjwBudbiFm2mecExsl_rncsBFZYlMA0hafYh2tRcFNyvCQGpTN7NCTEqe4WqxKw9U6L...

170 B
188 B

26ms
25ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTY1MTE1ODcyNjQzNzgyMzQwMQ&google_push=ATf1kGOmx8HsjwBudbiFm2mecExsl_rncsBFZYlMA0hafYh2tRcFNyvCQGpTN7NCTEqe4WqxKw9U6L_HElES_2p7-NJzKvKHTEXM

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTY1MTE1ODcyNjQzNzgyMzQwMQ&google_push=ATf1kGOmx8HsjwBudbiFm2mecExsl_rncsBFZYlMA0hafYh2tRcFNyvCQGpTN7NCTEqe4WqxKw9U6L_HElES_2p7-NJzKvKHTEXM
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5A88
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEApzDCqPgJbA8Thf2-8u87A&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEApzDCqPgJbA8Thf2-8u87A&google_hm=ZHi2qRhGZ3FohZUGusT4AwAAFCsAAAAB&google_nid=index&google_push=ATf1kGOhK85r5u3chuSqyxh0EDRuiC0DYAbvz...

170 B
188 B

23ms
23ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEApzDCqPgJbA8Thf2-8u87A&google_hm=ZHi2qRhGZ3FohZUGusT4AwAAFCsAAAAB&google_nid=index&google_push=ATf1kGOhK85r5u3chuSqyxh0EDRuiC0DYAbvzXlRP7Zz1RykZ7gutwg0PZR78fTP_-aiweptcn6zHmgBODCCy9_5IcMIsBSfGxIb9w

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:18:04 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEApzDCqPgJbA8Thf2-8u87A&google_hm=ZHi2qRhGZ3FohZUGusT4AwAAFCsAAAAB&google_nid=index&google_push=ATf1kGOhK85r5u3chuSqyxh0EDRuiC0DYAbvzXlRP7Zz1RykZ7gutwg0PZR78fTP_-aiweptcn6zHmgBODCCy9_5IcMIsBSfGxIb9w
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5A88
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEF1hZYDu11XYOzUl8MKgXHI&google_cver=1&google_push=ATf1kGMN4dNFrMBHRx0mnPZYJZU_LLEk0DkJSDmEv-D5jnt2ohFKhGBabaICbJzIu8_5pcRVX2Pis_LKXwdG1SeV-...
https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEF1hZYDu11XYOzUl8MKgXHI&google_cver=1&google_push=ATf1kGMN4dNFrMBHRx0mnPZYJZU_LLEk0DkJSDmEv-D5jnt2ohFKhGBabaICbJzIu8_5pcRVX2Pis_LKXwdG1SeV-...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=ATf1kGMN4dNFrMBHRx0mnPZYJZU_LLEk0DkJSDmEv-D5jnt2ohFKhGBabaICbJzIu8_5pcRVX2Pis_LKXwdG1SeV-Gs7TNdAuEwW_Q&google_hm=Gvl2sGZHqLiffNNjQNij...

170 B
188 B

24ms
24ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=ATf1kGMN4dNFrMBHRx0mnPZYJZU_LLEk0DkJSDmEv-D5jnt2ohFKhGBabaICbJzIu8_5pcRVX2Pis_LKXwdG1SeV-Gs7TNdAuEwW_Q&google_hm=Gvl2sGZHqLiffNNjQNijNfJl

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 01 Jun 2023 15:18:05 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=ATf1kGMN4dNFrMBHRx0mnPZYJZU_LLEk0DkJSDmEv-D5jnt2ohFKhGBabaICbJzIu8_5pcRVX2Pis_LKXwdG1SeV-Gs7TNdAuEwW_Q&google_hm=Gvl2sGZHqLiffNNjQNijNfJl
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap4ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 5A88
Redirect Chain

https://ups.analytics.yahoo.com/ups/58281/sync?redir=true&google_gid=CAESEIx2-x5GWxZcYx6mh4AsMws&google_cver=1&google_push=ATf1kGMTgQrjYO90k8nEXuP_nnq2ZJVy0rP2j4SwHZDpIeTRCbhnBp1dWt7S4pGYJ6rqvIrySA...
https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS04MDZaVnc1RTJ1RkFIb3VLN2tuWERnelNIZnNjTDFqcH5B&google_push=ATf1kGMTgQrjYO90k8nEXuP_nnq2ZJVy0rP2j4SwHZDpIeTRCbhnBp1dW...

170 B
188 B

22ms
22ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS04MDZaVnc1RTJ1RkFIb3VLN2tuWERnelNIZnNjTDFqcH5B&google_push=ATf1kGMTgQrjYO90k8nEXuP_nnq2ZJVy0rP2j4SwHZDpIeTRCbhnBp1dWt7S4pGYJ6rqvIrySAixqZtvUwMZtVyvWLXRgFPWtXvGvUU

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:04 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=oath__display__app_eb_&google_hm=eS04MDZaVnc1RTJ1RkFIb3VLN2tuWERnelNIZnNjTDFqcH5B&google_push=ATf1kGMTgQrjYO90k8nEXuP_nnq2ZJVy0rP2j4SwHZDpIeTRCbhnBp1dWt7S4pGYJ6rqvIrySAixqZtvUwMZtVyvWLXRgFPWtXvGvUU
date: Thu, 01 Jun 2023 15:18:04 GMT
strict-transport-security: max-age=31536000
server: ATS/9.1.10.57
age: 0
content-length: 0
p3p: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

GET
H2

200

/
onetag-sys.com/match/ Frame 5A88
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEI_J6gkL5yNeYN7zqH2qvaI&google_cver=1&google_push=ATf1kGNHBVv2CUpJY03NQeYghjfNJNjxUiYYWsgT2uQpOSnglgdKvuOVAjsOyctQBnSS3-5tzv0Gz2fDcyt...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGNHBVv2CUpJY03NQeYghjfNJNjxUiYYWsgT2uQpOSnglgdKvuOVAjsOyctQBnSS3-5tzv0Gz2fDcytD3jLWjQrP8B9zeJN73Ik
https://onetag-sys.com/match/?int_id=19&google_error=5

0
151 B

16ms
15ms

Image
text/plain

51.89.9.254
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

51.89.9.254 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip254.ip-51-89-9.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 5A88 0
12 B 26ms
21ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13Idessv8RdMGmw16vf_C_NpntsUv8mHvxW7QoqozbE0ZIhnxBbqb1U4csqfI0G2AeTLCReoZ4o

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:04 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame F9A5 22 KB
8 KB 14ms
13ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 69062
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 20:07:02 GMT
expires: Thu, 30 May 2024 20:07:02 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/7183888988352841573/DE-DEU_XA-10_0_160x600_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/ Frame 335B 164 KB
92 KB 15ms
14ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7183888988352841573/DE-DEU_XA-10_0_160x600_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a4820c5ab11f8aa9ca2be35904c5eb1790284b59a7ef691cb24ef495ef985eb6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 284316
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 94011
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 29 May 2023 08:19:28 GMT
expires: Tue, 28 May 2024 08:19:28 GMT
last-modified: Tue, 07 Feb 2023 18:30:02 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9786 0
0 52ms
52ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssPfk4HP7bfj2c-A_ujk1qIvoBwJ37HwWnN7DnIODX4j0jYpVuXckmqXhaqp0151k9ZxhKNvWtYhR0wiKQYvbJjanKB-fCsm0XSVmFaC5KfVEauz499FiuyupULF5w9gsf7ZE4dCvVFCBIMckcW3cmFnZPu9lGBFNy3KEV1WsMbGDRFzBAD-l2Pe-RoOxJfTCaGA4rPWkppbXCmFOgAo2oRew&sai=AMfl-YRC9pEcxOcQeIlIz39KGrYhtJ9VX95xsQywVKXJVEo73gPHO6ctRLstEb4vgE8I7PK7gfVkRPN23zdGWnZMLcoUIzgnSknn1jJQPN8rQ4u0gpVQZrQG7UORPAFhhuqZDyKFt_PFHucEidaUGIs8rBMfxA&sig=Cg0ArKJSzCAjwLXq2TnxEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=228&cbvp=1&cstd=223&cisv=r20230530.75688&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:04 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 01 Jun 2023 15:18:04 GMT

POST
H2 200 bluemonkey.gif Show response
corporateofficehq.com/detroitchicago/ 43 B
129 B 10ms
10ms XHR
image/gif 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/detroitchicago/bluemonkey.gif?e=eyJhZHZlcnRpc2VyX2RvbWFpbnMiOiJjaXNjby5jb20iLCJmcm9tX2NhY2hlIjowLCJwYWdldmlld19pZCI6IjM2NzczODE2LWU2NTgtNDEwYS02NzZhLWI0N2NjYzU5NmUwYyIsImF1Y3Rpb25faWQiOiJmN2U1MzQxMi1kZTZhLTQyODUtOTRlMC1iNjQ0Mzc0MmU1YzYiLCJhZF91bml0X2NvZGUiOiJkaXYtZ3B0LWFkLWNvcnBvcmF0ZW9mZmljZWhxX2NvbS1lZGdlLTItMCIsImFkYXB0ZXJfY29kZSI6InJ1Ymljb24iLCJvcmlnaW5hbF9jcG0iOjAuMywiY3BtIjowLjMsImFkanVzdG1lbnQiOjEsIm1lZGlhX3R5cGUiOiJkaXNwbGF5IiwidGltZV90b19yZXNwb25kIjozMjYsInJlc3BvbnNlX3NpemUiOiIxNjB4NjAwIiwicmVxdWVzdF9zaXplIjoiMTYweDYwMCIsImRvbWFpbl9pZCI6MTE0MzgsImZvcm1fZmFjdG9yX2lkIjoxLCJwb3NpdGlvbl90eXBlIjozOSwic3RhdF9zb3VyY2VfaWQiOjEwMDYzLCJyZWZyZXNoX2NvdW50IjowLCJzb3VyY2UiOiJjbGllbnQiLCJhYl90ZXN0X2lkIjoibW9kNjItYyJ9
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache/2.4.39 (Ubuntu) /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:04 GMT
content-encoding: br
server: Apache/2.4.39 (Ubuntu)
access-control-max-age: 1728000
access-control-allow-methods: GET, POST, PUT, OPTIONS
content-type: image/gif
access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: imp_sol
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
access-control-allow-credentials: true
vary: Accept-Encoding,Origin,Access-Control-Request-Method,Access-Control-Request-Headers
access-control-allow-headers: Content-Type
content-length: 49
expires: Wed, 31 May 2023 15:18:04 GMT

GET
H3 200 jquery-migrate.min.js Show response
cdn-0.corporateofficehq.com/wp-includes/js/jquery/ 11 KB
5 KB 16ms
16ms Script
text/javascript 2606:4700:3030::ac43:94d9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-0.corporateofficehq.com/wp-includes/js/jquery/jquery-migrate.min.js?screx=1&sxcb=1a&ver=3.3.2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:94d9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8704650cfb8bf873b0e1972bc6a3e34546d08be5bb5419968ebba009a86e8c15

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:04 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 276951
x-ezoic-cdn: Hit ds;mm;6ceddcffdf0a2d0c3c3ef234ce61b8ee;2-11438-3;1e04f090-2155-42f7-5e1e-f2ce427ab589
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400
response: 200
last-modified: Sat, 11 Dec 2021 16:18:02 GMT
server: cloudflare
etag: W/"2bd8-5d2e12f102b9a-gzip-gzip"
x-origin-cache-control
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o2IivAQsMq53ybSTBfq5%2B%2BTuYxMmopMPYhA9ww%2FFobAGl7wRq%2FBz7awYhcCt5xBPizX3zk%2FKd8yBcNrVhbFm%2Fl%2BrpuON0syi94XOkFGR7S5nyDFxwh8sfCl5nce%2BxyfKn%2Bg7DUSWhEHoQIBOOadbL%2FDHfMcar1%2FMFH4%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: public, max-age=31536000
cf-ray: 7d086d58fe8592c9-FRA

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 03E2 41 KB
15 KB 14ms
14ms Script
text/javascript 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DaCfzhxvwHZ64AJnnEvYvEFRX84pCR8LIUp69JulxG7znVA8ZHZfIJO6nFPqfRY1rPBpwe8Tkx0x1Cz5Yc8FIHvcyq2s6L4py-oZap15YGjoi0R1LfiG7nxmZgwN9MRsyRMl4i8Z7zDszAs_UU90reFFuas6wWE_IZlMdu7GbyZDBl1m4&cry=1&dbm_d=AKAmf-DelWYU-mvENXYWZHFtYPn-LqreT3WGtDiLvu9JdZXYYwpjnmxxddu1rZ_N5E-_Ep0ZJpXaNgo2TAHL_Bk1xl5Gyzafc37rnizt42c4mctRCj7qOUQJVRJU_3XmbAEItQkwwRLV1V2Gv_XoE1Fjg2KuPTZxCyGjMf2aQM9JC1UWRxn7ckYpObk7Sf2Lt4EvhMcz_0Q8dzYtl7Z8qM-g4o4lpaH_hpS1ezTZw72g1hn3BTvijOZgzu-5EAphvjvR0l0F-BHp8i0LJcacCeocG3PAH9bF-tRtggsaG3dWTqop5sVhrEyv-qsh4TnA4AjRqHFAJFosb1CQuvTpFYihqG-HVE0BXD74a5YdVPC9PosIeTcj0vlkIXKUQShbexVtGb1k6XtGXKvRv6ANgC7qSzgHHVhTajVYX1UcgP4Z3DJBxXcKd6qBEvJEQmRo4E2ydTqamqSItODm2QyfbraE1dtB6utOYvTn_cyZArY6hUJZY_E_WkkqG3gr60UOnItyE--Mohx8exA-gzRIpblF2FlmBLwNUIATrsuIjI4aD4GoAf0UqJEZyi5Cndfl7Y43R8tg8tLRzPzBCcGkO4yAch2dwNjU_y8RFOCxOrq0B0cjvI-JVEDVy9XpA4Y9IhzWsHXeWYh-6QUuZlEjbRUNjjufJEoSMkwR3DqH8VNlECEa8KyXUfMOeoZGxRkswmq4dfT-L0-MRh2LvJVeJRQvz5Vy9OgUmeQU0eW8iAkGEgeA1CxW647R3GfCj5lMuajGr-3xPJ1WTTlg8m57ErzmWZOYa28nQqhWSIaPOHXYJ7TkR0ycUSSj3UZOzwgwnCd4aeqQeJwlekgRC6ngXE6m-i8qdxVJKC1ybxVO1ENqlMcY7xGeC2Yar3kcIaK9apbf3Qr3UBwb1Mrb_v7UM2LHmY8a5-gb4uiUGvq94nS2iuQW_8EtRWAU5v59v_68_tGdAgJqeeFC9tg2rvYP-vsDaVt7tgcN-T_csjoChefSY-L4zLlJ_ZG5gQOiFOwCGGYFndS5cNT6oKQJ9iT_Sp7o8f5-tBPM7Lf8-HStLTLPeyBB_6wn1iggrnslCMiP1po6wAfomQqQrcVjV2g1NXiN4HwVz_r_LprH4bpPKnJe_S_IXJNgj1gMsTjjUxtRvfRP9hNgHuVTcYBf0flZ2-Ju3EToki7iNbEO9yx2RhhDWfwoAhP7po-NAYW3ZTwZv_E-_Dcd509rrGnEBUI24soc8l4wOvUq5Hfqz2Vvk7S76O7cmus06fqzuARIPX5v9FoTJwDYv3-r69WFgChkZuNkNue45r-XSdavlGbQ4ml7DAH1BFvzoDaTfYG7r91HMSse8gTTDEbiUIh3gluE1U6ZUJStLuIKdwUITXw4TfDLAIhdkJ3mAEQOQjyL23kGbRZvKJ11HJ5fNliqW2Jo4zguKBpOLZE6vN_mtCOqYGldVcOTZpkmfDBovWoRsDO6vHWvjV_lgOdvFJArVwnCGT2G8fGcnCSBdRUUAHaTbVSb_VblELRkJpHxtz9w6oBBq6wbbvshgzXXaGaZHsYgjsaNG-c9qdrbERUcv0pV4t2si-jjZ9O1QCe9PUeHSCR2fzUg782LWaaqY2niYnGzyqT1HZ7oheOBk7zkImMeq8O1fXEMY1S8qRk-gNNs62dzRgooXOu_-cU4ZxMurS1DiQLnjdXcU_XLS9KURQRl_tKok54gP0iHn7BSYdCWjqzoZdoI5fLYULAWrkZjGwS53qa7q_RXK7pHEuM638i1A3aYHJtoLTIyV3u-Pk9xrTGp8H7_KoLJU2KM9jUANU6Rtf8COiqGxKHOI6FSd5pxE1ECFjwk7jyniDkJO8Qay1r9Jn5-WOdxrFiWOSS9b1LMNRc3MdRpQYjvySR1iCzw6J9IZk-kT6TtHyiEZqZB6wKsStZFJBHZzHw0hPYoAL203xqC7g4JZrOyNzHwKb-AcCxQrFm3yhkg-uT03NVCe7iBQQ73gnhxVH8x6rV86aBbtZXHVq2taRQgpM6j51TiZJxug3jxjhIas9JpU1qbKzcUL9PyXFEqVhD8bZISOF_Vuqs6FAQYOP5-XEDGTreX4huJPfnlfuuXqoCDxGhLrFHM1eWZcH2IzvqRelIgwYjKo3rFGZ_e-3lxe-KuhC8fdyvNhvlKKct3X0-XDoQcmrqzuXwyPFob_I7R_zZcTuj-LXMYoj-7N1Ddf2k8a2Z7DaI67ncatmPysO3ZifOU1nZFGtTG7wCNpnqqdC-qP6eUuWsZUhIsTYe-U1KacF3ZpCVLSMy_7brgE1XrmTdVzCgitNvMP0TXdLlnScxtvi9BiofeD7loC9a2naPPW_URjKVGC0x97lvDvxi-qfCpdV6xvWrpCYnEzZnvlLN6I6Ex_WNKvz-hX8aGBCFIf0RnCbz81CFYKg10hrKZonGoRfDJ57Lk3SGG0-ufGNwAnVbfChaI6Aew3Uv_s-Coipo1blo33oOe61eWz_kP2_t7WYngpfy6Vn_6niqIG_RfS3nGPThUIyfrF639JMzYPoF5YOcoLvS92zYHDRbVZ9zQ5wAQAjzAwlyaqmjKT1R8PLEsustKgrT6yVzcVW4GviCBq-F7Iy_SVaGxiSfp_bFx2xPxIecLusapDBXZdrnxouoi4wecdfnb8EVOn5wKGPrhzQl9S9zGv3PGbF7uMjYvsLZ3JAHl2ciYJs2xaUq16fK7zbZQNsDgsH3AvweMp5lr0BONN23I07S8MLO6mzr80znTaRpvVJesTi_bTW90r7-fLEVGEeqf_PqLKw0dROQKHq3Qf8pq3HGimefjwzXCSuCa_wzjLi8uDJcX1V-qeifkYvRGpCTifWrETEwDQe_cryL5Cll-emAUHux-pdWt_WkHtGtDgQXAfjr0lRZ2dFEw137yvzASyOZgJnwjl2djprUFyCXT2ohqqJXJVjqJkTM6w9cvbsd5BEb29JJzNmzkaQsTmIgrJmh2x_LNdEXlCjwdBA48Dk8GgwTEJLY3xIq9XKCO8P1MdO5SXdOWVl52obqV3WOaVtWiGBD3DJgL-n0MObUn4jqFLXfqh0v_mlIXSiUc3DRSXvTR&cid=CAQSOwBygQiDIPDOH0hvDjKyCCzUWFh7_7hkwdQsMR3V7e3axHyImTRvEC3mPUKdYlSexaB9eEaLQdtS0rBJGAE&dv3_ver=m202301230201&rfl=https%3A%2F%2Fcorporateofficehq.com%2F&ds=l&xdt=1&iif=1&cor=15251660909149055000&adk=2086295851&idt=191&cac=0&dtd=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 20:07:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 69063
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 30 May 2024 20:07:01 GMT

GET
H3 200 Cisco_Logo_no_TM_White-RGB.svg.js Show response
s0.2mdn.net/sadbundle/7183888988352841573/DE-DEU_XA-10_0_160x600_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/ Frame 335B 2 KB
939 B 14ms
13ms Script
application/x-javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/7183888988352841573/DE-DEU_XA-10_0_160x600_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/Cisco_Logo_no_TM_White-RGB.svg.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7183888988352841573/DE-DEU_XA-10_0_160x600_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

97bb35db9f4c936f90d08979bca2b96efdc4c1f65a758c1bde577e53c70dba26

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7183888988352841573/DE-DEU_XA-10_0_160x600_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 29 May 2023 08:19:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 284316
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 904
x-xss-protection: 0
last-modified: Tue, 07 Feb 2023 18:30:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 May 2024 08:19:28 GMT

GET
H3

200

adj Show response
bid.g.doubleclick.net/xbbe/creative/ Frame 03E2
Redirect Chain

https://fw.adsafeprotected.com/rfw/bgd/1135760/65089100/xbbe/creative/adj?p=APEucNXyq3IQCB_rQDbnVa--a205ZaEUI7aDdWSLdWsq7fHzkvZ8d_k&d=CokBAKAmf-BGERD5UpNaAYXLaV6IyBCdUHFEUR_VoUe_KuQWZ0Qaq9eTRdoOpmp...
https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXyq3IQCB_rQDbnVa--a205ZaEUI7aDdWSLdWsq7fHzkvZ8d_k&d=CokBAKAmf-BGERD5UpNaAYXLaV6IyBCdUHFEUR_VoUe_KuQWZ0Qaq9eTRdoOpmpp84nAEFsqh5lzBNvP9WJ0bo10y...

70 KB
24 KB

55ms
54ms

Script
text/javascript

173.194.76.157
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXyq3IQCB_rQDbnVa--a205ZaEUI7aDdWSLdWsq7fHzkvZ8d_k&d=CokBAKAmf-BGERD5UpNaAYXLaV6IyBCdUHFEUR_VoUe_KuQWZ0Qaq9eTRdoOpmpp84nAEFsqh5lzBNvP9WJ0bo10y1jyf0mj3jR3pNEvjAsRfUi70n3-CkDEsZbQAoubdsMTrR2nuS3tSCENChbojKKbB4c2Y9Pi8FNSzlDQvu_nasR1gY82n-0SZ4QSyRUAoCZ_4D6qnPneoh4tWbqy0JPyG2KvDBj6ARqHWWOH2J6UU0OIfUltiw2cU4kpDI1okkLgrlA7CXTpLw2_13HRJYo9GH1T-eCUE568eyNgCaOHKKWvoroBhBklo43M9KqFxVAJVn5K4sPatGbeE-gr-IIIosUIL_vPeU8dgCF4rQFfXmlyoU2lBo279-T6_rHKCL_DYp7Oy3stIdT0BnNtxTOlO-TObpjDW7PJ3mZXZetLnL4XJa2cFqG0dK9yu_QKa1M_0mnSsQtX-PL7KG2X6MpzKP65LGg032SAjyxfPcFpPgbnZ4XWOfYT9lmQ1S58HmmHIwVQJQzLHdTl4nldvi3PYSuxKJ4Qi70c2q88o9fLaJSuA6pU2yG0MYoMle5M9WMIIFZSLQpS8YtkAJQJmsz-iUdFkoP7PFY0ivAHMZbLkgLb8hqWMOg9SIMi7nqqSlTTA9EZFD_KlGJn3EiQNBEy41Q0lROPQPYuxbDcgkO6GMkY8nxqrQ-JveisQE6RsLoOH6BzKbQiaM3HIYcn_amE-kwD4QrN6z8k1qTD4eLfAY-FTsnxT4EaZL8VNkDpu_nzuTrAffXWGIB6rmFfykqkCs9MaBNCusvbOdVkVpaGfJrrTv5iCi8kNp-GsscARfsIT_mufZFNumhNRZ34Fh2sx1UN44ejyvcOdABQ2909IDEudOSLbKXoOyMQOzMwVJ3nhdwx8n3tK0A1jagtWpJ5NjgXEGlsIo1idQB6Es7xwllHWbGTkZ1ab8CZ3ZqEK7lF9ycejerOvZwAHCRdqVhwA58Twh4RYCmvhkHxQoCyAT4dAsmiYgIT7R9Hbn88oQX6__X8cgxAaPWqLIxbFYJYupAmwERQJCo1RVnafg39JT8nLUfSY1CHqW34Iylh5zaN3HN2H36nbSLoFbsGrGmcViBcJ_jzhkcXIKLTu0D_EQw72X45FcrTBwOJheUlwUZSYYr1bLn1pCSmUDsjOfXYC4uYOuw1t4c8EPAYYWopYO0GJ4BcMfhAglgmJm2NRBRD01tFucxDZTqtGsH6serUJbJVE9FhnF2tkUoZzAUEqICijBNTtutJ2WC9ugWtoxvpYuUJYfLqa0q1pD0SoNnBQs318g8VX5fqX8oh2sOGnchOSwhluCLoz6axfYg_xlskcTg22KfKeC4kcOFqwtchtdAZxxoqiD_AvGcmc4efOQMZSuembGYUx2qyAy3-qtPASPxH_0IZVgiYSJf2sRHAMrlK_w6qENr_WQ6N8PGzcvne2iXOZejGZUDnX8ZVp9JANKjxTgqG5CRJ3xLh10_1v0o38di9iBW73wv7YFAsfdGzIGedyMyyGFGQDym2lRLyqioMvFQxJocupxjbUBmu1PhGe5YrVCiRqbtFu-beK-Z1KrAPGwYte0M3ZI5oZCevgyC2SJAaJmwMC79zpNJvBr418fN1KRv9D-728l-qjJ-QMwi1u4q7UiIeUx9sCjJt5LHC367qVFtN7eQ5qKPb6WIqA50TWOYIhY10R_WGHznyJSTb_qeXFBXa-stOmvHhLWW_Tpm3iYudaNazNeUDFVoHwMynYiEN4vb9PMqS-SiQx9kVUeN_i9BV6gx0AOFHladkwVk5rondRBqo6S1UlM3btHDdepUTRJl39i2QKmyhzEmI3uQ1iOPOLO-_gcuPUeSNlqNItuiG6hVda6qHuzuuIN85YdI2pMQqnf_0WsnJ9KKqwHY_tNnHQZpWqdfXjHAQTtYWb1L6-oEoY7ZOA_y4ZGRS4U87vUhIO3YnynTkIY9m1aLQ71Fx0RQr9u5bJNgyZw1eB1hhiv-Rf2zMNZ48oQEOQfF46rOjit7M69kvodgV3irFtXhBe3-ishlZGV-hDqA8KaLdbYhYN1wszlLK7jJhHpLIEuUMMpcfS-nCtdA708eXGb7vEfJ50g1SYyP2t2vPZkLxprreMsy44-W5fymm46i_GxZC1PP0TCRuCKuaM7dVRezFQL4BOGPAD4yGxLNK0JpirnD77XwuWYQz4vRkQqVqop9PrXohpfkGJqWJaCxvkuDI3Ep9gm6EhtAHkY3yIlO6RWnr3xqdCSeymY1iN3DQfA_IkB3UuNew1wqclBkoS0Y-HiQ6EJ6nWKFxpCzRFHZt8tcf4Ev7eHeLRLn0aPY8JOkNCdCIq-Do61YwXSsmSb4eeeKlG5PXNgsrs3oJxhch8VDk3oBbuGF5mvjC406qxNS_sHC13HCWwIn2uub29vN4JPzyhmm3lBfk2ViMMAyDPxp2TAoBgZYmr7hgOfnI_lcaiq-D3YQyo-n0SvWjwoAgccr1DKId9HSxwKu8mvvvL-EBlQx-XyRXJZ46ZzgwkMOgLFyo1UIDRmVPeUE8odBmAEa9zqfyVfyhfb879EKeigUo7Es9jX791KZgr8fbe5EPh9DtrDi-LlKLBUyAqI6q-3y3hjEj43WSIJ070-eUm_YwfiPuVu8c8wLTlOmlWarRfnUI3nCi2OpOHEKUwIo1tB9pxoiLRSgjvsH8hsm-fvc4WlkqSX-S5ev2Dvwvykale0SmGc7CY4B8kohZ8r1KTFNPz9AzqvzGjDWvGukAffBEiFSO-dlB7H6OIyFeLjTxcSPotimDv6K00g1h3mIJI5N1fgT_ZDeEngYC9iL_z2dFbxCWIGuv8MwJothppQm70oTcbjtY9vorJlwCSwOZxDv-GWBpNMQItlmGRp7T6aOwsX0pW9S37T8OJ5g5oGtBnlSRCRkxeAS5bAyQhdwqYayIMjd_57k2-OVIJ7Pexi4PIRdkVZBlGhbcof-9-XQRDTN_TcrfF-Iu4CpXCjVqh13e62xBZ9C3lNzC0u5YxvQuSgxZ-2LKjdjkFeeVVwy7yfTJ8jFaLGtRlnXN-utB6Wdk4yMav-dR4-zLd8pPcefb7d_CqQac7g9i1luyEmnZuOS6tKhnOXnX2vsDMgsgfXdigM2TTYlMrPAaST2nitFPLGOCP4Pa38ussPrDA1a3_wrF8h4SZFFFd-o7zBYUd4zjhKwbFlq7Ymo87tRDk2Ejyx7gqeaZIE1Mg8WVY1MCvb9iy3DeQ8Cjq5kP_aPTpWpk96ml_XEWIVex77bXua8-QdPepzUdDR0IGIptHP7dX7Do-xuuuaNp5GSbxR8B4H9RswwzcWtajfyPs3A_whsrP2yigM36QI2-pXsWuCbaaluluxVBkGIdkNRs8NPeKmX_wZa41uAl-wK_LB2aLDnQR5SnuC9t_nGzl-nJXCA1mSK_C5wuOV8dlrjHXcjJInVomtk7qNiMK6ggqrlTqa-m0kHINTNikuoGTxXshclwkwcEOqZ5Y9Aers8xwOsporexNmp003d2uUiSjxfzjeDn81kFpzGWdRrh4LcCpUVc0QbziD7xr2FDsr5A6qWduguDi8UdMHQc-lOf2oXAn5iXtWprjw29oVN_cwqxLXQY7-bhkuH1096n4UsnRH9fEN8NlAAqJuHCfnyvcyMEL1ZSJTtahziUA-_USxBDQ3sX7pH74KjSmI4ZJ1N0u6FWcS9QN-6GJxKgjbXeeqgtivwKKjoGRiZlf-FoDYcyMwaZa-dUw4dOpx1d-qiEKT_T5mCIqWsDwk43m9sAHXJR7lN0pNEidrjtuC1CSbGHGd9UTNGHY1w_9s8_f_N0DW0CDvLZCkteGnDHR0Ntnq9Ri30UkEWnAOOHP-j2GkEIBBI7AHKBCIMg8M4fSG8OMrIILNRYWHv_uGTB1CwxHdXt7drEfIiZNG8QLeY9Qp1iVJ7FoH14RotB21LSsEkYAWAB

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

173.194.76.157 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

55a7fa231ad8795217997542cf744b36d5e78b55caca65f1336ac018d23c7964

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24183
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
server: nginx
x-server-name: app06.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://bid.g.doubleclick.net/xbbe/creative/adj?p=APEucNXyq3IQCB_rQDbnVa--a205ZaEUI7aDdWSLdWsq7fHzkvZ8d_k&d=CokBAKAmf-BGERD5UpNaAYXLaV6IyBCdUHFEUR_VoUe_KuQWZ0Qaq9eTRdoOpmpp84nAEFsqh5lzBNvP9WJ0bo10y1jyf0mj3jR3pNEvjAsRfUi70n3-CkDEsZbQAoubdsMTrR2nuS3tSCENChbojKKbB4c2Y9Pi8FNSzlDQvu_nasR1gY82n-0SZ4QSyRUAoCZ_4D6qnPneoh4tWbqy0JPyG2KvDBj6ARqHWWOH2J6UU0OIfUltiw2cU4kpDI1okkLgrlA7CXTpLw2_13HRJYo9GH1T-eCUE568eyNgCaOHKKWvoroBhBklo43M9KqFxVAJVn5K4sPatGbeE-gr-IIIosUIL_vPeU8dgCF4rQFfXmlyoU2lBo279-T6_rHKCL_DYp7Oy3stIdT0BnNtxTOlO-TObpjDW7PJ3mZXZetLnL4XJa2cFqG0dK9yu_QKa1M_0mnSsQtX-PL7KG2X6MpzKP65LGg032SAjyxfPcFpPgbnZ4XWOfYT9lmQ1S58HmmHIwVQJQzLHdTl4nldvi3PYSuxKJ4Qi70c2q88o9fLaJSuA6pU2yG0MYoMle5M9WMIIFZSLQpS8YtkAJQJmsz-iUdFkoP7PFY0ivAHMZbLkgLb8hqWMOg9SIMi7nqqSlTTA9EZFD_KlGJn3EiQNBEy41Q0lROPQPYuxbDcgkO6GMkY8nxqrQ-JveisQE6RsLoOH6BzKbQiaM3HIYcn_amE-kwD4QrN6z8k1qTD4eLfAY-FTsnxT4EaZL8VNkDpu_nzuTrAffXWGIB6rmFfykqkCs9MaBNCusvbOdVkVpaGfJrrTv5iCi8kNp-GsscARfsIT_mufZFNumhNRZ34Fh2sx1UN44ejyvcOdABQ2909IDEudOSLbKXoOyMQOzMwVJ3nhdwx8n3tK0A1jagtWpJ5NjgXEGlsIo1idQB6Es7xwllHWbGTkZ1ab8CZ3ZqEK7lF9ycejerOvZwAHCRdqVhwA58Twh4RYCmvhkHxQoCyAT4dAsmiYgIT7R9Hbn88oQX6__X8cgxAaPWqLIxbFYJYupAmwERQJCo1RVnafg39JT8nLUfSY1CHqW34Iylh5zaN3HN2H36nbSLoFbsGrGmcViBcJ_jzhkcXIKLTu0D_EQw72X45FcrTBwOJheUlwUZSYYr1bLn1pCSmUDsjOfXYC4uYOuw1t4c8EPAYYWopYO0GJ4BcMfhAglgmJm2NRBRD01tFucxDZTqtGsH6serUJbJVE9FhnF2tkUoZzAUEqICijBNTtutJ2WC9ugWtoxvpYuUJYfLqa0q1pD0SoNnBQs318g8VX5fqX8oh2sOGnchOSwhluCLoz6axfYg_xlskcTg22KfKeC4kcOFqwtchtdAZxxoqiD_AvGcmc4efOQMZSuembGYUx2qyAy3-qtPASPxH_0IZVgiYSJf2sRHAMrlK_w6qENr_WQ6N8PGzcvne2iXOZejGZUDnX8ZVp9JANKjxTgqG5CRJ3xLh10_1v0o38di9iBW73wv7YFAsfdGzIGedyMyyGFGQDym2lRLyqioMvFQxJocupxjbUBmu1PhGe5YrVCiRqbtFu-beK-Z1KrAPGwYte0M3ZI5oZCevgyC2SJAaJmwMC79zpNJvBr418fN1KRv9D-728l-qjJ-QMwi1u4q7UiIeUx9sCjJt5LHC367qVFtN7eQ5qKPb6WIqA50TWOYIhY10R_WGHznyJSTb_qeXFBXa-stOmvHhLWW_Tpm3iYudaNazNeUDFVoHwMynYiEN4vb9PMqS-SiQx9kVUeN_i9BV6gx0AOFHladkwVk5rondRBqo6S1UlM3btHDdepUTRJl39i2QKmyhzEmI3uQ1iOPOLO-_gcuPUeSNlqNItuiG6hVda6qHuzuuIN85YdI2pMQqnf_0WsnJ9KKqwHY_tNnHQZpWqdfXjHAQTtYWb1L6-oEoY7ZOA_y4ZGRS4U87vUhIO3YnynTkIY9m1aLQ71Fx0RQr9u5bJNgyZw1eB1hhiv-Rf2zMNZ48oQEOQfF46rOjit7M69kvodgV3irFtXhBe3-ishlZGV-hDqA8KaLdbYhYN1wszlLK7jJhHpLIEuUMMpcfS-nCtdA708eXGb7vEfJ50g1SYyP2t2vPZkLxprreMsy44-W5fymm46i_GxZC1PP0TCRuCKuaM7dVRezFQL4BOGPAD4yGxLNK0JpirnD77XwuWYQz4vRkQqVqop9PrXohpfkGJqWJaCxvkuDI3Ep9gm6EhtAHkY3yIlO6RWnr3xqdCSeymY1iN3DQfA_IkB3UuNew1wqclBkoS0Y-HiQ6EJ6nWKFxpCzRFHZt8tcf4Ev7eHeLRLn0aPY8JOkNCdCIq-Do61YwXSsmSb4eeeKlG5PXNgsrs3oJxhch8VDk3oBbuGF5mvjC406qxNS_sHC13HCWwIn2uub29vN4JPzyhmm3lBfk2ViMMAyDPxp2TAoBgZYmr7hgOfnI_lcaiq-D3YQyo-n0SvWjwoAgccr1DKId9HSxwKu8mvvvL-EBlQx-XyRXJZ46ZzgwkMOgLFyo1UIDRmVPeUE8odBmAEa9zqfyVfyhfb879EKeigUo7Es9jX791KZgr8fbe5EPh9DtrDi-LlKLBUyAqI6q-3y3hjEj43WSIJ070-eUm_YwfiPuVu8c8wLTlOmlWarRfnUI3nCi2OpOHEKUwIo1tB9pxoiLRSgjvsH8hsm-fvc4WlkqSX-S5ev2Dvwvykale0SmGc7CY4B8kohZ8r1KTFNPz9AzqvzGjDWvGukAffBEiFSO-dlB7H6OIyFeLjTxcSPotimDv6K00g1h3mIJI5N1fgT_ZDeEngYC9iL_z2dFbxCWIGuv8MwJothppQm70oTcbjtY9vorJlwCSwOZxDv-GWBpNMQItlmGRp7T6aOwsX0pW9S37T8OJ5g5oGtBnlSRCRkxeAS5bAyQhdwqYayIMjd_57k2-OVIJ7Pexi4PIRdkVZBlGhbcof-9-XQRDTN_TcrfF-Iu4CpXCjVqh13e62xBZ9C3lNzC0u5YxvQuSgxZ-2LKjdjkFeeVVwy7yfTJ8jFaLGtRlnXN-utB6Wdk4yMav-dR4-zLd8pPcefb7d_CqQac7g9i1luyEmnZuOS6tKhnOXnX2vsDMgsgfXdigM2TTYlMrPAaST2nitFPLGOCP4Pa38ussPrDA1a3_wrF8h4SZFFFd-o7zBYUd4zjhKwbFlq7Ymo87tRDk2Ejyx7gqeaZIE1Mg8WVY1MCvb9iy3DeQ8Cjq5kP_aPTpWpk96ml_XEWIVex77bXua8-QdPepzUdDR0IGIptHP7dX7Do-xuuuaNp5GSbxR8B4H9RswwzcWtajfyPs3A_whsrP2yigM36QI2-pXsWuCbaaluluxVBkGIdkNRs8NPeKmX_wZa41uAl-wK_LB2aLDnQR5SnuC9t_nGzl-nJXCA1mSK_C5wuOV8dlrjHXcjJInVomtk7qNiMK6ggqrlTqa-m0kHINTNikuoGTxXshclwkwcEOqZ5Y9Aers8xwOsporexNmp003d2uUiSjxfzjeDn81kFpzGWdRrh4LcCpUVc0QbziD7xr2FDsr5A6qWduguDi8UdMHQc-lOf2oXAn5iXtWprjw29oVN_cwqxLXQY7-bhkuH1096n4UsnRH9fEN8NlAAqJuHCfnyvcyMEL1ZSJTtahziUA-_USxBDQ3sX7pH74KjSmI4ZJ1N0u6FWcS9QN-6GJxKgjbXeeqgtivwKKjoGRiZlf-FoDYcyMwaZa-dUw4dOpx1d-qiEKT_T5mCIqWsDwk43m9sAHXJR7lN0pNEidrjtuC1CSbGHGd9UTNGHY1w_9s8_f_N0DW0CDvLZCkteGnDHR0Ntnq9Ri30UkEWnAOOHP-j2GkEIBBI7AHKBCIMg8M4fSG8OMrIILNRYWHv_uGTB1CwxHdXt7drEfIiZNG8QLeY9Qp1iVJ7FoH14RotB21LSsEkYAWAB
cache-control: no-cache
content-length: 0

GET
H2 200 sca.17.6.2.js Show response
static.adsafeprotected.com/ Frame 85ED 91 KB
23 KB 15ms
15ms Script
application/javascript 2600:9000:225b:2c00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.adsafeprotected.com/sca.17.6.2.js
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:225b:2c00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 01cee6a7a3f1444680b188ab84052e2b6c85966f53a718d3926135ebcc832ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 21 Sep 2022 15:36:17 GMT
x-amz-version-id: go8nfBUviNCPCwnrYX1LpMW5hEx3ASGy
content-encoding: gzip
via: 1.1 0f14828b89630f6555c6372e13fc999a.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P1
age: 21858109
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Sep 2022 19:21:34 GMT
server: AmazonS3
etag: W/"1f3488247c90bb5de253d3d0cb3b7458"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=315360000
x-amz-cf-id: pHxSBkQ3Rxqk6P0z7ozdgw2cnr2jSRERmCEfiPDfwysvfeF1YTMIDw==

GET
H3 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame A5F9 106 KB
37 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Origin: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 09:27:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21052
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 09:27:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/ Frame A5F9 11 KB
4 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/omrhp.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1135760/65089092/xbbe/creative/adj?p=APEucNXJ6zVKcfmOYNWnPhlQ6G5PmIikX67-eOp2ZvMylSaquzdI9-o&d=CokBAKAmf-C1VGR5_ys5-t6R26z4FIIbIByRu8KdgvorqvrCS3LUqCbLoCJcndGP4y2-SKHS3nEmshfZ--6b6Q-XJmX2tnOUBgKGKMP3lj9pM7flHidRro1_QUQZjYhyU1qNK8EtgpzHr1j8uA6NFfwoOBDumDhvVLgVhS1_H4SRHvTUy1St8cPYsMoS2RUAoCZ_4BtXpOcj4Molce7Pn4q-HkECDAmdrKLyd6p3hbI6Pt1Qr260Oqqnaex9dZc_Tu-HmxNLiOTfwo_RXe7xzK4MtF3JAmY6mk2KE7gTvqZVtY_ewkE83sVHCBJhsZDmqKD_4QUBBpAHzSzz9758fB3NsIW0F4yZh7On11lzyEGdh0nxVSoR1-mw8dg9cceWUJyLkKj1dMh6PqrxgINasqOpuYz4FWEG77bnESrlPwzJHaOCcBXVQ6pqxPTM0QL7P6klpV1gubcfo78_8ARrps84Os8dN9VhBN3T9FkaRwS4MBXsNEFVACatc10qmPQBKqlZzqpGcDBMLNixewmtMg-BZByRi4Ks4FqoYPTgJze781SUaXnJWFBzb1EyyTHQYzuhb8HesFwBnSRTp7C5_AA9G-Khe6sVp_8vFX-7YqN4fPb9qfuAlaZLXEmaA4-L_r3vS7kJab9HlHMGJEp3azYxZw_gvCDVUJCxDGCKgHnNREpO8jLFS1CuW-fKBeKF-GuSz_6cK9zNtilPru_umtfjL_yr91fqcmuD-gE34xlLzgwTdxbtfYcQfwcPtxhCzWAgQCXz3qvZAVpP50W89PLKxGpYpp8fSq3lyGT3jcifBgx8jQ_l62H8kveonCqIAfKRa5f5gTSgFnU3P4AkPoUavCK8MGVviUoMO6eHPb_PTHwXaseP1gLPCSqP8cSoWLwdMkCIQnXzY_6OZXZZCqzrOIUY4ymCua3VU5geKsZioXcJRRzZjkNuf9nhvJ2uOFMHCw9MFfMJQh5g3dxZhgr9Dw58NdH30r_p0Qo_taEKTk1y2YgDGAgdq5mtXDrS0sBnaZK0q-Wk1n4nWbfBcFTEKLssplSbx8NPz61PvEOlJWOnkEEndqRDcK7xzLBgwIu7F5uX6l__xicBCljz0V2ouzJJwFWdtw21f5pbMmmAzeYgzsDQSTDXiJtmKfvvekFyTK97gD6lVYKaBJ67hGJCe14OQa8-gltVMLH4L-Ccl_8TpUjlrSBC8u2N13MYZPm7FJr8slpAoZt1C0qdB4jQyYds9L9zqufTWifh48iZY2Gj8uT2e1jGWIG3cFBXHaDSHjo8IDWmHHbUIhEAfbPAz72CMZccn5PoQzM11cC0LO6dw0OcG5g9L5tFl8uUeo-02x7zU5vXFEo_Tv4Xjs-dRIKPC1wYD17tM6ZQrRRznQ_LehckOoAj2Zbh5NrheQO2kMbvLrkj1Kk1XNg3kzjFoeIoULHji8ocrYRYVI5SzLi5UtcuRHRA3OhNs6MyeRk5MmnGkSIkcCYhBi3X1a0mof9HmA79pH2JDfRaA0qBaqSSL1CxRZk5h1RrRC0LJlfP7WIP3HBGef86EA-8v6ZQUYH0EtEqN7WJFvJjgJUyKuK4tkYOZqHDWyDbMm5djyFsElz8d7lr0vDc1xdYL62WSEvExc3sUjLNITRttrvulAVuOigbP3sxrdK7zIE3tIZx8chO28Yhf423hmkTnrSdsw2pQ2ijnTGBDib2F2aVR2FpSgDPAp72Nph4kWnMTZNCSyjJSzTK-8ifhhKvqhV-aZU5xIQPAEtijifVwjE4av3Vi-oZtFVeNkXiZoISQHfN4c4E2xIYo3yh03MAcZ9wiPtCMA118MNlTfaLbVWJ6t4F7jK2AlvGl1VKNdv-XLzNpRStcqeOECKjf_KChouVT_uJgjEZpuTOucIQW6ya-Acjml1bsKKHPk92V1SUcihjETjs0cL2O22ixqBkzyYRKEJHo7LQ7OZbxd_wqfK4YJcfFvaIwH5QDqBg6xTgNRREcpjCK_B_V2vO4fwtyOXvoKr9kt-oiwNe3_hVso3UjUO1xK4WPxzGUBtpWWmFLEK1rLAeoZxh6aPMgPx09Nsnjud5OMXW34pdE_QGCojZcVXDy22WtMVk0xzJyu21aayqEUVSbWmIuI6A1RbyeuJ6HYwwPEZq8Ko4-HAKP3M2YM_NsVYq1UjVgDb0XmEZXaKPYosbUlPy6xOUoamD87X4w69S5BS25MsnkwlQMVpTmGsRI7rhXdu0eGcaWUGeERB1dM1nhNJAh4JKXRkP6HTYLQsU6me5f9gkLMpNFIWKeHP8NJ38V2qUn0wB5m9PWoMFsz4gzo9JvssusfQTKDD0v3s-qit8zNUrG9560kz6WSTYSMBNRgNjISC5qUu9GGVyqePA_G5iHUJy8T9ZHcB0x20STgoldRTA4TDoLnGgCO2xndBiCwqwKN5mNzoVO95cm9ryIWQm3DtomoAYWgSTnaXVDrDRdsIPV4fNLrhF59vEjXneK_WHNK2fiFgZeTiIaPDToIoG_LOQxPRyTG__MyknHRLsbz1kZw8GzegHtu7mXb7Z1ov6ZnhXm8GGRIJ0ATxMNeOoKmIpl6J-zYylRQ904fv85u7qa8n68T6xLhzio0xa3KZo8aJcSSH6h0UYWC2EjIVJZ14q417RcYacUqwZjzZf3YTrlibxOGooJ9FVVCaO8RTK4w8wQyitrMh0V33TReaSdS7h_H6xIA6F4dJh7Dddk_Un1g9ehAhhnaZCoP9WpcXEFGXPPz4SE5o4XTXyFOMi_ObEqie6tmN6K_Jlss8CNZ0YfwEX5O4bAgzFOyE7n6qX7RLUk38qutyad6RQ2z04zuzTQZ5ZtXm0P45zZ0kyVU6wSngrvykTaRITNLb5aNnaICqgNeMj8vfylpIUR9eqaaD1c5KcctkB5cKusGGci_2gF0ruyrUXEyDedpzUWKvHvxCWZWEwcSNcRBPYLiUIUqcf21h1jlv_qunu97BlFrHg8AoFFghmWpENsAQTzxoQ09xqptaomiNr-RrldeK9H2dO2lET0PDYOPE64MwK5bzeSyM2VoT0sQ4kEh6xGSzQpFdQ98fsBAqfSSDlF4gyza1waa3eMZ6Rc93dOJH0qp8D1n36EO0FQcTs9aFSuAdFNUimx-AZTtZVnf_6_7XtsRoohDERa2svl2IDNt6i3cqc2cjmXkEA5KHJvgNld9Livtbw4C-ZpCIfzmJNUW7SJGADhEEbubR1_Urthd-BiFpopZMOxB0ybNtwGwnRvMvjDJ2UXX_EDvzyMLChYyZIQfAKkgDGFRgZ3BfNdGsvksDnQC4RkYr0dKWCreHaFvRqn1V8Ghmz-ccugUH2judCM8nNKUZz5SYrp7lwC9ySKdWweWVklxnKgKm-XjBMwIiBO6rAkIV6lyWWqoqruZcL147Gipw413FrecM4-WUPvzDqFR_IopTFpb-LFuSTTW6GWbJQ4S6F_k3uQ4nCsJhz3sV58RtK-umiz-Y671mdrqnnA3txDv7QCRnFrdQW9DhJ4j1Q_3v_KJ_0jZMkoaZ2Yg1re_JG_B4NtRjEidiZ78su4c-R4Y41PfT9qo42blYXKMGa2KDEqbWLuvLlkHbwjdAeybfdCInnYooljrL2tYotuwlxGZnuw3_qy2mcUUm4HB5WsnBBQetZvFI-oAlXCJAN17QcuRbs2OxIPgUTS7BYlXIQ1uuHo0cbxOrvKCoavBYFJPW_f2pW0VxBmr_v7FNa7ygcX7tOq6qkQNKOa3Bz1KXbeP7gsvKq921DLIwY5Nvks3kFw6Izxv7w5zW52CiqHB6e-EGliBUbomIF7YvhzJamSVlGeV-cgml_0R9KC0oAO9RW1C4V-BozECJN_kK2E8RgvNaLGgPc4jQQwlBGZLr-KGfLjFv-dcX1oRpBCAQSOwBygQiDWzpQ1nGUaFY9e2-jIDLeq3js2FRQEKe1OnQXIlFoJ7MyNNiYQAHvBl9PqXkq0nEmL18PsaJ8GAFgAQ&ias_dspID=3&ias_campId=1008772806&ias_pubId=pub-6396844742497208&ias_chanId=1&ias_placementId=20163094551&bidurl=https://corporateofficehq.com/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0i_GaKWM7TA024-RdcVKEwg&adsafe_url=https%3A%2F%2Fcorporateofficehq.com&adsafe_type=y&adsafe_url=https%3A%2F%2Fcorporateofficehq.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:2e643bab-4ea5-3f71-781d-54e83a024c58,c:eiEuHu,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-5b89c49c56-wdbsw,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.300.250,am:i,cc:NaN.NaN.300.250,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,dvs:visible,oam:0,mtim:4,mot:0,app:0,maw:0,fm:tFWuXGt+11%7C12%7C13%7C141%7C142%7C143%7C151%7C152%7C153%7C154%7C1611%7C1612%7C1613%7C171%7C172%7C1731%7C174%7C18*.1135760-65089092%7C181%7C191%7C1a,idMap:18*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:28,oid:815ef009-008f-11ee-a383-0e0fbd3e6c2f,v:19.8.415,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8017866a6744d35f26aa9da389e9771d40bcae3ee65df4c1b5e16e57b09fda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4873
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 6053914914909336730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:52 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/ Frame A5F9 29 KB
11 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4870
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:55 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 03E2 43 B
215 B 98ms
98ms Image
image/gif 2600:1f18:1aca:4281:ac44:4026:62a9:ef97
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1135760&asId=2c3ec0ee-d69a-a927-a927-84ce91028e76&tv=%7Bc:eiEuKX,pingTime:-3,time:79,type:v,clog:%5B%7Bpiv:0,vs:o,r:r,w:728,h:90,t:28%7D%5D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:79,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:28,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B74~0%5D,as:%5B74~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tFWuXJ6+11%7C12%7C13%7C141%7C142%7C143%7C151%7C152%7C153%7C154%7C1611%7C1612%7C1613%7C171%7C172%7C1731%7C174%7C175%7C181%7C182%7C183%7C19*.1135760-65089100%7C191%7C1a,idMap:19*,rmeas:1,rend:0,renddet:IMG.us,siq:29%7D&br=c
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:ac44:4026:62a9:ef97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
server: nginx
x-server-name: dt08.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 03E2 43 B
215 B 98ms
98ms Image
image/gif 2600:1f18:1aca:4281:ac44:4026:62a9:ef97
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1135760&asId=2c3ec0ee-d69a-a927-a927-84ce91028e76&tv=%7Bc:eiEuKZ,pingTime:-6,time:81,type:i,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:81,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:28,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B76~0%5D,as:%5B76~728.90%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:0,fm:tFWuXJ6+11%7C12%7C13%7C141%7C142%7C143%7C151%7C152%7C153%7C154%7C1611%7C1612%7C1613%7C171%7C172%7C1731%7C174%7C175%7C181%7C182%7C183%7C19*.1135760-65089100%7C191%7C1a,idMap:19*,rmeas:1,rend:0,renddet:IMG.us,siq:29%7D&tpiLookup=ao:corporateofficehq.com*&br=c
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:ac44:4026:62a9:ef97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
server: nginx
x-server-name: dt05.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 9AEC 1 KB
645 B 13ms
13ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 75774
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 18:15:11 GMT
etag: 48472445140208031
expires: Thu, 01 Jun 2023 18:15:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame A5F9 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e94ba02a4684cabc196b853307cf8e8e4ce6b45c44bbb06b5b374f7b5d57252c

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

GET dt
dt.adsafeprotected.com/ Frame 03E2 0
0

GET
H3 200 9rqtaVZiiC_7YLKwh7YBfT4gwbCPSzX7QNXGZKOGVto.js Show response
pagead2.googlesyndication.com/bg/ Frame F9A5 37 KB
14 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/9rqtaVZiiC_7YLKwh7YBfT4gwbCPSzX7QNXGZKOGVto.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6baad695662882ffb60b2b087b6017d3e20c1b08f4b35fb40d5c664a38656da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 18:50:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 73645
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14729
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 30 May 2024 18:50:40 GMT

GET
H2 200 5da49f9947c2000012581b9a Show response
api.pushnami.com/scripts/v1/pushnami-adv/ 247 KB
62 KB 474ms
443ms Script
application/javascript 13.32.99.63

General

Check archive.org

Show headers Download Go to

Full URL: https://api.pushnami.com/scripts/v1/pushnami-adv/5da49f9947c2000012581b9a
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.63 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 693dd8c82f758689d0235cc60624994df2e7f7dfcd02f1997ee128faf7da8e71

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:05 GMT
content-encoding: gzip
via: 1.1 372875ad1ec20daf24f3f29f14a73cd0.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P3
vary: accept-encoding
x-cache: Miss from cloudfront
content-type: application/javascript; charset=utf-8
cache-control: no-cache
x-amz-cf-id: 33RQ0VKq8MHW5tmZxsA2ICh10Q5rSIW4iIgpE9bZxrcy8MIcLkr1Kw==

GET
H2 200 all.js Show response
connect.facebook.net/en_US/ 3 KB
3 KB 25ms
7ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

26296e9ce2388cabc99f8c71b8ab4485588c5564b249d5ad139671bd93b0fd5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 01 Jun 2023 15:18:05 GMT
content-md5: gzN8Jv/ITsUlxMsT1fM7Lw==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 1686
x-fb-rlafr: 0
x-fb-debug: //RX/fEZsbPqeymQsRhEfoZMNRnE5I1cZXiPGhT+JdxgO00P7Q3U1T6HPTkyCrKnPYavBhF5Cezxgf2K3uneKw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 1679558926
x-fb-content-md5: c4b9ea5539380a62684d17663bbf0509
cross-origin-opener-policy: same-origin-allow-popups
etag: "bcc0ec439abcb30d946ca6c5ead5aecb"
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
x-frame-options: DENY
timing-allow-origin: *
expires: Thu, 01 Jun 2023 15:29:40 GMT

GET
H3 200 17187X1541030.skimlinks.js Show response
cdn-0.corporateofficehq.com/ezossp/unknown/s.skimresources.com/js/ 51 KB
52 KB 24ms
24ms Script
application/octet-stream 2606:4700:3030::ac43:94d9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn-0.corporateofficehq.com/ezossp/unknown/s.skimresources.com/js/17187X1541030.skimlinks.js?screx=1&sxcb=1a
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700:3030::ac43:94d9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cae9f8eaf0df372cc87d42ccfd9b989b07b0b1131858f2d698dc289717f2341c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:05 GMT
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id: 4YWB2F7N6PDXGG80
age: 125565
x-ezoic-cdn: Hit ds;dm;f7383f0f0682d8dca7bb3653fbf34fcb;2-11438-3;b1186a26-5105-4f1c-6698-45feb3eedba0
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400
x-amz-id-2: Qy/pCfDhXcaMBUpwXoh8wEWnYGJy49jXrYOrsy/Fq4omg0QTlytjABZnMb5XDHNDZiZZRVW+RrE=
last-modified: Mon, 12 Dec 2022 13:42:02 GMT
server: cloudflare
etag: W/"fad180b2d99229b6d0b8da3ce4226515-gzip"
x-origin-cache-control: max-age=3600
vary: Accept-Encoding,User-Agent,Origin
x-hw: 1684006744.cds054.fr8.hn,1684006744.cds332.fr8.c
content-type: application/octet-stream
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Foxs%2BvONX4QwR3SvkQCiVYNsZREAgKluFrv62vWc2CwvfDHn9vHuEl10tbAsR64DWOzmOzcQslI%2B4movU0YIio5%2Bt1stgx7TmVE4wwnGONIXUJkPsTWerl3pzCRMtVdmO6nWDZVSsCFLlQqHGAwEhBw7BYvtCulEdj4%3D"}],"group":"cf-nel","max_age":604800}
cache-control: public, max-age=2592000
cf-ray: 7d086d5a18b492c9-FRA

GET
DATA 200
OK truncated
/ Frame 335B 73 KB
0 Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame CE75 22 KB
8 KB 13ms
13ms Document
text/html 2a00:1450:4001:811::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 69063
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 20:07:02 GMT
expires: Thu, 30 May 2024 20:07:02 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 XDR-GettyImages-1080277602-1.png
s0.2mdn.net/sadbundle/7183888988352841573/DE-DEU_XA-10_0_160x600_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/ Frame 335B 98 KB
98 KB 14ms
13ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7183888988352841573/DE-DEU_XA-10_0_160x600_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/XDR-GettyImages-1080277602-1.png?

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c97792fa4c924d1a1bb1e3305f446ac43020a2caa506e09b227921ae98b6eb57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7183888988352841573/DE-DEU_XA-10_0_160x600_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 04:03:19 GMT
x-content-type-options: nosniff
age: 213286
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100739
x-xss-protection: 0
last-modified: Tue, 07 Feb 2023 18:30:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 May 2024 04:03:19 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9786 0
0 50ms
50ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssPfk4HP7bfj2c-A_ujk1qIvoBwJ37HwWnN7DnIODX4j0jYpVuXckmqXhaqp0151k9ZxhKNvWtYhR0wiKQYvbJjanKB-fCsm0XSVmFaC5KfVEauz499FiuyupULF5w9gsf7ZE4dCvVFCBIMckcW3cmFnZPu9lGBFNy3KEV1WsMbGDRFzBAD-l2Pe-RoOxJfTCaGA4rPWkppbXCmFOgAo2oRew&sai=AMfl-YRC9pEcxOcQeIlIz39KGrYhtJ9VX95xsQywVKXJVEo73gPHO6ctRLstEb4vgE8I7PK7gfVkRPN23zdGWnZMLcoUIzgnSknn1jJQPN8rQ4u0gpVQZrQG7UORPAFhhuqZDyKFt_PFHucEidaUGIs8rBMfxA&sig=Cg0ArKJSzCAjwLXq2TnxEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=486&vt=11&dtpt=258&dett=3&cstd=223&cisv=r20230530.75688&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:05 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 01 Jun 2023 15:18:05 GMT

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/5859732888780852880/DE-DEU_XA-10_0_300x250_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/ Frame CF93 162 KB
92 KB 15ms
14ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5859732888780852880/DE-DEU_XA-10_0_300x250_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

382044fe0b677cd49fdb88195e0a3109dfff099f484c93ba53684eb9484316a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 284012
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 93957
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Mon, 29 May 2023 08:24:33 GMT
expires: Tue, 28 May 2024 08:24:33 GMT
last-modified: Wed, 08 Feb 2023 08:50:47 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame A5F9 0
0 54ms
53ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst32Dmy_-B1xpw7z15PwYKm_7dlg8I0Z0HQ4OkWPQUFZUfIag_BE-LLIhFDb7Ae0hU1Yf9c22KW_ZWNQ_xxknCk0ga2BKM0NU7WsfyGMz9cBNAFyGmnZFNG6I_W4f4xZ9XRV1qX7MBKgWSU2stlo3iu-zSNa9a2-qoRc7-0VyMYN-ijdpgDNC9wpM8clrrgqMz0Ts2v2dZNBguXjiEzhBlVZQ&sai=AMfl-YQljPAj_hp-2tyC_DQ0x3AQXTLRebseP3l-NkwpPp4EwNLEwRhOgLSIu9aK3FEHkZhirDTSj2RwtqoF3Wk5FDI5t9d0LF39reZUAzMPB_NYrazanZtadSbKjRmdFxpiPjHxHW8MNOg9BsrCJ_FdnvDjLg&sig=Cg0ArKJSzJH80u7Nsdv2EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=179&cbvp=1&cstd=177&cisv=r20230530.07133&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:05 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 01 Jun 2023 15:18:05 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 9AEC 70 B
264 B 31ms
30ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEIcMb0l8lAzPaqDzIH1yvYs&google_cver=1&google_push=ATf1kGNAA3yyJDOneVAOOPvcql1PKxoM7AFdeB4D9k1eI2oiwQDdzvJFpeLWJjVbFaJNUVq8YwemFuPKzX2F_G65tzSnsnHmduLU
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9AEC
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEL1rY1cFPQE3gU8Fgq6oTW8&google_cver=1&google_push=ATf1kGPnwjB3uCcopYYRpJC01JTUuQ_iMbojzVG9ny5IcqGr2dNUZeJKP4Rbbe7V2-bcA0bWOqyCzSYO...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTY1MTE1ODcyNjQzNzgyMzQwMQ&google_push=ATf1kGPnwjB3uCcopYYRpJC01JTUuQ_iMbojzVG9ny5IcqGr2dNUZeJKP4Rbbe7V2-bcA0bWOqyCzS...

170 B
188 B

23ms
23ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTY1MTE1ODcyNjQzNzgyMzQwMQ&google_push=ATf1kGPnwjB3uCcopYYRpJC01JTUuQ_iMbojzVG9ny5IcqGr2dNUZeJKP4Rbbe7V2-bcA0bWOqyCzSYO042vXtiT6NoXvKdTfO_u2A

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NTY1MTE1ODcyNjQzNzgyMzQwMQ&google_push=ATf1kGPnwjB3uCcopYYRpJC01JTUuQ_iMbojzVG9ny5IcqGr2dNUZeJKP4Rbbe7V2-bcA0bWOqyCzSYO042vXtiT6NoXvKdTfO_u2A
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 dds
rtb.openx.net/sync/ Frame 9AEC 43 B
245 B 74ms
20ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEP-tpfKZZ51PlYqrOVPUiow&google_cver=1&google_push=ATf1kGNU4CUzLhRNHVteNAZE5Y7jYueIOYEiIhgAlgmLuvOnVXHKxY089M55yfmx3pO0egB4_PIO0XMHfjOwQWl10_R5Cu3mXeQL3w
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9AEC
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=XfIxKxRtT_22J08UxVnwJg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

23ms
23ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=XfIxKxRtT_22J08UxVnwJg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGMe-XR-mqOYdDyC1TO60b-hUMxbOh8muEYohhpgfxbBgfqkr3Jp4r08Ogx7i3rB9Z7lqC69kg3pkjiBnHmis-U4DEGlmBby_A

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=XfIxKxRtT_22J08UxVnwJg%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=ATf1kGMe-XR-mqOYdDyC1TO60b-hUMxbOh8muEYohhpgfxbBgfqkr3Jp4r08Ogx7i3rB9Z7lqC69kg3pkjiBnHmis-U4DEGlmBby_A
date: Thu, 01 Jun 2023 15:18:04 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9AEC
Redirect Chain

https://ap.lijit.com/dsp/google/pixelmatch?google_gid=CAESEF1hZYDu11XYOzUl8MKgXHI&google_cver=1&google_push=ATf1kGPolloJgNRXRfuBbgTbrjN9ExfOQHw3gwxWrqlOMe-Wr9KyRTmBCWYZwUHFSpVlYyaJ1StoZFs-rquHHOKOD...
https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=ATf1kGPolloJgNRXRfuBbgTbrjN9ExfOQHw3gwxWrqlOMe-Wr9KyRTmBCWYZwUHFSpVlYyaJ1StoZFs-rquHHOKODvmOOM7UnD7KDg&google_hm=Gvl2sGZHqLiffNNjQNij...

170 B
188 B

23ms
23ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=ATf1kGPolloJgNRXRfuBbgTbrjN9ExfOQHw3gwxWrqlOMe-Wr9KyRTmBCWYZwUHFSpVlYyaJ1StoZFs-rquHHOKODvmOOM7UnD7KDg&google_hm=Gvl2sGZHqLiffNNjQNijNfJl

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Date: Thu, 01 Jun 2023 15:18:05 GMT
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Location: https://cm.g.doubleclick.net/pixel?google_nid=sovrn&google_push=ATf1kGPolloJgNRXRfuBbgTbrjN9ExfOQHw3gwxWrqlOMe-Wr9KyRTmBCWYZwUHFSpVlYyaJ1StoZFs-rquHHOKODvmOOM7UnD7KDg&google_hm=Gvl2sGZHqLiffNNjQNijNfJl
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ad_ap4ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 9AEC
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESECtNWJr-aCsEo-SESGOMkH4&google_cver=1&google_push=ATf1kGPhDrMycO7QICOj2nnqsP8HIHjwg8Y-khjEq238mZU75iVZ3DV93lnWUT2lGZ9fNDBXf84HDWhFLMYUwBDL...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGPhDrMycO7QICOj2nnqsP8HIHjwg8Y-khjEq238mZU75iVZ3DV93lnWUT2lGZ9fNDBXf84HDWhFLMYUwBDLpfKC1aobYm5uXA

170 B
188 B

25ms
25ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGPhDrMycO7QICOj2nnqsP8HIHjwg8Y-khjEq238mZU75iVZ3DV93lnWUT2lGZ9fNDBXf84HDWhFLMYUwBDLpfKC1aobYm5uXA

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 01 Jun 2023 15:18:05 GMT
via: 1.1 5d6d1ee413c782ab05cc32e601576462.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: MUC50-C1
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGPhDrMycO7QICOj2nnqsP8HIHjwg8Y-khjEq238mZU75iVZ3DV93lnWUT2lGZ9fNDBXf84HDWhFLMYUwBDLpfKC1aobYm5uXA
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: B2mo21AF2IGGztFkuCWolAut-tWjjqMbmgioE0QkSLAFqlU5yIuXxw==

GET
H2

200

/
onetag-sys.com/match/ Frame 9AEC
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEI_J6gkL5yNeYN7zqH2qvaI&google_cver=1&google_push=ATf1kGPo17NBSE4mw0sW5pSZAvCQCHt84Dhkb0RRDm9McYljDM0T6RLVNbmxH7Ovd68Mg8b-pgrcHdWWJTT...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGPo17NBSE4mw0sW5pSZAvCQCHt84Dhkb0RRDm9McYljDM0T6RLVNbmxH7Ovd68Mg8b-pgrcHdWWJTTPf9lm_Dv8NbY7KcevwpA
https://onetag-sys.com/match/?int_id=19&google_error=5

0
151 B

14ms
14ms

Image
text/plain

51.89.9.254
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

51.89.9.254 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip254.ip-51-89-9.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 9AEC 0
12 B 21ms
21ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13LIfwqA2lydW_J81-n4Fj6w0dwJ739nB24pFuZYTup6GEFbUa8fQ9OFIzZO795bLL4sjne3eA

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:05 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1130 0
23 B 51ms
51ms Image
image/gif 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=B0uC9rLZ4ZImpBdW8gQeOiY-YAQAAAAA4AeAEAg&bg=!JCelJ3PNAAZu7ficTu07ADkAdvg8WnvEe2xLnXbXwGVE9yNm8vkP_qg30EYE4Y04MiA2g6zXNW72SzAyGus_ehrzYTf6YUZG5rkCAAABlVIAAAADaAEHmQNP3SgCUMkNC8DZvHnS8QkJeTlVekqbBkcxhq7VJB5ceVrXPJVFmk3_Ke53_cLU6jn4nXlv7mbYa5p0JjwtvynC2Zj6_iamF3ZLcT59SXR3IFUH-TN8uhnlqefTiILayJpUAgUEZ1Chp8pTYGu9tDW6ksGrH71UAafj5VXnbqAR28aIEsm-hG8rNBNjI0q4bctzCb1kP7ib6gQORDyXNdEPY6_K6oCWG_p2-akHwkcEr4HFFx6t3HYJ8bfJGj299xXdHuGkPOLFcjN6-JWYw_MUnq3RG8HiftU36yj9PilSAuIZz_FdfMNVsv0ytAeL-xihe7cZTbp3M2TkA04Qs9-5nN3BLQRI9yUlDUygODRprf6LKv6VU3NjwRVJ6c2kSIqqQES4XCJL7bymuFOkxHz0FivTxpQ2wJN4mBISa7UUDeeTinR0JbmzgpPEiJ2eBgN8ZAIerOPw7rcwMl3dVm0XCu9FF8TmS_sX0IUa90tRK2hx0ud2M51DUIQtyAfS4GcC-vmUDzKULxDXaNT6ODJ6kNz-CwihzSGwmwpoBzoTKWKHizlW5R3-2AfArEsChklFnKG4ObdQNNXwWzkSoBGNy2KRDMBIfxyHm7q5t3UyUAwMPDfAWLwODG27hF06C1KFjfmLvPuiH6PypeIws3-2V4OPW_JS8ScnLncFGC-4UMqBAoprbu_es8wYdKNLO1XEdTEaOjBcHqcCnm7D66mV_cHNjFYRnWHYtGwwsOLZlTfcfT5r98pDYUoao2dRgJdviv--EI2WHKuq0SUhT-vHyI513uNm3XCijofy5By5zI-HzbOzCpFax3H3fEfocjkyLeWa0KFsdwJ8eLYJRIn2fMQE_U5N46rGILhBteT9OGq2QmR6m20b3sZ1z3o-crtvkCZ30cd72aZIn_IPfEdM5LbnU8fW6cVOmD0JFhnGsXRam2GXDYadMOaz7ilN-bJA9YB747Zf83xFA7FQILmecSRAXSwNK2x_vhyzXcWblCzcLV0qXhe1BRD-pNZspGkdA7YixorjTPKLOf9NQk4AztU_q7YMa2FW6fscI96GK4uWMcGKXD2IFzX0f7sAxy8R8OWqMMzfJeFOH2lMOusZJf8wQ3nvRNyqVJEjPmnozw

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 express_html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 03E2 106 KB
37 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e41d1ae45acbf836b8dcc29544c7e41cced4211214df601d5284a7e9c7134c73

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Origin: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 09:27:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 21052
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37872
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:26 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 02 Jun 2023 09:27:13 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/ Frame 03E2 11 KB
4 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/elements/html/omrhp.js

Requested by

Host: fw.adsafeprotected.com
URL: https://fw.adsafeprotected.com/rfw/bgd/1135760/65089100/xbbe/creative/adj?p=APEucNXyq3IQCB_rQDbnVa--a205ZaEUI7aDdWSLdWsq7fHzkvZ8d_k&d=CokBAKAmf-BGERD5UpNaAYXLaV6IyBCdUHFEUR_VoUe_KuQWZ0Qaq9eTRdoOpmpp84nAEFsqh5lzBNvP9WJ0bo10y1jyf0mj3jR3pNEvjAsRfUi70n3-CkDEsZbQAoubdsMTrR2nuS3tSCENChbojKKbB4c2Y9Pi8FNSzlDQvu_nasR1gY82n-0SZ4QSyRUAoCZ_4D6qnPneoh4tWbqy0JPyG2KvDBj6ARqHWWOH2J6UU0OIfUltiw2cU4kpDI1okkLgrlA7CXTpLw2_13HRJYo9GH1T-eCUE568eyNgCaOHKKWvoroBhBklo43M9KqFxVAJVn5K4sPatGbeE-gr-IIIosUIL_vPeU8dgCF4rQFfXmlyoU2lBo279-T6_rHKCL_DYp7Oy3stIdT0BnNtxTOlO-TObpjDW7PJ3mZXZetLnL4XJa2cFqG0dK9yu_QKa1M_0mnSsQtX-PL7KG2X6MpzKP65LGg032SAjyxfPcFpPgbnZ4XWOfYT9lmQ1S58HmmHIwVQJQzLHdTl4nldvi3PYSuxKJ4Qi70c2q88o9fLaJSuA6pU2yG0MYoMle5M9WMIIFZSLQpS8YtkAJQJmsz-iUdFkoP7PFY0ivAHMZbLkgLb8hqWMOg9SIMi7nqqSlTTA9EZFD_KlGJn3EiQNBEy41Q0lROPQPYuxbDcgkO6GMkY8nxqrQ-JveisQE6RsLoOH6BzKbQiaM3HIYcn_amE-kwD4QrN6z8k1qTD4eLfAY-FTsnxT4EaZL8VNkDpu_nzuTrAffXWGIB6rmFfykqkCs9MaBNCusvbOdVkVpaGfJrrTv5iCi8kNp-GsscARfsIT_mufZFNumhNRZ34Fh2sx1UN44ejyvcOdABQ2909IDEudOSLbKXoOyMQOzMwVJ3nhdwx8n3tK0A1jagtWpJ5NjgXEGlsIo1idQB6Es7xwllHWbGTkZ1ab8CZ3ZqEK7lF9ycejerOvZwAHCRdqVhwA58Twh4RYCmvhkHxQoCyAT4dAsmiYgIT7R9Hbn88oQX6__X8cgxAaPWqLIxbFYJYupAmwERQJCo1RVnafg39JT8nLUfSY1CHqW34Iylh5zaN3HN2H36nbSLoFbsGrGmcViBcJ_jzhkcXIKLTu0D_EQw72X45FcrTBwOJheUlwUZSYYr1bLn1pCSmUDsjOfXYC4uYOuw1t4c8EPAYYWopYO0GJ4BcMfhAglgmJm2NRBRD01tFucxDZTqtGsH6serUJbJVE9FhnF2tkUoZzAUEqICijBNTtutJ2WC9ugWtoxvpYuUJYfLqa0q1pD0SoNnBQs318g8VX5fqX8oh2sOGnchOSwhluCLoz6axfYg_xlskcTg22KfKeC4kcOFqwtchtdAZxxoqiD_AvGcmc4efOQMZSuembGYUx2qyAy3-qtPASPxH_0IZVgiYSJf2sRHAMrlK_w6qENr_WQ6N8PGzcvne2iXOZejGZUDnX8ZVp9JANKjxTgqG5CRJ3xLh10_1v0o38di9iBW73wv7YFAsfdGzIGedyMyyGFGQDym2lRLyqioMvFQxJocupxjbUBmu1PhGe5YrVCiRqbtFu-beK-Z1KrAPGwYte0M3ZI5oZCevgyC2SJAaJmwMC79zpNJvBr418fN1KRv9D-728l-qjJ-QMwi1u4q7UiIeUx9sCjJt5LHC367qVFtN7eQ5qKPb6WIqA50TWOYIhY10R_WGHznyJSTb_qeXFBXa-stOmvHhLWW_Tpm3iYudaNazNeUDFVoHwMynYiEN4vb9PMqS-SiQx9kVUeN_i9BV6gx0AOFHladkwVk5rondRBqo6S1UlM3btHDdepUTRJl39i2QKmyhzEmI3uQ1iOPOLO-_gcuPUeSNlqNItuiG6hVda6qHuzuuIN85YdI2pMQqnf_0WsnJ9KKqwHY_tNnHQZpWqdfXjHAQTtYWb1L6-oEoY7ZOA_y4ZGRS4U87vUhIO3YnynTkIY9m1aLQ71Fx0RQr9u5bJNgyZw1eB1hhiv-Rf2zMNZ48oQEOQfF46rOjit7M69kvodgV3irFtXhBe3-ishlZGV-hDqA8KaLdbYhYN1wszlLK7jJhHpLIEuUMMpcfS-nCtdA708eXGb7vEfJ50g1SYyP2t2vPZkLxprreMsy44-W5fymm46i_GxZC1PP0TCRuCKuaM7dVRezFQL4BOGPAD4yGxLNK0JpirnD77XwuWYQz4vRkQqVqop9PrXohpfkGJqWJaCxvkuDI3Ep9gm6EhtAHkY3yIlO6RWnr3xqdCSeymY1iN3DQfA_IkB3UuNew1wqclBkoS0Y-HiQ6EJ6nWKFxpCzRFHZt8tcf4Ev7eHeLRLn0aPY8JOkNCdCIq-Do61YwXSsmSb4eeeKlG5PXNgsrs3oJxhch8VDk3oBbuGF5mvjC406qxNS_sHC13HCWwIn2uub29vN4JPzyhmm3lBfk2ViMMAyDPxp2TAoBgZYmr7hgOfnI_lcaiq-D3YQyo-n0SvWjwoAgccr1DKId9HSxwKu8mvvvL-EBlQx-XyRXJZ46ZzgwkMOgLFyo1UIDRmVPeUE8odBmAEa9zqfyVfyhfb879EKeigUo7Es9jX791KZgr8fbe5EPh9DtrDi-LlKLBUyAqI6q-3y3hjEj43WSIJ070-eUm_YwfiPuVu8c8wLTlOmlWarRfnUI3nCi2OpOHEKUwIo1tB9pxoiLRSgjvsH8hsm-fvc4WlkqSX-S5ev2Dvwvykale0SmGc7CY4B8kohZ8r1KTFNPz9AzqvzGjDWvGukAffBEiFSO-dlB7H6OIyFeLjTxcSPotimDv6K00g1h3mIJI5N1fgT_ZDeEngYC9iL_z2dFbxCWIGuv8MwJothppQm70oTcbjtY9vorJlwCSwOZxDv-GWBpNMQItlmGRp7T6aOwsX0pW9S37T8OJ5g5oGtBnlSRCRkxeAS5bAyQhdwqYayIMjd_57k2-OVIJ7Pexi4PIRdkVZBlGhbcof-9-XQRDTN_TcrfF-Iu4CpXCjVqh13e62xBZ9C3lNzC0u5YxvQuSgxZ-2LKjdjkFeeVVwy7yfTJ8jFaLGtRlnXN-utB6Wdk4yMav-dR4-zLd8pPcefb7d_CqQac7g9i1luyEmnZuOS6tKhnOXnX2vsDMgsgfXdigM2TTYlMrPAaST2nitFPLGOCP4Pa38ussPrDA1a3_wrF8h4SZFFFd-o7zBYUd4zjhKwbFlq7Ymo87tRDk2Ejyx7gqeaZIE1Mg8WVY1MCvb9iy3DeQ8Cjq5kP_aPTpWpk96ml_XEWIVex77bXua8-QdPepzUdDR0IGIptHP7dX7Do-xuuuaNp5GSbxR8B4H9RswwzcWtajfyPs3A_whsrP2yigM36QI2-pXsWuCbaaluluxVBkGIdkNRs8NPeKmX_wZa41uAl-wK_LB2aLDnQR5SnuC9t_nGzl-nJXCA1mSK_C5wuOV8dlrjHXcjJInVomtk7qNiMK6ggqrlTqa-m0kHINTNikuoGTxXshclwkwcEOqZ5Y9Aers8xwOsporexNmp003d2uUiSjxfzjeDn81kFpzGWdRrh4LcCpUVc0QbziD7xr2FDsr5A6qWduguDi8UdMHQc-lOf2oXAn5iXtWprjw29oVN_cwqxLXQY7-bhkuH1096n4UsnRH9fEN8NlAAqJuHCfnyvcyMEL1ZSJTtahziUA-_USxBDQ3sX7pH74KjSmI4ZJ1N0u6FWcS9QN-6GJxKgjbXeeqgtivwKKjoGRiZlf-FoDYcyMwaZa-dUw4dOpx1d-qiEKT_T5mCIqWsDwk43m9sAHXJR7lN0pNEidrjtuC1CSbGHGd9UTNGHY1w_9s8_f_N0DW0CDvLZCkteGnDHR0Ntnq9Ri30UkEWnAOOHP-j2GkEIBBI7AHKBCIMg8M4fSG8OMrIILNRYWHv_uGTB1CwxHdXt7drEfIiZNG8QLeY9Qp1iVJ7FoH14RotB21LSsEkYAWAB&ias_dspID=3&ias_campId=1008772806&ias_pubId=pub-6396844742497208&ias_chanId=1&ias_placementId=20163094551&bidurl=https://corporateofficehq.com/&ias_dealId=&adsafe_par&ias_impId=v4~~ABAjH0hSAUz3gwoC7nU28jNlLWgl&adsafe_url=https%3A%2F%2Fcorporateofficehq.com&adsafe_type=y&adsafe_url=https%3A%2F%2Fcorporateofficehq.com%2F&adsafe_type=e&adsafe_url=https%3A%2F%2F4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com%2F&adsafe_type=f&adsafe_url=https%3A%2F%2F4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com%2Fsafeframe%2F1-0-40%2Fhtml%2Fcontainer.html&adsafe_type=d&adsafe_jsinfo=,id:2c3ec0ee-d69a-a927-a927-84ce91028e76,c:eiEuK8,sl:outOfView,em:true,fr:false,thd:1,mn:jsserver-primary-5b89c49c56-9bd9k,rg:ie,pt:1-5-15,wc:0.0.1600.1200,ac:NaN.NaN.728.90,am:i,cc:NaN.NaN.728.90,piv:0,obst:0,th:0,reas:r,mu:10000,br:c,bru:c,an:n,oam:0,mtim:3,mot:0,app:0,maw:0,fm:tFWuXJ6+11%7C12%7C13%7C141%7C142%7C143%7C151%7C152%7C153%7C154%7C1611%7C1612%7C1613%7C171%7C172%7C1731%7C174%7C175%7C181%7C182%7C183%7C19*.1135760-65089100%7C191%7C1a,idMap:19*,pl:CV8L.VEBo.0YtC,rmeas:1,rend:0,renddet:IMG.us,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,tt:rjss,et:29,oid:815f8cbc-008f-11ee-a4a2-8a0d7a2ede80,v:19.8.415,sp:0,st:0,fwm:0,wr:1600.1200,sr:1600.1200,ov:0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8017866a6744d35f26aa9da389e9771d40bcae3ee65df4c1b5e16e57b09fda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:52 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4873
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4172
x-xss-protection: 0
server: cafe
etag: 6053914914909336730
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:52 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/ Frame 03E2 29 KB
11 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20230530/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 13:56:55 GMT
content-encoding: br
x-content-type-options: nosniff
age: 4870
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 11027
x-xss-protection: 0
server: cafe
etag: 5492578185836041520
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Thu, 15 Jun 2023 13:56:55 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 24ms
23ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=corporateofficehq.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305300101/pubads_impl.js?cb=31074979

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 25ms
24ms Script
application/javascript 2a00:1450:4001:80e::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=corporateofficehq.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305300101/pubads_impl.js?cb=31074979

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: application/javascript; charset=UTF-8
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100
x-xss-protection: 0

GET
H2 200 player.css
cds.connatix.com/p/276231/ 66 KB
11 KB 19ms
18ms Stylesheet
text/css 172.64.154.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cds.connatix.com/p/276231/player.css
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js?cid=5f049401-746e-4449-8c27-b6b9d8e25882
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.154.204 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1b1eba1a5f554c6d27c50b2c6803b71fd6587b89a1384e14b783b06e3f746e0a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:05 GMT
x-amz-version-id: NQDox8ojhUhtSYH5NwzjuXlevIFtpZoR
content-encoding: br
cf-cache-status: HIT
x-amz-replication-status: FAILED
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 31 May 2023 14:56:29 GMT
server: cloudflare
etag: W/"538527869698efa213c4e87e3ab2b161"
vary: Accept-Encoding
access-control-allow-methods: *
content-type: text/css
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
access-control-max-age: 86400
cf-ray: 7d086d5b2a9868e9-FRA
access-control-allow-headers: range
expires: Fri, 31 May 2024 15:18:05 GMT

GET
H3 200 XDR-GettyImages-1080277602-1.png
s0.2mdn.net/sadbundle/7183888988352841573/DE-DEU_XA-10_0_160x600_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/ Frame 335B 98 KB
98 KB 13ms
13ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/7183888988352841573/DE-DEU_XA-10_0_160x600_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/XDR-GettyImages-1080277602-1.png?

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/7183888988352841573/DE-DEU_XA-10_0_160x600_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c97792fa4c924d1a1bb1e3305f446ac43020a2caa506e09b227921ae98b6eb57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/7183888988352841573/DE-DEU_XA-10_0_160x600_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 04:03:19 GMT
x-content-type-options: nosniff
age: 213286
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 100739
x-xss-protection: 0
last-modified: Tue, 07 Feb 2023 18:30:02 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 May 2024 04:03:19 GMT

GET
H3 200 Cisco_Logo_no_TM_White-RGB.svg.js Show response
s0.2mdn.net/sadbundle/5859732888780852880/DE-DEU_XA-10_0_300x250_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/ Frame CF93 2 KB
941 B 14ms
13ms Script
application/x-javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/5859732888780852880/DE-DEU_XA-10_0_300x250_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/Cisco_Logo_no_TM_White-RGB.svg.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5859732888780852880/DE-DEU_XA-10_0_300x250_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2e6d975777a7fb65cd5ad3cf67b2ce537c0da4966c0917bb8fb6ba8c290d731c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5859732888780852880/DE-DEU_XA-10_0_300x250_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 11:54:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 185025
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 903
x-xss-protection: 0
last-modified: Wed, 08 Feb 2023 08:50:47 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 May 2024 11:54:20 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 2B12 1 KB
645 B 13ms
12ms Document
text/html 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 75774
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=86400
content-encoding: br
content-length: 618
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 May 2023 18:15:11 GMT
etag: 48472445140208031
expires: Thu, 01 Jun 2023 18:15:11 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 03E2 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 9a05b7829f4988a4c7498cd6c64336b6a962d76b45e2eba1b6919343501756df

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: image/png

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
62 B 9ms
9ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTE1NjY5MzYwODg1MzUzNiIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLWJveC0yLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6MTE0NywiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUzLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMTEifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6Ijc2NDc4OTkzNDY4NDMyNTMiLCJkb21haW5faWQiOiIxMTQzOCIsInVuaXQiOiJkaXYtZ3B0LWFkLWNvcnBvcmF0ZW9mZmljZWhxX2NvbS1sYXJnZS1iaWxsYm9hcmQtMi0wIiwidF9lcG9jaCI6MTY4NTYzMjY3OSwiYWRfcG9zaXRpb24iOjExNTQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMzY3NzM4MTYtZTY1OC00MTBhLTY3NmEtYjQ3Y2NjNTk2ZTBjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU0NywiZGF0YSI6W3sibmFtZSI6IndvcmRzX2JlZm9yZSIsInZhbCI6IjIxIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI1MjQ0MTg5NTY4ODY2NTUwIiwiZG9tYWluX2lkIjoiMTE0MzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1jb3Jwb3JhdGVvZmZpY2VocV9jb20tZWRnZS0yLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6MTk3NiwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTUwLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMTMifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjkwNDkyNTMwMzQ4ODExNzUiLCJkb21haW5faWQiOiIxMTQzOCIsInVuaXQiOiJkaXYtZ3B0LWFkLWNvcnBvcmF0ZW9mZmljZWhxX2NvbS1lZGdlLTEtMCIsInRfZXBvY2giOjE2ODU2MzI2NzksImFkX3Bvc2l0aW9uIjoxOTc1LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjM2NzczODE2LWU2NTgtNDEwYS02NzZhLWI0N2NjYzU5NmUwYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1MTYsImRhdGEiOlt7Im5hbWUiOiJ3b3Jkc19iZWZvcmUiLCJ2YWwiOiIxMyJ9XSwiaXNfb3JpZyI6ZmFsc2V9LHsidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNjc2NDc3ODY0MDg2ODM2NyIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLW1lZHJlY3RhbmdsZS0yLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6MTEwOCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NDg2LCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMTc2In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:06 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:06 GMT

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
16 B 9ms
9ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiMTM1MTIwNDY1MDkwNjQ5MCIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLWJveC00LTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6MTE3NCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjAsImNyZWF0aXZlX2lkIjowLCJkYXRhIjpbeyJuYW1lIjoid29yZHNfYmVmb3JlIiwidmFsIjoiMjI3In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:05 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:05 GMT

GET
H3 200 9rqtaVZiiC_7YLKwh7YBfT4gwbCPSzX7QNXGZKOGVto.js Show response
pagead2.googlesyndication.com/bg/ Frame CE75 37 KB
14 KB 13ms
13ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/9rqtaVZiiC_7YLKwh7YBfT4gwbCPSzX7QNXGZKOGVto.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6baad695662882ffb60b2b087b6017d3e20c1b08f4b35fb40d5c664a38656da

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Wed, 31 May 2023 18:50:40 GMT
content-encoding: br
x-content-type-options: nosniff
age: 73645
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14729
x-xss-protection: 0
last-modified: Mon, 22 May 2023 09:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 30 May 2024 18:50:40 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1 KB
470 B 628ms
628ms XHR
text/plain 2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=566361812916587&correlator=3744306812386028&eid=31074925%2C31074979%2C31074987%2C31068366%2C676982996&output=ldjh&gdfp_req=1&vrg=202305300101&ptt=17&impl=fifs&iu_parts=1254144%3A29527787%2Ccorporateofficehq_com-box-4&enc_prev_ius=%2F0%2F1&prev_iu_szs=300x250&ifi=10&adks=2893769761&didk=723596676&sfv=1-0-40&prev_scp=a%3D%257C0%257C%26iid1%3D1351204650906490%26eid%3D1351204650906490%26t%3D134%26d%3D11438%26t1%3D134%26pvc%3D0%26ap%3D1174%26sap%3D1174%26as%3Drevenue%26plat%3D1%26bra%3Dmod62-c%26ic%3D1%26at%3Dmbf%26adr%3D399%26ezosn%3D4%26reft%3Dtf%26refs%3D30%26refa%3D1%26ga%3D2497208%26rid%3D99998%26pt%3D3%26al%3D1003%26compid%3D0%26tap%3Dcorporateofficehq_com-box-4-1351204650906490%26eb_br%3D3530fcb6bcc13dc3c1712eaef7d92700%26eba%3D1%26ebss%3D10017%2C10082%2C10061%2C10015%2C10063%2C11304%2C11307%26asau%3D8206438403%26bv%3D3%26bvm%3D0%26bvr%3D8%26avc%3D485%26shp%3D1%26ftsn%3D12%26ftsng%3D12%26br1%3D160%26br2%3D80%26ezoic%3D1%26nmau%3D0%26mau%3D0%26stl%3D63%2C14%2C28%2C4%2C51%2C0%2C88%2C0%2C71%2C30%2C0%2C31%2C901%2C902%2C903%26deal1%3D20%2C21%2C22%2C23%2C24%2C25%2C26%2C27%2C815%2C817%2C899%2C903%2C919%2C1794%2C2310%2C2339%2C2526%2C2527%2C2761%2C2763%2C2764%2C2765%2C3044%2C3054%2C3154%2C3430%2C3455%2C3456%2C3457%2C3458%2C3460%2C3682%2C3683%2C3684%2C3919%2C3933%2C4184%2C4185%2C4186%2C4604%2C4605%2C1893%2C783%2C5534%26ax_ssid%3D10082%26amznbid%3D2%26amznsz%3D0x0%26amznp%3D2%26hb_bidder%3Drubicon%26hb_adid%3D18469371bfedc5c%26hb_format%3Dbanner%26hb_ssid%3D10063%26hb_opt%3D0.01%26hb_rt%3Dclient&eri=1&sc=1&cookie=ID%3D41ad7ed754f81817%3AT%3D1685632680%3ART%3D1685632680%3AS%3DALNI_MaRj92dmnm8OptM6obT4Qstrzu0ug&gpic=UID%3D00000c3a8d5c66bf%3AT%3D1685632680%3ART%3D1685632680%3AS%3DALNI_MYAeuJ3Er27BT8t3XIiqLlx67gm6A&abxe=1&dt=1685632685403&lmt=1685632685&dlt=1685632679437&idt=353&adxs=230&adys=1374&biw=1600&bih=1200&scr_x=0&scr_y=0&btvi=1&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&nvt=1&url=https%3A%2F%2Fcorporateofficehq.com%2F&frm=20&vis=1&psz=809x250&msz=300x250&fws=0&ohw=0&ga_vid=1290599683.1685632680&ga_sid=1685632680&ga_hid=1089242052&ga_fc=true&a3p=EhwKDWNyd2RjbnRybC5uZXQYk_-lvIcxSABSAghkEhkKCnB1YmNpZC5vcmcY_YCmvIcxSABSAghqEsIBCghydGJob3VzZRKsAUc4QmlVWGc4NWNBbW05Rko1Q1gxK2E3SGd1U0REUHh4b1cvTk02dTVTZlFTWXFXcWRxMXJjMmorS0hnNS9OQkV4RWY2d20vVVF3T09JRlNHOVpqMjJKWU8yN0RVQjRKaEoyNnVqR292NG5qVTV6SU9zVjRWcURydjkvS1N1bjV2NGhhVXhBMjcvdXBTYW0xdXI5YUtZeXlrM1RCZ0NtWUZvei9hdlJTSXJzcz0Y9oGmvIcxSAASHQoOZXNwLmNyaXRlby5jb20Yk_-lvIcxSABSAghkEhkKCnVpZGFwaS5jb20Yk_-lvIcxSABSAghkEj4KBW9wZW54EixleUpwSWpvaU5VNW9VbVJHVXpGU04ybDVLMEowYVhFeWRqVmFRVDA5SW4wPRjgg6a8hzFIABIbCgxpZDUtc3luYy5jb20Yh4KmvIcxSABSAghq

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202305300101/pubads_impl.js?cb=31074979

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

96bcefbb96caa0239b601cb8133291200682af20220bcf8f273c48fd91fc3cc5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:06 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 441
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://corporateofficehq.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 all.js Show response
connect.facebook.net/en_US/ 308 KB
86 KB 17ms
7ms Script
application/x-javascript 2a03:2880:f083:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/all.js?hash=96ec0d88b95e0f15638ece8a353c8bb6

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f083:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1ad2a640781e0aee299547ef00067f45ac9c54f19002aeb67e8dad05c9e38ee5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://corporateofficehq.com/
Origin: https://corporateofficehq.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 01 Jun 2023 15:18:05 GMT
content-md5: yO/lA7Lt4ir2tc/r8DiHtg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 88513
x-fb-rlafr: 0
x-fb-debug: EBCC6Zit2qlaPQgTyYz5aFtQd9MUOKIH1zBPJ5DKOV62Db9rjwq1OxwuzG6wq/vdkC3j6vfje9aZIgto6mq9+g==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-content-md5: 75690d73cdff64a4f961d51d5db1b793
cross-origin-opener-policy: same-origin-allow-popups
etag: "975ec5065c42e933a2bcd7f79664acd1"
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), screen-wake-lock=(), serial=(), usb=()
x-frame-options: DENY
timing-allow-origin: *
priority: u=3,i
expires: Fri, 31 May 2024 13:23:20 GMT

GET
H2 206 robots.txt
t.skimresources.com/api/v2/ Frame B668 0
148 B 77ms
27ms Image
text/plain 35.201.67.47
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.skimresources.com/api/v2/robots.txt?__skimjs_preflight__please_ignore__=true&rnd=0.20544928065661394
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.201.67.47 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 47.67.201.35.bc.googleusercontent.com
Software: Python/3.10 aiohttp/3.8.4 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:05 GMT
via: 1.1 google
cache-control: private, no-store
server: Python/3.10 aiohttp/3.8.4
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
content-type: text/plain charset=UTF-8

GET
H2 200 px.gif
p.skimresources.com/ 43 B
276 B 81ms
19ms Image
image/gif 35.190.91.160
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=1&rn=6.40181897571265
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.91.160 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 160.91.190.35.bc.googleusercontent.com
Software: Skimlinks Pixel 1.0 /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

p3p: policyref="http://skimlinks.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
date: Thu, 01 Jun 2023 15:18:05 GMT
via: 1.1 google
server: Skimlinks Pixel 1.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
content-type: image/gif

GET
H2 200 px.gif
p.skimresources.com/ 43 B
102 B 82ms
20ms Image
image/gif 35.190.91.160
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=2&rn=6.40181897571265
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.91.160 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 160.91.190.35.bc.googleusercontent.com
Software: Skimlinks Pixel 1.0 /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

p3p: policyref="http://skimlinks.com/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
date: Thu, 01 Jun 2023 15:18:05 GMT
via: 1.1 google
server: Skimlinks Pixel 1.0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
content-type: image/gif

GET
H3 200 hoverIntent.min.js Show response
cdn-0.corporateofficehq.com/wp-includes/js/ 1 KB
1 KB 22ms
22ms Script
text/javascript 2606:4700:3030::ac43:94d9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-0.corporateofficehq.com/wp-includes/js/hoverIntent.min.js?screx=1&sxcb=1a&ver=1.10.2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:94d9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ed5b5df9ceacfe76857ac51964972b0b417a215b2f50e837fd6b64bad7339c40

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:05 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 298775
x-ezoic-cdn: Hit ds;mm;6074543c43c2d2da054ddb4cd7bdf3af;2-11438-3;46866d4c-3d0e-45f9-4608-58e916fcad8d
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400
response: 200
last-modified: Sat, 14 Jan 2023 17:31:55 GMT
server: cloudflare
etag: W/"5db-5f23cb9f41373-gzip-gzip"
x-origin-cache-control
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=34slFnKKnNnLBzKKBFxQw3CRpeKBgmj9vUJBbVBN33L7fAPH4%2Bpr1X1%2Fpgxca0zyn3VKBDD93bugsSFmegWA1V58QnU4KRiLxWvlkW8SLlFBGwIpbJA5W95hrzfQZzrOVujJz0F9b0zQ1gK6hGviSwaMABoRIuQu3Gk%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: public, max-age=31536000
cf-ray: 7d086d5bec3292c9-FRA

POST
H2 200 ucl Show response
capi.connatix.com/tr/ Frame EDE8 0
123 B 134ms
134ms XHR
application/x-protobuf 172.64.154.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/tr/ucl?v=276231
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js?cid=5f049401-746e-4449-8c27-b6b9d8e25882
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.154.204 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: multipart/form-data

Response headers

date: Thu, 01 Jun 2023 15:18:05 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/x-protobuf
access-control-allow-origin: https://corporateofficehq.com
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7d086d5be93a0374-FRA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

POST
H2 200 pls Show response
capi.connatix.com/core/ Frame EDE8 4 KB
2 KB 152ms
151ms XHR
application/x-protobuf 172.64.154.204
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://capi.connatix.com/core/pls?v=276231&cid=5f049401-746e-4449-8c27-b6b9d8e25882
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js?cid=5f049401-746e-4449-8c27-b6b9d8e25882
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.154.204 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f3b91d81d58149e538458a39a5105341329890ca70d06b417cbda858fd519ba0

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-Type: multipart/form-data

Response headers

date: Thu, 01 Jun 2023 15:18:05 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
vary: Accept-Encoding
content-type: application/x-protobuf
access-control-allow-origin: https://corporateofficehq.com
cache-control: no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
cf-ray: 7d086d5bf93d0374-FRA
access-control-allow-headers: x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
alt-svc: h3=":443"; ma=86400

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/1095001735994885930/DE-DEU_IA-12_0_728x90_BAN-A_HTML5_TOFU-no-B2P-Mountain-CIO-Networking-Collab_voroth026873_5/ Frame 6752 94 KB
32 KB 14ms
14ms Document
text/html 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1095001735994885930/DE-DEU_IA-12_0_728x90_BAN-A_HTML5_TOFU-no-B2P-Mountain-CIO-Networking-Collab_voroth026873_5/index.html

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/express_html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7bd7023492a854bb16d2bbf2c0bc0e8fc150960896543af831dbc7c5583307ec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
age: 189620
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 32446
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Tue, 30 May 2023 10:37:45 GMT
expires: Wed, 29 May 2024 10:37:45 GMT
last-modified: Fri, 26 Aug 2022 09:29:02 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 03E2 0
0 56ms
56ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuJk7MyCbXcf7bu8b4r_3AMwBlzSe9MV6xGLCjipI6NUuwbp3NCM1jhPBs1Pku4JrR-dbTP0IXcedEMNqhB1B0yRZp0MP21q3-F5kGyLu4rUZgc_umtmdrmBhmXIzPI8RKA70HuSTH-48RlO2kFAiC-CnfYOq6Qj6fAUPMMvYmsCvNDX5SF08xbxVgPZafmdw07MDc945OPgcgNLs9y3H7RUQ&sai=AMfl-YQOAfdvFNtwHuYFkIc_Xqx1BYhF4hYnFdicd6L1lJhl3K7R4FJG3O2MKHOHNbw8w6mKNHGsBnQwBOae0ZpoBfExG8MdNFMcka7eJBxuTljbe7DoTyAs0PEGylgexeKMzt4XHO6FqunMMBbhxHA6TqMgJg&sig=Cg0ArKJSzJ3ffVRhoboqEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=201&cbvp=1&cstd=199&cisv=r20230530.10616&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:05 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 01 Jun 2023 15:18:05 GMT

GET
DATA 200
OK truncated
/ Frame CF93 73 KB
0 Font
application/font-woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

Referer
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: application/font-woff;charset=utf-8

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 2B12 70 B
264 B 40ms
38ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEIcMb0l8lAzPaqDzIH1yvYs&google_cver=1&google_push=ATf1kGPQ-_aKgYOz31IgBQbr_MOotltN0e276UVwaf6msu-W3-ftPYh4E6H8LxzX26hquGMJzEcRRdPU-44S99CyjlEevd3U6xTP7g
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2B12
Redirect Chain

https://dsp.adfarm1.adition.com/cookie/?ssp=2&google_gid=CAESEMbBmC-UodXZ_DUraJaQiDQ&google_cver=1&google_push=ATf1kGNBbLJNWGtQpNaSWigUYO3Rxj5LQbsrHxQc95jVto8h3XLK0eQ_AtQCa5O2sicbXjpLIySU8yQhVcRp8U...
https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzIzOTczNzI1NTE1OTAwMzI4NA%3D%3D&google_push=ATf1kGNBbLJNWGtQpNaSWigUYO3Rxj5LQbsrHxQc95jVto8h3XLK0eQ_AtQCa5O2sicbXjpLIySU8yQhVcRp8UcPDD...

170 B
188 B

24ms
23ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzIzOTczNzI1NTE1OTAwMzI4NA%3D%3D&google_push=ATf1kGNBbLJNWGtQpNaSWigUYO3Rxj5LQbsrHxQc95jVto8h3XLK0eQ_AtQCa5O2sicbXjpLIySU8yQhVcRp8UcPDDD5YOXZ-XkGiw

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NzIzOTczNzI1NTE1OTAwMzI4NA%3D%3D&google_push=ATf1kGNBbLJNWGtQpNaSWigUYO3Rxj5LQbsrHxQc95jVto8h3XLK0eQ_AtQCa5O2sicbXjpLIySU8yQhVcRp8UcPDDD5YOXZ-XkGiw
Date: Thu, 01 Jun 2023 15:18:05 GMT
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
p3p: policyref="http://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

GET
H2 200 dds
rtb.openx.net/sync/ Frame 2B12 43 B
103 B 20ms
18ms Image
image/gif 35.186.253.211
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEP-tpfKZZ51PlYqrOVPUiow&google_cver=1&google_push=ATf1kGPlwdz_dDWTuZM-UiEH0TpYhpeg2CQ136flxROuHYsr3RfUH0ejFnAVTwAmjHfxJr2z93n6qF5AIxs6_3KzvbkRjDpuB4hkSg
Requested by: Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.253.211 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 211.253.186.35.bc.googleusercontent.com
Software: /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
via: 1.1 google
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2B12
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEApzDCqPgJbA8Thf2-8u87A&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEApzDCqPgJbA8Thf2-8u87A&google_hm=ZHi2qRhGZ3FohZUGusT4AwAAFCsAAAAB&google_nid=index&google_push=ATf1kGPYGlbxlAvjOAaEIRjx8GjP0V_6n6clm...

170 B
188 B

23ms
23ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEApzDCqPgJbA8Thf2-8u87A&google_hm=ZHi2qRhGZ3FohZUGusT4AwAAFCsAAAAB&google_nid=index&google_push=ATf1kGPYGlbxlAvjOAaEIRjx8GjP0V_6n6clmMecXJPv2z23oAg7U6WFsxd7Is1Qba4jr9Nh6dbnxdNVzUVJhIZV_WpK_5lS8OqTjQ

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:18:05 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://cm.g.doubleclick.net/pixel?google_cver=1&google_gid=CAESEApzDCqPgJbA8Thf2-8u87A&google_hm=ZHi2qRhGZ3FohZUGusT4AwAAFCsAAAAB&google_nid=index&google_push=ATf1kGPYGlbxlAvjOAaEIRjx8GjP0V_6n6clmMecXJPv2z23oAg7U6WFsxd7Is1Qba4jr9Nh6dbnxdNVzUVJhIZV_WpK_5lS8OqTjQ
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 0
Expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2B12
Redirect Chain

https://s.ad.smaato.net/c/n///-?adNetInit=g&google_gid=CAESECtNWJr-aCsEo-SESGOMkH4&google_cver=1&google_push=ATf1kGPBrYpKWld7W9qHf6wrlxcn55yR5BWujWE1SaY891Sv8PuZ-bMw1jLU90g-iaraZ3B4exdhqj-sF4mJXUfD...
https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGPBrYpKWld7W9qHf6wrlxcn55yR5BWujWE1SaY891Sv8PuZ-bMw1jLU90g-iaraZ3B4exdhqj-sF4mJXUfDOps1h-42JoEj_g

170 B
188 B

23ms
23ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGPBrYpKWld7W9qHf6wrlxcn55yR5BWujWE1SaY891Sv8PuZ-bMw1jLU90g-iaraZ3B4exdhqj-sF4mJXUfDOps1h-42JoEj_g

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Thu, 01 Jun 2023 15:18:05 GMT
via: 1.1 5d6d1ee413c782ab05cc32e601576462.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: MUC50-C1
x-cache: FunctionGeneratedResponse from cloudfront
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://cm.g.doubleclick.net/pixel?google_nid=smaato&google_push=ATf1kGPBrYpKWld7W9qHf6wrlxcn55yR5BWujWE1SaY891Sv8PuZ-bMw1jLU90g-iaraZ3B4exdhqj-sF4mJXUfDOps1h-42JoEj_g
cache-control: no-cache, must-revalidate
content-length: 0
x-amz-cf-id: lwO1Da24B6KPNk-ABclytxfmnh4z52pzTYBKcdZKAi7TRNStLKO_YQ==

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 2B12
Redirect Chain

https://cs.media.net/cksync?type=g&google_gid=CAESEIt3o_IcnP3aZiFvH3ckA44&google_cver=1&google_push=ATf1kGOcgVdgkm85SpRVT3sGseGzbKOaK5J3ypgI9b3mhl0nEK5g3HE5NafEP3zIOs21WgobelDk8JScD5z72RIiLlX2A3AWG...
https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzI4NjM0Mjg1MTQ5MTg5OTAwMFYxMA%3d%3d&mn_hm=MzI4NjM0Mjg1MTQ5MTg5OTAwMFYxMA%3d%3d&google_sc=1&google_push=ATf1kGOcgVdgkm85SpRVT3sGseGzbKO...

170 B
188 B

24ms
24ms

Image
image/png

172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzI4NjM0Mjg1MTQ5MTg5OTAwMFYxMA%3d%3d&mn_hm=MzI4NjM0Mjg1MTQ5MTg5OTAwMFYxMA%3d%3d&google_sc=1&google_push=ATf1kGOcgVdgkm85SpRVT3sGseGzbKOaK5J3ypgI9b3mhl0nEK5g3HE5NafEP3zIOs21WgobelDk8JScD5z72RIiLlX2A3AWGSvwdA&gdpr=&gdpr_consent=

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 01 Jun 2023 15:18:05 GMT
Server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MzI4NjM0Mjg1MTQ5MTg5OTAwMFYxMA%3d%3d&mn_hm=MzI4NjM0Mjg1MTQ5MTg5OTAwMFYxMA%3d%3d&google_sc=1&google_push=ATf1kGOcgVdgkm85SpRVT3sGseGzbKOaK5J3ypgI9b3mhl0nEK5g3HE5NafEP3zIOs21WgobelDk8JScD5z72RIiLlX2A3AWGSvwdA&gdpr=&gdpr_consent=
Content-Type: text/html
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 154
x-mnet-hl2: E
Expires: Thu, 01 Jun 2023 15:18:05 GMT

GET
H2

200

/
onetag-sys.com/match/ Frame 2B12
Redirect Chain

https://onetag-sys.com/match/?int_id=106&redir=1&google_gid=CAESEI_J6gkL5yNeYN7zqH2qvaI&google_cver=1&google_push=ATf1kGP2SVU34W41gdDIhxVSSwRScf3uRVejUwhGUANpcrihXioOkIDdC82cfgqVLOWHyUzUASRuLUuMx0Z...
https://cm.g.doubleclick.net/pixel?google_nid=one_tag&google_hm=&google_push=ATf1kGP2SVU34W41gdDIhxVSSwRScf3uRVejUwhGUANpcrihXioOkIDdC82cfgqVLOWHyUzUASRuLUuMx0ZY2q4nHvyHVu7decZ3rE8
https://onetag-sys.com/match/?int_id=19&google_error=5

0
151 B

14ms
14ms

Image
text/plain

51.89.9.254
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onetag-sys.com/match/?int_id=19&google_error=5

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Server

51.89.9.254 London, United Kingdom, ASN16276 (OVH, FR),

Reverse DNS

ip254.ip-51-89-9.eu

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

strict-transport-security: max-age=15552000
cache-control: no-transform, no-cache
content-length: 0
p3p: CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'

Redirect headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://onetag-sys.com/match/?int_id=19&google_error=5
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 255
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 2B12 0
12 B 22ms
21ms Image
text/html 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13KAxIgUXI-GytGLBR6JZ8EPzzXznIJRGLZGMmmDkcIT_gHAO1jsaZbJ0tLJeP_dIXfXaGWpKw

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:05 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
16 B 9ms
8ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiOTA0OTI1MzAzNDg4MTE3NSIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLWVkZ2UtMS0wIiwidF9lcG9jaCI6MTY4NTYzMjY3OSwiYWRfcG9zaXRpb24iOjE5NzUsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMzY3NzM4MTYtZTY1OC00MTBhLTY3NmEtYjQ3Y2NjNTk2ZTBjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDAzNDUxNiwiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9zaXplIiwidmFsIjoiWzE2MCw2MDBdIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI5MDQ5MjUzMDM0ODgxMTc1IiwiZG9tYWluX2lkIjoiMTE0MzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1jb3Jwb3JhdGVvZmZpY2VocV9jb20tZWRnZS0xLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6MTk3NSwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDM0NTE2LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX2ZsdWlkIiwidmFsIjoiZmFsc2UifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6IjkwNDkyNTMwMzQ4ODExNzUiLCJkb21haW5faWQiOiIxMTQzOCIsInVuaXQiOiJkaXYtZ3B0LWFkLWNvcnBvcmF0ZW9mZmljZWhxX2NvbS1lZGdlLTEtMCIsInRfZXBvY2giOjE2ODU2MzI2NzksImFkX3Bvc2l0aW9uIjoxOTc1LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjM2NzczODE2LWU2NTgtNDEwYS02NzZhLWI0N2NjYzU5NmUwYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwMzQ1MTYsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMzEifV0sImlzX29yaWciOmZhbHNlfV0=
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:05 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:05 GMT

GET
H3 200 XDR-GettyImages-1080277602-1.png
s0.2mdn.net/sadbundle/5859732888780852880/DE-DEU_XA-10_0_300x250_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/ Frame CF93 186 KB
186 KB 14ms
14ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5859732888780852880/DE-DEU_XA-10_0_300x250_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/XDR-GettyImages-1080277602-1.png?

Requested by

Host: 4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com
URL: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/safeframe/1-0-40/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33e54f97aa7d13b79824c4dffea9e53f753a825091869529a9e077eadb69ac13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5859732888780852880/DE-DEU_XA-10_0_300x250_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 29 May 2023 17:43:12 GMT
x-content-type-options: nosniff
age: 250493
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 190884
x-xss-protection: 0
last-modified: Wed, 08 Feb 2023 08:50:47 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 May 2024 17:43:12 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame A5F9 0
0 57ms
56ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjst32Dmy_-B1xpw7z15PwYKm_7dlg8I0Z0HQ4OkWPQUFZUfIag_BE-LLIhFDb7Ae0hU1Yf9c22KW_ZWNQ_xxknCk0ga2BKM0NU7WsfyGMz9cBNAFyGmnZFNG6I_W4f4xZ9XRV1qX7MBKgWSU2stlo3iu-zSNa9a2-qoRc7-0VyMYN-ijdpgDNC9wpM8clrrgqMz0Ts2v2dZNBguXjiEzhBlVZQ&sai=AMfl-YQljPAj_hp-2tyC_DQ0x3AQXTLRebseP3l-NkwpPp4EwNLEwRhOgLSIu9aK3FEHkZhirDTSj2RwtqoF3Wk5FDI5t9d0LF39reZUAzMPB_NYrazanZtadSbKjRmdFxpiPjHxHW8MNOg9BsrCJ_FdnvDjLg&sig=Cg0ArKJSzJH80u7Nsdv2EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=442&vt=11&dtpt=263&dett=3&cstd=177&cisv=r20230530.07133&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:05 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
server: cafe
content-type: image/gif
access-control-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: private
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Thu, 01 Jun 2023 15:18:05 GMT

GET
H3 200 LogoLockup_Vert_RGB_white_190103.svg.js Show response
s0.2mdn.net/sadbundle/1095001735994885930/DE-DEU_IA-12_0_728x90_BAN-A_HTML5_TOFU-no-B2P-Mountain-CIO-Networking-Collab_voroth026873_5/ Frame 6752 9 KB
3 KB 17ms
17ms Script
application/x-javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1095001735994885930/DE-DEU_IA-12_0_728x90_BAN-A_HTML5_TOFU-no-B2P-Mountain-CIO-Networking-Collab_voroth026873_5/LogoLockup_Vert_RGB_white_190103.svg.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1095001735994885930/DE-DEU_IA-12_0_728x90_BAN-A_HTML5_TOFU-no-B2P-Mountain-CIO-Networking-Collab_voroth026873_5/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9d471075777fb24de73c008de10294dde0878998d1344ea936f06727a2dabd4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1095001735994885930/DE-DEU_IA-12_0_728x90_BAN-A_HTML5_TOFU-no-B2P-Mountain-CIO-Networking-Collab_voroth026873_5/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Tue, 30 May 2023 12:15:19 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 183766
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3012
x-xss-protection: 0
last-modified: Fri, 26 Aug 2022 09:29:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 29 May 2024 12:15:19 GMT

GET
H3 200 cta_German.svg.js Show response
s0.2mdn.net/sadbundle/1095001735994885930/DE-DEU_IA-12_0_728x90_BAN-A_HTML5_TOFU-no-B2P-Mountain-CIO-Networking-Collab_voroth026873_5/ Frame 6752 4 KB
1 KB 18ms
16ms Script
application/x-javascript 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/1095001735994885930/DE-DEU_IA-12_0_728x90_BAN-A_HTML5_TOFU-no-B2P-Mountain-CIO-Networking-Collab_voroth026873_5/cta_German.svg.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/1095001735994885930/DE-DEU_IA-12_0_728x90_BAN-A_HTML5_TOFU-no-B2P-Mountain-CIO-Networking-Collab_voroth026873_5/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b47113c11f50ddd29c8d635ecdad9ca369691f9b8e94a02746b7b567a5eae837

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/1095001735994885930/DE-DEU_IA-12_0_728x90_BAN-A_HTML5_TOFU-no-B2P-Mountain-CIO-Networking-Collab_voroth026873_5/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 29 May 2023 07:32:00 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 287165
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1423
x-xss-protection: 0
last-modified: Fri, 26 Aug 2022 09:29:02 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 May 2024 07:32:00 GMT

GET
H2 200 dt
dt.adsafeprotected.com/ Frame 9786 43 B
215 B 98ms
98ms Image
image/gif 2600:1f18:1aca:4281:ac44:4026:62a9:ef97
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dt.adsafeprotected.com/dt?advEntityId=1135760&asId=6571827c-84e0-f343-9446-ecab41d3ef35&tv=%7Bc:eiEuSL,time:1030,type:e,im:%7Bpci:%7Btdr:555%7D%7D,es:0,sc:1,ha:1,fgad:1,fif:0,gmnp:0,for:0,b11:0,cnod:1,gm:0,slTimes:%7Bi:0,o:1030,n:0,pp:0,pm:0%7D,slEvents:%5B%7Bsl:o,t:18,wc:0.0.1600.1200,ac:NaN.NaN.160.600,am:i,cc:NaN.NaN.160.600,piv:0,obst:0,th:0,reas:r,bkn:%7Bpiv:%5B1025~0%5D,as:%5B1025~160.600%5D%7D%7D%5D,slEventCount:1,em:true,fr:false,e:,tt:rjss,dtt:104,fm:tFWuWM9+11%7C12%7C13%7C141%7C142%7C143%7C15.1135760-69474490%7C151%7C152%7C153%7C154%7C1611%7C1612%7C1613%7C17*.1135760-65089090%7C171%7C18.1135760-65089092%7C19.1135760-65089100,idMap:17*,rmeas:1,rend:1,renddet:DIV.qs.sn,siq:19,sis:205%7D&br=c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:1aca:4281:ac44:4026:62a9:ef97 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://4a37989e2c6a33d4fed2ed9855449507.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 01 Jun 2023 15:18:05 GMT
server: nginx
x-server-name: dt16.va.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
content-type: image/gif
cache-control: no-cache
content-length: 43

POST
H2 200 / Show response
r.skimresources.com/api/ 172 B
389 B 180ms
19ms XHR
application/json 35.190.59.101

General

Check archive.org

Show headers Download Go to

Full URL

https://r.skimresources.com/api/

Requested by

Host: cdn-0.corporateofficehq.com
URL: https://cdn-0.corporateofficehq.com/ezossp/unknown/s.skimresources.com/js/17187X1541030.skimlinks.js?screx=1&sxcb=1a

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.59.101 -, , ASN (),

Reverse DNS

Software

openresty/1.19.9.1 /

Resource Hash

5f07a8fd625ca0c47d045a413b8ca35e45bafdfa74b69f5fea318f8b9275d402

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://corporateofficehq.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Thu, 01 Jun 2023 15:18:05 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: gzip
server: openresty/1.19.9.1
via: 1.1 google
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://corporateofficehq.com
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3 200 XDR-GettyImages-1080277602-1.png
s0.2mdn.net/sadbundle/5859732888780852880/DE-DEU_XA-10_0_300x250_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/ Frame CF93 186 KB
186 KB 13ms
13ms Image
image/png 2a00:1450:4001:82a::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/sadbundle/5859732888780852880/DE-DEU_XA-10_0_300x250_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/XDR-GettyImages-1080277602-1.png?

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/5859732888780852880/DE-DEU_XA-10_0_300x250_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/index.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

33e54f97aa7d13b79824c4dffea9e53f753a825091869529a9e077eadb69ac13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/5859732888780852880/DE-DEU_XA-10_0_300x250_BAN-A_HTML5_BOFU-no-Security-XDRSubHubBanners-Security-ALL_0_105/index.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Mon, 29 May 2023 17:43:12 GMT
x-content-type-options: nosniff
age: 250493
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 190884
x-xss-protection: 0
last-modified: Wed, 08 Feb 2023 08:50:47 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Tue, 28 May 2024 17:43:12 GMT

POST
H2 204 army.gif
corporateofficehq.com/porpoiseant/ 0
16 B 10ms
9ms Ping
text/plain 2a05:d014:776:a63f:551c:5660:31da:fe01
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://corporateofficehq.com/porpoiseant/army.gif?orig=0&sts=W3sidHlwZSI6ImltcHJlc3Npb24iLCJpbXByZXNzaW9uX2lkIjoiNzY0Nzg5OTM0Njg0MzI1MyIsImRvbWFpbl9pZCI6IjExNDM4IiwidW5pdCI6ImRpdi1ncHQtYWQtY29ycG9yYXRlb2ZmaWNlaHFfY29tLWxhcmdlLWJpbGxib2FyZC0yLTAiLCJ0X2Vwb2NoIjoxNjg1NjMyNjc5LCJhZF9wb3NpdGlvbiI6MTE1NCwiYWRfc2l6ZSI6IiIsImNvdW50cnlfY29kZSI6IkRFIiwicGFnZXZpZXdfaWQiOiIzNjc3MzgxNi1lNjU4LTQxMGEtNjc2YS1iNDdjY2M1OTZlMGMiLCJjb21wX2lkIjowLCJsaW5lX2l0ZW1faWQiOjI4Njg3Mjc0LCJjcmVhdGl2ZV9pZCI6MTM4MzEwMDQzNTQ3LCJkYXRhIjpbeyJuYW1lIjoiZmlsbGVkX3NpemUiLCJ2YWwiOiJbMzAwLDI1MF0ifV0sImlzX29yaWciOmZhbHNlfSx7InR5cGUiOiJpbXByZXNzaW9uIiwiaW1wcmVzc2lvbl9pZCI6Ijc2NDc4OTkzNDY4NDMyNTMiLCJkb21haW5faWQiOiIxMTQzOCIsInVuaXQiOiJkaXYtZ3B0LWFkLWNvcnBvcmF0ZW9mZmljZWhxX2NvbS1sYXJnZS1iaWxsYm9hcmQtMi0wIiwidF9lcG9jaCI6MTY4NTYzMjY3OSwiYWRfcG9zaXRpb24iOjExNTQsImFkX3NpemUiOiIiLCJjb3VudHJ5X2NvZGUiOiJERSIsInBhZ2V2aWV3X2lkIjoiMzY3NzM4MTYtZTY1OC00MTBhLTY3NmEtYjQ3Y2NjNTk2ZTBjIiwiY29tcF9pZCI6MCwibGluZV9pdGVtX2lkIjoyODY4NzI3NCwiY3JlYXRpdmVfaWQiOjEzODMxMDA0MzU0NywiZGF0YSI6W3sibmFtZSI6ImZpbGxlZF9mbHVpZCIsInZhbCI6ImZhbHNlIn1dLCJpc19vcmlnIjpmYWxzZX0seyJ0eXBlIjoiaW1wcmVzc2lvbiIsImltcHJlc3Npb25faWQiOiI3NjQ3ODk5MzQ2ODQzMjUzIiwiZG9tYWluX2lkIjoiMTE0MzgiLCJ1bml0IjoiZGl2LWdwdC1hZC1jb3Jwb3JhdGVvZmZpY2VocV9jb20tbGFyZ2UtYmlsbGJvYXJkLTItMCIsInRfZXBvY2giOjE2ODU2MzI2NzksImFkX3Bvc2l0aW9uIjoxMTU0LCJhZF9zaXplIjoiIiwiY291bnRyeV9jb2RlIjoiREUiLCJwYWdldmlld19pZCI6IjM2NzczODE2LWU2NTgtNDEwYS02NzZhLWI0N2NjYzU5NmUwYyIsImNvbXBfaWQiOjAsImxpbmVfaXRlbV9pZCI6Mjg2ODcyNzQsImNyZWF0aXZlX2lkIjoxMzgzMTAwNDM1NDcsImRhdGEiOlt7Im5hbWUiOiJkb21haW5fZGZwX3N0eWxlX2lkIiwidmFsIjoiMTU3In1dLCJpc19vcmlnIjpmYWxzZX1d
Requested by: Host: corporateofficehq.com
URL: https://corporateofficehq.com/detroitchicago/cmbv2.js?gcb=195-4&cb=04-3y02-8y06-13y07-2y1d-7y0b-6y0d-23y15-3y17-4y1b-5y20-4y21-1y24-2y23-5y25-3y26-4y27-11y28-58y2b-133y2f-142y33-4y36-11y3a-12y3b-6y5d-2y61-22y68-1&cmbcb=144&sj=x04x02x06x07x1dx0bx0dx15x17x1bx20x21x24x23x25x26x27x28x2bx2fx33x36x3ax3bx5dx61x68
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a05:d014:776:a63f:551c:5660:31da:fe01 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

access-control-allow-origin: https://corporateofficehq.com
x-middleton-display: ezp_sol
date: Thu, 01 Jun 2023 15:18:05 GMT
cache-control: private, max-age=0, must-revalidate, no-cache, no-store
vary: Accept-Encoding
expires: Wed, 31 May 2023 15:18:05 GMT

GET
H3 200 superfish.min.js Show response
cdn-0.corporateofficehq.com/wp-content/themes/genesis/lib/js/menu/ 4 KB
3 KB 19ms
19ms Script
text/javascript 2606:4700:3030::ac43:94d9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-0.corporateofficehq.com/wp-content/themes/genesis/lib/js/menu/superfish.min.js?screx=1&sxcb=1a&ver=1.7.10

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3030::ac43:94d9 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ece565a1f66a32347dfed83562c428ff7736648de72b0027dd8f0e0f27e0c327

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://corporateofficehq.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:05 GMT
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
display: staticcontent_sol
age: 298774
x-ezoic-cdn: Hit ds;mm;bf390b9e0ada4dd45f61616fcc009040;2-11438-3;4d865c8a-ae1e-414b-5038-6b49ddff5ae5
x-middleton-display: staticcontent_sol
x-middleton-response: 200
alt-svc: h3=":443"; ma=86400
response: 200
last-modified: Sat, 14 Jan 2023 17:32:57 GMT
server: cloudflare
etag: W/"1193-5f23cbdaa622e-gzip-gzip"
x-origin-cache-control
vary: Accept-Encoding,User-Agent,Origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i0GLTHUNe6TVe%2B%2BRaaxOZR47fizMAqzjg8iEXypA0ULTb%2Bkio1iwG7M609jIotSG1lR71nyFp253ntmmMbglq1NE2AzwOglFfxLXx35rqjY0Ao8R4IKtZsmprgPs7lL22khgN4ZvSPP6XA2fy2fXTTEZkpETujJkkq8%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: public, max-age=31536000
cf-ray: 7d086d5cbd9492c9-FRA

GET
DATA 200
OK truncated
/ Frame 6752 15 KB
15 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 186c6a8f5db1d9bc19132abdbfd2f4d655289254b890ce8a688353243fcffc38

Request headers

Referer
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: font/woff;charset=utf-8

GET
DATA 200
OK truncated
/ Frame 6752 8 KB
8 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 246c92390c1fd796ca44b9a199c303edc4d0541388de50295243234a274c349c

Request headers

Referer
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

Content-Type: font/woff;charset=utf-8

GET
H2 200 insights.bin Show response
ins.connatix.com/9341907b8ff55bc3324be0881662b684/ Frame EDE8 360 B
555 B 121ms
29ms XHR
application/x-protobuf 104.18.33.52

General

Check archive.org

Show headers Download Go to

Full URL: https://ins.connatix.com/9341907b8ff55bc3324be0881662b684/insights.bin
Requested by: Host: cd.connatix.com
URL: https://cd.connatix.com/connatix.player.js?cid=5f049401-746e-4449-8c27-b6b9d8e25882
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.33.52 -, , ASN (),
Reverse DNS
Software: cloudflare /
Resource Hash: 4bff0da19a21d9284d121b76b6bf56682e3def802765bac991b6ceb8894e0102

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.90 Safari/537.36

Response headers

date: Thu, 01 Jun 2023 15:18:05 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Wed, 15 Feb 2023 03:40:29 GMT
server: cloudflare
etag: W/"78a262125a1829dc7fbacf54d09963b2"
access-control-max-age: 86400
access-control-allow-methods: GET, HEAD
content-type: application/x-protobuf
access-control-allow-origin: *
cache-control: public,max-stale=31536000,stale-while-revalidate=31536000,immutable,max-age=31536000
vary: Accept-Encoding
cf-ray: 7d086d5daf5c68e5-FRA
alt-svc: h3=":443"; ma=86400
expires: Fri, 31 May 2024 15:18:05 GMT

GET
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 03E2 0
0 51ms
51ms Fetch
image/gif 142.250.186.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsuJk7MyCbXcf7bu8b4r_3AMwBlzSe9MV6xGLCjipI6NUuwbp3NCM1jhPBs1Pku4JrR-dbTP0IXcedEMNqhB1B0yRZp0MP21q3-F5kGyLu4rUZgc_umtmdrmBhmXIzPI8RKA70HuSTH-48RlO2kFAiC-CnfYOq6Qj6fAUPMMvYmsCvNDX5SF08xbxVgPZafmdw07MDc945OPgcgNLs9y3H7RUQ&sai=AMfl-YQOAfdvFNtwHuYFkIc_Xqx1BYhF4hYnFdicd6L1lJhl3K7R4FJG3O2MKHOHNbw8w6mKNHGsBnQwBOae0ZpoBfExG8MdNFMcka7eJBxuTljbe7DoTyAs0PEGylgexeKMzt4XHO6FqunMMBbhxHA6TqMgJg&sig=Cg0ArKJSzJ3ffVRhoboqEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=378&vt=11&dtpt=177&dett=3&cstd=199&cisv=r20230530.10616&uach=WyIiLCIiLCIiLCIiLCIiLFtdLDAsbnVsbCwiIixbXSwwXQ..&arae=0&ftch=1&adurl=

Requested by

Host: corporateofficehq.com
URL: https://corporateofficehq.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS