pt.lizspaperloft.com Open in urlscan Pro
2a06:98c1:3120::7 Public Scan

Software

sffe /

Resource Hash

6ca8ffa3793893211b88ffda414c65d61a0d9a66a6cf571427b55912f6245ec0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28542
x-xss-protection: 0
server: sffe
etag: "1192 / 740 of 1000 / last-modified: 1650452814"
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Wed, 20 Apr 2022 21:19:48 GMT

GET
H2 200 prebid6.13.0.js Show response
get.optad360.io/sf/ 527 KB
528 KB 8ms
7ms Script
application/javascript 2600:9000:2156:3800:11:a4de:2580:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://get.optad360.io/sf/prebid6.13.0.js
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/4be3cb92-a399-488d-a445-a51558b6ee9b/plugin.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:3800:11:a4de:2580:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 710bf3b3a54e164c3bde1c64dd239d2e8cafb6277fecfcfff4bda901d81d377b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 29 Mar 2022 06:38:41 GMT
via: 1.1 ba77f90aac0ddbc2c4c2c02062fac762.cloudfront.net (CloudFront)
last-modified: Wed, 02 Mar 2022 11:37:42 GMT
server: AmazonS3
age: 1953668
etag: "9880469287264dec1b2db80d6f0c4c98"
x-cache: Hit from cloudfront
content-type: application/javascript
cache-control: public, max-age=360000000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-length: 539768
x-amz-cf-id: v64OiBjEgtrbQj8qqj7z2XS8o_Aagf0cvSqdwQO4-hJeMWtiLEDlQQ==

OPTIONS
H2 200 openrtb
adx.adform.net/adx/ Frame 0
0 63ms
20ms Preflight 37.157.6.246
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/openrtb

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.246 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://pt.lizspaperloft.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://pt.lizspaperloft.com
access-control-max-age: 86400
allow: POST,OPTIONS
cache-control: no-cache, no-store, must-revalidate, no-transform
date: Wed, 20 Apr 2022 21:19:48 GMT
expires: -1
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

OPTIONS
H2 200 openrtb
adx.adform.net/adx/ Frame 0
0 61ms
19ms Preflight 37.157.6.246
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/openrtb

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.246 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://pt.lizspaperloft.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://pt.lizspaperloft.com
access-control-max-age: 86400
allow: POST,OPTIONS
cache-control: no-cache, no-store, must-revalidate, no-transform
date: Wed, 20 Apr 2022 21:19:48 GMT
expires: -1
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 latest.json Show response
cdn.jsdelivr.net/gh/prebid/currency-file@1/ 2 KB
2 KB 47ms
19ms XHR
application/json 2606:4700::6810:5914
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/prebid/currency-file@1/latest.json?date=20220420

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5914 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3bed460c8d9b5ca84c390278610d80bdc15c12abaa1481b85b1a375e1215aeda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 20 Apr 2022 21:19:48 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 22729
x-jsd-version: 1.0.1317
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19144-FRA, cache-cdg20741-CDG
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"66f-OtFGlWPBgwv4HsnJYzbdTiRqi7A"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KmDRfD3%2BRPwg7JuiXIeAagf5D16j7gxS%2Bz9agx3vS2PKHOI9AHVfsoKPP8NXaychctZNQmWiynh0LkglWVUjr7YvD9vTbxflbKFm7oDOuh51UV%2Ft4TYh1LvqQx417jylNhiGnlk%2BE8cNp6SmxFw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 6ff0eb9779030215-ZRH
access-control-expose-headers: *

GET
H2 200 localstore.js Show response
script.4dex.io/ 483 B
943 B 69ms
28ms Script
application/javascript 2606:4700:20::681a:9a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/localstore.js
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:9a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e8fe64429e5900c16c7f8dd7861704e2f4d38e00cbb16bc18820b46d92461389

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:48 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 801633
x-amz-request-id: tx0c810f9b689a43feb0d6c-0062543d8e
x-amz-id-2: tx0c810f9b689a43feb0d6c-0062543d8e
last-modified: Mon, 11 Apr 2022 14:37:55 GMT
server: cloudflare
etag: W/"922cffdd75f7192f75231d92684885aa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y4iDM1AAXRhoe%2BBWIFFuOohxhtT5xt36El3lidnqL7pehLMinjed2OgMJZ0o9lSsP%2FqgbkDlo%2BBPU5Z7zn1RRTBfUiR8O0C%2BO3n1RgoBDOHgXOIM7c0UxexSAvjzNxuoOB8ZB4ROMiLH2%2F%2B0"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: public, max-age=1800
x-amz-version-id: 1649687875786561
cf-ray: 6ff0eb978be15a31-MXP

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
182 B 46ms
18ms XHR
text/plain 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://pt.lizspaperloft.com
date: Wed, 20 Apr 2022 21:19:48 GMT
access-control-allow-credentials: true
access-control-max-age: 3600
vary: Origin
access-control-allow-methods: POST

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 10 KB
5 KB 242ms
206ms XHR
application/json 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

8e2f9be3123d627bd899e7927cd9ead60d05975abc973c0794ed1db14dc4b5f3

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 20 Apr 2022 21:19:48 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: a1969249-6bd2-453a-9fa4-746727c1e234
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://pt.lizspaperloft.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
350 B 293ms
98ms XHR
text/plain 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://pt.lizspaperloft.com
date: Wed, 20 Apr 2022 21:19:47 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
server: envoy
x-envoy-upstream-service-time: 1
vary: origin, Accept-Encoding

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 10 KB
6 KB 118ms
84ms XHR
application/json 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

1e694c08571bfbf2c4a52da22a7d339d48c480146c4fa948f5a39bf52c99a0d0

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 20 Apr 2022 21:19:48 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 65cc8216-5e12-40bd-841a-23d2ab7d8279
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://pt.lizspaperloft.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 openrtb Show response
adx.adform.net/adx/ 0
411 B 103ms
66ms XHR
text/plain 37.157.6.246
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/openrtb

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.246 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:48 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://pt.lizspaperloft.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

POST
H2 204 openrtb Show response
adx.adform.net/adx/ 0
412 B 102ms
64ms XHR
text/plain 37.157.6.246
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/openrtb

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.246 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:48 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://pt.lizspaperloft.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
228 B 297ms
107ms XHR
text/plain 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://pt.lizspaperloft.com
date: Wed, 20 Apr 2022 21:19:48 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
server: envoy
x-envoy-upstream-service-time: 9
vary: origin, Accept-Encoding

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 10 KB
5 KB 130ms
100ms XHR
application/json 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e4d103cf93f178c3b8d7e61f8b7a2ba969784c766ce16a578fb83be5385c87f6

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 20 Apr 2022 21:19:48 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 1de7ede2-16a4-4c69-b5fa-df06b139ca5b
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://pt.lizspaperloft.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
182 B 37ms
16ms XHR
text/plain 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://pt.lizspaperloft.com
date: Wed, 20 Apr 2022 21:19:48 GMT
access-control-allow-credentials: true
access-control-max-age: 3600
vary: Origin
access-control-allow-methods: POST

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 9 KB
5 KB 97ms
68ms XHR
application/json 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

c0fbc22f10dccac81439d9c7dbc1b72544aa874e8dddda873dcaf15ef0dd9447

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 20 Apr 2022 21:19:48 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 6de99506-3ec0-4444-b419-8f74e3affcf3
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://pt.lizspaperloft.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 pubads_impl_2022041401.js Show response
securepubads.g.doubleclick.net/gpt/ 362 KB
123 KB 22ms
7ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

108a5ee6306c726271c490dceca48e5fb5a148ea41fcb9fe55cd5d348f16eb57

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 20:59:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1223
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 125916
x-xss-protection: 0
last-modified: Thu, 14 Apr 2022 08:34:33 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Thu, 20 Apr 2023 20:59:25 GMT

GET
H3 200 ppub_config Show response
securepubads.g.doubleclick.net/pagead/ 82 B
103 B 34ms
18ms XHR
application/json 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=pt.lizspaperloft.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a944f9ef22a49bdcee0175bf86081c9ebbbc3da5268cad0708346c15bb8d304e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 21:19:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 78
x-xss-protection: 0
expires: Wed, 20 Apr 2022 21:19:48 GMT

GET
H2 200 adagio.js Show response
script.4dex.io/ 72 KB
23 KB 86ms
35ms Fetch
application/javascript 2606:4700:20::681a:9a9
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.4dex.io/adagio.js
Requested by: Host: script.4dex.io
URL: https://script.4dex.io/localstore.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:9a9 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c842fa8019eafc4beae4bd989e2c486d3ecd7a407edb21804c35a1726a90fec7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:48 GMT
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 485740
access-control-max-age: 3000
access-control-allow-methods: GET
x-amz-request-id: txcccc64b450964da48c126-0062543f97
x-amz-id-2: txcccc64b450964da48c126-0062543f97
last-modified: Mon, 11 Apr 2022 14:37:55 GMT
server: cloudflare
etag: W/"e88bab2e9c57f44732eeec31ca508d70"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=efkZSusNYuyivZD420gf%2B2DvIAjpzWklXqyweSibmb0LpSfw4IygpxpP01g6X6d7bBERerJByNTjE%2B%2BfrM1nEDaosc%2BS15RqMZVIxcp3iTNv8vh4KsTea4lYReYSggvpQQDvR%2FnBaG12FAcB"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=1800
access-control-allow-credentials: true
x-amz-version-id: 1649687874851815
cf-ray: 6ff0eb981e4d734b-MRS
access-control-allow-headers: Authorization
expires: Wed, 20 Apr 2022 21:49:48 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
792 B 64ms
15ms Script
application/javascript 2a00:1450:4001:811::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=pt.lizspaperloft.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 21:19:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
549 B 55ms
16ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=pt.lizspaperloft.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 21:19:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 1009 B
576 B 270ms
270ms XHR
text/plain 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

63cefbc4133c7e859c623d9ce6e0751e94bfc16d5861fd24c3dacdc6ae228ada

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:48 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 546
x-xss-protection: 0
google-lineitem-id: -2
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: -2
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pt.lizspaperloft.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 container.html Show response
d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 01E9 6 KB
4 KB 52ms
16ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pt.lizspaperloft.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 21:19:48 GMT
expires: Thu, 20 Apr 2023 21:19:48 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 pubads_impl_page_level_ads_2022041401.js Show response
securepubads.g.doubleclick.net/gpt/ 35 KB
13 KB 9ms
8ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2022041401.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c321245e6d62047e34eb64d468495376a05026060a19408588ba2dd9e552f1aa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Thu, 14 Apr 2022 10:47:45 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 556323
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13283
x-xss-protection: 0
last-modified: Thu, 14 Apr 2022 08:34:33 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type: text/javascript
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
expires: Fri, 14 Apr 2023 10:47:45 GMT

GET
H2 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ 14 KB
11 KB 43ms
21ms XHR
application/json 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022041401&st=env

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cf5521546e58ea96d01455479ff4461630555192e19cdd750401f572f188bc21

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 21:19:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10523
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 32ms
16ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=pt.lizspaperloft.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 21:19:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 31ms
16ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=pt.lizspaperloft.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 21:19:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 19 KB
9 KB 395ms
394ms XHR
text/plain 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=32471245794900&correlator=4210107993115095&eid=31063377%2C31065401%2C31066184&output=ldjh&gdfp_req=1&vrg=2022041401&ptt=17&impl=fif&iu_parts=121764058%3A22528037647%2Ccelebs-networth.com%2Ccelebs-networth.com_SF&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90%7C750x100%7C970x90&ifi=2&adks=1095535024&sfv=1-0-38&ecs=20220420&fsapi=false&prev_scp=hb_format_appnexus%3Dbanner%26hb_size_appnexus%3D728x90%26hb_pb_appnexus%3D0.26%26hb_adid_appnexus%3D24038aa2c117f35%26hb_bidder_appnexus%3Dappnexus%26hb_format_bluerooste%3Dbanner%26hb_size_blueroosterm%3D970x90%26hb_pb_blueroostermed%3D0.02%26hb_adid_blueroosterm%3D2258e9ef9635fa6%26hb_bidder_bluerooste%3Dblueroostermedia%26hb_format%3Dbanner%26hb_size%3D728x90%26hb_pb%3D0.26%26hb_adid%3D24038aa2c117f35%26hb_bidder%3Dappnexus&cust_params=pubcid%3Dee225e62-3a6d-4651-b25c-d4a19947483a&sc=1&cookie_enabled=1&abxe=1&dt=1650489588674&lmt=1650489588&dlt=1650489588061&idt=406&biw=1600&bih=1200&adxs=436&adys=1200&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&url=https%3A%2F%2Fpt.lizspaperloft.com%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=0x-1&msz=728x-1&fws=640&ohw=0&ga_vid=318061361.1650489588&ga_sid=1650489588&ga_hid=577484960&ga_fc=false&btvi=1&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a78fc80bfe80d553ad5df7623c161af9e81ba477f78ed376c05153cbb5a53d9f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9549
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pt.lizspaperloft.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 78 KB
23 KB 707ms
706ms XHR
text/plain 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=32471245794900&correlator=4210107993115095&eid=31063377%2C31065401%2C31066184&output=ldjh&gdfp_req=1&vrg=2022041401&ptt=17&impl=fif&iu_parts=121764058%3A22528037647%2Ccelebs-networth.com%2Ccelebs-networth.com_ATF&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=728x90%7C970x250%7C970x300&ifi=3&adks=2150126683&sfv=1-0-38&ecs=20220420&fsapi=false&prev_scp=hb_format_appnexus%3Dbanner%26hb_size_appnexus%3D970x250%26hb_pb_appnexus%3D0.07%26hb_adid_appnexus%3D21f7fb166de6b49%26hb_bidder_appnexus%3Dappnexus%26hb_format_bluerooste%3Dbanner%26hb_size_blueroosterm%3D970x250%26hb_pb_blueroostermed%3D0.08%26hb_adid_blueroosterm%3D234d6d2dc4ff074%26hb_bidder_bluerooste%3Dblueroostermedia%26hb_format%3Dbanner%26hb_size%3D970x250%26hb_pb%3D0.08%26hb_adid%3D234d6d2dc4ff074%26hb_bidder%3Dblueroostermedia&cust_params=pubcid%3Dee225e62-3a6d-4651-b25c-d4a19947483a&sc=1&cookie_enabled=1&abxe=1&dt=1650489588682&lmt=1650489588&dlt=1650489588061&idt=406&biw=1600&bih=1200&adxs=436&adys=240&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&url=https%3A%2F%2Fpt.lizspaperloft.com%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=0x-1&msz=728x-1&fws=640&ohw=0&ga_vid=318061361.1650489588&ga_sid=1650489588&ga_hid=577484960&ga_fc=false&btvi=0&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

fc5232f374867af26681cfdeef028a49c5708ab1124f9cae4997fde6dea9da26

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 23910
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pt.lizspaperloft.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ 17 KB
7 KB 42ms
19ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 20 Apr 2022 21:19:48 GMT

GET
H3 200 runner.html Show response
tpc.googlesyndication.com/sodar/sodar2/225/ Frame BAD3 13 KB
5 KB 23ms
6ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pt.lizspaperloft.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3936
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 5046
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 20:14:12 GMT
expires: Thu, 20 Apr 2023 20:14:12 GMT
last-modified: Mon, 21 Jun 2021 20:47:05 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 aframe Show response
www.google.com/recaptcha/api2/ Frame D287 783 B
1 KB 41ms
16ms Document
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/aframe

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

69d7a96bc36e1d50c32ce5396f6e23b0c9e7b3a73b7c389629c111c2f1c5c65f

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-NyaEoWXTXZkSwIPFhAtnnQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://pt.lizspaperloft.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=300
content-encoding: gzip
content-length: 511
content-security-policy: script-src 'report-sample' 'nonce-NyaEoWXTXZkSwIPFhAtnnQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 21:19:48 GMT
expires: Wed, 20 Apr 2022 21:19:48 GMT
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 LJGn0i2Pg8yG-wzimFR5htSsDE5oolsrGkll4HQxngw.js Show response
pagead2.googlesyndication.com/bg/ Frame BAD3 35 KB
13 KB 22ms
7ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/LJGn0i2Pg8yG-wzimFR5htSsDE5oolsrGkll4HQxngw.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c91a7d22d8f83cc86fb0ce298547986d4ac0c4e68a25b2b1a4965e074319e0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 14:40:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 110368
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13643
x-xss-protection: 0
last-modified: Mon, 11 Apr 2022 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Apr 2023 14:40:20 GMT

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ Frame D287 0
0 57ms
55ms Image
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022041401&jk=32471245794900&rc=
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

OPTIONS
H2 200 openrtb
adx.adform.net/adx/ Frame 0
0 19ms
19ms Preflight 37.157.6.246
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/openrtb

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.246 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://pt.lizspaperloft.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://pt.lizspaperloft.com
access-control-max-age: 86400
allow: POST,OPTIONS
cache-control: no-cache, no-store, must-revalidate, no-transform
date: Wed, 20 Apr 2022 21:19:48 GMT
expires: -1
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

OPTIONS
H2 200 openrtb
adx.adform.net/adx/ Frame 0
0 19ms
19ms Preflight 37.157.6.246
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/openrtb

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.246 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://pt.lizspaperloft.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://pt.lizspaperloft.com
access-control-max-age: 86400
allow: POST,OPTIONS
cache-control: no-cache, no-store, must-revalidate, no-transform
date: Wed, 20 Apr 2022 21:19:48 GMT
expires: -1
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
pragma: no-cache
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

POST
H2 204 openrtb Show response
adx.adform.net/adx/ 0
411 B 59ms
59ms XHR
text/plain 37.157.6.246
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/openrtb

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.246 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:48 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://pt.lizspaperloft.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 13 KB
7 KB 86ms
86ms XHR
application/json 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

ceea75ef4b44fa966d673306ae0d3b8564155d56231809240479eab8b299c3cf

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 20 Apr 2022 21:19:48 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: e2afd53f-366b-4838-bbfe-13cad2461eb3
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://pt.lizspaperloft.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
182 B 15ms
14ms XHR
text/plain 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://pt.lizspaperloft.com
date: Wed, 20 Apr 2022 21:19:48 GMT
access-control-allow-credentials: true
access-control-max-age: 3600
vary: Origin
access-control-allow-methods: POST

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 10 KB
5 KB 147ms
147ms XHR
application/json 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

3f7aaa0630d1b0419bd532c259cc4ab9bf4b9d8e89fd14b8458e6551ca167aba

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 20 Apr 2022 21:19:48 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: 2817fe3d-60d4-464f-8368-ef48e869130f
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://pt.lizspaperloft.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
204 B 99ms
99ms XHR
text/plain 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://pt.lizspaperloft.com
date: Wed, 20 Apr 2022 21:19:48 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
server: envoy
x-envoy-upstream-service-time: 4
vary: origin, Accept-Encoding

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 10 KB
5 KB 180ms
180ms XHR
application/json 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e653eaed83aeecb02dd5f3d11848e1f860db1b052e70df4ff9cbc9175eb2edb8

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

Date: Wed, 20 Apr 2022 21:19:49 GMT
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: eb311ba0-828c-4f2a-b12f-edfacbdab04c
Server: nginx/1.21.3
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://pt.lizspaperloft.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 c Show response
prebid.a-mo.net/a/ 0
204 B 96ms
96ms XHR
text/plain 147.75.38.124
PACKET

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.a-mo.net/a/c
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 147.75.38.124 Amsterdam, Netherlands, ASN54825 (PACKET, US),
Reverse DNS
Software: envoy /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://pt.lizspaperloft.com
date: Wed, 20 Apr 2022 21:19:48 GMT
cache-control: max-age=0, private, must-revalidate
access-control-allow-credentials: true
server: envoy
x-envoy-upstream-service-time: 2
vary: origin, Accept-Encoding

POST
H2 204 openrtb Show response
adx.adform.net/adx/ 0
411 B 59ms
59ms XHR
text/plain 37.157.6.246
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://adx.adform.net/adx/openrtb

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.246 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: application/json

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:48 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: POST,OPTIONS
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://pt.lizspaperloft.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
expires: -1

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 76ms
76ms XHR
application/json 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

27c213c59fde2e5782b568e0d63b8b13b04eb8420512972823d5ba9f62d68204

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:48 GMT
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 4a350f3c-6569-49ed-8cf1-8d4f8587f892
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://pt.lizspaperloft.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 bids Show response
prebid-eu.creativecdn.com/bidder/prebid/ 0
182 B 15ms
15ms XHR
text/plain 185.184.8.90
RTB-HOUSE-AMS

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid-eu.creativecdn.com/bidder/prebid/bids
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 185.184.8.90 Amsterdam, Netherlands, ASN204995 (RTB-HOUSE-AMS, PL),
Reverse DNS: ip-185-184-8-90.rtbhouse.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: https://pt.lizspaperloft.com
date: Wed, 20 Apr 2022 21:19:48 GMT
access-control-allow-credentials: true
access-control-max-age: 3600
vary: Origin
access-control-allow-methods: POST

GET
H3 204 generate_204
tpc.googlesyndication.com/ Frame BAD3 0
9 B 7ms
6ms Image
text/plain 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tpc.googlesyndication.com/generate_204?mbQIHw
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 15ms
15ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=pt.lizspaperloft.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 16ms
16ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=pt.lizspaperloft.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
9 KB 682ms
681ms XHR
text/plain 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=32471245794900&correlator=4210107993115095&eid=31063377%2C31065401%2C31066184&output=ldjh&gdfp_req=1&vrg=2022041401&ptt=17&impl=fif&iu_parts=121764058%3A22528037647%2Ccelebs-networth.com%2Ccelebs-networth.com_am_S2&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250%7C336x280%7C360x300%7C580x400&ifi=4&adks=3711858918&sfv=1-0-38&ecs=20220420&fsapi=false&prev_scp=hb_format_appnexus%3Dbanner%26hb_size_appnexus%3D336x280%26hb_pb_appnexus%3D0.07%26hb_adid_appnexus%3D467f4a1eef88819%26hb_bidder_appnexus%3Dappnexus%26hb_format_bluerooste%3Dbanner%26hb_size_blueroosterm%3D300x250%26hb_pb_blueroostermed%3D0.02%26hb_adid_blueroosterm%3D4582401b47acaa9%26hb_bidder_bluerooste%3Dblueroostermedia%26hb_format%3Dbanner%26hb_size%3D336x280%26hb_pb%3D0.07%26hb_adid%3D467f4a1eef88819%26hb_bidder%3Dappnexus&cust_params=pubcid%3Dee225e62-3a6d-4651-b25c-d4a19947483a&sc=1&cookie=ID%3D171f417a1f26b045-2232691c7ecd00ba%3AT%3D1650489588%3AS%3DALNI_MYSZiK2QU5GT0-XLg7W73FTSoa76g&abxe=1&dt=1650489589008&lmt=1650489589&dlt=1650489588061&idt=406&biw=1600&bih=1200&adxs=460&adys=1522&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&url=https%3A%2F%2Fpt.lizspaperloft.com%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=0x-1&msz=300x-1&fws=640&ohw=0&psts=AGkb-H8nCze6nsAS9elrvRwB4CU8iybNF2joSB6_XppkPRbd&ga_vid=318061361.1650489588&ga_sid=1650489588&ga_hid=577484960&ga_fc=false&btvi=2&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a91e18d4af2c456afc3a0a1a36b23f119b21f047a9781fe56a39da9bb4b7aec2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9578
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pt.lizspaperloft.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 integrator.js Show response
adservice.google.de/adsid/ 107 B
122 B 16ms
15ms Script
application/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=pt.lizspaperloft.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 integrator.js Show response
adservice.google.com/adsid/ 107 B
122 B 16ms
16ms Script
application/javascript 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=pt.lizspaperloft.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control: private, no-cache, no-store
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 100
x-xss-protection: 0

GET
H3 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 18 KB
10 KB 945ms
944ms XHR
text/plain 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?pvsid=32471245794900&correlator=4210107993115095&eid=31063377%2C31065401%2C31066184&output=ldjh&gdfp_req=1&vrg=2022041401&ptt=17&impl=fif&iu_parts=121764058%3A22528037647%2Ccelebs-networth.com%2Ccelebs-networth.com_am_S1&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=300x250%7C336x280%7C360x300%7C580x200&ifi=5&adks=3777506267&sfv=1-0-38&ecs=20220420&fsapi=false&prev_scp=hb_format_appnexus%3Dbanner%26hb_size_appnexus%3D336x280%26hb_pb_appnexus%3D0.07%26hb_adid_appnexus%3D47992e390bfab83%26hb_bidder_appnexus%3Dappnexus%26hb_format%3Dbanner%26hb_size%3D336x280%26hb_pb%3D0.07%26hb_adid%3D47992e390bfab83%26hb_bidder%3Dappnexus&cust_params=pubcid%3Dee225e62-3a6d-4651-b25c-d4a19947483a&sc=1&cookie=ID%3D171f417a1f26b045-2232691c7ecd00ba%3AT%3D1650489588%3AS%3DALNI_MYSZiK2QU5GT0-XLg7W73FTSoa76g&abxe=1&dt=1650489589042&lmt=1650489589&dlt=1650489588061&idt=406&biw=1600&bih=1200&adxs=460&adys=330&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&url=https%3A%2F%2Fpt.lizspaperloft.com%2F&frm=20&vis=1&scr_x=0&scr_y=0&psz=0x-1&msz=300x-1&fws=640&ohw=0&psts=AGkb-H8nCze6nsAS9elrvRwB4CU8iybNF2joSB6_XppkPRbd&ga_vid=318061361.1650489588&ga_sid=1650489588&ga_hid=577484960&ga_fc=false&btvi=0&nvt=1

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

53b7b550acc8de8faf9a78bdbf1076c11c1b8ae989a29ea62d65daffbbb2b0fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 10169
x-xss-protection: 0
google-lineitem-id: -1
pragma: no-cache
server: cafe
google-creative-id: -1
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://pt.lizspaperloft.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 container.html Show response
d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 80F1 6 KB
3 KB 23ms
7ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pt.lizspaperloft.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 21:19:48 GMT
expires: Thu, 20 Apr 2023 21:19:48 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame E25B 624 B
975 B 40ms
18ms Document
text/html 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CJD8NRDO0zYYgcPQxwEwAQ&v=APEucNU4-yI2odYzw8ALMVPAlDhp9Rkc1EJ90_qI1MfCVykelF3ZL-nGqFdaQiD07BwbdnckKvsjAW5zncKX3n6N2vjPGhUwkUe6aj0G-FktNoiijEUQzvgNsmwyIPGOW4KbaO0-qPtQ75Gu_7JOzLxNha2WqX4V2-rL-YL3wJUD4TiWUPjUHaCBmEBiI9lqgE0_iHQuiRRkeeaXsmV1ymqslt4od150Rw

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 21:19:49 GMT
expires: Wed, 20 Apr 2022 21:19:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 80F1 27 KB
16 KB 56ms
34ms Script
text/javascript 2a00:1450:4001:813::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AAnsEbNmmR3-xncoQPslwF6vlYW1MK-t_mlcQqcSeNhn7QYJrm3OsxfboP7ojFxxMrvidnCJbBXkNQz8mOSsMi-_bO-kDPxtMO3iGMcwvfVGKYg-QwV1tRS7mA35IPb3fAgzQ4kY452ok7iNWFQkM7au3xzA&cry=1&dbm_d=AKAmf-BIq-vswGoeUQeuJ8NQ2Qhup1pt8jiBaDVu-w3WyuH7K3eNT36ohUJESNJXmuY-4QfeEl3_xIPQusXzA284zPieZq1Ms5kQVd9pSFDfWOMIKyLOpYSsInIoaadUtQIu0qTzFU7ejdO0L_3AUKc0kcCddNTfKi9waYJp8VVqHSPuAShSMvkiZ8ew_8JPwiaGEutv12pbC4OLUVC7WcdBH0hlc7v6uSZKCASxK65txS8x5Is4o3G4z_bNq7XMh7148mZrErr-VaDxCdFY1JYID5le7eluY9Y7p1gUJOCVIIqvRdazMNQKeIn3z2qyG5Ff_J-hIUMH6l_ug4FGoPG4oDga9keRZu-u7SK-K4itqte-Se_ZGu7YAQZvg6B8Si3cnbee9N30591UGAAVHS0GX9Weqbs6lPyCmACY8khFrTrZESU30BbXPKK72v3m58XwcQMlZ0jHe196KBkjwHpfxeRVzEtoROMYu2yShxgWizvNfzCD6FMPn5Vbj2TmJJOWZzejOHk9xkdk87naodkWdcSEqZGtyTpAr0KluoL7UJbqoj3LQED6xQ60htOQYtEFzdAJhGcKxt0liEftQxpsYrYIIakHJX2MK5rUTQI_ZWTj-vWP_29U_8wOXGTuFd6lxakJepfpVZobruybtNQTC9R8aBR95ghcQ_tprygeq7Oxow8me9FDepcMJTgbwZChf2IDmfXbct6wNbqv48OcHX5V1WtdgWMqSLX8nXusSsIrxLWXxRweQABIIr5c_9nTjmtPPkr1QLJw9PonRp38nV2BcdykKetVqpf3-GBDEXwbDxGA5OSowwHH6HwzL6eZtEZ1OK2QGDAbOXxKLPyukCLTLP6PivGEJVJbIPWPZHPwvQOYz8QW_EPyOUZwf93EteA6cFdbYOISdlvl8QVdk3p_j19QgBzkxk92BIwRQ9FO4jpnjS0ZTlHXjKZdgga9QhzwunT2urUAAuTp9RAynV2O6wqET8oB2aAQfWY1M_G0tIvmYcqfmpfAEVcmaOcZZDYTdDru31UWDNAkMsPqWS4o4jBgrIE3A-KiVdGqc6AqFV4A-lReHKB8mNLeNzJUfPFVKEmeGLhFwFPTvTSovWxhmaYN9YlVoO0v81YM7h6K3FrLncOIoXE4c6gaAZ6ECufFYH10yk0CtwG6Fjby7KqGvGtv_2Z8Hnvtya9hSHchS0n9dbJiLkYqheNqZukIkYNT6MPJXZsKExaSb6Cz4ULYGB4OxW5PtoofJ3PvO4TxlKMLG4t1uVMg0teNUoZmPnAuu-0yjcyz7vrcaTjwHiY1v9nDD1E1p4BDzBEk1CdBsBTtwk-KhXSPFB09KGsXAosKkl3eoKPs2QXG9IN4SyT8TDE3e_HWAcHoIfCIaifH7To_vvUvLk_I9t6ilLJokIkrZMDjusN5JtWTFIAU-cu9et47pi7GMFm29_UI4EUKeMt7ZsHd03NS8XrqoqoQazj_PN7A4mutPjxCqAVx4hPGBM8Wk3eu6KEqeSLVDk_ZcmJEi3dNalvLVpwTYSHghtC3uuo0-ziCmNKy91uF8WgyHdxVXVP0EHsabjUgfiQRg29Jao6Zh-7HJsIhfotzfsXcoJHXvaKw0VAG6adrLwFE3cJiUbqrQjQ35zF7khZuxvVSn0JfC6cJMTdD7eHl3UbYvAQciMxTtuwE27trAefSmBdVR9WbAkPjwzuQ6VsOvrIgSOQ-6tO33xtEebs1-r6C0BTsg1SvZG8bd4VtH2CZ0pKFWqUlc_5esV3bOovtDPTKgjH9ogZ3fuFEFAwyeeF0w2-WmykjVyQwec_RWDxhC6Cw18raLah1aRNCyeLqvp41KZmP7fSz425Y-W7q5gGAG0R6FYoTGM_xOUAtqvr1vY8Wqf0z-K2UPqY0NahAAicwgCxQ9IzjyyNcUGqXTpAMbeB39vfxoVICeCn88x3MrePfAIq0SI8v7gOMGuW_kTQllG8JwUx-fbnov_q5DedDLf2w8IzCp3fllHTq4Y8dGm6B8z-nsrtBJCnIOuVvvv2qx25WWq35sG06wwc2rTZz5yQviX1rNRpcChUrLQkBdxz0ce58waeyyv06BhTI_wX7YJtJuU_izah7MhfoUAovBX5EIsjlMEWqBzjiNhQFLPsSfPCl_of9f8YM7gtb1lPBnMsOVzc9ex8MUJLiEyIhr_qLZWWihb6TezYUoGE-p1IivDAL3kya_N7Fxeb-rUl6dDOu6i7a2kPEQgFt7hDHZ-hFftlRHuOvQSvvyO3CW17zbKyiRyWAnRkNTiD6Txaw2LfINP2WY5619FS4E7MuQNYYFfEYCcEXkqct7yQHeOHONjZ9rpHqCr0stoMuufmugWSumkZ8tMPex5Z_5AiKJvTuDZl2CEDiCr9vAm17WtzQBZ9vfcgATcqcyVAr9DpcstJ3L9aalvMXCaqz8kyD39ihfduXZ6F7s-1ZSciUWIrPjcniJfwpxDpagPtFPOrvfmg55MN5n9wEaGhXNNkhvOKM6y1zKxq7tWjY_-CfMb1b1nZyMNltI2XqOmtQlyOm0T4nggtK3qkxWSD4a7IfgrmYlx2XaPsWuHdOuwxBn5pwl3evOZN5UMQgBNh0jmGv-sniogDLRbCqXRusb6z1DnS1cKFbhvnDWB9qQgmYmtw5tiVNBC81dckVxTTFN7HvJLgdpK_Dt1E0ZYUAAbx3yRIlgJNAXVdsQwEITlc5mB2BB-H3B5Z1qNqAWJoYpjmXBx9biCp7jV1Ninv0rMarzvnExmKO3UVDEfyHBZ941bB-O65zt3mvQsKkStr4GHAhrBa6MAMtKQaCuh1g54GDVfJL9kVbbHUGFPouRTeMv6cjE9lyLU9DXgJAKpMOgPnyubZqh2RxvRbWCSYoypIfTmQqlq1XtiDBUkv6VLJ7H-Md4MpSsKJo0ofwhGnDO4P12N55R5v57ZcyTz6GPBlRDTvrMKd5NjuPdOsob_EdzLwo6aGcQMAi66xgj5FJhTSLpvG2kdRkd_gxHz5o-qlUDuPEE3cpq6lST8vMn15s2Gu03UMR7AFE7KPiuvunJW5zHyZiZ5BXaafuwfr5i_w3W7PrW1Nu8rGNwsVtk_m8o06_ZVcO7BG1U65JAZ-AfPE1aWvJjpD0zH8zukwW1DQRyIjaK2hie4AQuh8epouhGwG2i9ab55DEWt0oqXfkfwBIpLjWwedgFkcBKdWDgK-NXySNsDShIqEvJ3NJjuUlzXPVUmUHAJ2OWVVlBh7cqj3mNezuxZgziIL2aya1wIoJolsYB4m95Lx7ruw7d-PhyiELEm8NYjPT1uwHYBbYIujKuymxVpY6FloBHV0uwwIsaj4Og1l8hnuaBPGTSHMWtmcLO-ga1oUrgfBjIcXILUofJXUqxYR42sAorSiMyRlvgxePu5GNTQJcpW_zXo1PoxPWorFfIAyWq87KcET39zPcuQ9t_Y_dYR1q_W8gVJKrmaPtp5xOaG4qK_L6XY1i3Ni6D2ui_cnx133Y5NeBadv2FPZWC1-hwv9sZTOYm7AMGIC38Oj1eoeouvDENdUBGNmyjQXyPlNiy2edo6oMod4h1mQZH1CLkn98m42X3EHjY1d7fm4gfcrk0Q0FsCP7nMAj2lbmE7jaRiFjtPoZ5UhsATqtC5SsnsJ1i-xXe7ywnuOL-u0aCYJPMAjETBudKL8Tw5cn-NzWOJz5yX91PyGuGxuXP07LZvBVRyTLSfilHz6QPYFZCgaK7jqU318iavRYDXh2g9p24Fjts48BPNUpHl-9PxwgXHxvtyJGNn4FQJYMT74uqUIeqZVf_hSt_I9MgPIKjbYa0HsnaKX1cbQ1bBjg_guzuCSPNtPK9kD-cBYw0xke9odQnjphZlYdfY1GnCzZkfDYyrVpt0gN9URcbUgxxV10wuXvaSdfXg2hmDVIzYjXDvNYyNMHJGDwuOmiwV8xhMePafTGbgjYb70QWgTbeMOFEKZf9XiN_whw_lQlnkXvr87vBuUZln9vRbaWrRpHDw4FWwq-OvD8ci0RjpO8WXLo54YkQQ1ehZ4yP4lIlwRRFPXZiDZXQwfO3cN6dO1IBmKCeEZfmvxUVJvjwGVme89Ims_ljTEWzTN5J7tVpwX86MIQfFGDvfNSHdSaFbcCQ7K5y_BKOGWYJqxg-dRLrOS3mqGT4b6_MV0n0Qt1GwG1Emw7SDFW4woGb8m9P05LYbuBL-andf_h0GU44rkk8rh0VJOobZRQKQGU8XD-vx9oDjl3qrbRaFqWsHcJgcrCeenGzTXdSKYcSWZExKl3aNygD1QVqxj8e9PkluIY&cid=CAQSLQCNIrLMyTyxPyWSFKP3YG2IvXPrDni2ozokT8gfP4EqCPW9_FtfsTMP4d7ukw&rfl=1%2Chttps%253A%252F%252Fpt.lizspaperloft.com%252F%240

Requested by

Host: pt.lizspaperloft.com
URL: https://pt.lizspaperloft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

261b8cd0496e1a916c0ccd3ea6fa97e13922d6721c3ab5c5dcb268bcc6acc082

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 16413
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 80F1 42 B
63 B 40ms
39ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-D4c-z60zO48WDlXQgDIkoEcwS5Ah7jt5ntjSrP0NgnIgF-VHZISWCk6N2KuOMbpleKwknvcdF_1bRg_pZsOdBHxGLsp7e8ETt6IPd5CC1W74j8NHA

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
a1.adform.net/adfscript/ Frame 80F1 2 KB
3 KB 98ms
20ms Script
text/javascript 37.157.4.24
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://a1.adform.net/adfscript/?bn=54370173;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CYuU-9HhgYsCGLvKO7_UP5u2d2A2M1KXCaeHgprDwD5Ok_orXKRABIKqAwyJgldqigrAHoAGTpo--A8gBCakCCmX3rhg1sj6oAwGqBI8CT9BLydD9fG1_aUmHp4khhsVR2szxt-_IZ0jeKFi8sm2Fr-oSAACAr5oYvpU4uFgyQPshdMio3MqPD2-UJC0IOTSxcHzAtUqhS2uhmbBRKSLALdQt1i3ktpLOYtSUiXinbIKmoXHX6BbKRW6SfkX2c3-AjL5qZ2mw3VLVwBWoJctHa8UmoOo0TKVHqORjYwfprPMNAIdRTZg6Kooib48kXBMe-2xLpBoawaa1tGRmJS6ZkesgVCVEHFXFOLZcpybwyLNln62issZhXOXo8koAfJDsUSHDAXTc3HzJFUXa4Fz-uvBJ_OqDp8XJ41tVJWI29PPnwtfBJ6CeBFpZTYtdfn7VYXT0JmxQn3-omh0OncAE_d30tO0D4AQDkAYBoAZNgAfV2fBBqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggJCIjhgBAQARgd8ggbYWR4LXN1YnN5bi03OTQ0NzI2NzAwNjA0NzAxgAoDmAsByAsBgAwBsBPyxPEO2BMN2BQB0BUB-BYBgBcB&ae=1&num=1&cid=CAQSLQCNIrLMyTyxPyWSFKP3YG2IvXPrDni2ozokT8gfP4EqCPW9_FtfsTMP4d7ukw&sig=AOD64_1GD8XAVq-t3XgVg4nxvHhgbqRu3g&client=ca-pub-5512390705137507&dbm_c=AKAmf-DGJB980y18Yjx98pZH9cHEHCyGOJ2lnWzmh40uLydI2Zep0v4I48pXQGngeBSpXp2DeSEU01bBSx_7RuqikqSUJcN2G5MuJZCR5ZAitqAQXOT3uQW-PzWz5kqXM8dzEMjZdXQzg901FOB53ct84p1QSXCvbQ&cry=1&dbm_d=AKAmf-BuT1eLFpuK-M_vF_zQ3zN8H9qH_CI8Q0zpsHCXymmdxw0vvuVixkd8bckDE0ZdI0dDmF2zR2xjTQR4CI_Y0t5JKMeKUvXboWq0g-ucMF2Z2f_3KQ_4xOrt_GV1hUt68-e4GtOAjqE5SlzizcycrzeFJMtHz1tx9xoITmG5WFnjdmvJOsDDeb_I_r6SdYXERMoRkNrOWPCFSMFkS-3CdxeIkd0CtGnRrmQUjIT9zGxV73vQqcAwlfYL8DbwtowVN4FQWFTR2Txg1quzaNUY148DCohY_APJPVEwnRbe_dFvKHnlBu3CmLX1NzqTUf7og4nTT2xmV2cnVAq0U3QFY30-UO5oShaMrMX12lvIEho14HyEklsnLVvkKVAzkiarU3kB6wThpD7gH9x1m4sJDwmVJru88FeLsPCDDzWRO_nXAE3aa9KkD11txM_gO9CaDy-GA6bv0zWQAwQng7js7xxsToCFLQ&adurl=

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.24 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

f9dc5ca4e7676e4848a5a541b1782fe636b556b71d4c789b7e155d7b0e6fc265

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 2210
expires: -1

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/ Frame 80F1 3 KB
1 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/window_focus_fy2019.js

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 May 2022 21:19:39 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/ Frame 80F1 15 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:15:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 231
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6409
x-xss-protection: 0
server: cafe
etag: 15284592792851369840
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 May 2022 21:15:58 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 80F1 0
0 33ms
15ms Image
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQcBVUBFe-A0o64rCn77_1KORuZaaExGhsHMG-JVT2tTXMx5xPDXIpYC9W_XK6McXeuMqHu
Requested by: Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
H2 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 80F1 119 KB
37 KB 38ms
14ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef2e3293c1558e5b49e30e1e094cfc3412ec386a68067aee04a92fc913f2c2ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36950
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1650454428054601"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 20 Apr 2022 21:19:49 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame E25B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI6HivpohbL-9M1jL3fiwJU&google_cver=1

43 B
1014 B

22ms
22ms

Image
image/gif

69.192.160.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI6HivpohbL-9M1jL3fiwJU&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJD8NRDO0zYYgcPQxwEwAQ&v=APEucNU4-yI2odYzw8ALMVPAlDhp9Rkc1EJ90_qI1MfCVykelF3ZL-nGqFdaQiD07BwbdnckKvsjAW5zncKX3n6N2vjPGhUwkUe6aj0G-FktNoiijEUQzvgNsmwyIPGOW4KbaO0-qPtQ75Gu_7JOzLxNha2WqX4V2-rL-YL3wJUD4TiWUPjUHaCBmEBiI9lqgE0_iHQuiRRkeeaXsmV1ymqslt4od150Rw
Protocol: HTTP/1.1
Server: 69.192.160.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-160-245.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:49 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 20 Apr 2022 21:19:49 GMT

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEI6HivpohbL-9M1jL3fiwJU&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame E25B
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://dsum-sec.casalemedia.com/rrum?cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D&cm_dsp_id=85&ixi=0&C=1
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YmB49UKycvfJ7qLWk3e5DQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEXHA18JL0ABy9JBgbYVBxI&google_cver=1

43 B
894 B

32ms
32ms

Image
image/gif

69.192.160.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEXHA18JL0ABy9JBgbYVBxI&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJD8NRDO0zYYgcPQxwEwAQ&v=APEucNU4-yI2odYzw8ALMVPAlDhp9Rkc1EJ90_qI1MfCVykelF3ZL-nGqFdaQiD07BwbdnckKvsjAW5zncKX3n6N2vjPGhUwkUe6aj0G-FktNoiijEUQzvgNsmwyIPGOW4KbaO0-qPtQ75Gu_7JOzLxNha2WqX4V2-rL-YL3wJUD4TiWUPjUHaCBmEBiI9lqgE0_iHQuiRRkeeaXsmV1ymqslt4od150Rw
Protocol: HTTP/1.1
Server: 69.192.160.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-160-245.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:49 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 20 Apr 2022 21:19:49 GMT

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEEXHA18JL0ABy9JBgbYVBxI&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame E25B
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEI8SIxyKh_0QHZTg7jvkwE8&google_cver=1

43 B
1014 B

20ms
20ms

Image
image/gif

185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEI8SIxyKh_0QHZTg7jvkwE8&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CJD8NRDO0zYYgcPQxwEwAQ&v=APEucNU4-yI2odYzw8ALMVPAlDhp9Rkc1EJ90_qI1MfCVykelF3ZL-nGqFdaQiD07BwbdnckKvsjAW5zncKX3n6N2vjPGhUwkUe6aj0G-FktNoiijEUQzvgNsmwyIPGOW4KbaO0-qPtQ75Gu_7JOzLxNha2WqX4V2-rL-YL3wJUD4TiWUPjUHaCBmEBiI9lqgE0_iHQuiRRkeeaXsmV1ymqslt4od150Rw

Protocol

HTTP/1.1

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:49 GMT
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 9a6e02ed-71da-4ec4-94bc-e3bca43fa7c5
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEI8SIxyKh_0QHZTg7jvkwE8&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
cm.g.doubleclick.net/ Frame E25B
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODA5MjkzNDc3MjEzODg2NDM3Mg%3D%3D

170 B
243 B

54ms
17ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODA5MjkzNDc3MjEzODg2NDM3Mg%3D%3D

Requested by

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:49 GMT
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 161e9207-e2fa-4554-86e8-5e4f27206112
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODA5MjkzNDc3MjEzODg2NDM3Mg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220413/r20110914/ Frame 80F1 25 KB
10 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220413/r20110914/abg_lite.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-AAnsEbNmmR3-xncoQPslwF6vlYW1MK-t_mlcQqcSeNhn7QYJrm3OsxfboP7ojFxxMrvidnCJbBXkNQz8mOSsMi-_bO-kDPxtMO3iGMcwvfVGKYg-QwV1tRS7mA35IPb3fAgzQ4kY452ok7iNWFQkM7au3xzA&cry=1&dbm_d=AKAmf-BIq-vswGoeUQeuJ8NQ2Qhup1pt8jiBaDVu-w3WyuH7K3eNT36ohUJESNJXmuY-4QfeEl3_xIPQusXzA284zPieZq1Ms5kQVd9pSFDfWOMIKyLOpYSsInIoaadUtQIu0qTzFU7ejdO0L_3AUKc0kcCddNTfKi9waYJp8VVqHSPuAShSMvkiZ8ew_8JPwiaGEutv12pbC4OLUVC7WcdBH0hlc7v6uSZKCASxK65txS8x5Is4o3G4z_bNq7XMh7148mZrErr-VaDxCdFY1JYID5le7eluY9Y7p1gUJOCVIIqvRdazMNQKeIn3z2qyG5Ff_J-hIUMH6l_ug4FGoPG4oDga9keRZu-u7SK-K4itqte-Se_ZGu7YAQZvg6B8Si3cnbee9N30591UGAAVHS0GX9Weqbs6lPyCmACY8khFrTrZESU30BbXPKK72v3m58XwcQMlZ0jHe196KBkjwHpfxeRVzEtoROMYu2yShxgWizvNfzCD6FMPn5Vbj2TmJJOWZzejOHk9xkdk87naodkWdcSEqZGtyTpAr0KluoL7UJbqoj3LQED6xQ60htOQYtEFzdAJhGcKxt0liEftQxpsYrYIIakHJX2MK5rUTQI_ZWTj-vWP_29U_8wOXGTuFd6lxakJepfpVZobruybtNQTC9R8aBR95ghcQ_tprygeq7Oxow8me9FDepcMJTgbwZChf2IDmfXbct6wNbqv48OcHX5V1WtdgWMqSLX8nXusSsIrxLWXxRweQABIIr5c_9nTjmtPPkr1QLJw9PonRp38nV2BcdykKetVqpf3-GBDEXwbDxGA5OSowwHH6HwzL6eZtEZ1OK2QGDAbOXxKLPyukCLTLP6PivGEJVJbIPWPZHPwvQOYz8QW_EPyOUZwf93EteA6cFdbYOISdlvl8QVdk3p_j19QgBzkxk92BIwRQ9FO4jpnjS0ZTlHXjKZdgga9QhzwunT2urUAAuTp9RAynV2O6wqET8oB2aAQfWY1M_G0tIvmYcqfmpfAEVcmaOcZZDYTdDru31UWDNAkMsPqWS4o4jBgrIE3A-KiVdGqc6AqFV4A-lReHKB8mNLeNzJUfPFVKEmeGLhFwFPTvTSovWxhmaYN9YlVoO0v81YM7h6K3FrLncOIoXE4c6gaAZ6ECufFYH10yk0CtwG6Fjby7KqGvGtv_2Z8Hnvtya9hSHchS0n9dbJiLkYqheNqZukIkYNT6MPJXZsKExaSb6Cz4ULYGB4OxW5PtoofJ3PvO4TxlKMLG4t1uVMg0teNUoZmPnAuu-0yjcyz7vrcaTjwHiY1v9nDD1E1p4BDzBEk1CdBsBTtwk-KhXSPFB09KGsXAosKkl3eoKPs2QXG9IN4SyT8TDE3e_HWAcHoIfCIaifH7To_vvUvLk_I9t6ilLJokIkrZMDjusN5JtWTFIAU-cu9et47pi7GMFm29_UI4EUKeMt7ZsHd03NS8XrqoqoQazj_PN7A4mutPjxCqAVx4hPGBM8Wk3eu6KEqeSLVDk_ZcmJEi3dNalvLVpwTYSHghtC3uuo0-ziCmNKy91uF8WgyHdxVXVP0EHsabjUgfiQRg29Jao6Zh-7HJsIhfotzfsXcoJHXvaKw0VAG6adrLwFE3cJiUbqrQjQ35zF7khZuxvVSn0JfC6cJMTdD7eHl3UbYvAQciMxTtuwE27trAefSmBdVR9WbAkPjwzuQ6VsOvrIgSOQ-6tO33xtEebs1-r6C0BTsg1SvZG8bd4VtH2CZ0pKFWqUlc_5esV3bOovtDPTKgjH9ogZ3fuFEFAwyeeF0w2-WmykjVyQwec_RWDxhC6Cw18raLah1aRNCyeLqvp41KZmP7fSz425Y-W7q5gGAG0R6FYoTGM_xOUAtqvr1vY8Wqf0z-K2UPqY0NahAAicwgCxQ9IzjyyNcUGqXTpAMbeB39vfxoVICeCn88x3MrePfAIq0SI8v7gOMGuW_kTQllG8JwUx-fbnov_q5DedDLf2w8IzCp3fllHTq4Y8dGm6B8z-nsrtBJCnIOuVvvv2qx25WWq35sG06wwc2rTZz5yQviX1rNRpcChUrLQkBdxz0ce58waeyyv06BhTI_wX7YJtJuU_izah7MhfoUAovBX5EIsjlMEWqBzjiNhQFLPsSfPCl_of9f8YM7gtb1lPBnMsOVzc9ex8MUJLiEyIhr_qLZWWihb6TezYUoGE-p1IivDAL3kya_N7Fxeb-rUl6dDOu6i7a2kPEQgFt7hDHZ-hFftlRHuOvQSvvyO3CW17zbKyiRyWAnRkNTiD6Txaw2LfINP2WY5619FS4E7MuQNYYFfEYCcEXkqct7yQHeOHONjZ9rpHqCr0stoMuufmugWSumkZ8tMPex5Z_5AiKJvTuDZl2CEDiCr9vAm17WtzQBZ9vfcgATcqcyVAr9DpcstJ3L9aalvMXCaqz8kyD39ihfduXZ6F7s-1ZSciUWIrPjcniJfwpxDpagPtFPOrvfmg55MN5n9wEaGhXNNkhvOKM6y1zKxq7tWjY_-CfMb1b1nZyMNltI2XqOmtQlyOm0T4nggtK3qkxWSD4a7IfgrmYlx2XaPsWuHdOuwxBn5pwl3evOZN5UMQgBNh0jmGv-sniogDLRbCqXRusb6z1DnS1cKFbhvnDWB9qQgmYmtw5tiVNBC81dckVxTTFN7HvJLgdpK_Dt1E0ZYUAAbx3yRIlgJNAXVdsQwEITlc5mB2BB-H3B5Z1qNqAWJoYpjmXBx9biCp7jV1Ninv0rMarzvnExmKO3UVDEfyHBZ941bB-O65zt3mvQsKkStr4GHAhrBa6MAMtKQaCuh1g54GDVfJL9kVbbHUGFPouRTeMv6cjE9lyLU9DXgJAKpMOgPnyubZqh2RxvRbWCSYoypIfTmQqlq1XtiDBUkv6VLJ7H-Md4MpSsKJo0ofwhGnDO4P12N55R5v57ZcyTz6GPBlRDTvrMKd5NjuPdOsob_EdzLwo6aGcQMAi66xgj5FJhTSLpvG2kdRkd_gxHz5o-qlUDuPEE3cpq6lST8vMn15s2Gu03UMR7AFE7KPiuvunJW5zHyZiZ5BXaafuwfr5i_w3W7PrW1Nu8rGNwsVtk_m8o06_ZVcO7BG1U65JAZ-AfPE1aWvJjpD0zH8zukwW1DQRyIjaK2hie4AQuh8epouhGwG2i9ab55DEWt0oqXfkfwBIpLjWwedgFkcBKdWDgK-NXySNsDShIqEvJ3NJjuUlzXPVUmUHAJ2OWVVlBh7cqj3mNezuxZgziIL2aya1wIoJolsYB4m95Lx7ruw7d-PhyiELEm8NYjPT1uwHYBbYIujKuymxVpY6FloBHV0uwwIsaj4Og1l8hnuaBPGTSHMWtmcLO-ga1oUrgfBjIcXILUofJXUqxYR42sAorSiMyRlvgxePu5GNTQJcpW_zXo1PoxPWorFfIAyWq87KcET39zPcuQ9t_Y_dYR1q_W8gVJKrmaPtp5xOaG4qK_L6XY1i3Ni6D2ui_cnx133Y5NeBadv2FPZWC1-hwv9sZTOYm7AMGIC38Oj1eoeouvDENdUBGNmyjQXyPlNiy2edo6oMod4h1mQZH1CLkn98m42X3EHjY1d7fm4gfcrk0Q0FsCP7nMAj2lbmE7jaRiFjtPoZ5UhsATqtC5SsnsJ1i-xXe7ywnuOL-u0aCYJPMAjETBudKL8Tw5cn-NzWOJz5yX91PyGuGxuXP07LZvBVRyTLSfilHz6QPYFZCgaK7jqU318iavRYDXh2g9p24Fjts48BPNUpHl-9PxwgXHxvtyJGNn4FQJYMT74uqUIeqZVf_hSt_I9MgPIKjbYa0HsnaKX1cbQ1bBjg_guzuCSPNtPK9kD-cBYw0xke9odQnjphZlYdfY1GnCzZkfDYyrVpt0gN9URcbUgxxV10wuXvaSdfXg2hmDVIzYjXDvNYyNMHJGDwuOmiwV8xhMePafTGbgjYb70QWgTbeMOFEKZf9XiN_whw_lQlnkXvr87vBuUZln9vRbaWrRpHDw4FWwq-OvD8ci0RjpO8WXLo54YkQQ1ehZ4yP4lIlwRRFPXZiDZXQwfO3cN6dO1IBmKCeEZfmvxUVJvjwGVme89Ims_ljTEWzTN5J7tVpwX86MIQfFGDvfNSHdSaFbcCQ7K5y_BKOGWYJqxg-dRLrOS3mqGT4b6_MV0n0Qt1GwG1Emw7SDFW4woGb8m9P05LYbuBL-andf_h0GU44rkk8rh0VJOobZRQKQGU8XD-vx9oDjl3qrbRaFqWsHcJgcrCeenGzTXdSKYcSWZExKl3aNygD1QVqxj8e9PkluIY&cid=CAQSLQCNIrLMyTyxPyWSFKP3YG2IvXPrDni2ozokT8gfP4EqCPW9_FtfsTMP4d7ukw&rfl=1%2Chttps%253A%252F%252Fpt.lizspaperloft.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e66bfceb15a6ee125dff79826be02a07b766843e6c660edf55ec0c22d1a407c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:09:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 612
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9777
x-xss-protection: 0
server: cafe
etag: 12512753850102923420
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 May 2022 21:09:37 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 80F1 41 KB
15 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 08:56:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 44609
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Apr 2023 08:56:20 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 768F 22 KB
8 KB 8ms
7ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 44609
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 08:56:20 GMT
expires: Thu, 20 Apr 2023 08:56:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 LJGn0i2Pg8yG-wzimFR5htSsDE5oolsrGkll4HQxngw.js Show response
pagead2.googlesyndication.com/bg/ Frame 768F 35 KB
13 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/LJGn0i2Pg8yG-wzimFR5htSsDE5oolsrGkll4HQxngw.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c91a7d22d8f83cc86fb0ce298547986d4ac0c4e68a25b2b1a4965e074319e0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 14:40:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 110369
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13643
x-xss-protection: 0
last-modified: Mon, 11 Apr 2022 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Apr 2023 14:40:20 GMT

GET
H2 200 bootstrap.js Show response
s1.adform.net/stoat/626/s1.adform.net/ Frame 80F1 33 KB
16 KB 105ms
34ms Script
text/javascript 37.157.6.234
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Requested by: Host: a1.adform.net
URL: https://a1.adform.net/adfscript/?bn=54370173;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CYuU-9HhgYsCGLvKO7_UP5u2d2A2M1KXCaeHgprDwD5Ok_orXKRABIKqAwyJgldqigrAHoAGTpo--A8gBCakCCmX3rhg1sj6oAwGqBI8CT9BLydD9fG1_aUmHp4khhsVR2szxt-_IZ0jeKFi8sm2Fr-oSAACAr5oYvpU4uFgyQPshdMio3MqPD2-UJC0IOTSxcHzAtUqhS2uhmbBRKSLALdQt1i3ktpLOYtSUiXinbIKmoXHX6BbKRW6SfkX2c3-AjL5qZ2mw3VLVwBWoJctHa8UmoOo0TKVHqORjYwfprPMNAIdRTZg6Kooib48kXBMe-2xLpBoawaa1tGRmJS6ZkesgVCVEHFXFOLZcpybwyLNln62issZhXOXo8koAfJDsUSHDAXTc3HzJFUXa4Fz-uvBJ_OqDp8XJ41tVJWI29PPnwtfBJ6CeBFpZTYtdfn7VYXT0JmxQn3-omh0OncAE_d30tO0D4AQDkAYBoAZNgAfV2fBBqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggJCIjhgBAQARgd8ggbYWR4LXN1YnN5bi03OTQ0NzI2NzAwNjA0NzAxgAoDmAsByAsBgAwBsBPyxPEO2BMN2BQB0BUB-BYBgBcB&ae=1&num=1&cid=CAQSLQCNIrLMyTyxPyWSFKP3YG2IvXPrDni2ozokT8gfP4EqCPW9_FtfsTMP4d7ukw&sig=AOD64_1GD8XAVq-t3XgVg4nxvHhgbqRu3g&client=ca-pub-5512390705137507&dbm_c=AKAmf-DGJB980y18Yjx98pZH9cHEHCyGOJ2lnWzmh40uLydI2Zep0v4I48pXQGngeBSpXp2DeSEU01bBSx_7RuqikqSUJcN2G5MuJZCR5ZAitqAQXOT3uQW-PzWz5kqXM8dzEMjZdXQzg901FOB53ct84p1QSXCvbQ&cry=1&dbm_d=AKAmf-BuT1eLFpuK-M_vF_zQ3zN8H9qH_CI8Q0zpsHCXymmdxw0vvuVixkd8bckDE0ZdI0dDmF2zR2xjTQR4CI_Y0t5JKMeKUvXboWq0g-ucMF2Z2f_3KQ_4xOrt_GV1hUt68-e4GtOAjqE5SlzizcycrzeFJMtHz1tx9xoITmG5WFnjdmvJOsDDeb_I_r6SdYXERMoRkNrOWPCFSMFkS-3CdxeIkd0CtGnRrmQUjIT9zGxV73vQqcAwlfYL8DbwtowVN4FQWFTR2Txg1quzaNUY148DCohY_APJPVEwnRbe_dFvKHnlBu3CmLX1NzqTUf7og4nTT2xmV2cnVAq0U3QFY30-UO5oShaMrMX12lvIEho14HyEklsnLVvkKVAzkiarU3kB6wThpD7gH9x1m4sJDwmVJru88FeLsPCDDzWRO_nXAE3aa9KkD11txM_gO9CaDy-GA6bv0zWQAwQng7js7xxsToCFLQ&adurl=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.234 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: 3d0bf782b47dcd079eedf6bb34ecb0742c114a4e4b90e37a58a412482101b475

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: gzip
last-modified: Thu, 10 Feb 2022 15:16:56 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Fri, 22 Apr 2022 00:10:18 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 768F 0
20 B 44ms
43ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BL5WH9XhgYp7LCoqOjuwPruCh-AkAAAAAOAHgBAI&bg=!Dg2lDUnNAAZvJBiFTyQ7ACkAdvg8WjaIVjlPGupZR0pQPsYrYEbbfVHNUdl8LnsWLlZxBgcxYBfNYwIAAABGUgAAAAJoAQeZAuWPzXov-9AHAuJdNVBBMUbnPlCK6XF7mQQ7HTDze1dqE9MzV9SqkdXASi-lqnOCAhwIypy6gIAbjhhsxHgBZxNakFlucHj3syr92jwAP8jJq5Ek35rqI7AaIk7lLGAGZTAKEl9AoiVLA8RLTBMyM8H4N78n-UqFia2QZpwDLTn-jwZ2jT2wrcfS6qQV3XPluaIUubcwUA5A2qXDMWzqvf3wevLf9UR-gQPp3OkdIzILT5hwwJv2Z6E2lNDGY1LxpohGDqcTC5GUz_7Y_YI4tKj0jrpBoMsx6T59PvWYFAOhin4pp3R1PAo0_-RxC7xK9befBqYNcVHy1jIgEVdqLYkZCJP8A8iWChKutbevQ6ev8mnMvQUNa4_4GLsxeipf2oV6i2nyqJxkDYl2vlcXaZ1LKC5JVVp0Lu62THJG2CIfW1K-0J_-TxzEJmXoyr8ZL7D5FjqIEpsKDaxuyfJkbi2WviaEFC2Mn_R-XYhPTN8ZTruM3nDsRh0lsR0ZoMWVcynUAiiOQPz8zZUyZQ8xZQmgSX5pUMSsEPCPCbgyz29qDoBiSMfR2FZKhUQTDzzSXj7n__VW8hzzPNF6eR0MFgBb-vWMs3OrTK6NC8UDO3YgXeSxMEX1Q1nIwdbTlvq83s4g1ajnBgkh-9cU4y09ym_1iO2QxIAtbZdPM_oLnx5pZyj8WBOqd5P0PM-tqtWl-ywKziPRK2fniQx5N7UMCv4rP3Sq2I_NSDnXa9OTJrZsaGeO7IJCmFRKZe7CB5J4_vG2CxZXjsmao_LvjhpFngonrrdNVHAl22DcyaivSUgQjcDqSLxQPZPZ-M2jIw5o44WY7VVU0CPYmbAfGbMRPrXCHdMO0vnxLt7KV1SZGa1j_4vj9K1VDPpQjVjMkMbSH4sT7o308Ni6hLPSpREIcCHzIVx1_X-PXJkTAJL2ID23tEH6PwkpUzSH43pu_uZzwNCdfWMFGXPNU5qZU9TPVF1UJ_q4GTA

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
a1.adform.net/adfserve/ Frame 80F1 8 KB
4 KB 21ms
21ms Script
text/javascript 37.157.4.24
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://a1.adform.net/adfserve/?CC=1&bn=54370173;click=https://googleads.g.doubleclick.net/dbm/clk?sa=L&ai=CYuU-9HhgYsCGLvKO7_UP5u2d2A2M1KXCaeHgprDwD5Ok_orXKRABIKqAwyJgldqigrAHoAGTpo--A8gBCakCCmX3rhg1sj6oAwGqBI8CT9BLydD9fG1_aUmHp4khhsVR2szxt-_IZ0jeKFi8sm2Fr-oSAACAr5oYvpU4uFgyQPshdMio3MqPD2-UJC0IOTSxcHzAtUqhS2uhmbBRKSLALdQt1i3ktpLOYtSUiXinbIKmoXHX6BbKRW6SfkX2c3-AjL5qZ2mw3VLVwBWoJctHa8UmoOo0TKVHqORjYwfprPMNAIdRTZg6Kooib48kXBMe-2xLpBoawaa1tGRmJS6ZkesgVCVEHFXFOLZcpybwyLNln62issZhXOXo8koAfJDsUSHDAXTc3HzJFUXa4Fz-uvBJ_OqDp8XJ41tVJWI29PPnwtfBJ6CeBFpZTYtdfn7VYXT0JmxQn3-omh0OncAE_d30tO0D4AQDkAYBoAZNgAfV2fBBqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggJCIjhgBAQARgd8ggbYWR4LXN1YnN5bi03OTQ0NzI2NzAwNjA0NzAxgAoDmAsByAsBgAwBsBPyxPEO2BMN2BQB0BUB-BYBgBcB&ae=1&num=1&cid=CAQSLQCNIrLMyTyxPyWSFKP3YG2IvXPrDni2ozokT8gfP4EqCPW9_FtfsTMP4d7ukw&sig=AOD64_1GD8XAVq-t3XgVg4nxvHhgbqRu3g&client=ca-pub-5512390705137507&dbm_c=AKAmf-DGJB980y18Yjx98pZH9cHEHCyGOJ2lnWzmh40uLydI2Zep0v4I48pXQGngeBSpXp2DeSEU01bBSx_7RuqikqSUJcN2G5MuJZCR5ZAitqAQXOT3uQW-PzWz5kqXM8dzEMjZdXQzg901FOB53ct84p1QSXCvbQ&cry=1&dbm_d=AKAmf-BuT1eLFpuK-M_vF_zQ3zN8H9qH_CI8Q0zpsHCXymmdxw0vvuVixkd8bckDE0ZdI0dDmF2zR2xjTQR4CI_Y0t5JKMeKUvXboWq0g-ucMF2Z2f_3KQ_4xOrt_GV1hUt68-e4GtOAjqE5SlzizcycrzeFJMtHz1tx9xoITmG5WFnjdmvJOsDDeb_I_r6SdYXERMoRkNrOWPCFSMFkS-3CdxeIkd0CtGnRrmQUjIT9zGxV73vQqcAwlfYL8DbwtowVN4FQWFTR2Txg1quzaNUY148DCohY_APJPVEwnRbe_dFvKHnlBu3CmLX1NzqTUf7og4nTT2xmV2cnVAq0U3QFY30-UO5oShaMrMX12lvIEho14HyEklsnLVvkKVAzkiarU3kB6wThpD7gH9x1m4sJDwmVJru88FeLsPCDDzWRO_nXAE3aa9KkD11txM_gO9CaDy-GA6bv0zWQAwQng7js7xxsToCFLQ&adurl=;js=1;adfxid=1x;7167;set=en-US|en-US|1600X1200|0|750|100|24|8|3|7|1|;cmpgdpr=;cmpgdprconsent=;fd=0|0&CREFURL=https%3A%2F%2Fpt.lizspaperloft.com

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.24 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

1c8bf8cbe4f6429279e56e59929ef2315bb5c29f89e333e98d26d64c8c4afaba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/javascript; charset=utf-8
content-length: 3868
expires: -1

GET
H/1.1 200
OK 1x1.b
mm.melia.com/dynview/melia-com/ Frame 80F1 111 B
1 KB 133ms
28ms Image
image/png 109.232.197.33
EULERIAN-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mm.melia.com/dynview/melia-com/1x1.b?ead-publisher=mhi_dbm&ead-name=3_EMEA_PT_C_DE_p-mhi_dbm&ead-location=display_Prospecting_DE-728x90_de&ead-creative=DE-mhi_dbm-c_presummer_tenerife_videoinbanner-728x90_de&ead-creativetype=728x90_de&eseg-name=campaign&eseg-item=presummer&ead-mediaplan=DE-Prospecting&ea-rnd=12523&adfrmid=6718199658697509927

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

109.232.197.33 , France, ASN50234 (EULERIAN-AS, FR),

Reverse DNS

ml.eulerian.net

Software

EWS /

Resource Hash

0609b70c35eab974a2c2d99d6da5d84d95b97f9fe3d28828710d04835153cb20

Security Headers

Name	Value
Strict-Transport-Security	max-age=604800
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Date: Wed, 20 Apr 2022 21:19:49 GMT
X-Content-Type-Options: nosniff
Server: EWS
Strict-Transport-Security: max-age=604800
Content-Type: image/png
Cache-Control: max-age=0, private
Connection: Close
Accept-Ranges: none
X-Robots-Tag: noindex
Content-Length: 111
X-XSS-Protection: 0

GET
DATA 200
OK truncated
/ Frame 80F1 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fe7e7519d81d0e00a237672a4cd5c8728f608363b36a8fe785c64ef9d71399e8

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 container.html Show response
d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame C02A 6 KB
3 KB 8ms
7ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pt.lizspaperloft.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 21:19:48 GMT
expires: Thu, 20 Apr 2023 21:19:48 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 204 sodar
pagead2.googlesyndication.com/pagead/ 0
0 58ms
58ms Image
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022041401&jk=32471245794900&bg=!1Nel15PNAAZvJBiFTyQ7ACkAdvg8WkdKgm3QmcYBM8hIzqtPtNocDvJGuj5jJw_A9Dqw3aTN8lF2yAIAAABdUgAAAAFoAQcKAOJczXZveyzowYBYDXNyGDD-F5pIJ7cNL96eFCnkF-6t0vcGQFwrhxxjw22jmtieU1-LEr_gOPvzhv2IYHXyV7K2ZJEBAf5WGJUH7fJf3-U3ORg1Em0urJGebqW9p3iroFbp5dJ8D446OQ9n7lfsfFwIsLAKjRKfJFyPANX2Sym6cSBiFKWMZxzKAL0OUiB72MPqMWYjtgzjf4CfT2gZmUI98awvMTubX-Gmz-4jxH2BA21bcVjYD8NuBybwpUbji9SHxq1-bM94I00PmnrY-O_wfTAIWlERaJQjH4qXZcY1nJG7mQKcdH91iQfuj06rhiDHoTz0Qr5u2c8h3HGAIzijnUS60ffIpaCcEjnPMEVFfbBEi4fWQBiDpxxSuplNCM062NGUK2UBtWiQCzC-dXLdfuwvAiXbepvlv_RwP_Xh37FwuPml131JSvzddcvFa-pRv_1CN2fMysB61FLOB0kjIyq3BI-e3WlIAmPaoUhtOidnROrj-a-S4ZXqaStNSk4FJYxEmcqbn-Hp3xvtq85ZTQmeKtc9sbxxnVxKVrq5DxOTtMWbc6HOxTWFZ1R5ceQC7vXg8BSjUD5biyF999eCTuVdCgBS1mFYc5ZaLsi_gB1xfFaIxRv7iekTDrS2BSQXESvSxOPa1Fd0VLbDJlfKrUnZTJTWCI_VHGkNsKmxiNo3lVu8BNoSCTGi-UoV8Dyj9Ar4rIouCYaV488RIs-lHuvkmUOvr8L7214rN8toLbYMzxr_DfHmAx7pJgkqz2Ii5ay_O219ztvBpKChXEgbomRqgyiPrY0rnx4AKTQ8MJdSxAVCGirjN1aYc_UQv3e6wB7i1z5fkYLVU4sAuXosQGfAK0BdgdlQhLvonMClHbWt5B_VYrOlKzzAYP3SgQO15ocV6hKt6HnUs8PFpLOgdFI-8H1Kko8EScRfEwnpLMiiDHcoM4uc9JybTd6MKk0vU6Mqr8pAT1ts_IFdCfc4crnJDqAq3pJDkcJdmdHSevi2U7R_yTF3CAk_pzdamWIUqdZTARE4obWvLtnH6sb7KNwlblhjafsqeDZXVrIqyMSQmYBsDBiP486FAiqosc36fit2LH4ekJjEJhQ_ye8nHKU5B69-DjdF_oFFIrAbQsozIRlY8sMyIQBSf8fBQIl44jN7dUtQ8unl5ywa9GlPYDSeO5frIVrA-lz6ZkJl2eI
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
H3 200 abg_lite_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220413/r20110914/ Frame C02A 19 KB
8 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220413/r20110914/abg_lite_fy2019.js

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a7d5c1bfe43c8beefab2fa059f4fcaa029fcbbace9a672aae1dfe1ffb7d6976c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:18:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 76
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8002
x-xss-protection: 0
server: cafe
etag: 5332015062585099865
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 May 2022 21:18:33 GMT

GET
H3 200 css
fonts.googleapis.com/ Frame C02A 8 KB
714 B 33ms
18ms Stylesheet
text/css 2a00:1450:4001:810::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:810::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

32bc7c1c64fd1b755d48d6025b86b7e7a28ad35d1f420cf85cdc1123aa7dfcd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
last-modified: Wed, 20 Apr 2022 19:30:46 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
date: Wed, 20 Apr 2022 21:19:49 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 20 Apr 2022 21:19:49 GMT

GET
H2 200 outstream.min.css
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220413_RC00/ Frame C02A 14 KB
3 KB 31ms
8ms Stylesheet
text/css 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220413_RC00/outstream.min.css

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

48ca4c570f2d58d8ff837e1c8f7d73e418a485ae23b2c9322f2f351d71d93aa7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 13:04:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29713
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2798
x-xss-protection: 0
last-modified: Wed, 13 Apr 2022 10:38:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Apr 2023 13:04:36 GMT

GET
H2 200 outstream.min.js Show response
imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220413_RC00/ Frame C02A 347 KB
120 KB 32ms
9ms Script
text/javascript 2a00:1450:4001:830::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220413_RC00/outstream.min.js

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0900693ba4018c6de9126b543a8a3c50080eb74d1ed0696e5cc8fca0c0c99513

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 13:04:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 29713
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 122258
x-xss-protection: 0
last-modified: Wed, 13 Apr 2022 10:38:38 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-doubleclick-instream-static"
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-instream-static","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-instream-static"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Apr 2023 13:04:36 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/ Frame C02A 15 KB
6 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:15:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 231
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6409
x-xss-protection: 0
server: cafe
etag: 15284592792851369840
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 May 2022 21:15:58 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame C02A 0
0 16ms
16ms Image
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaQBqYdqw3pcm1og8hIl-oTzr4MQHdOdvtfVgUqOJyTxc1_SpBCY6I1A5lRUs6CVyw81ONG6taddCwVuWwpr1aR57GIQ-g
Requested by: Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
H2 200 Standard Show response
s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/ Frame 80F1 90 KB
39 KB 26ms
26ms Script
text/javascript 37.157.6.234
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/stoat/626/s1.adform.net/load/v/0.0.219/e/igSBggDQ/i/vCAv.IAAAAAoAA/r:AdConstructor:contents/HTML:types/Standard
Requested by: Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.6.234 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: f7e06ae449bdd4ebece6e26cdb36840f7cb19f28b57bbb6b8647a54535557d3f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: gzip
last-modified: Thu, 10 Feb 2022 15:16:56 GMT
server: nginx
x-cache-status: HIT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=100000
expires: Fri, 22 Apr 2022 00:11:04 GMT

POST
H2 204 csi
csi.gstatic.com/ Frame C02A 0
327 B 50ms
27ms Ping
image/gif 2001:4860:4802:32::3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=1~l282vxti&c=8289927038026&slotId=4144963519013&qqid=CK2Kpe3Io_cCFVOK_Qcd6aAK8A&fb=outstream-lima&sei=44729911%2C44730425%2C44730426%2C420706098&nsei=44714510%2C72811302%2C75259405%2C75259407%2C75259408%2C318491509%2C447279544&bi=outstream
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220413_RC00/outstream.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v29/ Frame C02A 15 KB
15 KB 25ms
9ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0eaeadb58e6995ba85eccb6198aaef77eeb1d4b66699e4e1f3fc10eb6adfcdb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 17:56:19 GMT
x-content-type-options: nosniff
age: 12210
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15828
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:28 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Thu, 20 Apr 2023 17:56:19 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v29/ Frame C02A 15 KB
15 KB 20ms
7ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v29/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:700,500,400,300

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cc46322d5c4d41da447f26f7fa714827f2ec9a112968c12ef5736c7494985eca

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Fri, 15 Apr 2022 01:46:21 GMT
x-content-type-options: nosniff
age: 502408
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15688
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 16:13:19 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 15 Apr 2023 01:46:21 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C02A 0
20 B 40ms
40ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=osv-info&clickstring=COpcu9XhgYu27A9OU9u8P6cGqgA_n_cq7acihhLSVEM_mor3AARABIKqAwyJgldqigrAHoAGX_pvwAsgBBakCCmX3rhg1sj6oAwHIA5sEqgTDAk_QUYNs6IigaOHekCPRrMUdfshPE0DlYB7OYed8GmkmwNpq4qR0m8uzpCpLD3eez6qp8Jrd-g7eQ-yLEMrkksQ6dsRunJc-mtvph6s2IAjMxXuoW3Bl4dsn3N5sy5HgkrdY2srb-6FJkV0MpOrzOHSgt_rtMMm7dm97QvabtKE7o-Bzm81wsnD5moA7g-TU11CupusYUn5EzGV5VJk_AwCpOCG6R2berJPg6ds4COUvW2k6FIWEmMZbZtBWn66sC5XHtG9QuygbjPSI6APLw3STnFnWQrMe12wyv1varjT3uPlL4iR5sgFO4Tx0A-_ZJ8YOPHWVeMHfbfol0qOWB-saI-S8ib_V4qYpN7tGVLVz_53JCtV-m6S50P0JlB88NxrvBuMdjgR-Zr_YZQlcu7Kb7ERHN68LHaU6A8AwhpWmsJUlwATf_rLW8gPgBAOQBgGgBnaAB9GB5I8BqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIjhgBAQARgd8ggbYWR4LXN1YnN5bi03OTQ0NzI2NzAwNjA0NzAxgAoDyAsB4AsBgAwBsBPno-gOyBP1-OLfA9gTCogUAtgUAdAVAfgWAYAXAQ&eventType=clickstring&clientTime=1650489589503&ai=COpcu9XhgYu27A9OU9u8P6cGqgA_n_cq7acihhLSVEM_mor3AARABIKqAwyJgldqigrAHoAGX_pvwAsgBBakCCmX3rhg1sj6oAwHIA5sEqgTDAk_QUYNs6IigaOHekCPRrMUdfshPE0DlYB7OYed8GmkmwNpq4qR0m8uzpCpLD3eez6qp8Jrd-g7eQ-yLEMrkksQ6dsRunJc-mtvph6s2IAjMxXuoW3Bl4dsn3N5sy5HgkrdY2srb-6FJkV0MpOrzOHSgt_rtMMm7dm97QvabtKE7o-Bzm81wsnD5moA7g-TU11CupusYUn5EzGV5VJk_AwCpOCG6R2berJPg6ds4COUvW2k6FIWEmMZbZtBWn66sC5XHtG9QuygbjPSI6APLw3STnFnWQrMe12wyv1varjT3uPlL4iR5sgFO4Tx0A-_ZJ8YOPHWVeMHfbfol0qOWB-saI-S8ib_V4qYpN7tGVLVz_53JCtV-m6S50P0JlB88NxrvBuMdjgR-Zr_YZQlcu7Kb7ERHN68LHaU6A8AwhpWmsJUlwATf_rLW8gPgBAOQBgGgBnaAB9GB5I8BqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIjhgBAQARgd8ggbYWR4LXN1YnN5bi03OTQ0NzI2NzAwNjA0NzAxgAoDyAsB4AsBgAwBsBPno-gOyBP1-OLfA9gTCogUAtgUAdAVAfgWAYAXAQ

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 vast Show response
bid.g.doubleclick.net/dbm/ Frame C02A 29 KB
16 KB 108ms
53ms XHR
text/xml 74.125.71.156
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://bid.g.doubleclick.net/dbm/vast?dbm_c=AKAmf-Doy2MSGQU9CPOs4LYOvjkCKFI8aTeIV6qmvgL7OGOELWU4UuR4ADp7Ncr-eITfc9OPopDG_KZ0_sLBrnIAbHlWuAJj1w&cry=1&dbm_d=AKAmf-CagUVOFQo1X2bqvjCAAqeKmi0WUIct7z6pSAIth8Rh-t3fVsRyQZBvVyG2q3DZd8_1-W_T06y8JJ4-Q9pIJkufcp8uyVwO1O-_63IL4tD4mEssYRfdM5tN-H9i9rZEKRqq2sQnXOK0M_r5Lop8g3fEpRqkgRLhKgF8xVSgxMXNIS1nHDdIu440RvMqvQalRw35FAS1SkR4-tUPEDQybrrpM7-WoJoi-E4_drLdHHR7uXmR5wuGVY_zNQcCgQlkiIGyOn3w_x0BLxfgZsqGtJOuopdPzOFZo-9Jx1nZjTRIAkmqFXeWHgWmnXu28Iz3Pnm5CL8FE604cl9bNDeGwLbEjHsb80fP6vgBgqRbNrpu31s3ggu4mgwJ99yVqJ4Ijhv231p3dONFs8RULcEzPVUMu25M1XC88bZBSTZkOj0Po21AzhAKPYZ2Dp-WLudOTv7eFon1QtBHNr1eWh-jPREtGQo5iOjXp0GADikptR6_C8LIwwtheV2Aw1xeSZL4TKmwrQcWfpOiEGh2ubVpyyvXD0amtUMe3IZyrCOcbikuSHefdeS-r5YH91Vx-isD849qlZuAzP5m8TFFQDX7CEd6jkXysweq5_51WDgjUHWCJSiMv5eCWgoPB8MYeo2gQkm7RR8ILBlxRsnR72hjcmK3jwXBsQ_mHHMZVOwXY92ds5dz2dH49wupkLnzHLWG0CVdX6DY5HF-v5ao1EXFrV87mo4Hp8lLlE1HoAaT72YrCJnWF0z8PJRmBm_qVXd_lCqFSsej1SjiEpdUzIRVljn_jWMka9CPfWGBuWtywqLgM2RjF1uLHMMC25Gr79l0dVn94mdIkKiTLqPrdpiqIN0my-QSlta-8Xq-n5nFR20645pzWNoOJ6nAJaHrisziEimkquUb4F8XlQ8L7MjiaCTW1igiJtmDFkbDqM0hZTiYB8yfYch08I3OmYJLyFmWAxIka51rRGYUAr4km07aCtEY0JN7_8K4798LDm_xSeGVN8mIL0b0aE39SX_nCaM60YUd6yMWtJ7kd6msvMaho5Qcn9iwxa6gxAmQFybOIrXcnO5JxnzCso_xZ0YOtO2YktgsXQ6UwcX2B6Wkf7xbZQAFd1P3qZlAT68sF25fFQrbaO00QWDVPSNNdZgy5jdNUeRTdWYY-chqPbnxlS4t4s3Z4wUJrSYnca4no3p0st6WKy4Nwxs6aWLs_822Bd3qYtiJQx0i8-x0aMTbFLSNXprZGksdZJTky48KUF3ik_HxcMhrH3q1gr1-1ASYS9fFqw7LoWzRaacxXluBl-aM9KdtL343xQjfzcRUD2UCfb__69x-6zJ4mH485jhWZWI2C_cpboxGcZy9wMdpW8D4UaFJWTSsuWGZ1pv27PDHxHyGjMu-VTN1godwBtY2QCOSfW0XFM03R0Ut1Ri3uTXgJoNbPIprir4EQSyIJ409hUdHmJD_SAuDZBkMI_ClxnAOWCNp18KUykTJS51xB5Q-Ef0ZUmIEA1DVbcKEN8OcPN70dUMHQbF4ZBp_9oIJXYZxhd9U_kv3dNHQVauSNf1-BudVL2AjpfX49d6P3jnYRmNtW-zKZOLXBUfnbDbxAscLf672o-MUFd6yuRqvmNAOzLMKp0trt79IB7zA-bQc2_V0bMkespq064LfpQRypAdH1nHLKTpHiXvifqdPOGIK_ZFoNXUZ3MW70s110vvf9XTUBqwEZJ2Vy23Uf1vFTfggz49fQcQEYafMU6b9KtDa2A3BVT9f8sSsNObAsgB2r07eteqDZfoccQhnBe8g_ouoe2ohZfIv5GSgjE1EyWEfv8MGSWcX2iT0WsVHdyLx6OtHvz5RFoGFXTxAkzcqojehmC_xRwu3vMYuaEfTQV7Dq5KFDYIF14SaMGHncIJ7My-RUHD2-dEjhWvIDNZnZNsfrPzSjfrknr0LEHH-63aig9wI_b76VPBfCsODVliG66GyNOKdoLBg1pISR6GGN6T9wJry5VT2R_HzlzXvlzqCcbS3v5UIAiJQnDeW_XM3yAr3pFmosW0MKgxiQ8vC4irIyieLRkl0I_nedQ_QIIRRBAYji38uSu0b1774s8WnRNAhsop52_cuNhlvhi_OJi_zqw1o4lVBa-u-vlD9e7b3LfTG3bvq1a2qj_P6RoHrcmRl3n7WdK6qY5jfjFSHSH5T-MmkSesNLZedpQbBBw6ffzLdpW15k9C1yaLT5n94tR7F7Wgis9fFm9orLhBViwDqkAQzJQoj-JNwTWxLvnCWqOk6iQHgpun8XeOpmaC3Yd9yNQa9bciusvFuL-UGE6dpHu0KTd0JaYEmHtejsvurO5hGvijAXnvKfOIfqnvVYdG6luGUjyF0vuSWOhIdtsiuRLBKXdiGmTc_yAa8puJjYzOExFLC1l57lm6NGmHyaAVv9c4eMQQuv-xKVbg3f_B-1W6stwCV-PuAVWCk1g2FAZrFAAKABOrf7YyO0YaGhu7DkcsKo3x_WEO2wkuEdP6a6hI4-iZbFm6bJPfr4S-YiUYfc7SMI-CkrXAwpFKcBZGnFB2HVADIDIkZu-A2rWjoCzVHjbWKNBb0sXPwJh_dP1Blwk4CmyozbrLxayHrkbzwBBmXqK-cHkELxDSoPtrF2cpm-pfkjt2g8t8DF4nOhLbnV-xda5Fd63EuVumUL3Gmx8gL-q3sU3kTRcjpW9OTkQAZJkl4DOvGS3OFejpNdQIa8lNVVcwSwmz-oiHOkfO1Ba78uk2fJwD8ht2Q0tmQOwUCHys2xv0-SC6Lq8hAnr0DyLh2JLKbEX_vbZjWftioQzttQ7ZTt1lQmPMDmPT-4nuqVdvO8xL3qNL6BoEqhHgskw5oITIuJHmR6FWYEugnNM8-VQ8pqhCVM1KUzXYHwUoNFQ_ZE7P861mM7iHuqpgxrHnR5UIXPQGMDgbMZpf63ekHiZ0DR1wPQ-LAAH4BEDBunjvylJOUS13Edieu8Eq4IW-4Twdeum7wl_wLDYrH2J0CqbhiBucjRO6Q3XECQoAg3tTv1ADnuvcRfvnjFvs4nv3AGq7iiTkgEJzIfCQc-6FViTHMWz0JUOWHg0i5Ij0P4VxWeymozQgl6lu2wQk0CoWuJL2DHYCtSKgRn8nMktfm9w1obuB9y7SAMZ49e3mDKVNZE7wtR2kK6pfSzM1RvMvU6YExTQDOcXzlyb-UTBm090RH6hJxjqVeVpfFXEALD0kJ0PUty7jTTlYVtHGQhgLEJnLamoBnSZGLufAZkZudDvDZ8jcY0CAxw9_pxP1bX0Mxuwqgnj2w8peyA44jTXJKeEumVWP80R9N6tGdehd9lq0MF9b-22LZJCtK-td5d1OaIhSIhbFeLkdEF4w2OXz4ZaWT419sPl7ewdUo8jwDGeLSvoERzukq0i11CSOyqsZ9xFtrtSXWEqPFyOYcdgQ-VSjsW6IPbxSOQ5QrJNRVNYHOZpuyup7b9-z8Ds0QWk3XpltR-Zvytdaxip7hVveTbLGhMgx3tgNkY6_pjzRBjHHYfgOv36iLsBejAr6Uku3qEBQKNMkCbTAKf0Ic_DVLmHZe5LCx6FZM4RTBODKbQcPt_-Qu8XqXNeF0AEVSPJing4xQ5hE1kaSsK6oNIkeTeE9fiUUAmlRhCKaCnfseVwUe67ieVTvD3gOeHcLUEMhnhyIBe3ZhFEkTMhGIECXBAVRzVfwVAGuWdcTBFg6tvTEDzhLSOm6hl0jazWqg2PIKbMd0JzzVxUuD_a5oNxxUcDa2KvA8ZaMFpd5BScZffSXWkkL1m4WLxJeqPAfQ6NtR8jd_Eta_Tj_JOSf2zEBrkvxNvhjUYtQ_r1nmQ75i1S272UkyTFzGL0EeFM3zA4MdFHvSqLb1CWmDVU8DVAry5tXGK_g5fsk2yOgBeF5V1WpbdE-TRhdXwga9mqtSmxolLqoM5Tt6fmwGY4ZUOsYv-YuB_HP6ZJo_x3_9wUknh5YxAtv24oNfzI8_TPtxQlDw1zOU1646sViu3M6ALR2ORlWpsEcZzKZIAje5n509erZiNapNd3aexwLZRdVyetvD09UoaKeQsDMUaJud93zjdGS_eMyYXcxbJkgE7H0Km6A&cid=CAASJ-Row093ftuAHf3RTltz17HdDZhuJEoZAl1n_Sr-nY65gW-G63gQ0A&sdkv=h.0.0.0&osd=2&frm=2&vis=1&sdr=1

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220413_RC00/outstream.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

74.125.71.156 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wn-in-f156.1e100.net

Software

cafe /

Resource Hash

295312fdc2e0f59ddb60651b102ddb9b3641cfd7b89db0084c9f5f88dc484fb3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15646
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/xml; charset=UTF-8
access-control-allow-origin: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 /
a1.adform.net/csimpr/ Frame 80F1 35 B
502 B 21ms
20ms Ping
image/gif 37.157.4.24
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://a1.adform.net/csimpr/?bn=54370173&csi=Gc4KwEYaWu7j-kIezvIMCk4bN67wtpV7CpdRT7VHHo_rygPkIxxfk0n4UBYG0Xi1RdU4npzY7MFetgOmG7B8xt6vWmW1dlSa0

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.24 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
DATA 200
OK truncated
/ Frame C02A 216 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: fce55aebdeb1228673436efdb29b4b4ec6b00b205cdce110c24cc8d3bb0fd673

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame C02A 0
0 44ms
44ms Fetch
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CT3bT9XhgYu27A9OU9u8P6cGqgA_n_cq7acihhLSVEM_mor3AARABIKqAwyJgldqigrAHoAGX_pvwAsgBBakCCmX3rhg1sj6oAwGqBMQCT9BRg2zoiKBo4d6QI9GsxR1-yE8TQOVgHs5h53waaSbA2mripHSby7OkKksPd57Pqqnwmt36Dt5D7IsQyuSSxDp2xG6clz6a2-mHizaOzHbBv2q9w0oOPiI4vcWjGG_SbGTeytuIpkmRtOZP6jfTkaWq-gs-PPiDZPsCA5jBojtjFXRuDnCyh_pvhzmDEdciU66mHhunfUTMkHihmj8B9arNIrtHk91YkODpLjv95i9bnDnhhoSYM1iT01afW4_DkcZmomSKSlD-wxCmUc_j9JriAvfa8e13QQ63W9SpJPe3-nPijNMTAEtEAsQCP_YqxtYsSKuYx8SImLNItByX6tdrPLSLf1xLmrSsK35uaT6x6HgRMgm8pRnGAWnzUpwJIN8k4xad-wlBvnhRK1y3pn-MIwqXmykdqyzHjX7zJD0rIo8ywATf_rLW8gPgBAOIBe_LqL4-kgUGCAMQARgBkgUGCBsQAhgBkgUNCCIQAxgBSI3StwFQAZIFBggdEAQYAZIFBggdEAEYAZIFBggeEAEYAZAGAaAGdoAH0YHkjwGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHChDU9xwY28KuyAHSCAkIiOGAEBABGB3yCBthZHgtc3Vic3luLTc5NDQ3MjY3MDA2MDQ3MDGACgPICwGwE-ej6A7IE_X44t8D2BMKiBQC2BQB0BUBgBcBshceChwIABIUcHViLTU1MTIzOTA3MDUxMzc1MDcYku8h&sigh=36ibcxYdIIg&uach_m=[UACH]&cid=CAQSPgCNIrLM_jxIp3lGnzxQnrsGUFbWEYkKNkHiajPFfbIBHT15-FS0L6VKFDyGZMlhD0iEi8lnzPwGdRRsP18Z&vt=10&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.
Requested by: Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s06-in-f2.1e100.net
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
H2 200 11022066.js Show response
s1.adform.net/Banners/Elements/Files/63577/11022066/ Frame 580C 2 KB
1 KB 18ms
17ms Script
application/x-javascript 37.157.6.234
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://s1.adform.net/Banners/Elements/Files/63577/11022066/11022066.js?ADFassetID=11022066&bv=257

Requested by

Host: pt.lizspaperloft.com
URL: https://pt.lizspaperloft.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.6.234 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

879cab3d6755806dfc9a395f8a3cfd0978cfab8897d55fda48ad06ef09bb9003

Security Headers

Name	Value
Strict-Transport-Security	max-age=0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: gzip
last-modified: Thu, 17 Mar 2022 08:10:54 GMT
server: nginx
etag: W/"6232ed0e-7b0"
x-cache-status: HIT
strict-transport-security: max-age=0
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
content-type: application/x-javascript

GET
H2

200

Adform.DHTML.js Show response
s1.adform.net/banners/scripts/rmb/ Frame 580C
Redirect Chain

https://track.adform.net/banners/scripts/rmb/Adform.DHTML.js
https://s1.adform.net/banners/scripts/rmb/Adform.DHTML.js

30 KB
13 KB

19ms
19ms

Script
application/x-javascript

37.157.6.234
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s1.adform.net/banners/scripts/rmb/Adform.DHTML.js
Requested by: Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 37.157.6.234 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash: bea63616949c80ff0dfdbb1e8547f1585882fc691483317b06441688e3e5f14a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: gzip
last-modified: Fri, 14 May 2021 12:35:38 GMT
server: nginx
etag: W/"609e6e9a-76d9"
x-cache-status: HIT
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: *
cache-control: public, max-age=604800
content-type: application/x-javascript

Redirect headers

location: https://s1.adform.net/banners/scripts/rmb/Adform.DHTML.js
date: Wed, 20 Apr 2022 21:19:49 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/html

GET
H2 200 6232eccb9663a849c8c24941 Show response
c.bannerflow.net/a/ Frame 580C 89 KB
32 KB 92ms
51ms Script
application/javascript 2606:4700::6810:d40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/a/6232eccb9663a849c8c24941?did=5ced02fe0fd60d000186f5ac&redirecturl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCYuU-9HhgYsCGLvKO7_UP5u2d2A2M1KXCaeHgprDwD5Ok_orXKRABIKqAwyJgldqigrAHoAGTpo--A8gBCakCCmX3rhg1sj6oAwGqBI8CT9BLydD9fG1_aUmHp4khhsVR2szxt-_IZ0jeKFi8sm2Fr-oSAACAr5oYvpU4uFgyQPshdMio3MqPD2-UJC0IOTSxcHzAtUqhS2uhmbBRKSLALdQt1i3ktpLOYtSUiXinbIKmoXHX6BbKRW6SfkX2c3-AjL5qZ2mw3VLVwBWoJctHa8UmoOo0TKVHqORjYwfprPMNAIdRTZg6Kooib48kXBMe-2xLpBoawaa1tGRmJS6ZkesgVCVEHFXFOLZcpybwyLNln62issZhXOXo8koAfJDsUSHDAXTc3HzJFUXa4Fz-uvBJ_OqDp8XJ41tVJWI29PPnwtfBJ6CeBFpZTYtdfn7VYXT0JmxQn3-omh0OncAE_d30tO0D4AQDkAYBoAZNgAfV2fBBqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggJCIjhgBAQARgd8ggbYWR4LXN1YnN5bi03OTQ0NzI2NzAwNjA0NzAxgAoDmAsByAsBgAwBsBPyxPEO2BMN2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSLQCNIrLMyTyxPyWSFKP3YG2IvXPrDni2ozokT8gfP4EqCPW9_FtfsTMP4d7ukw%26sig%3DAOD64_1GD8XAVq-t3XgVg4nxvHhgbqRu3g%26client%3Dca-pub-5512390705137507%26dbm_c%3DAKAmf-DGJB980y18Yjx98pZH9cHEHCyGOJ2lnWzmh40uLydI2Zep0v4I48pXQGngeBSpXp2DeSEU01bBSx_7RuqikqSUJcN2G5MuJZCR5ZAitqAQXOT3uQW-PzWz5kqXM8dzEMjZdXQzg901FOB53ct84p1QSXCvbQ%26cry%3D1%26dbm_d%3DAKAmf-BuT1eLFpuK-M_vF_zQ3zN8H9qH_CI8Q0zpsHCXymmdxw0vvuVixkd8bckDE0ZdI0dDmF2zR2xjTQR4CI_Y0t5JKMeKUvXboWq0g-ucMF2Z2f_3KQ_4xOrt_GV1hUt68-e4GtOAjqE5SlzizcycrzeFJMtHz1tx9xoITmG5WFnjdmvJOsDDeb_I_r6SdYXERMoRkNrOWPCFSMFkS-3CdxeIkd0CtGnRrmQUjIT9zGxV73vQqcAwlfYL8DbwtowVN4FQWFTR2Txg1quzaNUY148DCohY_APJPVEwnRbe_dFvKHnlBu3CmLX1NzqTUf7og4nTT2xmV2cnVAq0U3QFY30-UO5oShaMrMX12lvIEho14HyEklsnLVvkKVAzkiarU3kB6wThpD7gH9x1m4sJDwmVJru88FeLsPCDDzWRO_nXAE3aa9KkD11txM_gO9CaDy-GA6bv0zWQAwQng7js7xxsToCFLQ%26adurl%3Dhttps%3A%2F%2Fa1.adform.net%2FC%2F%3Fbn%3D54370173%3Badfibeg%3D0%3Bcdata%3DiRC99z5vOMPyVUB3sm7qdD3H6zHyVHqzADbraSVMwddeWA_EDGcbq-vhfINXxkXnhcMRvNZZuUQdBto-OTni43tt2n4OwTFixfgN7wWhehNcPlakbYq96RfFbAlL4jcDepog248PTuUVdH9pxlMXHT15XEr-uFmMQeEimShqzcc1%3B%3BCREFURL%3Dhttps%253a%252f%252fpt.lizspaperloft.com%3BC%3D1&domain=https%3a%2f%2fd5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com%2f&targetwindow=_blank
Requested by: Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:d40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 929d9e7f809aae29b56c16a40ca6c2b190a9385a786a0bdd4dcdf4f9c450fd7d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
content-type: application/javascript
cf-ray: 6ff0eb9f6caa0211-ZRH
link: <https://c.bannerflow.net/accounts/melia-hotels-international/59c9120b31ae8f128419d688/published/1957125/2252985/preload.jpg>; rel=preload; as=image
request-context: appId=cid-v1:8ccc0d93-c9cf-4965-a9de-1823f9df557e

GET
H3 200 HdsydzJK.js Show response
tpc.googlesyndication.com/sodar/ Frame C02A 41 KB
15 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Requested by

Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220413_RC00/outstream.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1ddb3277324a871335ef0b7e680de58c9a79b3c1355b4082ca5425818c8a0306

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Mon, 18 Apr 2022 13:10:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 202175
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15407
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 18 Apr 2023 13:10:14 GMT

HEAD
H/1.1

200
OK

file.mp4
r5---sn-4g5edns6.c.2mdn.net/videoplayback/id/49cfa2139890e885/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1682025589/sparams/acao,ctier,expire,hcs,id,ip,ipbits,itag,mh... Frame C02A
Redirect Chain

https://gcdn.2mdn.net/videoplayback/id/49cfa2139890e885/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1682025589/sparams/ip,ipbits,expire,id,itag,source,ctier,acao/signa...
https://r5---sn-4g5edns6.c.2mdn.net/videoplayback/id/49cfa2139890e885/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1682025589/sparams/acao,ctier,expire,hcs,id,ip,ipbits...

0
0

44ms
29ms

Fetch
video/mp4

2a00:1450:4001:6d::a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r5---sn-4g5edns6.c.2mdn.net/videoplayback/id/49cfa2139890e885/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1682025589/sparams/acao,ctier,expire,hcs,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,rmhost,source/signature/72A6B7A83B7B2DD0C4FDA4A50D093578BBBEE0EB.0D8D2CBEA1548EB7C358966156EFBD1F70F3FBF0/key/cms1/cms_redirect/yes/hcs/ir/mh/rD/mip/2001:ac8:20:302::202e/mm/42/mn/sn-4g5edns6/ms/onc/mt/1650489130/mv/u/mvi/5/pl/53/rmhost/r1---sn-4g5edns6.c.2mdn.net/file/file.mp4

Protocol

HTTP/1.1

Server

2a00:1450:4001:6d::a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Wed, 20 Apr 2022 21:19:49 GMT
X-Content-Type-Options: nosniff
Connection: close
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 2723323
Last-Modified: Fri, 15 Apr 2022 15:21:01 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/mp4
Access-Control-Allow-Origin: null
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=86400
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: null
Expires: Wed, 20 Apr 2022 21:19:49 GMT

Redirect headers

date: Wed, 20 Apr 2022 21:19:49 GMT
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 704
x-xss-protection: 0
pragma: no-cache
server: ClientMapServer
location: https://r5---sn-4g5edns6.c.2mdn.net/videoplayback/id/49cfa2139890e885/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1682025589/sparams/acao,ctier,expire,hcs,id,ip,ipbits,itag,mh,mip,mm,mn,ms,mv,mvi,pl,rmhost,source/signature/72A6B7A83B7B2DD0C4FDA4A50D093578BBBEE0EB.0D8D2CBEA1548EB7C358966156EFBD1F70F3FBF0/key/cms1/cms_redirect/yes/hcs/ir/mh/rD/mip/2001:ac8:20:302::202e/mm/42/mn/sn-4g5edns6/ms/onc/mt/1650489130/mv/u/mvi/5/pl/53/rmhost/r1---sn-4g5edns6.c.2mdn.net/file/file.mp4
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame C02A 0
17 B 45ms
27ms Ping
image/gif 2001:4860:4802:32::3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=2~l282vxtt&c=8289927038026&slotId=4144963519013&qqid=CK2Kpe3Io_cCFVOK_Qcd6aAK8A&fb=outstream-lima&gpm_i=9&gpm_c=9&gpm_a=9&smb=1000&br=890&mt=video%2Fmp4&vs=1024x576&ulv=1&cll=0&vmfc=12&vhc=0&msm=1&aits=0%2C18%2C22%2C37%2C692%2C59%2C342%2C343%2C344%2C345%2C346%2C347&webm=0&vp9=0&vamt=video%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4%2Cvideo%2Fmp4&hvmf=false&vms=1&bit=347&vsrc=web_video_ads&ape=1&met.4=videopreviewvisible.qp
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220413_RC00/outstream.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:32::3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 H0ZEmIz7.html Show response
tpc.googlesyndication.com/sodar/ Frame 7234 23 KB
9 KB 8ms
8ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/HdsydzJK.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1f4644988cfb9648d5236c12056f9ca31317c75544ef8776f4fec148322bb954

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 480877
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8727
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Fri, 15 Apr 2022 07:45:12 GMT
expires: Sat, 15 Apr 2023 07:45:12 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 LJGn0i2Pg8yG-wzimFR5htSsDE5oolsrGkll4HQxngw.js Show response
pagead2.googlesyndication.com/bg/ Frame 7234 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/LJGn0i2Pg8yG-wzimFR5htSsDE5oolsrGkll4HQxngw.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/H0ZEmIz7.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c91a7d22d8f83cc86fb0ce298547986d4ac0c4e68a25b2b1a4965e074319e0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 14:40:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 110369
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13643
x-xss-protection: 0
last-modified: Mon, 11 Apr 2022 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Apr 2023 14:40:20 GMT

GET
H3 200 container.html Show response
d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 9E8D 6 KB
3 KB 8ms
7ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pt.lizspaperloft.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 1
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 21:19:48 GMT
expires: Thu, 20 Apr 2023 21:19:48 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 preload.jpg
c.bannerflow.net/accounts/melia-hotels-international/59c9120b31ae8f128419d688/published/1957125/2252985/ Frame 580C 9 KB
10 KB 33ms
33ms Image
image/jpeg 2606:4700::6810:d40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/melia-hotels-international/59c9120b31ae8f128419d688/published/1957125/2252985/preload.jpg
Requested by: Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:d40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 95123151b63c2ac4a243f8ac1e0f11895292b5e9966a8fd0e96fb3760822ac8c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 20 Apr 2022 21:19:49 GMT
cf-cache-status: HIT
age: 1659190
content-length: 9504
x-ms-lease-status: unlocked
last-modified: Mon, 21 Mar 2022 08:48:04 GMT
server: cloudflare
etag: 0x8DA0B17837D5039
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
x-ms-request-id: 1c49a563-501e-009b-6ae5-452c23000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 6ff0eb9fdd380211-ZRH
cf-bgj: h2pri

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame 8E4D 624 B
297 B 24ms
23ms Document
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiB_aO-ATAB&v=APEucNV5fYa6eOX2zA9aiMkYtLFAehcyRx_ExvYmMW_3v9w7MBXBoKUpOqqS3DVxWoprshUPVFbK7NaVrDYyDemWsE56VVeI1ARaLi5jk9i0SLhfaWxYtFC2czc1nmMHRg-18CC04DOFfesB9zgkyC2JmISgnCXsDhxTASejAeTWpgEJJpajLPtqVjFvqKtn4F0E_-1wRutuy2znL12OKzpVq-Mdok3x1w

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 21:19:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 9E8D 84 KB
34 KB 56ms
55ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DzelBinH6wJMxx5fkT1yxD-UkUZuJ8ZtfkroerNq2ZkSyehWYKdVIUwDe64-PpH9w7LpzraCoSyawVeEGyWzOY_ejjrtWT9cenxZ_wgFhsR8otde0XNWNhZDGnxrhPnlDBkUbtefT4GaWRnyVzuLeprPFrDQ&dbm_d=AKAmf-B1jMR_XEGm239VIQtnll5yUuz-sQ__Ed3JtrwoKtsatPyBCKawzKhQWkuJdGiVvi3Wq83Dc7JsXI-BphtdVsLRoK-Pzi2UvM1VQx6QMGMMCmq_tmVFotGCWlbU4sSmLzL5vAvQQKIn9LVphdHufFmtDtFXY30oS2n_DMrW_wWtln1FUBLFcEcoUwT2PPiVxPflQm-P4fgT59N8hf9CH26_UXFZcu7qiN3oBwYYwFnDoQrt5mt9Z7dFfkG8zRoHO44vpmj5o8O1nH-g6KisiR0pLURvbqVtGyU9RRRU8TiMnuGX-jxk3HbgawPXIF8uCjnMYwyGRkUA9kmQckm-_MFtDF00L5W9k7B9SJy8JOnY2s1m-e0s4Msabys6me6_GEMO_MWgGozCR9dZDabEX1K_l6SyNJsGlcwecDj8ITl9I5a4POMJoYz7Yw6y4ezcqX5KgwBsOqNzFxcjXoV-4BHjuJx6kwk7DCCOSvDqYIksFJ-c_59KfeXHFnbpvpxfKYwgq7wxh05G89mldk151CN6Md6jvr2TfRZ_na194sCZd8ze6UNQTRQaFWqpjDgqxZx1WOjIwYZ23qPlj1aqoNeb8HzdIrG1eGwvtdotJrymOK_E7PLOvSukjw6oAqJj2VJe_pkGGCMjp1sX-_ExuxZz96qW3pznNi-ytjYyOqDBRUxLnPm327gyqf1kxfPBMKyX0TLE1yZBrUF6xS2g7yWA09P2ZvYpnpQyDgpY5Ul8OdqpFpbycxrWv1fdX2dPffwxZhQ6prPhHdcPgoFsXiNWliYd6BlOv8tCLSuDRsEa0Mv4c3iWyw5bmSuIrX_ktJ0Jrca7XwjLIju1vKDe9gwfR6ArGCRm18zO_tlf4GpfhUG4Vh7v5oIY_HjDetd5Iu-yrmWOuZW3R0gNavsfHArJT3_zi9bedl5pwkg9J_-a_MWrorSieObyIcvWWyLOWxUTZMcl92PfX3xhqxeARVxuxMsWGygYCTgjCndWDoh5iur4U-NwfJjLj80G5VY15RQ6du7ZDtWAz_4yqKdt_GkdKI7JLuCv1hBJisfkFJnlOZeG8hT_IvE3opBnq3iv7RpndG9I8n1JQTm7ssVovGwiOw8M4crUzJS6tXC5_i6vnW3c4hfK4Xk-WA3wAuDFY3p8qXeuGEEXtXyE4H18VUl82h0E-Rf8TJrlX5-Q2ZbbVx4UGBOWXmqGVzJlJcuOzFcfR2JGOFQ6K30htHtOa0X5RLraZuMgwiifTR4dieaWPFoQ8FQbqZIa4qVe_1SjuCaShsnNcGUDFZ-enVdYD-RGWpOUgXFYe54tbw3RDO00o47_Td8cea0wssUXR3mFeQxT08pfgyCYaOMIf3NH7l0KfLCrLiJDm5J29qw6f6Ie-bz4hN-4LB0K4vE7U3kjUFtaM9ASXHHpqhToM7lS0mOBtC6l7re-aWwMRCNN7mJ7puSwDQYFqzDWKwFxWhMmm4fqxVWKoxnSZo6hScHUDtCSJLHyqIfdSClvz2Q1eG2T79vpe4YkshpPrQq_ZdP7kWG7nhvSN94neA7K8Q0viJMyupIlHPA9qBlO7EPgON8D39IWfcMgdX7rKJhzqMq9D_YIFrVj5OOIZZqFqN7XscX8EiSglpDM3Y7XXj6JX9mF8noUfz7kfnqvgXo7c4RIXHKpi2FBydUms9yom0EI3_KU0M4Mm_aZKteLgeANaLAnjcXB1EesIrZhavZCOSLVdr-QA8kDvRtZsEQknVGgCLwqgU72mne0o0QTB8_r6tHKyAGwcGS7_LFqa_kWBispaRTSZaZsf3A3szhZpSQ93qB-t6yH8lvsHvC4i2vA-TacsqCFZI266swJYyC3HqBAKyOPKdwg3YeBLbVnOqudQAhLIThzCJGRBEcbFjDW-hpyDlLsbAXb76Y6ii49zbI3ednb2IMaPj-tWhXWh6OW86Fhd5s4E1P-BWnAv-ZvZCjusYJIcNie-ZIukHwr0JJYnx79o30GPoC4YgkMiantBvlpgdA1tLhbTanErx8bg1NzBeYmPBhyz4oLldyBF7CmD11fXGQKaq1bhJpga9pw-U-FPo_RIhzwLefc77YN8EiVOgoc-Jy68rYQqQWYWvp_YaCFTEWWP2hwuaVyOCInFID7ierElGsL71EPuEPKK7Da6UQteJJ4sqq-R88535dj3Pb1KUIm_a66IZE1DtW_cCnEDWjLJzcgBSOeh8Ln1zyfymgxktco1jOpESY_C1Ar051abuRAWB_8GfGo7diwHzanUEQGJL6ffXedzsNDPEgwFttvQ7TNe5GROPVfZAJ7Ao17HhKzD0bX_N_kj7MNyo8DZY3IE4orPpTlNWo0VSu2CvC3Pjrghwa_fJNuFjswL032jLpuYmMVogkSfhnf2WhPVvwyY7eH9KRa4-QcSeMt4zj3Brs7l0YDVKOomjFn2fNj9tTohXoZVw1nvsWPCoeF9LCVLL6S3ShWZdr1NxglA-yd8biBA8bpCOEmvn2IBU5Wo31kWK3O4mKbR-G4G44FvDpbRsup5YdJbo-zhQHD-2aAjrkTCY1LZnaGytCtjyGW9oEYYmhUmGAVc4yGHt-edjd6svmghp2JHqxIm_a1ufaktWoK1PWpzbo6uo1UvmSNhBUV7j5JUap5vVR9-TXtwUP4aZJWeELKnzQi8kw97_58manMqDp9hxl8TjeZP0hgodw57DgbVrWjBl0_cJFjS9IQXD74OeQVT_atpxAVzqSmrGMj8xIYl9GZnCpkMt605PWcdC8_ca3azdpcRomj4uqQMxT12Xb32V0Lepp-bkQgUOfeplmL8psvQ5DweyyiNV4L2U5Xuqe1Lhsh8sYRXMeueI8FFtTRbD2maUD3oLH52i7prjDV0Gg8DwqchSskS3_qbPDA4yMydSbimznrdqz2lXhhQvmjIBzQA1woIKINnoituG9tDcf2PFlQZloBPrYxP3U-0JQnJRw1AFRuElFud__s2G5vAmyPOFj5-ozPAdoJoKFCL68xeVi7v1FWUmQu6J25k2xyY8gRffNvS3brjQPskehmdfwGp3EDItsUGrjEQHyvl8JtGXdh_S30u4IxMtZQno-x34i9Kyk6Rd9UxqJ9TL2lfzdIxYFovMZXYfIN4vJb2XXnCWzd1QuGBv48YlzRhmECXygw_K2wf3m2ZsawBgrIO7cDo1DYmrZVg_PU2WX-cDW-xDTIA3w_0MtXV1fBkN7nuJkVNWhnpnjRqrjkQvyRIeEe1mJbxSzuCOg2YznyWLcj9RbVY5-n1XBHwvpPTFekdVijHIqLGyPu14qPK2zMoeylkm_A82osdSclkXTWYu3yEWvGijMXAkBe&cid=CAASJORosT8Ui8Rykl-Vw9ZDqUAPMMUune9c8yzbOMMOdkYQPMCxrg&rfl=1%2Chttps%253A%252F%252Fpt.lizspaperloft.com%252F%240

Requested by

Host: pt.lizspaperloft.com
URL: https://pt.lizspaperloft.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0c7601774a4c4e3d9a4d6a1217f74d67981b005302aa5eb4bc7ddbdc94ad01e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34332
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9E8D 42 B
63 B 43ms
40ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-DWsRyFgZ96691LWhpq4g-PMy0T_GTDq6QpaT7LHHNFUhe7azxXpNFCSSEf00Dy4neKciXg8oIjhi8xeR8TRgYEvO9zYY1lWEG6FY-BFfpkWEPpt58

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/ Frame 9E8D 3 KB
1 KB 9ms
6ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/window_focus_fy2019.js

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 May 2022 21:19:39 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 9E8D 119 KB
36 KB 34ms
18ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef2e3293c1558e5b49e30e1e094cfc3412ec386a68067aee04a92fc913f2c2ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36950
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1650454428054601"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 20 Apr 2022 21:19:49 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/ Frame 9E8D 15 KB
6 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:15:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 231
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6409
x-xss-protection: 0
server: cafe
etag: 15284592792851369840
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 May 2022 21:15:58 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 9E8D 0
0 16ms
15ms Image
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRAwYMQeYI50_7cMAEaJGmpMcNny13OkkzLanncWoEnpT3tdDxvs06Tzoit_1V_iOdmt1luEAjTqvNYwWDcW0msdnb1Ww
Requested by: Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
H3 206 file.mp4
r5---sn-4g5edns6.c.2mdn.net/videoplayback/id/49cfa2139890e885/itag/347/source/web_video_ads/ctier/L/acao/yes/ip/0.0.0.0/ipbits/0/expire/1682025589/sparams/acao,ctier,expire,hcs,id,ip,ipbits,itag,mh... Frame C02A 3 MB
3 MB 16ms
7ms Media
video/mp4 2a00:1450:4001:6d::a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:6d::a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

ef26a0ba972764225128f30872097aef24a27a3eb97ad27ad60de92e1c7c0774

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Range: bytes=0-

Response headers

date: Wed, 20 Apr 2022 21:19:49 GMT
x-content-type-options: nosniff
Content-Range: bytes 0-2723322/2723323
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 2723323
expires: Wed, 20 Apr 2022 21:19:49 GMT
last-modified: Fri, 15 Apr 2022 15:21:01 GMT
server: gvs 1.0
vary: Origin
content-type: video/mp4
access-control-allow-origin: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=86400
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
client-protocol: quic

POST
H3 204 csi
csi.gstatic.com/ Frame C02A 0
17 B 27ms
27ms Ping
image/gif 2001:4860:4802:32::3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=3~l282vxxo&c=8289927038026&slotId=4144963519013&qqid=CK2Kpe3Io_cCFVOK_Qcd6aAK8A&fb=outstream-lima&gpm_i=9&gpm_c=9&gpm_a=9&smb=1000&br=890&mt=video%2Fmp4&vs=1024x576&ple=0&umsem=0&event_name=unmeasurable_asset&resource_name=https%253A%252F%252Fgcdn.2mdn.net%252Fvideoplayback%252Fid%252F49cfa2139890e885%252Fitag%252F347%252Fsource%252Fweb_video_ads%252Fctier%252FL%252Facao%252Fyes%252Fip%252F0.0.0.0%252Fipbits%252F0%252Fexpire%252F1682025589%252Fsparams%252Fip%252Cipbits%252Cexpire%252Cid%252Citag%252Csource%252Cctier%252Cacao%252Fsignature%252F13849E40BC715E6AA08E373BAA622535F100BDF6.2E4CB505DC3C347F3821161EA83002EB232AFCBA%252Fkey%252Fck2%252Ffile%252Ffile.mp4&encoded_body_size=0&transfer_size=0
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220413_RC00/outstream.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:32::3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 widget.312873177f7c8c26c3a1.js Show response
c.bannerflow.net/scripts/ Frame 580C 19 KB
7 KB 28ms
28ms Script
application/javascript 2606:4700::6810:d40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/widget.312873177f7c8c26c3a1.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/6232eccb9663a849c8c24941?did=5ced02fe0fd60d000186f5ac&redirecturl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCYuU-9HhgYsCGLvKO7_UP5u2d2A2M1KXCaeHgprDwD5Ok_orXKRABIKqAwyJgldqigrAHoAGTpo--A8gBCakCCmX3rhg1sj6oAwGqBI8CT9BLydD9fG1_aUmHp4khhsVR2szxt-_IZ0jeKFi8sm2Fr-oSAACAr5oYvpU4uFgyQPshdMio3MqPD2-UJC0IOTSxcHzAtUqhS2uhmbBRKSLALdQt1i3ktpLOYtSUiXinbIKmoXHX6BbKRW6SfkX2c3-AjL5qZ2mw3VLVwBWoJctHa8UmoOo0TKVHqORjYwfprPMNAIdRTZg6Kooib48kXBMe-2xLpBoawaa1tGRmJS6ZkesgVCVEHFXFOLZcpybwyLNln62issZhXOXo8koAfJDsUSHDAXTc3HzJFUXa4Fz-uvBJ_OqDp8XJ41tVJWI29PPnwtfBJ6CeBFpZTYtdfn7VYXT0JmxQn3-omh0OncAE_d30tO0D4AQDkAYBoAZNgAfV2fBBqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggJCIjhgBAQARgd8ggbYWR4LXN1YnN5bi03OTQ0NzI2NzAwNjA0NzAxgAoDmAsByAsBgAwBsBPyxPEO2BMN2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSLQCNIrLMyTyxPyWSFKP3YG2IvXPrDni2ozokT8gfP4EqCPW9_FtfsTMP4d7ukw%26sig%3DAOD64_1GD8XAVq-t3XgVg4nxvHhgbqRu3g%26client%3Dca-pub-5512390705137507%26dbm_c%3DAKAmf-DGJB980y18Yjx98pZH9cHEHCyGOJ2lnWzmh40uLydI2Zep0v4I48pXQGngeBSpXp2DeSEU01bBSx_7RuqikqSUJcN2G5MuJZCR5ZAitqAQXOT3uQW-PzWz5kqXM8dzEMjZdXQzg901FOB53ct84p1QSXCvbQ%26cry%3D1%26dbm_d%3DAKAmf-BuT1eLFpuK-M_vF_zQ3zN8H9qH_CI8Q0zpsHCXymmdxw0vvuVixkd8bckDE0ZdI0dDmF2zR2xjTQR4CI_Y0t5JKMeKUvXboWq0g-ucMF2Z2f_3KQ_4xOrt_GV1hUt68-e4GtOAjqE5SlzizcycrzeFJMtHz1tx9xoITmG5WFnjdmvJOsDDeb_I_r6SdYXERMoRkNrOWPCFSMFkS-3CdxeIkd0CtGnRrmQUjIT9zGxV73vQqcAwlfYL8DbwtowVN4FQWFTR2Txg1quzaNUY148DCohY_APJPVEwnRbe_dFvKHnlBu3CmLX1NzqTUf7og4nTT2xmV2cnVAq0U3QFY30-UO5oShaMrMX12lvIEho14HyEklsnLVvkKVAzkiarU3kB6wThpD7gH9x1m4sJDwmVJru88FeLsPCDDzWRO_nXAE3aa9KkD11txM_gO9CaDy-GA6bv0zWQAwQng7js7xxsToCFLQ%26adurl%3Dhttps%3A%2F%2Fa1.adform.net%2FC%2F%3Fbn%3D54370173%3Badfibeg%3D0%3Bcdata%3DiRC99z5vOMPyVUB3sm7qdD3H6zHyVHqzADbraSVMwddeWA_EDGcbq-vhfINXxkXnhcMRvNZZuUQdBto-OTni43tt2n4OwTFixfgN7wWhehNcPlakbYq96RfFbAlL4jcDepog248PTuUVdH9pxlMXHT15XEr-uFmMQeEimShqzcc1%3B%3BCREFURL%3Dhttps%253a%252f%252fpt.lizspaperloft.com%3BC%3D1&domain=https%3a%2f%2fd5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com%2f&targetwindow=_blank
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:d40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7ac12c45b91c1e960c86dca2b137081c6e861123624d08442f5a80ff24be47de

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: HZEQkVfbP7Jm3zV8y9pNcA==
age: 3734261
cf-polished: origSize=19187
x-ms-lease-status: unlocked
last-modified: Mon, 07 Mar 2022 14:49:32 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: acda45bd-d01e-0085-4d05-33c0fb000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2009-09-19
cf-ray: 6ff0eb9ffd770211-ZRH
cf-bgj: minify

GET
H2 200 document.64441b2ae6.js Show response
c.bannerflow.net/accounts/melia-hotels-international/59c9120b31ae8f128419d688/published/1957125/2252985/ Frame 580C 90 KB
23 KB 25ms
25ms Script
application/javascript 2606:4700::6810:d40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/accounts/melia-hotels-international/59c9120b31ae8f128419d688/published/1957125/2252985/document.64441b2ae6.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/6232eccb9663a849c8c24941?did=5ced02fe0fd60d000186f5ac&redirecturl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCYuU-9HhgYsCGLvKO7_UP5u2d2A2M1KXCaeHgprDwD5Ok_orXKRABIKqAwyJgldqigrAHoAGTpo--A8gBCakCCmX3rhg1sj6oAwGqBI8CT9BLydD9fG1_aUmHp4khhsVR2szxt-_IZ0jeKFi8sm2Fr-oSAACAr5oYvpU4uFgyQPshdMio3MqPD2-UJC0IOTSxcHzAtUqhS2uhmbBRKSLALdQt1i3ktpLOYtSUiXinbIKmoXHX6BbKRW6SfkX2c3-AjL5qZ2mw3VLVwBWoJctHa8UmoOo0TKVHqORjYwfprPMNAIdRTZg6Kooib48kXBMe-2xLpBoawaa1tGRmJS6ZkesgVCVEHFXFOLZcpybwyLNln62issZhXOXo8koAfJDsUSHDAXTc3HzJFUXa4Fz-uvBJ_OqDp8XJ41tVJWI29PPnwtfBJ6CeBFpZTYtdfn7VYXT0JmxQn3-omh0OncAE_d30tO0D4AQDkAYBoAZNgAfV2fBBqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggJCIjhgBAQARgd8ggbYWR4LXN1YnN5bi03OTQ0NzI2NzAwNjA0NzAxgAoDmAsByAsBgAwBsBPyxPEO2BMN2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSLQCNIrLMyTyxPyWSFKP3YG2IvXPrDni2ozokT8gfP4EqCPW9_FtfsTMP4d7ukw%26sig%3DAOD64_1GD8XAVq-t3XgVg4nxvHhgbqRu3g%26client%3Dca-pub-5512390705137507%26dbm_c%3DAKAmf-DGJB980y18Yjx98pZH9cHEHCyGOJ2lnWzmh40uLydI2Zep0v4I48pXQGngeBSpXp2DeSEU01bBSx_7RuqikqSUJcN2G5MuJZCR5ZAitqAQXOT3uQW-PzWz5kqXM8dzEMjZdXQzg901FOB53ct84p1QSXCvbQ%26cry%3D1%26dbm_d%3DAKAmf-BuT1eLFpuK-M_vF_zQ3zN8H9qH_CI8Q0zpsHCXymmdxw0vvuVixkd8bckDE0ZdI0dDmF2zR2xjTQR4CI_Y0t5JKMeKUvXboWq0g-ucMF2Z2f_3KQ_4xOrt_GV1hUt68-e4GtOAjqE5SlzizcycrzeFJMtHz1tx9xoITmG5WFnjdmvJOsDDeb_I_r6SdYXERMoRkNrOWPCFSMFkS-3CdxeIkd0CtGnRrmQUjIT9zGxV73vQqcAwlfYL8DbwtowVN4FQWFTR2Txg1quzaNUY148DCohY_APJPVEwnRbe_dFvKHnlBu3CmLX1NzqTUf7og4nTT2xmV2cnVAq0U3QFY30-UO5oShaMrMX12lvIEho14HyEklsnLVvkKVAzkiarU3kB6wThpD7gH9x1m4sJDwmVJru88FeLsPCDDzWRO_nXAE3aa9KkD11txM_gO9CaDy-GA6bv0zWQAwQng7js7xxsToCFLQ%26adurl%3Dhttps%3A%2F%2Fa1.adform.net%2FC%2F%3Fbn%3D54370173%3Badfibeg%3D0%3Bcdata%3DiRC99z5vOMPyVUB3sm7qdD3H6zHyVHqzADbraSVMwddeWA_EDGcbq-vhfINXxkXnhcMRvNZZuUQdBto-OTni43tt2n4OwTFixfgN7wWhehNcPlakbYq96RfFbAlL4jcDepog248PTuUVdH9pxlMXHT15XEr-uFmMQeEimShqzcc1%3B%3BCREFURL%3Dhttps%253a%252f%252fpt.lizspaperloft.com%3BC%3D1&domain=https%3a%2f%2fd5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com%2f&targetwindow=_blank
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:d40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f6c417546ab95f377359977407b1c777b74643ef2f7e5eb6aaf410ce540c462a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: ZEQbKub/JHrdQz//0StmlA==
age: 1659189
cf-polished: origSize=94267
x-ms-lease-status: unlocked
last-modified: Mon, 21 Mar 2022 08:48:19 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 8b9a6aa5-201e-0038-55e5-4549e6000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2009-09-19
cf-ray: 6ff0eb9ffd780211-ZRH
cf-bgj: minify

GET
H2 200 animated-creative.113bb23e864a7f983e9d.js Show response
c.bannerflow.net/scripts/ Frame 580C 142 KB
48 KB 29ms
29ms Script
application/javascript 2606:4700::6810:d40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/scripts/animated-creative.113bb23e864a7f983e9d.js
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/6232eccb9663a849c8c24941?did=5ced02fe0fd60d000186f5ac&redirecturl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCYuU-9HhgYsCGLvKO7_UP5u2d2A2M1KXCaeHgprDwD5Ok_orXKRABIKqAwyJgldqigrAHoAGTpo--A8gBCakCCmX3rhg1sj6oAwGqBI8CT9BLydD9fG1_aUmHp4khhsVR2szxt-_IZ0jeKFi8sm2Fr-oSAACAr5oYvpU4uFgyQPshdMio3MqPD2-UJC0IOTSxcHzAtUqhS2uhmbBRKSLALdQt1i3ktpLOYtSUiXinbIKmoXHX6BbKRW6SfkX2c3-AjL5qZ2mw3VLVwBWoJctHa8UmoOo0TKVHqORjYwfprPMNAIdRTZg6Kooib48kXBMe-2xLpBoawaa1tGRmJS6ZkesgVCVEHFXFOLZcpybwyLNln62issZhXOXo8koAfJDsUSHDAXTc3HzJFUXa4Fz-uvBJ_OqDp8XJ41tVJWI29PPnwtfBJ6CeBFpZTYtdfn7VYXT0JmxQn3-omh0OncAE_d30tO0D4AQDkAYBoAZNgAfV2fBBqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggJCIjhgBAQARgd8ggbYWR4LXN1YnN5bi03OTQ0NzI2NzAwNjA0NzAxgAoDmAsByAsBgAwBsBPyxPEO2BMN2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSLQCNIrLMyTyxPyWSFKP3YG2IvXPrDni2ozokT8gfP4EqCPW9_FtfsTMP4d7ukw%26sig%3DAOD64_1GD8XAVq-t3XgVg4nxvHhgbqRu3g%26client%3Dca-pub-5512390705137507%26dbm_c%3DAKAmf-DGJB980y18Yjx98pZH9cHEHCyGOJ2lnWzmh40uLydI2Zep0v4I48pXQGngeBSpXp2DeSEU01bBSx_7RuqikqSUJcN2G5MuJZCR5ZAitqAQXOT3uQW-PzWz5kqXM8dzEMjZdXQzg901FOB53ct84p1QSXCvbQ%26cry%3D1%26dbm_d%3DAKAmf-BuT1eLFpuK-M_vF_zQ3zN8H9qH_CI8Q0zpsHCXymmdxw0vvuVixkd8bckDE0ZdI0dDmF2zR2xjTQR4CI_Y0t5JKMeKUvXboWq0g-ucMF2Z2f_3KQ_4xOrt_GV1hUt68-e4GtOAjqE5SlzizcycrzeFJMtHz1tx9xoITmG5WFnjdmvJOsDDeb_I_r6SdYXERMoRkNrOWPCFSMFkS-3CdxeIkd0CtGnRrmQUjIT9zGxV73vQqcAwlfYL8DbwtowVN4FQWFTR2Txg1quzaNUY148DCohY_APJPVEwnRbe_dFvKHnlBu3CmLX1NzqTUf7og4nTT2xmV2cnVAq0U3QFY30-UO5oShaMrMX12lvIEho14HyEklsnLVvkKVAzkiarU3kB6wThpD7gH9x1m4sJDwmVJru88FeLsPCDDzWRO_nXAE3aa9KkD11txM_gO9CaDy-GA6bv0zWQAwQng7js7xxsToCFLQ%26adurl%3Dhttps%3A%2F%2Fa1.adform.net%2FC%2F%3Fbn%3D54370173%3Badfibeg%3D0%3Bcdata%3DiRC99z5vOMPyVUB3sm7qdD3H6zHyVHqzADbraSVMwddeWA_EDGcbq-vhfINXxkXnhcMRvNZZuUQdBto-OTni43tt2n4OwTFixfgN7wWhehNcPlakbYq96RfFbAlL4jcDepog248PTuUVdH9pxlMXHT15XEr-uFmMQeEimShqzcc1%3B%3BCREFURL%3Dhttps%253a%252f%252fpt.lizspaperloft.com%3BC%3D1&domain=https%3a%2f%2fd5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com%2f&targetwindow=_blank
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:d40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d545b0de5199928169a9eb70e4ea94a856936a826b1bc868619a7ff0a2f85bc6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: n7+0gUkvpEd8QT4r3GPRkg==
age: 3564602
cf-polished: origSize=145314
x-ms-lease-status: unlocked
last-modified: Mon, 07 Mar 2022 14:49:31 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 4eab124d-901e-002d-1390-345e55000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public,max-age=31536000,immutable
x-ms-version: 2009-09-19
cf-ray: 6ff0eb9ffd790211-ZRH
cf-bgj: minify

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 8E4D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELxMPSnr3h1IrVV4or0uEH0&google_cver=1

43 B
894 B

31ms
30ms

Image
image/gif

69.192.160.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELxMPSnr3h1IrVV4or0uEH0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiB_aO-ATAB&v=APEucNV5fYa6eOX2zA9aiMkYtLFAehcyRx_ExvYmMW_3v9w7MBXBoKUpOqqS3DVxWoprshUPVFbK7NaVrDYyDemWsE56VVeI1ARaLi5jk9i0SLhfaWxYtFC2czc1nmMHRg-18CC04DOFfesB9zgkyC2JmISgnCXsDhxTASejAeTWpgEJJpajLPtqVjFvqKtn4F0E_-1wRutuy2znL12OKzpVq-Mdok3x1w
Protocol: HTTP/1.1
Server: 69.192.160.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-160-245.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:49 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 20 Apr 2022 21:19:49 GMT

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELxMPSnr3h1IrVV4or0uEH0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 8E4D
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YmB49UKycvfJ7qLWk3e5DQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELxMPSnr3h1IrVV4or0uEH0&google_cver=1

43 B
894 B

25ms
25ms

Image
image/gif

69.192.160.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELxMPSnr3h1IrVV4or0uEH0&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiB_aO-ATAB&v=APEucNV5fYa6eOX2zA9aiMkYtLFAehcyRx_ExvYmMW_3v9w7MBXBoKUpOqqS3DVxWoprshUPVFbK7NaVrDYyDemWsE56VVeI1ARaLi5jk9i0SLhfaWxYtFC2czc1nmMHRg-18CC04DOFfesB9zgkyC2JmISgnCXsDhxTASejAeTWpgEJJpajLPtqVjFvqKtn4F0E_-1wRutuy2znL12OKzpVq-Mdok3x1w
Protocol: HTTP/1.1
Server: 69.192.160.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-160-245.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:49 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 20 Apr 2022 21:19:49 GMT

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESELxMPSnr3h1IrVV4or0uEH0&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame 8E4D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEPjDCDKiCYgBU2p2JmhrMVo&google_cver=1

43 B
1014 B

13ms
13ms

Image
image/gif

185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEPjDCDKiCYgBU2p2JmhrMVo&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CPvjgQEQ_aOOARiB_aO-ATAB&v=APEucNV5fYa6eOX2zA9aiMkYtLFAehcyRx_ExvYmMW_3v9w7MBXBoKUpOqqS3DVxWoprshUPVFbK7NaVrDYyDemWsE56VVeI1ARaLi5jk9i0SLhfaWxYtFC2czc1nmMHRg-18CC04DOFfesB9zgkyC2JmISgnCXsDhxTASejAeTWpgEJJpajLPtqVjFvqKtn4F0E_-1wRutuy2znL12OKzpVq-Mdok3x1w

Protocol

HTTP/1.1

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:49 GMT
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 8258c5fe-ae17-4db1-b479-d05fb48426ca
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEPjDCDKiCYgBU2p2JmhrMVo&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 8E4D
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODA5MjkzNDc3MjEzODg2NDM3Mg%3D%3D

170 B
188 B

18ms
17ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODA5MjkzNDc3MjEzODg2NDM3Mg%3D%3D

Requested by

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:49 GMT
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: a493fda1-4ea6-4888-8697-438e3cbff203
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODA5MjkzNDc3MjEzODg2NDM3Mg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 html_inpage_rendering_lib_200_275.js Show response
s0.2mdn.net/879366/ Frame 9E8D 169 KB
59 KB 31ms
7ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Requested by

Host: pt.lizspaperloft.com
URL: https://pt.lizspaperloft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e30f3479d6ce52ce1c83c50e5568a4a7c1080c3214b23aacbc9d21efdd52f95a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
Origin: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 19:38:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6075
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60173
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:44:51 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 21 Apr 2022 19:38:34 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220413/r20110914/elements/html/ Frame 9E8D 8 KB
3 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220413/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-DzelBinH6wJMxx5fkT1yxD-UkUZuJ8ZtfkroerNq2ZkSyehWYKdVIUwDe64-PpH9w7LpzraCoSyawVeEGyWzOY_ejjrtWT9cenxZ_wgFhsR8otde0XNWNhZDGnxrhPnlDBkUbtefT4GaWRnyVzuLeprPFrDQ&dbm_d=AKAmf-B1jMR_XEGm239VIQtnll5yUuz-sQ__Ed3JtrwoKtsatPyBCKawzKhQWkuJdGiVvi3Wq83Dc7JsXI-BphtdVsLRoK-Pzi2UvM1VQx6QMGMMCmq_tmVFotGCWlbU4sSmLzL5vAvQQKIn9LVphdHufFmtDtFXY30oS2n_DMrW_wWtln1FUBLFcEcoUwT2PPiVxPflQm-P4fgT59N8hf9CH26_UXFZcu7qiN3oBwYYwFnDoQrt5mt9Z7dFfkG8zRoHO44vpmj5o8O1nH-g6KisiR0pLURvbqVtGyU9RRRU8TiMnuGX-jxk3HbgawPXIF8uCjnMYwyGRkUA9kmQckm-_MFtDF00L5W9k7B9SJy8JOnY2s1m-e0s4Msabys6me6_GEMO_MWgGozCR9dZDabEX1K_l6SyNJsGlcwecDj8ITl9I5a4POMJoYz7Yw6y4ezcqX5KgwBsOqNzFxcjXoV-4BHjuJx6kwk7DCCOSvDqYIksFJ-c_59KfeXHFnbpvpxfKYwgq7wxh05G89mldk151CN6Md6jvr2TfRZ_na194sCZd8ze6UNQTRQaFWqpjDgqxZx1WOjIwYZ23qPlj1aqoNeb8HzdIrG1eGwvtdotJrymOK_E7PLOvSukjw6oAqJj2VJe_pkGGCMjp1sX-_ExuxZz96qW3pznNi-ytjYyOqDBRUxLnPm327gyqf1kxfPBMKyX0TLE1yZBrUF6xS2g7yWA09P2ZvYpnpQyDgpY5Ul8OdqpFpbycxrWv1fdX2dPffwxZhQ6prPhHdcPgoFsXiNWliYd6BlOv8tCLSuDRsEa0Mv4c3iWyw5bmSuIrX_ktJ0Jrca7XwjLIju1vKDe9gwfR6ArGCRm18zO_tlf4GpfhUG4Vh7v5oIY_HjDetd5Iu-yrmWOuZW3R0gNavsfHArJT3_zi9bedl5pwkg9J_-a_MWrorSieObyIcvWWyLOWxUTZMcl92PfX3xhqxeARVxuxMsWGygYCTgjCndWDoh5iur4U-NwfJjLj80G5VY15RQ6du7ZDtWAz_4yqKdt_GkdKI7JLuCv1hBJisfkFJnlOZeG8hT_IvE3opBnq3iv7RpndG9I8n1JQTm7ssVovGwiOw8M4crUzJS6tXC5_i6vnW3c4hfK4Xk-WA3wAuDFY3p8qXeuGEEXtXyE4H18VUl82h0E-Rf8TJrlX5-Q2ZbbVx4UGBOWXmqGVzJlJcuOzFcfR2JGOFQ6K30htHtOa0X5RLraZuMgwiifTR4dieaWPFoQ8FQbqZIa4qVe_1SjuCaShsnNcGUDFZ-enVdYD-RGWpOUgXFYe54tbw3RDO00o47_Td8cea0wssUXR3mFeQxT08pfgyCYaOMIf3NH7l0KfLCrLiJDm5J29qw6f6Ie-bz4hN-4LB0K4vE7U3kjUFtaM9ASXHHpqhToM7lS0mOBtC6l7re-aWwMRCNN7mJ7puSwDQYFqzDWKwFxWhMmm4fqxVWKoxnSZo6hScHUDtCSJLHyqIfdSClvz2Q1eG2T79vpe4YkshpPrQq_ZdP7kWG7nhvSN94neA7K8Q0viJMyupIlHPA9qBlO7EPgON8D39IWfcMgdX7rKJhzqMq9D_YIFrVj5OOIZZqFqN7XscX8EiSglpDM3Y7XXj6JX9mF8noUfz7kfnqvgXo7c4RIXHKpi2FBydUms9yom0EI3_KU0M4Mm_aZKteLgeANaLAnjcXB1EesIrZhavZCOSLVdr-QA8kDvRtZsEQknVGgCLwqgU72mne0o0QTB8_r6tHKyAGwcGS7_LFqa_kWBispaRTSZaZsf3A3szhZpSQ93qB-t6yH8lvsHvC4i2vA-TacsqCFZI266swJYyC3HqBAKyOPKdwg3YeBLbVnOqudQAhLIThzCJGRBEcbFjDW-hpyDlLsbAXb76Y6ii49zbI3ednb2IMaPj-tWhXWh6OW86Fhd5s4E1P-BWnAv-ZvZCjusYJIcNie-ZIukHwr0JJYnx79o30GPoC4YgkMiantBvlpgdA1tLhbTanErx8bg1NzBeYmPBhyz4oLldyBF7CmD11fXGQKaq1bhJpga9pw-U-FPo_RIhzwLefc77YN8EiVOgoc-Jy68rYQqQWYWvp_YaCFTEWWP2hwuaVyOCInFID7ierElGsL71EPuEPKK7Da6UQteJJ4sqq-R88535dj3Pb1KUIm_a66IZE1DtW_cCnEDWjLJzcgBSOeh8Ln1zyfymgxktco1jOpESY_C1Ar051abuRAWB_8GfGo7diwHzanUEQGJL6ffXedzsNDPEgwFttvQ7TNe5GROPVfZAJ7Ao17HhKzD0bX_N_kj7MNyo8DZY3IE4orPpTlNWo0VSu2CvC3Pjrghwa_fJNuFjswL032jLpuYmMVogkSfhnf2WhPVvwyY7eH9KRa4-QcSeMt4zj3Brs7l0YDVKOomjFn2fNj9tTohXoZVw1nvsWPCoeF9LCVLL6S3ShWZdr1NxglA-yd8biBA8bpCOEmvn2IBU5Wo31kWK3O4mKbR-G4G44FvDpbRsup5YdJbo-zhQHD-2aAjrkTCY1LZnaGytCtjyGW9oEYYmhUmGAVc4yGHt-edjd6svmghp2JHqxIm_a1ufaktWoK1PWpzbo6uo1UvmSNhBUV7j5JUap5vVR9-TXtwUP4aZJWeELKnzQi8kw97_58manMqDp9hxl8TjeZP0hgodw57DgbVrWjBl0_cJFjS9IQXD74OeQVT_atpxAVzqSmrGMj8xIYl9GZnCpkMt605PWcdC8_ca3azdpcRomj4uqQMxT12Xb32V0Lepp-bkQgUOfeplmL8psvQ5DweyyiNV4L2U5Xuqe1Lhsh8sYRXMeueI8FFtTRbD2maUD3oLH52i7prjDV0Gg8DwqchSskS3_qbPDA4yMydSbimznrdqz2lXhhQvmjIBzQA1woIKINnoituG9tDcf2PFlQZloBPrYxP3U-0JQnJRw1AFRuElFud__s2G5vAmyPOFj5-ozPAdoJoKFCL68xeVi7v1FWUmQu6J25k2xyY8gRffNvS3brjQPskehmdfwGp3EDItsUGrjEQHyvl8JtGXdh_S30u4IxMtZQno-x34i9Kyk6Rd9UxqJ9TL2lfzdIxYFovMZXYfIN4vJb2XXnCWzd1QuGBv48YlzRhmECXygw_K2wf3m2ZsawBgrIO7cDo1DYmrZVg_PU2WX-cDW-xDTIA3w_0MtXV1fBkN7nuJkVNWhnpnjRqrjkQvyRIeEe1mJbxSzuCOg2YznyWLcj9RbVY5-n1XBHwvpPTFekdVijHIqLGyPu14qPK2zMoeylkm_A82osdSclkXTWYu3yEWvGijMXAkBe&cid=CAASJORosT8Ui8Rykl-Vw9ZDqUAPMMUune9c8yzbOMMOdkYQPMCxrg&rfl=1%2Chttps%253A%252F%252Fpt.lizspaperloft.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:10:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 547
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 May 2022 21:10:42 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220413/r20110914/ Frame 9E8D 25 KB
10 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220413/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e66bfceb15a6ee125dff79826be02a07b766843e6c660edf55ec0c22d1a407c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:09:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 612
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9777
x-xss-protection: 0
server: cafe
etag: 12512753850102923420
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 May 2022 21:09:37 GMT

GET
H2 200 dc_oe=ChMI-NXF7cij9wIVRsvVCh3Mogn0EAAYACDPmoBROhoIm9qCkAEQ3_6y1vIDGPX44t8DIMihhLSVEEITCK2Kpe3Io_cCFVOK_Qcd6aAK8A;dc_rmcid=CAASJ-Row093ftuAHf3RTltz17HdDZhuJEoZAl1n_Sr-nY65gW-G63gQ0A;eps=CIjhgBAQARgd...
ade.googlesyndication.com/ddm/activity/ Frame C02A 42 B
251 B 58ms
43ms Image
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI-NXF7cij9wIVRsvVCh3Mogn0EAAYACDPmoBROhoIm9qCkAEQ3_6y1vIDGPX44t8DIMihhLSVEEITCK2Kpe3Io_cCFVOK_Qcd6aAK8A;dc_rmcid=CAASJ-Row093ftuAHf3RTltz17HdDZhuJEoZAl1n_Sr-nY65gW-G63gQ0A;eps=CIjhgBAQARgd;met=1;acvw=sv%3D925%26v%3D20220413%26cb%3Dout%26e%3D0%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D20053%26vmtime%3D7%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26i0%3D18%26ic%3D0%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D399097614%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1650489589844;dc_rfl=[URL_SIGNALS];ecn1=1;etm1=0;eid1=11;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame C02A 42 B
64 B 20ms
19ms Image
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=COpcu9XhgYu27A9OU9u8P6cGqgA_n_cq7acihhLSVEM_mor3AARABIKqAwyJgldqigrAHoAGX_pvwAsgBBakCCmX3rhg1sj6oAwHIA5sEqgTDAk_QUYNs6IigaOHekCPRrMUdfshPE0DlYB7OYed8GmkmwNpq4qR0m8uzpCpLD3eez6qp8Jrd-g7eQ-yLEMrkksQ6dsRunJc-mtvph6s2IAjMxXuoW3Bl4dsn3N5sy5HgkrdY2srb-6FJkV0MpOrzOHSgt_rtMMm7dm97QvabtKE7o-Bzm81wsnD5moA7g-TU11CupusYUn5EzGV5VJk_AwCpOCG6R2berJPg6ds4COUvW2k6FIWEmMZbZtBWn66sC5XHtG9QuygbjPSI6APLw3STnFnWQrMe12wyv1varjT3uPlL4iR5sgFO4Tx0A-_ZJ8YOPHWVeMHfbfol0qOWB-saI-S8ib_V4qYpN7tGVLVz_53JCtV-m6S50P0JlB88NxrvBuMdjgR-Zr_YZQlcu7Kb7ERHN68LHaU6A8AwhpWmsJUlwATf_rLW8gPgBAOQBgGgBnaAB9GB5I8BqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIjhgBAQARgd8ggbYWR4LXN1YnN5bi03OTQ0NzI2NzAwNjA0NzAxgAoDyAsB4AsBgAwBsBPno-gOyBP1-OLfA9gTCogUAtgUAdAVAfgWAYAXAQ&sigh=HLT726Hjw58&label=part2viewed&ad_mt=8&acvw=sv%3D925%26v%3D20220413%26cb%3Dout%26e%3D0%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D20053%26vmtime%3D7%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26i0%3D18%26ic%3D0%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D399097614%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1650489589844

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame C02A 0
622 B 89ms
52ms Image
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjssMyOVYZIGs9n3O62EkJf30YSN-JhPwHpTHHb-A5p_LGe0-OV3R5jX_YGj0UqqH09XCMZ_uH7mHxjO_d9m5_t2hWrW6kRlia8zU194adk7l-vUNi47c0PfMvFCCt53YQnlySEXPS5-0ecAqfJazB3gdAR52RCaWTRSHFNZccWYJv3tGI9Mj1QNl6So4gZrdnJCyHYY127DI_Gk1CpcqsZS8Pj5NUDJVNtXUMVokXeYI7mfqihGFRetaHh7p70lehUJzoISTSIiqTVqfZgzwHXfi27MAiEswyQd46yd9kYYaweOzVqRBHhKumZ3bkvWhhx0veVd1YEALc6IS1dG6ZKfB-Dwm-ye9d0g-CQSF4Ivx0-dlP5ZccsDzqo61pv5rqfYLxIN8SK6tHqQ9UPJ1GvywuJXn47AAcxl2_ufIJWSnKRWzYjcLsLmRxKR00Xz73oV_5WTJKQcP0W0xlqLSk7lUYp8mofP_J9bfI5BlBG-FyrmmPpqGocu0q7uKRlDL1bXPyh9STd2IT-FT3qgsLtqc7EJc2YhMlCz1zZeF1yqj59cKMD1EX27TZ2ixTuIHpmilMjFg0IsQHlqoRtvbzL4OY18HKhyR98rxD9EDTrSTnV5KqBcipYSDZQf3Jy9Of8S6q6jaOf07Rl3k91RbffoGUr_6lIpfsjvbTp5CAy5TK-9fPTeRZxURz8rbTjwT5JNurGV-cVLxePVsFsc71x7TFWn31QvAJzYTYwT1ZFIvfIj3V9fV1GrlGocCNRZ2UQASDrvFPWviD-lx29UqrcZbswDAUnxzYFHiU0D7oy0ER6n27nn8aMJca5agbmv1UytvbvusnszpYAs7FnyNi4qquECfMo-WG5V5hNR8GU7UOlMv0d7Oqbb1NOfDZEkNAfgDyfbjRabB5ScuCeMg28MwDDRj3BwRqmQju9BgrOQhHpo4Ppt-Mj_8332YUfXfm_EAyQh6M6W8a_JUignumvsw3Ob9x3HOa0d_LAeEOXYAE-8Ts7zJuPyVfBOKiekEdMkGMm6zr5HJ9DPcNozd04oaSnzKmTNLmi520MA1sItJlJe8IR8JQt6wFFUQVthfPJ3kPOltusWFpSIsOwUeIrB4Vvcbc0y8I12R_fv9fNaMvxmbsIaU1IIzeSN4TfJH9iqH4UH4N20ZTZ8mG1tba9OKC0c7H5uQ2QCAGiNTNwM4wXe1D_cOTNPMD8ZTOITOHt7x89OEhZU0pui0ND66bIjNzcUddKSq_DUJ01KKQbUrH9-miZqQyF7xFPz80oB_SbWeehA1dWI_6WIJIpq0hI-EbqS9igM_4_w_Q7In9Tl8bQL_bgRvskPwHMuHD14BWBB50l8FUaxk5oGGxOuRUrMICAoLmmbxn1U8hFEBaKyUMqytmd4jsS8X&sai=AMfl-YRjFNAVd0GW42AEbD31p30xFR-lXchiZmm9ounsVzmGJeVByKl6UhwVnUfZCyIcIC7GaRdeoUGPrH6zfJrbLcMtWcxc8PALW6vRPHSO2CmV2Bx9jm7nrAigQnRXBLUAwJQnpELErVboSf19TMJTDnOE55TTp3vvb6d7AEJ8Sgju-SgiTy3L8IwFg5hazhsiQMAFqOHBHu3mpTPGA2kJmj73nMmYveY&sig=Cg0ArKJSzMvBEzfrnywGEAE&uach_m=[UACH]&fbs_aeid=[gw_fbsaeid]&urlfix=1&adurl=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Wed, 20 Apr 2022 21:19:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 pixel
googleads.g.doubleclick.net/xbbe/ Frame C02A 0
0 19ms
17ms Image
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=CM6y0QEQpvfjARjbwq7IASABMAE&v=APEucNU_O6a3x4DfcytJX9mNUYEt_3fNxpd8p7H1B8W3JhJjWHb80D1axi11cGtKQqCVA1uvMpfUQT1uU3f32vtn5bzcMcHVog
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.185.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s53-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame C02A 0
20 B 41ms
39ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=video_impression_ping

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_oe=ChMI-NXF7cij9wIVRsvVCh3Mogn0EAAYACDPmoBROhoIm9qCkAEQ3_6y1vIDGPX44t8DIMihhLSVEEITCK2Kpe3Io_cCFVOK_Qcd6aAK8A;dc_rmcid=CAASJ-Row093ftuAHf3RTltz17HdDZhuJEoZAl1n_Sr-nY65gW-G63gQ0A;eps=CIjhgBAQARgd...
ade.googlesyndication.com/ddm/activity/ Frame C02A 42 B
107 B 57ms
43ms Image
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI-NXF7cij9wIVRsvVCh3Mogn0EAAYACDPmoBROhoIm9qCkAEQ3_6y1vIDGPX44t8DIMihhLSVEEITCK2Kpe3Io_cCFVOK_Qcd6aAK8A;dc_rmcid=CAASJ-Row093ftuAHf3RTltz17HdDZhuJEoZAl1n_Sr-nY65gW-G63gQ0A;eps=CIjhgBAQARgd;met=1;acvw=sv%3D925%26v%3D20220413%26cb%3Dout%26e%3D15%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D20053%26vmtime%3D7%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26ic%3D18%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D399097614%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,0;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1650489589844;ecn1=1;etm1=0;eid1=200101;

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame C02A 42 B
64 B 45ms
44ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssG2UlWHA7_lAIEdboSiRX5kHu5FhRvxbRq1iLeF8PlaT47X353VlfdDWoig16urLt5RaQCklsdeLJrsMxrWe8q8HOXcRmB2U9Ge7MfkxUycwX_c6Y8xA&sai=AMfl-YT60gCa5PbchMbjQ8DS36_OGyMFqgSmp8VfBL_EOZmBx786t2454ifCTgovM47QLxINzBvNu_elDOVQb2Dj1BUbyS9GL2VTNy12QKN3h9YXmRqDSzRSTlE3v-m_5Ek&sig=Cg0ArKJSzF-xJ-CUIM28EAE&cid=CAASJ-Row093ftuAHf3RTltz17HdDZhuJEoZAl1n_Sr-nY65gW-G63gQ0A&id=lidarv&acvw=sv%3D925%26v%3D20220413%26cb%3Dout%26e%3D15%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D20053%26vmtime%3D7%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26ic%3D18%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D399097614%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1650489589844&avm=1

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame C02A 42 B
64 B 20ms
19ms Image
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=COpcu9XhgYu27A9OU9u8P6cGqgA_n_cq7acihhLSVEM_mor3AARABIKqAwyJgldqigrAHoAGX_pvwAsgBBakCCmX3rhg1sj6oAwHIA5sEqgTDAk_QUYNs6IigaOHekCPRrMUdfshPE0DlYB7OYed8GmkmwNpq4qR0m8uzpCpLD3eez6qp8Jrd-g7eQ-yLEMrkksQ6dsRunJc-mtvph6s2IAjMxXuoW3Bl4dsn3N5sy5HgkrdY2srb-6FJkV0MpOrzOHSgt_rtMMm7dm97QvabtKE7o-Bzm81wsnD5moA7g-TU11CupusYUn5EzGV5VJk_AwCpOCG6R2berJPg6ds4COUvW2k6FIWEmMZbZtBWn66sC5XHtG9QuygbjPSI6APLw3STnFnWQrMe12wyv1varjT3uPlL4iR5sgFO4Tx0A-_ZJ8YOPHWVeMHfbfol0qOWB-saI-S8ib_V4qYpN7tGVLVz_53JCtV-m6S50P0JlB88NxrvBuMdjgR-Zr_YZQlcu7Kb7ERHN68LHaU6A8AwhpWmsJUlwATf_rLW8gPgBAOQBgGgBnaAB9GB5I8BqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIjhgBAQARgd8ggbYWR4LXN1YnN5bi03OTQ0NzI2NzAwNjA0NzAxgAoDyAsB4AsBgAwBsBPno-gOyBP1-OLfA9gTCogUAtgUAdAVAfgWAYAXAQ&sigh=HLT726Hjw58&label=vast_creativeview&ad_mt=8&acvw=sv%3D925%26v%3D20220413%26cb%3Dout%26e%3D19%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26at%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D20053%26vmtime%3D7%26is%3D18%26i0%3D18%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D399097614%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26pngs%3D9,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26ss%3D0%26t%3D1650489589844

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 204 csi
csi.gstatic.com/ Frame C02A 0
17 B 27ms
27ms Ping
image/gif 2001:4860:4802:32::3
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://csi.gstatic.com/csi?v=2&s=osv&dmc=8&puid=4~l282vy0b&c=8289927038026&slotId=4144963519013&qqid=CK2Kpe3Io_cCFVOK_Qcd6aAK8A&fb=outstream-lima&gpm_i=9&gpm_c=9&gpm_a=9&smb=1000&br=890&mt=video%2Fmp4&vs=1024x576&dm=20000&event_name=first_play&asset_bytes=214449&video_bytes=0&cached_data_bytes=0&js_cached=false&css_cached=false&num_assets=11&num_assets_cached=0&num_assets_cache_validated=0&num_assets_unmeasurable=1&video_played_seconds=0.00&video_muted=true&video_seconds_loaded=0.00&met.4=ff.wi~videopreviewstarted.wk
Requested by: Host: imasdk.googleapis.com
URL: https://imasdk.googleapis.com/formats/outstream/versioned/prod2/outstream_web_client_20220413_RC00/outstream.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:32::3 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
last-modified: Wed, 21 Jan 2004 19:51:30 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 7234 0
20 B 42ms
42ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=34&t=2&li=v_h.0.0.0&bgai=BegLi9XhgYriHJMaW1wbMxaagDwAAAAA4AeAEAg&bg=!BQalBkLNAAZvJBiFTyQ7ACkAdvg8WkWRS-qCtuwwfvA6kKYHvvhFAZRFWvhb6Dc0AJlRASTCjhT4egIAAACkUgAAAANoAQcKAK9jJD9RCPcrMT5ba0T79rl7NI2bjsDAIPlSJVgxRfK0XlfhUXnRgt3vlPPNAm5A9qI7oncc9h4B11jF5j3WQljwzWp5ZGWWLUaFoT3iajXjh4rViRRU4PE34i_sj190DjsuTuCSKiFPt4tP74XZiqayUB40CpxB6dsFNyv-0AnAnbAqArjpqk5eTyqGJV9JJ72BxBzmXWlFjCqehgZLJK2J6_PWQqI43SKVRmHy9H8mmQLoIm6zup12VKC7l_WcALvYDX5HB5nqVeTuw6e_yU7FiWCVVpi2trfAp61M0lQOoPjkODu2NkZhu4KuLRl_MEsOjE48Axs92pYXHiJtbiaY3jL9INZSjSV86VOb5DojgPmTubgb3yL-Y7Cw4ueRxFz-2KoAejQb6lQa4okTyEZRGHTnC_B3_AMthVHh4hTpjX3F4TzCwoebWSDn5GrDHBwcTFl59IyVTKHPmEsyfpGVWlO44KCIprW5KNOXMcxrWEn3FVLCxx0EkS8n_o1vHr8hiiwEUdRT7Pd6-l8JaKrH6SuGw4D0jBTkRsb4JDYWqYbWHD3qzSxISnIZG8MppHHPXWiAw7MJP5nadGM9B3QC9goKS397b--Azg9g_JtO1ICFyzasZ-3bZGKUYUjec9HwyUJ5CcJgaUkt-40p-tIDh3kA7ka6H4pJf7KhOuz3RCXLFeA_ErXKU88KIjAnR7sEXVbgyRohdMLfwsZnipDUNs2KqaqYatpM6uPTuD7KHEUmagdGsXsuZjAFZMpsxKS4gn55jT6QuwIgYU4GA1EPmOkcXsiMvjH8MtovOvM2FZ95tyu0Qyde_tQJhg30PTD1cTEe0zFqWyUl9E-amJK28yf6oW_j6KdozBgCbH_uOoAk4guiXOz2euoB8f4xjYu2q4rdbD5pTzXCbuP8bMbKK5y9Z3gaxVeM8XofuZ8HG9keTGT6XclR6kUh1MH3vYel65hkb8HdzByc_di52rjtXaD1gaB7TaomZZF49yB85KD4yXlyAMMPi_2Fihwv3bGYMf54Slyge2XJxeEXaDaDrVuqsRZLxkvvmaJykzd9rEcG-OnSAG0cRVR5iwAa_3ijLcFQQ4kU3Zw3FtCCClDVgUcn2PzgBAAY9u9Y-17qhgYDCz6Xbdw-KRYxEpZDDf-9ldq-ECieMCwQ7lzsFHeYiS-6XN9SjyXwN5h2F0XwcWGiGnmdQ1Oo2rQ5TgWAGRyY6ZD8QOatvION

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 300x250.html Show response
s0.2mdn.net/sadbundle/3542255663189065728/ Frame 6B02 46 KB
11 KB 30ms
15ms Document
text/html 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/3542255663189065728/300x250.html?e=69&leftOffset=0&topOffset=0&c=V46C1GHIaV&t=1&renderingType=2

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_275.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

78eaddff32589c813d37f5cf5b1f8df80c174f9b3db591975ca8fcc482d3e53c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 21:19:49 GMT
expires: Thu, 20 Apr 2023 21:19:49 GMT
last-modified: Mon, 24 Jan 2022 12:53:31 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H2 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9E8D 0
64 B 49ms
49ms Ping
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsssBVb0KRfV-8VAG8i8lZWgl6NdJje3i5Kq4U1fyWzOxqOOuXDGZwKYYMvitDUInjOHkGZRu2LrhOrEttmyPLraZZSRc4yH8jaUn8f80PYywtnyGORJP45jSEsPBZLJ50mnS9Bm6it_HZuqK754DkVQ9i5sxLUNuGCZgiNHpo_XLXA_bDA60TUllHc2bRKdkrRixYUgU5T-x5rt5igZj64QLmR24JYDCer0WbVWJgC-onLZBd5IFi8d2M4ucVNCMXgIGNb_7OtR3JAsGumgi5Uqk9bBc0biU0pmyXcw1h2flH-aXDoxpMjUDSf7LyfU-kMNPGGMi2IvkzbNml4YKIYR8gj8gXvhGrdZ6xv5KDboIWzVBAmri6uU8zo9UJK3hZdZaps4bT7jp6Mhn2OmWXhorkKZYWaFUOhjqD1VUuHwgPf5aLOf7UA8oM-DvWPTF1K2q0Kiq_CLfGPuYY6Q-u-zDwaJf3hM4NmsGaqoJZEDJ4OwP5t2lT5gJ3ePnkbovJpAhwG8nIYPyM9eYmr3WLb2fzGgU8MkEcoF3g3mQX-QfGa-IRbwROQNyI0Wo2ly0_sQZHdxgsrjt6ctZ9vMrRKdVNSpnZIoc2kWKX4hj3jjUGFvT1-n0m07oKRWYtfg734SlYO5Q1yQtMBXE_IXQLXytD5nnAkCnAiIIDFkxMKUPZ1EbyUaggglP6EQQMG4reWM7v_ZG2NpJbCMlVyMkEX5kRSyyxMDBc2AOR9Al3K_NNLCZF4bEtTnWDuSZVKjEv7-5lnxs9z4GBcA8rLQbJidEQFOWaODuLB_6tL6EWnPxEX_rMfSfAGBhjl76V9Do_v81FaXnyAu6PymgmTsr_zsqvkC03Ov13-S1EbvYMbncU0fevymn-A7KQM4TcZJZgYmjJOaGPRc8H335zhPPRvoEFE1lr1fdgkWht8Qwf8KXs2yPGVdybt9_psqfKnyltnhEB7OTEs2sfXP04fOt67RD1dYAo7R3R806a2pUKue7TSqA9eNDvHB5pLAiWsCyMbp-JH20RAv1NxCOJh3RUQNoup8aBpS8yTennMeQde2RCnvq6gKe1UAmz_9-fWSLfHdqfVKGHDIgarKuxSZL0laTF3GjZQ1guyS9o3wmv43kRmbvv1HmMeQGj0E6shfPM__tDvegcBSt3bM_7KuT6XiitPj4R07zGgsdZLCdkCxIpHE6FBvj046NydJXBjVBd13hZ2Z8Dy9CgG7fSmyD87NyTBDa7eOdTmOnqUWSLQ6DSXr-Rb0rqpW8fHu_tz5BRr-lIo3zIcitqu7kAP8hGACvIF-BKDaFo80yoR-yL-ICBUseQVlCrdJ0egngVzSFAJo84Kl-lsu1nY0XP0&sai=AMfl-YQr0e7A_9uZT-m08UsLiwTAP-HRiZFXijAm3OEpAFCwNMEkY_2MVfo5NEM9d2PHEtQccseuCOjEb_CiO-XlwwUkIPuY_fQkiL9YUagKFTVjt7NXpwida0_aPE9Zl5-deW-2c7As0YtUfy_sGVSrLc56W8MB6Xw8vZ0KzZ5o1KEq0RzmCG8GJZiGvxXzcimnQz8nLQeTHQvcUrh77FNHPA&sig=Cg0ArKJSzN-UKmm9B9KCEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=81&cbvp=1&cstd=56&cisv=r20220413.82138&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=

Requested by

Host: pt.lizspaperloft.com
URL: https://pt.lizspaperloft.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Wed, 20 Apr 2022 21:19:49 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 9E8D 41 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 08:56:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 44609
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Apr 2023 08:56:20 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 09AE 1 KB
749 B 7ms
7ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 55565
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 05:53:44 GMT
etag: 48472445140208031
expires: Thu, 21 Apr 2022 05:53:44 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 9E8D 215 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 3ba9caa53f9d0fc2c7182f39ba4c4d5e66c54bc55329a21d95ab5fb3fd4db815

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ Frame 580C 66 B
0 Image
image/webp

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: b71c20271d9c80d1a71aa0ab9935281c4fa8ac404533f1a0747d7fb03fc68e79

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/webp

GET
BLOB 200
OK 1152b6d6-6aeb-46a5-9b1f-21f313016244 Show response
https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/ Frame 51E2 668 B
0 Script
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/1152b6d6-6aeb-46a5-9b1f-21f313016244
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/scripts/animated-creative.113bb23e864a7f983e9d.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: cda3c421b62828768ee2741a35bef36bcfdb1199ee3eb987269f7d1ce2dd8876

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Length: 668

GET
H3 200 Enabler_01_247.js Show response
s0.2mdn.net/879366/ Frame 6B02 118 KB
40 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_247.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3542255663189065728/300x250.html?e=69&leftOffset=0&topOffset=0&c=V46C1GHIaV&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e2ec81b19233fd4cd6ef5adcb45c0cbec6bd5673716ba0454ce56b67486ece46

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3542255663189065728/300x250.html?e=69&leftOffset=0&topOffset=0&c=V46C1GHIaV&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 20:04:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 4548
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41099
x-xss-protection: 0
last-modified: Mon, 27 Sep 2021 18:45:07 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 21 Apr 2022 20:04:01 GMT

GET
H3 200 gsap_3.5.1_min.js Show response
s0.2mdn.net/ads/studio/cached_libs/ Frame 6B02 60 KB
24 KB 15ms
14ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/ads/studio/cached_libs/gsap_3.5.1_min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/3542255663189065728/300x250.html?e=69&leftOffset=0&topOffset=0&c=V46C1GHIaV&t=1&renderingType=2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

341e0d761251ee538d0cad6322c66abdbf78dc7d6f3ca62f3459fab822a2103f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3542255663189065728/300x250.html?e=69&leftOffset=0&topOffset=0&c=V46C1GHIaV&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 24155
x-xss-protection: 0
last-modified: Mon, 31 Aug 2020 21:23:17 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=0
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Apr 2022 21:19:49 GMT

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 9D0F 22 KB
8 KB 7ms
7ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 44609
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 08:56:20 GMT
expires: Thu, 20 Apr 2023 08:56:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 580C 20 KB
20 KB 56ms
25ms Font
font/woff 2606:4700::6810:d40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F59c910d931ae9c0318638256%2F58439817-62c3-4146-b079-bf26ee5c4e96.woff&t=%20GISTdehimnoru%C3%9F%C3%A4
Requested by: Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:d40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c4ccadf73a1fda71065011190d5644f48979b6095b0f6bbbfa64b8043c5fc2ed

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
Origin: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:50 GMT
cf-cache-status: HIT
last-modified: Wed, 23 Mar 2022 19:06:57 GMT
server: cloudflare
age: 2427173
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=58439817-62c3-4146-b079-bf26ee5c4e96-subset.woff
cf-ray: 6ff0eba1a8b4cc46-ZRH
expires: Thu, 23 Mar 2023 19:06:57 GMT

GET
H2 204 current
dclk-match.dotomi.com/match/bounce/ Frame 09AE 0
104 B 107ms
22ms Image
text/plain 2a02:fa8:8806:13::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dclk-match.dotomi.com/match/bounce/current?networkId=14000&version=1&google_gid=CAESEITjlGDZOE5ziyZaYTArnoA&google_cver=1&google_push=AYg5qPImiM3uHM_UL8dlO3JWoehjvj2AyDIAOOmoH2Z5Mmu8-STPyd8uf2ZJhgEV0z2AorrlvW4f0hb6HBmOfdYuvdQIlYv8-g8
Requested by: Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:13::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:50 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 09AE
Redirect Chain

https://gcm.ctnsnet.com/int/cm?exc=1&acc=crimtan&google_gid=CAESEDdRJ9tKUTMzSXS4p354hP4&google_cver=1&google_push=AYg5qPJy6lycSuWB8geqwqYX1BSNcXW7LLRhFhuU4gB8fXrzLyUDF5c-7Eodwj48_WDXxYhvmn9v1c9OpqM...
https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPJy6lycSuWB8geqwqYX1BSNcXW7LLRhFhuU4gB8fXrzLyUDF5c-7Eodwj48_WDXxYhvmn9v1c9OpqMlarlDTJNRalra0DJV&google_hm=9yJpKkfjQn6aXLh_Dbnz2Rk

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPJy6lycSuWB8geqwqYX1BSNcXW7LLRhFhuU4gB8fXrzLyUDF5c-7Eodwj48_WDXxYhvmn9v1c9OpqMlarlDTJNRalra0DJV&google_hm=9yJpKkfjQn6aXLh_Dbnz2Rk

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
via: 1.1 google
server: Apache-Coyote/1.1
status: 302
p3p: CP="NOI DSP COR NID CUR OUR NOR"
location: https://cm.g.doubleclick.net/pixel?google_nid=crimtan&google_push=AYg5qPJy6lycSuWB8geqwqYX1BSNcXW7LLRhFhuU4gB8fXrzLyUDF5c-7Eodwj48_WDXxYhvmn9v1c9OpqMlarlDTJNRalra0DJV&google_hm=9yJpKkfjQn6aXLh_Dbnz2Rk
cache-control: no-cache, must-revalidate
content-type: text/html;charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 1; mode=block
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 AdxPixel
tr.blismedia.com/v1/api/sync/ Frame 09AE 0
172 B 38ms
14ms Image
text/plain 34.96.105.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.blismedia.com/v1/api/sync/AdxPixel?google_gid=CAESEFSuo7Wzy9Wfz6k55euqG-s&google_cver=1&google_push=AYg5qPLgcfLD1LamQAFgWZBZ9P0wPO8xsbOVJPV1nnE1iF2XmlSV1wAdqDGXAeCPSZItupzzwfaCkIMaTO1Fl11Bkrp5TfM1bG_g
Requested by: Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.105.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.105.96.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:50 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 09AE
Redirect Chain

https://c1.adform.net/serving/cookie/match/?party=1&google_gid=CAESEGgVs3uWlDd51Gts77lSUwQ&google_cver=1&google_push=AYg5qPIjopDMJNKdQ_K8sMmLERELR8P7LfRGcaYuGNPLyhoAul3bLn1D9H3hF_dojpZjL-kGXTEK6ETx...
https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjcxODE5OTY1ODY5NzUwOTkyNw&google_push=AYg5qPIjopDMJNKdQ_K8sMmLERELR8P7LfRGcaYuGNPLyhoAul3bLn1D9H3hF_dojpZjL-kGXTEK6E...

170 B
188 B

16ms
16ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjcxODE5OTY1ODY5NzUwOTkyNw&google_push=AYg5qPIjopDMJNKdQ_K8sMmLERELR8P7LfRGcaYuGNPLyhoAul3bLn1D9H3hF_dojpZjL-kGXTEK6ETx0IJWWiz9ZWpgmTbmZ31m

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:50 GMT
server: nginx
location: https://cm.g.doubleclick.net/pixel?google_nid=1024&google_ula=1641347&google_hm=NjcxODE5OTY1ODY5NzUwOTkyNw&google_push=AYg5qPIjopDMJNKdQ_K8sMmLERELR8P7LfRGcaYuGNPLyhoAul3bLn1D9H3hF_dojpZjL-kGXTEK6ETx0IJWWiz9ZWpgmTbmZ31m
access-control-max-age: 86400
access-control-allow-methods: GET
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 dds
rtb.openx.net/sync/ Frame 09AE 43 B
350 B 49ms
25ms Image
image/gif 35.227.252.103
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://rtb.openx.net/sync/dds?google_gid=CAESEEPTeZGna7PHw6-rFTiyZXE&google_cver=1&google_push=AYg5qPIdmVdHOtumr2Ll17M0jzUVKJgFeap644Xe_wyCntg-5cZAfIlqpSjmF1DvxEhXlq38hlkOE4PC1bbMl-qXAHw2c289UpGQ
Requested by: Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.227.252.103 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 103.252.227.35.bc.googleusercontent.com
Software: Cowboy /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:49 GMT
via: 1.1 google
server: Cowboy
vary: Origin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: null
access-control-expose-headers
cache-control: private, max-age=0, no-cache, must-revalidate
access-control-allow-credentials: true
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
x-request-id: ld8rs7vc04bvv3j9tecliu24tsrror19

GET
H2 204 exptsync
ads.yieldmo.com/ Frame 09AE 0
35 B 124ms
30ms Image
text/plain 54.77.236.4
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.yieldmo.com/exptsync?google_gid=CAESELMT44Q_s6P8GfRKGdRXBEs&google_cver=1&google_push=AYg5qPKP9huYBjWUtl6Jv0GCRzJKZ51PjHDzJ-e-UBCqmQEw021s4J3Q_8McTZ9fJhkQVOp_cgvTW6yJsIZfEYIHL8uKPZoNOGRZ
Requested by: Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.77.236.4 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-77-236-4.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:50 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 09AE
Redirect Chain

https://ads.avads.net/sync/ggl?google_gid=CAESENjEV3JijkvDLCAzQ0D33tI&google_cver=1&google_push=AYg5qPKYw2mjPzpK3JKDSUZM4twiGAOEvEpe6Po66biDllrWxVjOzepAq2byd7pJKTZIfv5wb9nkNC_p-gn8N2F7MQ9cU0BGLmvD
https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NGRiNmI0YzEtZjc5NS00MDYzLWJmYzItOTY0MmExMDkwYzM4&google_push=AYg5qPKYw2mjPzpK3JKDSUZM4twiGAOEvEpe6Po66biDllrWxVjOzepAq2byd7pJKTZIfv5...

170 B
188 B

16ms
16ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NGRiNmI0YzEtZjc5NS00MDYzLWJmYzItOTY0MmExMDkwYzM4&google_push=AYg5qPKYw2mjPzpK3JKDSUZM4twiGAOEvEpe6Po66biDllrWxVjOzepAq2byd7pJKTZIfv5wb9nkNC_p-gn8N2F7MQ9cU0BGLmvD

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=antvoice&google_hm=NGRiNmI0YzEtZjc5NS00MDYzLWJmYzItOTY0MmExMDkwYzM4&google_push=AYg5qPKYw2mjPzpK3JKDSUZM4twiGAOEvEpe6Po66biDllrWxVjOzepAq2byd7pJKTZIfv5wb9nkNC_p-gn8N2F7MQ9cU0BGLmvD
date: Wed, 20 Apr 2022 21:19:49 GMT
x-envoy-upstream-service-time: 6
server: istio-envoy
content-length: 0

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 09AE 0
12 B 16ms
15ms Image
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13I8wW9ULObs9qDe-dOiciy-cBJPRS3yPQbURDCPM76Al0JVCF4J2pBMgUfV7PR5qWZWkyPM6g

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:50 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 container.html Show response
d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 8CF2 6 KB
3 KB 8ms
8ms Document
text/html 2a00:1450:4001:831::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022041401.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://pt.lizspaperloft.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, immutable, max-age=31536000
content-encoding: gzip
content-length: 3108
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 21:19:48 GMT
expires: Thu, 20 Apr 2023 21:19:48 GMT
last-modified: Tue, 02 Mar 2021 20:17:03 GMT
report-to: {"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 580C 18 KB
18 KB 21ms
21ms Font
font/woff 2606:4700::6810:d40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F59c910d931ae9c0318638256%2F63565b7a-3d57-473d-8aa5-528f9c57fb18.woff&t=%20ABCEHLNTZisuz
Requested by: Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:d40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cb08a7877623a64fa891caad146ec64c94e4cfee3108951848ceef9da5968c8d

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
Origin: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:50 GMT
cf-cache-status: HIT
last-modified: Wed, 23 Mar 2022 19:50:42 GMT
server: cloudflare
age: 2424548
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=63565b7a-3d57-473d-8aa5-528f9c57fb18-subset.woff
cf-ray: 6ff0eba2798dcc46-ZRH
expires: Thu, 23 Mar 2023 19:50:42 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 9E8D 0
26 B 60ms
44ms Ping
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjsssBVb0KRfV-8VAG8i8lZWgl6NdJje3i5Kq4U1fyWzOxqOOuXDGZwKYYMvitDUInjOHkGZRu2LrhOrEttmyPLraZZSRc4yH8jaUn8f80PYywtnyGORJP45jSEsPBZLJ50mnS9Bm6it_HZuqK754DkVQ9i5sxLUNuGCZgiNHpo_XLXA_bDA60TUllHc2bRKdkrRixYUgU5T-x5rt5igZj64QLmR24JYDCer0WbVWJgC-onLZBd5IFi8d2M4ucVNCMXgIGNb_7OtR3JAsGumgi5Uqk9bBc0biU0pmyXcw1h2flH-aXDoxpMjUDSf7LyfU-kMNPGGMi2IvkzbNml4YKIYR8gj8gXvhGrdZ6xv5KDboIWzVBAmri6uU8zo9UJK3hZdZaps4bT7jp6Mhn2OmWXhorkKZYWaFUOhjqD1VUuHwgPf5aLOf7UA8oM-DvWPTF1K2q0Kiq_CLfGPuYY6Q-u-zDwaJf3hM4NmsGaqoJZEDJ4OwP5t2lT5gJ3ePnkbovJpAhwG8nIYPyM9eYmr3WLb2fzGgU8MkEcoF3g3mQX-QfGa-IRbwROQNyI0Wo2ly0_sQZHdxgsrjt6ctZ9vMrRKdVNSpnZIoc2kWKX4hj3jjUGFvT1-n0m07oKRWYtfg734SlYO5Q1yQtMBXE_IXQLXytD5nnAkCnAiIIDFkxMKUPZ1EbyUaggglP6EQQMG4reWM7v_ZG2NpJbCMlVyMkEX5kRSyyxMDBc2AOR9Al3K_NNLCZF4bEtTnWDuSZVKjEv7-5lnxs9z4GBcA8rLQbJidEQFOWaODuLB_6tL6EWnPxEX_rMfSfAGBhjl76V9Do_v81FaXnyAu6PymgmTsr_zsqvkC03Ov13-S1EbvYMbncU0fevymn-A7KQM4TcZJZgYmjJOaGPRc8H335zhPPRvoEFE1lr1fdgkWht8Qwf8KXs2yPGVdybt9_psqfKnyltnhEB7OTEs2sfXP04fOt67RD1dYAo7R3R806a2pUKue7TSqA9eNDvHB5pLAiWsCyMbp-JH20RAv1NxCOJh3RUQNoup8aBpS8yTennMeQde2RCnvq6gKe1UAmz_9-fWSLfHdqfVKGHDIgarKuxSZL0laTF3GjZQ1guyS9o3wmv43kRmbvv1HmMeQGj0E6shfPM__tDvegcBSt3bM_7KuT6XiitPj4R07zGgsdZLCdkCxIpHE6FBvj046NydJXBjVBd13hZ2Z8Dy9CgG7fSmyD87NyTBDa7eOdTmOnqUWSLQ6DSXr-Rb0rqpW8fHu_tz5BRr-lIo3zIcitqu7kAP8hGACvIF-BKDaFo80yoR-yL-ICBUseQVlCrdJ0egngVzSFAJo84Kl-lsu1nY0XP0&sai=AMfl-YQr0e7A_9uZT-m08UsLiwTAP-HRiZFXijAm3OEpAFCwNMEkY_2MVfo5NEM9d2PHEtQccseuCOjEb_CiO-XlwwUkIPuY_fQkiL9YUagKFTVjt7NXpwida0_aPE9Zl5-deW-2c7As0YtUfy_sGVSrLc56W8MB6Xw8vZ0KzZ5o1KEq0RzmCG8GJZiGvxXzcimnQz8nLQeTHQvcUrh77FNHPA&sig=Cg0ArKJSzN-UKmm9B9KCEAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=330&vt=11&dtpt=249&dett=3&cstd=56&cisv=r20220413.82138&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=

Requested by

Host: pt.lizspaperloft.com
URL: https://pt.lizspaperloft.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 21:19:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 pixel Show response
googleads.g.doubleclick.net/xbbe/ Frame EAA1 624 B
297 B 19ms
18ms Document
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGNOd9sUBMAE&v=APEucNXdylNJhUE8RZ6NoJnRAemhHeC6mn_HtOkFqWWjFyo2T3pPX0ndi8eXk8DC8M3UlR4m1DZLodlLKqX0-NElUFsxn3Ez1ytor1BLDhMFHMkzpPA-HC5L1_ETltXqzg6KNlAW-fw81dmTINjXGTsCpeNCjUa5aqXf0hvV-97Y3RXayy2vWoBZ9n8HyKgG0H-IcCSlqaSnZgGDVoXqJbQJsk_Zzph_UA

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9ff367082be1d94abc86ad1e75ff921cc5d53846e860267372fade66305f9120

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private
content-encoding: gzip
content-length: 276
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 21:19:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 ad Show response
googleads.g.doubleclick.net/dbm/ Frame 8CF2 83 KB
34 KB 54ms
53ms Script
text/javascript 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BaD9iLFoA6QS1D0Ww2LaZTCBfQISOZkhkUA1HNQ8KVfoQXdPpiXQ-ikFxWOZB4x54P8NpVNJZPM16vzwhDwLxMqzoUGLn8hG7K4j5hz0fHy0hPgs_Wm-4anZkqp1asU5dibLlS23lJb2czajJ0jdGY3YYZOQ&dbm_d=AKAmf-DsAKyoDFvtFzy5vaxzKfTqJOpWsEtWQL5c5XjgKdoEUnJCBkS6-KgTlz5r0jUTGryHuonIT-pjYbSe-3Eja9g_S2urBzSKqFRehVEW18_PjClKVI8FqgLyNle8Vn60L6VGkRzynw8h97LhbW0qFkdAH2TQ__L3m4KObBWqn_QXrQiBKBQwafZOPjkzOL6Gf80j9YKn8GIwvza9A4Ao6OU_4VWzhjmH0kQ3dC-7BSCBjTyqUQLtdMrkAxdvP_hSElBMhLv2GaUPctg3uN1NmWev-Hc0L6VJqqG8CSdC7KZv-zX3ZNHybrnGnJDgwlHPL58zptO2WD6U-R_2U0Tvon4yWuo97qKIw_S2RdnJwHwlkoFgM6PaA1kfPlR2JEbVMwflM67XWX-Y7GFpGtCR9o1K6VEpNp2fHes-xCLNiAEju1xjSa7mAsb7SL-0uvFgfrjhNHUrHDQpyD1HJ6_6DirFFfFGtIcPHOAKhy-aBM97j4VdsRfuPkAu1T8e08ydBY84F-zV_gIWsafsyNLknsqlFasnUNTQgL9jd2_VQh3Q5cBpUJktIsFrBNwGUugs-Ea5eTnQ8Wd1lNkrocY7KY6ClwFl8mYpgab5SnX-398B6sn3L-iNAJGNFEcgIdCpVkQzlav05aNYJzNC1KtnscdCcZik8d8jqPpWxMkT-m-DJQW0vEmugR4uoqfb9xibE5mgy0fBduX7Zvz7gmiDmG2clrSLILgGNfxbmTcnr4XGjOqe0dZ7mxFFUSiP7OYMGhEBnROy-PsxivjgkWl2Zz2uDlZhj0DidpxuncgWRH-GTsueoFeBTKX-Zz494tcurJyYhbS1xPDfzezKSVqMZN5AZIogQY81ou-8K5pRp-yLnIrdg_U41t_dOHkLejiMoikYxkxDJMtXvy3_HjliZevCiBhoVMI68uS3X2u5x0Osq-XCjlIn-nno615PbItZHHRH0RrY-2_KLjE-iHWGtrbGkNVl13teE_RNx_u3X8J77xJMpyK6FjRW1z6Abe5P36pgxDF4wAAIvXs2-VW_HUYi-LsCjbuPRtUtQEHVYCVzM_PmMyt_Ndt7A1ipfLWXW3-Pm5b-BPINcO87oUmxcYgrqyjzzbtJqSmnXifqMAcR8UsHq6vw9BYPawF38N6OT4QpUFdDPxKWtY9ynm_DsEYtDieNxe466uMjJQE2z8TC16ygZ0iWYn2DmtWQrenqzxbJaFCWyKuVLqOdGPBmjNUI8HeoyM0PnDg_-12cqQlUoTTKk2fbARLMEQ5LTYqHOfwhJGJ5u5olLpTGuZtuO52kLC1SQupdDXLqzTnSuOOr4z0ADqxTS8ZgFw4keVQWxG8WexKeo9WgRhVP0qZ4OWB_IVKjyCQIwxO0o-wbXv8_qzzS54JC36cqoFwDDpyi8e2EY3ykbvlSf3hYsMwEyGSWYqyzRCzGC6PR2kd55bvOg2_q725Zo_4b88Mvd4uA5w4aLtA3P6XDCLkUJBMalxXmd2SHsQoY74VEV1XHxEW4QOcAV5ZWc4nwFjsUt8SGFjjAsAhuoC3DUoKVODS5yGEx1XImfrNbeJoK-SxOkFNV70Q6iQAvRz-V6vniHq3Eqf5ZsKcCWSRZBej2LJazzg4rbEm_VdbMesB_uZf61-71QmV34IUXoMMnOL2YMblg6-pRkP4EmmfwV7bL0Pc0Dc-Ox2628ch7P85Q8GhnveGDf3-S2lSc2tihg7x5bAOWnt1JZliyf9M7q8G4JyaTJXfZcFX7WoOhJoDp0JmIUv77-TkKDr4_vlqMYbgYuhHmJpzBxxg9R7rJLcFsXP51lHQ_htbSbeo5RHJJqsKcE-Lo4eS3-FUVlYBK05kFLyk0UbYV-M54xUY7JReL3JwZH9fIl0XQk6cRl-zEbC3OEd-XTsmkIYt009ddE_UCJA4D_aNLJIRMr5ueQz7PIW9ATF-eqV59ROxz6lfrBxI1XLhWQb2c7B6Q8f4XZq60CosOFcW-ypTB98uZVn8j5E6Ub-L0RC8JcvE53l6tF2HCbiyPVHGqHHqixB92CQ5uoI-4F1jKYlCoh0-QUSouokTxYZhWiBU-xilasQD2wUq_ZTiOkCLp-ccxuns7TTsNkb2hjdEDn-xR7c6JDi7RhSOChx3ZzIgUSIvu1d9MzJdMHSFBdSeda5_hQXsvO_pFlf0gAbRarze7rz4YHxin4jSp9_sZLVvsPKDuujeWinuhvc_udWM2RmSDlhcfi_i1T0U0mn6XQgRnFvbCrw_ntfMar83PqK_2-Up71gv61zLVLLWyd-QHRRhPcKVdPB0u5DUU9lKYovWHbM9UH1BdHgWQjS2cKMa1FJROVxwYGi36BaPBUvUTOIs3KsV4dIyhqxlJ5W7azhBhondR7LIiISvV5jI2G-NaekupDkij9sB7KQQJuBEw0DUX_Wzbf-yh9TElNXeSexXNyzB_E-cbwPwF9dClQX4Bn_3A32_b6c9KB-tTGn-xHlj8t3TwH1U3pVhhy55NV3o-qxt72qzs44CeUWo2N7khaj21Mzij2cGU6KJby3bR6PTHmYdHC2gQjjGtUrWuVxf9TfVijWRpFnI5OcmajUUCpB3_kY2_dsOtTPeMlM9qVs6xy0Vc8T1mfais31wur4NW-nXqF837LCi5PuQj7DXEz_j0pC6EfGkM4DxN2AwCWNhgf31EyIj6xisfXw8t2pBxDzz5tLS7Nd3E46XSY6QogvELz1oaOyXSWK3Uj8in6XrMKW-GflG3Bzvh4soj3gzNRfxF_lC8kFArb4mt-cv4OWCgRv8zr9xGWywsCACL5ahk1b3KV2ivsLkJwu1Zd3oBKU1pTQglj0pPfywt5dD3qn5PIuAfOvdKWaAs6qZzOuLLcvWRTUHyJbWn1S65vPQQybB1CqJgJ9NdDiUuMi1Ss7NHk82zEn22I9mPanLLmcKFSArR2Cevj_Nc4U3L-tehassRyFCY8SadtQXRB-mF_hy1oIBhyUrLBqegk1EBh50EY7Tptge8Ga50Aa-sqpGqf_YknFXiOozUxqZKpkokvhF7_fJoG-ejtF42AnpnQ4C3_YZcQjLhMkDkeqy1c95bg19oISt1guIGOqQuEwtIoZQz7ATsNDG4pGXyH6Zx5FvWoD1-VL4cezt2_BDQLpfHrH4-FD83nByCF1cpsP3zTdhWVOJgIpwVbfuYKMdFFL109RNAwcQQ1AuhZ8MoIv4LB4kpWEnVwTU4uAN9FwIPD37iDcakTF2bamfmB3SwgRvnaOnyx4b3FPcR8a-EBH_vaBsCM7KuuvuuTHNgMX5gF8E-ndCFMtEZ-qCJBOsAuVOAZgHTGnBcnVQwZXeg4-pXBAc5VoidzJXEsU5WVSZzDR_sovJvfMsrsqfPKimx0AiwhdGsIp_MdNl3eFEI5aeHH9KrWDt4RSVbmpy-OUbAoJJbIcTeZupTqozU3eUc71M&cid=CAASJORoWlG5a4Yd5eFwl3Ot2IpzOkqblRXxbm1pxsn4s2mej7jE7A&rfl=1%2Chttps%253A%252F%252Fpt.lizspaperloft.com%252F%240

Requested by

Host: pt.lizspaperloft.com
URL: https://pt.lizspaperloft.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f9d6ad667fb61dda87c8e7618d2d2c0ba596e2aeb3c3e372448f9a23aa1294bb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:50 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 34306
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 gen_204
pagead2.googlesyndication.com/pagead/ Frame 8CF2 42 B
63 B 40ms
39ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=xbid&dbm_b=AKAmf-C0uyUaN2efx7IifCXsU-MWBPza0Wb10PncBw3gyCsvOt2uv1Ygk21tqSNgogIhpIqRbHplbvxCGw6zowr9HKF5-Jb-yuvhKqWiXY7mKE4rp7NuTJ4

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

skeleton.gif
static.adsafeprotected.com/ Frame 8CF2
Redirect Chain

https://pixel.adsafeprotected.com/rfw/st/999585/61793174/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=&ias_dspID=3&ias_campId=27619585&ias_pubId=pub-5512390705137507&ias_chanId=1&ias_placementId=167258...
https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=

43 B
482 B

47ms
7ms

Image
image/gif

2600:9000:2156:8a00:8:48e:53c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=
Requested by: Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Server: 2600:9000:2156:8a00:8:48e:53c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 42b976597a2d977d0e300f6d06bc903db389e5c112d33c1c8c249690a522d9f2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Fri, 06 Aug 2021 16:14:35 GMT
via: 1.1 436c247027acc191b22ece964efbaeca.cloudfront.net (CloudFront)
age: 22223116
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 43
last-modified: Mon, 17 Aug 2020 23:55:15 GMT
server: AmazonS3
etag: "45cf913e5d9d3c9b2058033056d3dd23"
x-amz-version-id: iiN8XkcmZQdDIQeKkzAiegPwcD.5WPja
cache-control: max-age=315360000
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
content-type: image/gif
x-amz-cf-id: yPsaFKWPC_m_AYN5leX42CHJ2DS_fazHvj6IWjyOKRguLqMVJOiFWw==

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:50 GMT
x-server-name: app08.ie.303net.net
p3p: CP="COM NAV INT STA NID OUR IND NOI"
location: https://static.adsafeprotected.com/skeleton.gif?gdpr=&gdpr_consent=&gdpr_pd=
cache-control: no-cache
content-length: 0
server: nginx

GET
H3 200 window_focus_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/ Frame 8CF2 3 KB
1 KB 9ms
8ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/window_focus_fy2019.js

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 11
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1359
x-xss-protection: 0
server: cafe
etag: 1484984001845508991
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 May 2022 21:19:39 GMT

GET
H3 200 rx_lidar.js Show response
www.googletagservices.com/activeview/js/current/ Frame 8CF2 119 KB
36 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:828::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef2e3293c1558e5b49e30e1e094cfc3412ec386a68067aee04a92fc913f2c2ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36950
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="active-view-scs-read-write-acl"
etag: "1650454428054601"
vary: Accept-Encoding
report-to: {"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 20 Apr 2022 21:19:50 GMT

GET
H3 200 qs_click_protection_fy2019.js Show response
tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/ Frame 8CF2 15 KB
6 KB 10ms
9ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/pagead/js/r20220413/r20110914/client/qs_click_protection_fy2019.js

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

4a29964e922a0ddad04e2feb2b4496f1019838b0cd9754da5bc95f6e20a14e98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:15:58 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 232
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6409
x-xss-protection: 0
server: cafe
etag: 15284592792851369840
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 May 2022 21:15:58 GMT

GET
H3 204 l
www.google.com/ads/measurement/ Frame 8CF2 0
0 24ms
23ms Image
text/html 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaRShHW-C7bcPBFGGkiMkuwV8MyoBJFAPy57QXs91ttcp88476EK1bCezAj2g5sgVnZzWBslgdlseh75C5dd8BWNlp4DfA
Requested by: Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
H3 200 LJGn0i2Pg8yG-wzimFR5htSsDE5oolsrGkll4HQxngw.js Show response
pagead2.googlesyndication.com/bg/ Frame 9D0F 35 KB
13 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/LJGn0i2Pg8yG-wzimFR5htSsDE5oolsrGkll4HQxngw.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c91a7d22d8f83cc86fb0ce298547986d4ac0c4e68a25b2b1a4965e074319e0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 14:40:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 110370
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13643
x-xss-protection: 0
last-modified: Mon, 11 Apr 2022 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Apr 2023 14:40:20 GMT

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame 6B02 7 KB
5 KB 35ms
18ms XHR
application/json 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_247&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d2f1c02480d0eee7e883d40b60f4ebe9a7816d872cfae71769ea68f235cda3ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 21:19:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5470
x-xss-protection: 0

GET
H3 200 60005582_20220301245337111_300x250_Look_01.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 6B02 44 KB
44 KB 9ms
8ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20220301245337111_300x250_Look_01.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8f5754e162c6914f84645c43b52dd3fb050092dc7214e09c50831cec1a97b40b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3542255663189065728/300x250.html?e=69&leftOffset=0&topOffset=0&c=V46C1GHIaV&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 14:20:02 GMT
x-content-type-options: nosniff
age: 25188
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45326
x-xss-protection: 0
last-modified: Tue, 01 Mar 2022 08:53:37 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 21 Apr 2022 14:20:02 GMT

GET
H3 200 60005582_20220301245333532_300x250_Look_02.png
s0.2mdn.net/ads/richmedia/studio/60005582/ Frame 6B02 38 KB
38 KB 10ms
9ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/ads/richmedia/studio/60005582/60005582_20220301245333532_300x250_Look_02.png

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ef886cb5d32f41ad994d2e851d2056c029e93e0f76116695f8ab525785e2306e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/3542255663189065728/300x250.html?e=69&leftOffset=0&topOffset=0&c=V46C1GHIaV&t=1&renderingType=2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 14:20:02 GMT
x-content-type-options: nosniff
age: 25188
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38756
x-xss-protection: 0
last-modified: Tue, 01 Mar 2022 08:53:33 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 21 Apr 2022 14:20:02 GMT

GET
H/1.1 200
OK postview.gif
portal.o2online.de/nws/img/ Frame 6B02 43 B
609 B 35ms
10ms Image
image/gif 82.113.101.132
TDDE-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://portal.o2online.de/nws/img/postview.gif?partnerId=O2_DSP_TRA_HAV_14112_PV&mediacode=27008872_4307561_324252033_165558522_-0&ref=27008872_4307561_324252033_165558522_-0
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 82.113.101.132 Offenbach, Germany, ASN6805 (TDDE-ASN1, DE),
Reverse DNS: portal.o2online.de
Software: Apache /
Resource Hash: e46eb58f99814c32c849b97a268129ddb14ca88e9070964ee75a2cd987c66839

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Date: Wed, 20 Apr 2022 21:19:50 GMT
Last-Modified: Wed, 26 Aug 2020 10:11:24 GMT
Server: Apache
ETag: "2b-5adc50abeeb00"
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Connection: close
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 43

GET
H2 200 font
c.bannerflow.net/fs/api/v2/ Frame 580C 20 KB
20 KB 24ms
23ms Font
font/woff 2606:4700::6810:d40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/fs/api/v2/font?u=https%3A%2F%2Ffontmanagerstorage.blob.core.windows.net%2Ffontmanagerfonts%2F59c910d931ae9c0318638256%2Fb8d39551-68ea-4ae7-9f0e-5ab5c1261bdd.woff&t=%20%25%2a-35KSegilnorstu
Requested by: Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:d40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cfff66f0285504658a03b932d7bc9451d655ea76dc758be3dad7750b57ed7999

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
Origin: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:50 GMT
cf-cache-status: HIT
last-modified: Wed, 23 Mar 2022 19:50:42 GMT
server: cloudflare
age: 2424548
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: font/woff
access-control-allow-origin: *
cache-control: public, s-maxage=31536000, max-age=31536000, stale-if-error=86400, stale-while-revalidate=86400
content-disposition: attachment; filename=b8d39551-68ea-4ae7-9f0e-5ab5c1261bdd-subset.woff
cf-ray: 6ff0eba2b9d7cc46-ZRH
expires: Thu, 23 Mar 2023 19:50:42 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame EAA1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_dbm
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFg8LpraSfrkmU0LYwWQ3rs&google_cver=1

43 B
894 B

23ms
23ms

Image
image/gif

69.192.160.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFg8LpraSfrkmU0LYwWQ3rs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGNOd9sUBMAE&v=APEucNXdylNJhUE8RZ6NoJnRAemhHeC6mn_HtOkFqWWjFyo2T3pPX0ndi8eXk8DC8M3UlR4m1DZLodlLKqX0-NElUFsxn3Ez1ytor1BLDhMFHMkzpPA-HC5L1_ETltXqzg6KNlAW-fw81dmTINjXGTsCpeNCjUa5aqXf0hvV-97Y3RXayy2vWoBZ9n8HyKgG0H-IcCSlqaSnZgGDVoXqJbQJsk_Zzph_UA
Protocol: HTTP/1.1
Server: 69.192.160.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-160-245.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:50 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 20 Apr 2022 21:19:50 GMT

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:50 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFg8LpraSfrkmU0LYwWQ3rs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame EAA1
Redirect Chain

https://dsum-sec.casalemedia.com/rrum?ixi=0&cm_dsp_id=85&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dcasale_media2_dsp_secure%26google_cm%26google_hm%3D
https://cm.g.doubleclick.net/pixel?google_nid=casale_media2_dsp_secure&google_cm&google_hm=YmB49UKycvfJ7qLWk3e5DQAA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFg8LpraSfrkmU0LYwWQ3rs&google_cver=1

43 B
894 B

23ms
23ms

Image
image/gif

69.192.160.245
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFg8LpraSfrkmU0LYwWQ3rs&google_cver=1
Requested by: Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGNOd9sUBMAE&v=APEucNXdylNJhUE8RZ6NoJnRAemhHeC6mn_HtOkFqWWjFyo2T3pPX0ndi8eXk8DC8M3UlR4m1DZLodlLKqX0-NElUFsxn3Ez1ytor1BLDhMFHMkzpPA-HC5L1_ETltXqzg6KNlAW-fw81dmTINjXGTsCpeNCjUa5aqXf0hvV-97Y3RXayy2vWoBZ9n8HyKgG0H-IcCSlqaSnZgGDVoXqJbQJsk_Zzph_UA
Protocol: HTTP/1.1
Server: 69.192.160.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a69-192-160-245.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:50 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Wed, 20 Apr 2022 21:19:50 GMT

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:50 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=45&external_user_id=CAESEFg8LpraSfrkmU0LYwWQ3rs&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 313
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame EAA1
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_dbm
https://ib.adnxs.com/setuid?entity=101&code=CAESEDbnoyCPFyUR4wr9QL6hScM&google_cver=1

43 B
1014 B

17ms
17ms

Image
image/gif

185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=101&code=CAESEDbnoyCPFyUR4wr9QL6hScM&google_cver=1

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/xbbe/pixel?d=COWiHhDhjN4CGNOd9sUBMAE&v=APEucNXdylNJhUE8RZ6NoJnRAemhHeC6mn_HtOkFqWWjFyo2T3pPX0ndi8eXk8DC8M3UlR4m1DZLodlLKqX0-NElUFsxn3Ez1ytor1BLDhMFHMkzpPA-HC5L1_ETltXqzg6KNlAW-fw81dmTINjXGTsCpeNCjUa5aqXf0hvV-97Y3RXayy2vWoBZ9n8HyKgG0H-IcCSlqaSnZgGDVoXqJbQJsk_Zzph_UA

Protocol

HTTP/1.1

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:50 GMT
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: b3241002-737a-4901-9ec2-d83493ddc954
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:50 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://ib.adnxs.com/setuid?entity=101&code=CAESEDbnoyCPFyUR4wr9QL6hScM&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 290
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame EAA1
Redirect Chain

https://ib.adnxs.com/getuid?https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=${BASE64_UID_ENC}
https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODA5MjkzNDc3MjEzODg2NDM3Mg%3D%3D

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODA5MjkzNDc3MjEzODg2NDM3Mg%3D%3D

Requested by

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://googleads.g.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:50 GMT
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 8302e9d2-7f0c-4b44-9fce-ce54f2c66ff4
Server: nginx/1.21.3
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_hm=ODA5MjkzNDc3MjEzODg2NDM3Mg%3D%3D
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 optimize
c.bannerflow.net/io/api/image/ Frame 554E 2 KB
2 KB 20ms
20ms Image
image/webp 2606:4700::6810:d40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/io/api/image/optimize?u=https%3A%2F%2Fc.bannerflow.net%2Faccounts%2Fmelia-hotels-international%2F59c9120b31ae8f128419d688%2Fimages%2Fa326ed08-c4ea-44d9-8af8-9453fe674daa.jpg&w=765&h=90&q=85&f=webp&rt=cover&x1=0&y1=591&x2=1600&y2=779
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:d40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 802f33a3941dcda9d727eae784ad9056e2618204b6e79bb8bcff0840e9762d62

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:50 GMT
cf-cache-status: HIT
last-modified: Wed, 20 Apr 2022 09:56:05 GMT
api-supported-versions: 2.0
age: 41025
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/webp
cache-control: public, max-age=86400,stale-if-error=86400,stale-while-revalidate=86400
accept-ranges: bytes
cf-ray: 6ff0eba30a860211-ZRH
content-length: 1694
server: cloudflare
request-context: appId=cid-v1:aa2d0cc3-fd7d-4ac0-80ca-1db03d937ce1

GET
H2 200 27624350-8080-45f5-8ac5-4bcbf8478d7e.svg
c.bannerflow.net/accounts/melia-hotels-international/59c9120b31ae8f128419d688/images/ Frame 554E 7 KB
3 KB 26ms
26ms Image
image/svg+xml 2606:4700::6810:d40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.bannerflow.net/accounts/melia-hotels-international/59c9120b31ae8f128419d688/images/27624350-8080-45f5-8ac5-4bcbf8478d7e.svg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:d40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2c3109a82c3a2c23e65bf887a0c7d13be0a8c7a3d1468103051144cb9e84ad77

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 20 Apr 2022 21:19:50 GMT
content-encoding: br
cf-cache-status: HIT
content-md5: 5Xuj2A+y0C5AFucBYDjFgA==
age: 3740
x-ms-lease-status: unlocked
last-modified: Fri, 18 Jun 2021 07:47:06 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: cba44f8b-801e-0031-2a48-3c0c35000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
x-ms-version: 2009-09-19
cf-ray: 6ff0eba32ac00211-ZRH

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame 6B02 17 KB
6 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_247.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 20 Apr 2022 21:19:50 GMT

GET
H3 200 html_inpage_rendering_lib_200_276.js Show response
s0.2mdn.net/879366/ Frame 8CF2 170 KB
59 KB 23ms
8ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Requested by

Host: pt.lizspaperloft.com
URL: https://pt.lizspaperloft.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

96da839661d63f7cab3dc3e43613fee97166a472555cc91df21777d6d83e58d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
Origin: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 16:19:06 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 18044
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 60311
x-xss-protection: 0
last-modified: Wed, 02 Mar 2022 23:07:25 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 21 Apr 2022 16:19:06 GMT

GET
H3 200 omrhp.js Show response
pagead2.googlesyndication.com/pagead/js/r20220413/r20110914/elements/html/ Frame 8CF2 8 KB
3 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220413/r20110914/elements/html/omrhp.js

Requested by

Host: googleads.g.doubleclick.net
URL: https://googleads.g.doubleclick.net/dbm/ad?dbm_c=AKAmf-BaD9iLFoA6QS1D0Ww2LaZTCBfQISOZkhkUA1HNQ8KVfoQXdPpiXQ-ikFxWOZB4x54P8NpVNJZPM16vzwhDwLxMqzoUGLn8hG7K4j5hz0fHy0hPgs_Wm-4anZkqp1asU5dibLlS23lJb2czajJ0jdGY3YYZOQ&dbm_d=AKAmf-DsAKyoDFvtFzy5vaxzKfTqJOpWsEtWQL5c5XjgKdoEUnJCBkS6-KgTlz5r0jUTGryHuonIT-pjYbSe-3Eja9g_S2urBzSKqFRehVEW18_PjClKVI8FqgLyNle8Vn60L6VGkRzynw8h97LhbW0qFkdAH2TQ__L3m4KObBWqn_QXrQiBKBQwafZOPjkzOL6Gf80j9YKn8GIwvza9A4Ao6OU_4VWzhjmH0kQ3dC-7BSCBjTyqUQLtdMrkAxdvP_hSElBMhLv2GaUPctg3uN1NmWev-Hc0L6VJqqG8CSdC7KZv-zX3ZNHybrnGnJDgwlHPL58zptO2WD6U-R_2U0Tvon4yWuo97qKIw_S2RdnJwHwlkoFgM6PaA1kfPlR2JEbVMwflM67XWX-Y7GFpGtCR9o1K6VEpNp2fHes-xCLNiAEju1xjSa7mAsb7SL-0uvFgfrjhNHUrHDQpyD1HJ6_6DirFFfFGtIcPHOAKhy-aBM97j4VdsRfuPkAu1T8e08ydBY84F-zV_gIWsafsyNLknsqlFasnUNTQgL9jd2_VQh3Q5cBpUJktIsFrBNwGUugs-Ea5eTnQ8Wd1lNkrocY7KY6ClwFl8mYpgab5SnX-398B6sn3L-iNAJGNFEcgIdCpVkQzlav05aNYJzNC1KtnscdCcZik8d8jqPpWxMkT-m-DJQW0vEmugR4uoqfb9xibE5mgy0fBduX7Zvz7gmiDmG2clrSLILgGNfxbmTcnr4XGjOqe0dZ7mxFFUSiP7OYMGhEBnROy-PsxivjgkWl2Zz2uDlZhj0DidpxuncgWRH-GTsueoFeBTKX-Zz494tcurJyYhbS1xPDfzezKSVqMZN5AZIogQY81ou-8K5pRp-yLnIrdg_U41t_dOHkLejiMoikYxkxDJMtXvy3_HjliZevCiBhoVMI68uS3X2u5x0Osq-XCjlIn-nno615PbItZHHRH0RrY-2_KLjE-iHWGtrbGkNVl13teE_RNx_u3X8J77xJMpyK6FjRW1z6Abe5P36pgxDF4wAAIvXs2-VW_HUYi-LsCjbuPRtUtQEHVYCVzM_PmMyt_Ndt7A1ipfLWXW3-Pm5b-BPINcO87oUmxcYgrqyjzzbtJqSmnXifqMAcR8UsHq6vw9BYPawF38N6OT4QpUFdDPxKWtY9ynm_DsEYtDieNxe466uMjJQE2z8TC16ygZ0iWYn2DmtWQrenqzxbJaFCWyKuVLqOdGPBmjNUI8HeoyM0PnDg_-12cqQlUoTTKk2fbARLMEQ5LTYqHOfwhJGJ5u5olLpTGuZtuO52kLC1SQupdDXLqzTnSuOOr4z0ADqxTS8ZgFw4keVQWxG8WexKeo9WgRhVP0qZ4OWB_IVKjyCQIwxO0o-wbXv8_qzzS54JC36cqoFwDDpyi8e2EY3ykbvlSf3hYsMwEyGSWYqyzRCzGC6PR2kd55bvOg2_q725Zo_4b88Mvd4uA5w4aLtA3P6XDCLkUJBMalxXmd2SHsQoY74VEV1XHxEW4QOcAV5ZWc4nwFjsUt8SGFjjAsAhuoC3DUoKVODS5yGEx1XImfrNbeJoK-SxOkFNV70Q6iQAvRz-V6vniHq3Eqf5ZsKcCWSRZBej2LJazzg4rbEm_VdbMesB_uZf61-71QmV34IUXoMMnOL2YMblg6-pRkP4EmmfwV7bL0Pc0Dc-Ox2628ch7P85Q8GhnveGDf3-S2lSc2tihg7x5bAOWnt1JZliyf9M7q8G4JyaTJXfZcFX7WoOhJoDp0JmIUv77-TkKDr4_vlqMYbgYuhHmJpzBxxg9R7rJLcFsXP51lHQ_htbSbeo5RHJJqsKcE-Lo4eS3-FUVlYBK05kFLyk0UbYV-M54xUY7JReL3JwZH9fIl0XQk6cRl-zEbC3OEd-XTsmkIYt009ddE_UCJA4D_aNLJIRMr5ueQz7PIW9ATF-eqV59ROxz6lfrBxI1XLhWQb2c7B6Q8f4XZq60CosOFcW-ypTB98uZVn8j5E6Ub-L0RC8JcvE53l6tF2HCbiyPVHGqHHqixB92CQ5uoI-4F1jKYlCoh0-QUSouokTxYZhWiBU-xilasQD2wUq_ZTiOkCLp-ccxuns7TTsNkb2hjdEDn-xR7c6JDi7RhSOChx3ZzIgUSIvu1d9MzJdMHSFBdSeda5_hQXsvO_pFlf0gAbRarze7rz4YHxin4jSp9_sZLVvsPKDuujeWinuhvc_udWM2RmSDlhcfi_i1T0U0mn6XQgRnFvbCrw_ntfMar83PqK_2-Up71gv61zLVLLWyd-QHRRhPcKVdPB0u5DUU9lKYovWHbM9UH1BdHgWQjS2cKMa1FJROVxwYGi36BaPBUvUTOIs3KsV4dIyhqxlJ5W7azhBhondR7LIiISvV5jI2G-NaekupDkij9sB7KQQJuBEw0DUX_Wzbf-yh9TElNXeSexXNyzB_E-cbwPwF9dClQX4Bn_3A32_b6c9KB-tTGn-xHlj8t3TwH1U3pVhhy55NV3o-qxt72qzs44CeUWo2N7khaj21Mzij2cGU6KJby3bR6PTHmYdHC2gQjjGtUrWuVxf9TfVijWRpFnI5OcmajUUCpB3_kY2_dsOtTPeMlM9qVs6xy0Vc8T1mfais31wur4NW-nXqF837LCi5PuQj7DXEz_j0pC6EfGkM4DxN2AwCWNhgf31EyIj6xisfXw8t2pBxDzz5tLS7Nd3E46XSY6QogvELz1oaOyXSWK3Uj8in6XrMKW-GflG3Bzvh4soj3gzNRfxF_lC8kFArb4mt-cv4OWCgRv8zr9xGWywsCACL5ahk1b3KV2ivsLkJwu1Zd3oBKU1pTQglj0pPfywt5dD3qn5PIuAfOvdKWaAs6qZzOuLLcvWRTUHyJbWn1S65vPQQybB1CqJgJ9NdDiUuMi1Ss7NHk82zEn22I9mPanLLmcKFSArR2Cevj_Nc4U3L-tehassRyFCY8SadtQXRB-mF_hy1oIBhyUrLBqegk1EBh50EY7Tptge8Ga50Aa-sqpGqf_YknFXiOozUxqZKpkokvhF7_fJoG-ejtF42AnpnQ4C3_YZcQjLhMkDkeqy1c95bg19oISt1guIGOqQuEwtIoZQz7ATsNDG4pGXyH6Zx5FvWoD1-VL4cezt2_BDQLpfHrH4-FD83nByCF1cpsP3zTdhWVOJgIpwVbfuYKMdFFL109RNAwcQQ1AuhZ8MoIv4LB4kpWEnVwTU4uAN9FwIPD37iDcakTF2bamfmB3SwgRvnaOnyx4b3FPcR8a-EBH_vaBsCM7KuuvuuTHNgMX5gF8E-ndCFMtEZ-qCJBOsAuVOAZgHTGnBcnVQwZXeg4-pXBAc5VoidzJXEsU5WVSZzDR_sovJvfMsrsqfPKimx0AiwhdGsIp_MdNl3eFEI5aeHH9KrWDt4RSVbmpy-OUbAoJJbIcTeZupTqozU3eUc71M&cid=CAASJORoWlG5a4Yd5eFwl3Ot2IpzOkqblRXxbm1pxsn4s2mej7jE7A&rfl=1%2Chttps%253A%252F%252Fpt.lizspaperloft.com%252F%240

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

28f18d39406a4b70dfa6cd479fe03f7ed918ca5c05cee26b87d9e1626cea1ed9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:10:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 548
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3159
x-xss-protection: 0
server: cafe
etag: 1394524276809619753
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 May 2022 21:10:42 GMT

GET
H3 200 abg_lite.js Show response
pagead2.googlesyndication.com/pagead/js/r20220413/r20110914/ Frame 8CF2 25 KB
10 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/js/r20220413/r20110914/abg_lite.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e66bfceb15a6ee125dff79826be02a07b766843e6c660edf55ec0c22d1a407c1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:09:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 613
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9777
x-xss-protection: 0
server: cafe
etag: 12512753850102923420
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1209600
timing-allow-origin: *
expires: Wed, 04 May 2022 21:09:37 GMT

GET
H2 206 pre-summer22_h_low.mp4
productsup.melia.com/production/ Frame 532F 224 KB
0 65ms
8ms Media
video/mp4 143.204.98.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://productsup.melia.com/production/pre-summer22_h_low.mp4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.27 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-27.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash

Request headers

Referer
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Range: bytes=0-

Response headers

x-amz-version-id: Q6moKFDsjYlyK1W4.RP99wPb7MQNVV3h
via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
etag: "88914c9106e744f92c40234550dec9b6"
last-modified: Mon, 21 Mar 2022 07:56:34 GMT
server: AmazonS3
age: 1027
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: video/mp4
Content-Range: bytes 0-788348/788349
date: Wed, 20 Apr 2022 21:03:59 GMT
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
Content-Length: 788349
x-amz-cf-id: JKo_j_zZQAGpawPWHXceeOj5S24JML7-uinnw48rpXzT8ks_BxiEyQ==

GET
H3 200 LJGn0i2Pg8yG-wzimFR5htSsDE5oolsrGkll4HQxngw.js Show response
pagead2.googlesyndication.com/bg/ Frame 0F84 35 KB
13 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/LJGn0i2Pg8yG-wzimFR5htSsDE5oolsrGkll4HQxngw.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c91a7d22d8f83cc86fb0ce298547986d4ac0c4e68a25b2b1a4965e074319e0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 14:40:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 110370
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13643
x-xss-protection: 0
last-modified: Mon, 11 Apr 2022 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Apr 2023 14:40:20 GMT

GET
H3 200 UFYwWwmt.js Show response
tpc.googlesyndication.com/sodar/ Frame 8CF2 41 KB
15 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5056305b09ad6474ea540f796c79be51d6b8e96043cb3d7bc4ef774e56765f4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 08:56:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 44610
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15207
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 20 Apr 2023 08:56:20 GMT

GET
H3 200 cookie_push_onload.html Show response
pagead2.googlesyndication.com/pagead/s/ Frame 1D01 1 KB
749 B 7ms
6ms Document
text/html 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pagead/s/cookie_push_onload.html

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9a9b7fb32e01fd70747f32efdbd0472fd681c85eebb0c42d10c7a514820a0062

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 55566
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=86400
content-encoding: gzip
content-length: 724
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 05:53:44 GMT
etag: 48472445140208031
expires: Thu, 21 Apr 2022 05:53:44 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame 8CF2 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4035ebe5cb2d406bb1994e2cd6148a03ed88da2c9b3ca2ffc9da86e1e5a602fc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 200 index.html Show response
s0.2mdn.net/sadbundle/6657181183598343709/ Frame A84B 36 KB
6 KB 20ms
20ms Document
text/html 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6657181183598343709/index.html?e=69&leftOffset=0&topOffset=0&c=rG8LDoX2Hl&t=1&renderingType=2&ev=01_248

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/html_inpage_rendering_lib_200_276.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6441798447ba251e1090a35dcee01ee8b3e9446325a4c058fabda6090a90a16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
access-control-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-type: text/html
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 21:19:50 GMT
expires: Thu, 20 Apr 2023 21:19:50 GMT
last-modified: Wed, 05 May 2021 19:27:44 GMT
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-xss-protection: 0

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8CF2 0
27 B 57ms
56ms Ping
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstOTG6wPI1gsX4rOgzQA08vAVWYrFAQNR1I7YOKvwt3INgDSnkB4NsYzOrFH9n0EyXyCNO7pjGkJNopkTuds3Cs-pC1aWAzXDDJ9tRWPzUdkIWnoviAGacx2hah9FhsLNFlDnhZbJo6s9MSovCYzmMT-XguFucrcyWGLkmqB6mb4MpcAjNIc7eOsDL4Qlu4EAUztd5JfShWPS-hgbbHCwk--EA3ewmmDSGXpcQMWQfPOzKwQtrI4JSdStYKbmR45Q6_RTyxDFevqUyReEgN_u6Gidzr5QDH4OqOzFijkN2eA6EkNNBpw905i_isonlSiKPiUt1DTH5feUsVaNo5-syM99c1K6LTbI0vAkVfe9qsmZymBiXmKtv7eyrddXfbsp1Ln8vkkwsxtuAvAyFz8EjLLD-mHnBhNngEix87IK_5fP8wMkTqKDyTbHmSR6KF2NjEGlHy6NxhiQq0zLy7xf5p6ZUq7kDMlJkU-9zeb4GgpL6gogedrvO_ufdOJB4T6JWyW9nsm12ysA7FPQqwtKIFld3U1uV6VvLHvioTUnYjkecAWufVF9QSdIRX9MgnvV53lU2D-05XorggAlHiUfYxas6Zafme2KJpGYs53_RCIykwbgJtyqTyrNkENiW-AK09CN8wcJVivpuUZY9_13HS2pvSsUFXuAwppgmf1qtZLHC3KtyE72UL5eckOC_g2Qo3jZc17rq_-UD7GGX7s2HG-yz1Mx7JI_FPK1yqzNpfl1p6FKpg29U6L8zVodzldbxjiBXk_9wLUTPonHX5SGlK6BV8IAR2bra95f1n9yCsIx_j_3_dmw5qhesx2wabl3dMfYszAy0scwGpABagHpaW9pZ6A7E0Vk9Dp9nI7yNyd8xbGnQRWe9OH1dY7ZIJ1CXxUadFR8U8Pj15PmFB_Ya1u-sZ3NNAP8QdHidtWBKiMQDzAqQYNbv3iap-IJlmCOSkclZydmipl-Zm28f4KQUiw-9lAVTtgBSgvthYXeWYJreZ3D9twi3BHSOizYxwliKtaEdhyNC_0lbdEb-B0lDPFhI9U93-10d-yuSwIt8uiX8A88grL_OsUhHC_X3_XCOxxRY_4nhQY0n1_yZKCoUZjuAMEfwUwhmFWqzgFGaKmMx9QhbEF_JATxCrhSjqr1f1SBCxvlP5_IwUJv9-8xUn2NgnoZiJ9f2x9Wz0usUr2VyMGrZFEduAP5Xh_c6i9XMUuYinibnKb5Pj3PnGt6LhvN3pS5QpK-dzAhgyWCrW0NlpPN0Et28XsN4ikB31lgax4Wy0UG7pG1A9_yX7LwYK4f_qDKgtzlv7RQtlRuz7XtRLl1jWtozYxCDHpHUttYM-icien9GvifilmnOuPzo&sai=AMfl-YQCmVXpQU1MH5SRpzYFG0IzFa_akN1dXTKX4LP_H9RY_ox_Kov_W4W4X7yl2CTTv4v261Ypuk6D1PV1Amn982NfoKjUjuAGeDf11gFR_caHv_FmpbsbbS4bPpja3Wx4NX4vcKhjdkfFxGOV4EGTczTMbnFiwg-gqzp33QTmcJ7tUKFh6YlBAHMNFf-Ad9Gk4t1Tl9nf8Je8LVT7IBE9Bw&sig=Cg0ArKJSzKu1J8JWi7w4EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=87&cbvp=1&cstd=82&cisv=r20220413.90447&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=

Requested by

Host: pt.lizspaperloft.com
URL: https://pt.lizspaperloft.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ec2-52-31-67-18.eu-west-1.compute.amazonaws.com

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
date: Wed, 20 Apr 2022 21:19:50 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H/1.1 200
OK ai.aspx
m.exactag.com/ Frame 8CF2 43 B
1 KB 66ms
18ms Image
image/gif 213.202.235.10
MYLOC-AS IP Backb...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://m.exactag.com/ai.aspx?extProvApi=sky-dv360&extProvId=300&extPu=sky-dv360&extLi=27619585&extPm=415076051&extCr=16725820018&gdpr=&gdpr_consent=&rnd=36870423

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

213.202.235.10 Düsseldorf, Germany, ASN24961 (MYLOC-AS IP Backbone of myLoc managed IT AG, DE),

Reverse DNS

Software

Microsoft-IIS/8.5 / ASP.NET

Resource Hash

afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
P3P: policyref="https://m.exactag.com/w3c/p3p.xml", CP="NOI NID STP STA CUR OUR"
Connection: close
X-ET-Monitoring: 1
Content-Length: 43
Pragma: no-cache
X-ET-Code: 0
Last-Modified: Mi, 20 Apr 2022 09:19:50 GMT
Server: Microsoft-IIS/8.5
Date: Wed, 20 Apr 2022 21:19:49 GMT
Access-Control-Max-Age: 1000
Access-Control-Allow-Methods: POST, GET, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
Cache-Control: private
Access-Control-Allow-Credentials: true
X-ET-Camp: 923
Access-Control-Allow-Headers: *
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200
OK

firstevent
skydeutschland.demdex.net/ Frame 8CF2
Redirect Chain

https://skydeutschland.demdex.net/event?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=331926956&d_campaign=27483059&d_bust=36870423&gdpr=&gdpr_consent=
https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=331926956&d_campaign=27483059&d_bust=36870423&gdpr=&gdpr_...

42 B
967 B

40ms
39ms

Image
image/gif

52.31.67.18
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=331926956&d_campaign=27483059&d_bust=36870423&gdpr=&gdpr_consent=

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

HTTP/1.1

Server

52.31.67.18 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v031-04eb9e131.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: qEWy2iDhQrI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-1-v031-0f3341810.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: F1O/ppOSStc=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://skydeutschland.demdex.net/firstevent?d_event=imp&d_bu=9532313&d_site=5842564&d_src=158980&d_adsrc=&d_creative=132133369&d_placement=331926956&d_campaign=27483059&d_bust=36870423&gdpr=&gdpr_consent=
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H3 200 Enqz_20U.html Show response
tpc.googlesyndication.com/sodar/ Frame 1135 22 KB
8 KB 7ms
6ms Document
text/html 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/UFYwWwmt.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

127ab3ff6d14112ae6aa40b68d9d3144748eda08efbc60a48a5be0555cf8622b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 44610
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: public, max-age=31536000
content-encoding: gzip
content-length: 8395
content-type: text/html
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy: cross-origin
date: Wed, 20 Apr 2022 08:56:20 GMT
expires: Thu, 20 Apr 2023 08:56:20 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server: sffe
timing-allow-origin: *
vary: Accept-Encoding
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 80F1 42 B
64 B 41ms
41ms Fetch
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstCeAITPq_IdiebMCSV_ACXntBTuev3pJz5xrCqptHo3RivY7UtLrSbfVb4zatIzJY_pyCK8Ipl8SFLR2-F5Q00DN4P6PWdr67zTi4C6UPH9z1m03exjA&sai=AMfl-YSdaKYyrXmItf0agg7ZpN6pmzsGIBvySaL0zkT_7huMlx0Jn8FILswEwUwgIt8JSSJ63M7zsHBuy-nNQM3k_vqXq2B1WXmmFMPo0y36&sig=Cg0ArKJSzIrV3V4yvzkOEAE&cid=CAQSLQCNIrLMyTyxPyWSFKP3YG2IvXPrDni2ozokT8gfP4EqCPW9_FtfsTMP4d7ukw&id=lidar2&mcvt=1010&p=1110,436,1204,1164&mtos=132,1010,1010,1010,1010&tos=132,878,0,0,0&v=20220420&bin=7&avms=nio&bs=0,0&mc=1&if=1&app=0&itpl=20&adk=1095535024&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1650489589085&rpt=316&isd=0&lsd=0&met=mue&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 google
match.adsrvr.org/track/cmf/ Frame 1D01 70 B
265 B 93ms
32ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/google?google_gid=CAESEO3lDZ12CWz1cYMthM1lqrE&google_cver=1&google_push=AYg5qPISichJHSiIC3R20PM0Kn5P-bfEFiVb8vBk69YetOYESCPLOo_brO_Xy-k_qz1-1RORWmF1ohS5mZVYcPCjUO9_dckU9fv3
Requested by: Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:50 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1D01
Redirect Chain

https://x.bidswitch.net/sync?ssp=google&google_gid=CAESEIp7HHKVAvbU4aPm3K1e3FE&google_cver=1&google_push=AYg5qPJQlLXqY80ooFkh6m3BwmZVsPlfWmbDq2dw94KTeeo1lWZDzJl5mUwTmvH8legeNlMts3jwCrUnGkhfxPIsB0_6...
https://x.bidswitch.net/ul_cb/sync?ssp=google&google_gid=CAESEIp7HHKVAvbU4aPm3K1e3FE&google_cver=1&google_push=AYg5qPJQlLXqY80ooFkh6m3BwmZVsPlfWmbDq2dw94KTeeo1lWZDzJl5mUwTmvH8legeNlMts3jwCrUnGkhfxP...
https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJQlLXqY80ooFkh6m3BwmZVsPlfWmbDq2dw94KTeeo1lWZDzJl5mUwTmvH8legeNlMts3jwCrUnGkhfxPIsB0_6qU-xTopk&google_hm=ouw-tisfQcWPyM5jSJTHVA==

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJQlLXqY80ooFkh6m3BwmZVsPlfWmbDq2dw94KTeeo1lWZDzJl5mUwTmvH8legeNlMts3jwCrUnGkhfxPIsB0_6qU-xTopk&google_hm=ouw-tisfQcWPyM5jSJTHVA==

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:51 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: //cm.g.doubleclick.net/pixel?google_nid=bdsw&google_push=AYg5qPJQlLXqY80ooFkh6m3BwmZVsPlfWmbDq2dw94KTeeo1lWZDzJl5mUwTmvH8legeNlMts3jwCrUnGkhfxPIsB0_6qU-xTopk&google_hm=ouw-tisfQcWPyM5jSJTHVA==
Date: Wed, 20 Apr 2022 21:19:51 GMT
Cache-Control: no-cache, no-store, must-revalidate
Server: nginx
Connection: keep-alive
Content-Length: 0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1D01
Redirect Chain

https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://image6.pubmatic.com/AdServer/UCookieSetPug?oid=1&rd=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dpmeb%26google_sc%3D1%26google_hm%3D%23%23B64_16B_PM_UID%26google_redir%3Dhttps%...
https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_R_4EmLUSc2yy0u-42WsuQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mp...

170 B
188 B

16ms
16ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_R_4EmLUSc2yy0u-42WsuQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKT4QFISWP3hGebSC2c_jbZBUS5Y3f0Mez3SybvCvDymeT4smk3sBSJnquCewguI8VC0tLmGS8wEG-GUlStNAywk9IhxbvL

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://cm.g.doubleclick.net/pixel?google_nid=pmeb&google_sc=1&google_hm=_R_4EmLUSc2yy0u-42WsuQ%3D%3D&google_redir=https%3A%2F%2Fimage8.pubmatic.com%2FAdServer%2FImgSync%3Fsec%3D1%26p%3D156578%26mpc%3D4%26fp%3D1%26pu%3Dhttps%253A%252F%252Fimage4.pubmatic.com%252FAdServer%252FSPug%253Fp%253D156578%2526sc%253D1&google_push=AYg5qPKT4QFISWP3hGebSC2c_jbZBUS5Y3f0Mez3SybvCvDymeT4smk3sBSJnquCewguI8VC0tLmGS8wEG-GUlStNAywk9IhxbvL
date: Wed, 20 Apr 2022 21:19:49 GMT
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
content-length: 0
content-type: text/html; charset=UTF-8

GET
H/1.1 200
OK sync
dsp.adkernel.com/ Frame 1D01 42 B
233 B 263ms
85ms Image
image/gif 174.137.133.49
WEBAIR-INTERNET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsp.adkernel.com/sync?exchange=11&google_gid=CAESEEiCaojMNkOIIPKVtJeSRU0&google_cver=1&google_push=AYg5qPK4h2iX0ZX1pel0yieVCQ34zUnIuaK0Dh8nFsuUclks0HZwiwAvAttr4Tbr5st_KSNQJx--E7MukFDHcFPz5vzYSK2H5Dg
Requested by: Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 174.137.133.49 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:50 GMT
Server: nginx
Age: 0
Content-Type: image/gif
Cache-Control: no-store
Connection: keep-alive
Content-Length: 42

GET

pixel
cm.g.doubleclick.net/ Frame 1D01
Redirect Chain

https://ssum-sec.casalemedia.com/usermatchredir?s=184023&cb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dindex%26google_hm%3D&google_gid=CAESEDmnxOd4Y_pgc0lJ6yNcZq0&google_cver=1&googl...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmB49UKycvfJ7qLWk3e5DQAABGUAAAAB&google_cver=1&google_push=AYg5qPJHM3Bl4APWb2t98by_s-PbS9FXk84u3vMWp0Gc5fgARpVjPnAIObNrfhIIgRe4Ynacbmok...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmB49UKycvfJ7qLWk3e5DQAABGUAAAAB&google_cver=1&google_push=AYg5qPJHM3Bl4APWb2t98by_s-PbS9FXk84u3vMWp0Gc5fgARpVjPnAIObNrfhIIgRe4Ynacbmok...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmB49UKycvfJ7qLWk3e5DQAABGUAAAAB&google_cver=1&google_push=AYg5qPJHM3Bl4APWb2t98by_s-PbS9FXk84u3vMWp0Gc5fgARpVjPnAIObNrfhIIgRe4Ynacbmok...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmB49UKycvfJ7qLWk3e5DQAABGUAAAAB&google_cver=1&google_push=AYg5qPJHM3Bl4APWb2t98by_s-PbS9FXk84u3vMWp0Gc5fgARpVjPnAIObNrfhIIgRe4Ynacbmok...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmB49UKycvfJ7qLWk3e5DQAABGUAAAAB&google_cver=1&google_push=AYg5qPJHM3Bl4APWb2t98by_s-PbS9FXk84u3vMWp0Gc5fgARpVjPnAIObNrfhIIgRe4Ynacbmok...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmB49UKycvfJ7qLWk3e5DQAABGUAAAAB&google_cver=1&google_push=AYg5qPJHM3Bl4APWb2t98by_s-PbS9FXk84u3vMWp0Gc5fgARpVjPnAIObNrfhIIgRe4Ynacbmok...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmB49UKycvfJ7qLWk3e5DQAABGUAAAAB&google_cver=1&google_push=AYg5qPJHM3Bl4APWb2t98by_s-PbS9FXk84u3vMWp0Gc5fgARpVjPnAIObNrfhIIgRe4Ynacbmok...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmB49UKycvfJ7qLWk3e5DQAABGUAAAAB&google_cver=1&google_push=AYg5qPJHM3Bl4APWb2t98by_s-PbS9FXk84u3vMWp0Gc5fgARpVjPnAIObNrfhIIgRe4Ynacbmok...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmB49UKycvfJ7qLWk3e5DQAABGUAAAAB&google_cver=1&google_push=AYg5qPJHM3Bl4APWb2t98by_s-PbS9FXk84u3vMWp0Gc5fgARpVjPnAIObNrfhIIgRe4Ynacbmok...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmB49UKycvfJ7qLWk3e5DQAABGUAAAAB&google_cver=1&google_push=AYg5qPJHM3Bl4APWb2t98by_s-PbS9FXk84u3vMWp0Gc5fgARpVjPnAIObNrfhIIgRe4Ynacbmok...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmB49UKycvfJ7qLWk3e5DQAABGUAAAAB&google_cver=1&google_push=AYg5qPJHM3Bl4APWb2t98by_s-PbS9FXk84u3vMWp0Gc5fgARpVjPnAIObNrfhIIgRe4Ynacbmok...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmB49UKycvfJ7qLWk3e5DQAABGUAAAAB&google_cver=1&google_push=AYg5qPJHM3Bl4APWb2t98by_s-PbS9FXk84u3vMWp0Gc5fgARpVjPnAIObNrfhIIgRe4Ynacbmok...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmB49UKycvfJ7qLWk3e5DQAABGUAAAAB&google_cver=1&google_push=AYg5qPJHM3Bl4APWb2t98by_s-PbS9FXk84u3vMWp0Gc5fgARpVjPnAIObNrfhIIgRe4Ynacbmok...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmB49UKycvfJ7qLWk3e5DQAABGUAAAAB&google_cver=1&google_push=AYg5qPJHM3Bl4APWb2t98by_s-PbS9FXk84u3vMWp0Gc5fgARpVjPnAIObNrfhIIgRe4Ynacbmok...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmB49UKycvfJ7qLWk3e5DQAABGUAAAAB&google_cver=1&google_push=AYg5qPJHM3Bl4APWb2t98by_s-PbS9FXk84u3vMWp0Gc5fgARpVjPnAIObNrfhIIgRe4Ynacbmok...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmB49UKycvfJ7qLWk3e5DQAABGUAAAAB&google_cver=1&google_push=AYg5qPJHM3Bl4APWb2t98by_s-PbS9FXk84u3vMWp0Gc5fgARpVjPnAIObNrfhIIgRe4Ynacbmok...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmB49UKycvfJ7qLWk3e5DQAABGUAAAAB&google_cver=1&google_push=AYg5qPJHM3Bl4APWb2t98by_s-PbS9FXk84u3vMWp0Gc5fgARpVjPnAIObNrfhIIgRe4Ynacbmok...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmB49UKycvfJ7qLWk3e5DQAABGUAAAAB&google_cver=1&google_push=AYg5qPJHM3Bl4APWb2t98by_s-PbS9FXk84u3vMWp0Gc5fgARpVjPnAIObNrfhIIgRe4Ynacbmok...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmB49UKycvfJ7qLWk3e5DQAABGUAAAAB&google_cver=1&google_push=AYg5qPJHM3Bl4APWb2t98by_s-PbS9FXk84u3vMWp0Gc5fgARpVjPnAIObNrfhIIgRe4Ynacbmok...
https://cm.g.doubleclick.net/pixel?google_nid=index&google_hm=YmB49UKycvfJ7qLWk3e5DQAABGUAAAAB&google_cver=1&google_push=AYg5qPJHM3Bl4APWb2t98by_s-PbS9FXk84u3vMWp0Gc5fgARpVjPnAIObNrfhIIgRe4Ynacbmok...

0
0

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame 1D01
Redirect Chain

https://cs.media.net/cksync?type=g&google_gid=CAESEHJzYLEOLakqnKiXCMGF-kc&google_cver=1&google_push=AYg5qPJ4lHXklniQR9zfcfBcNfN4hQNvGomRvkBB5TrPLKh4UYlDI8ujAbwY4HlcxAjsqiY-nxk9NlIM6d0HjUCGmUdwMjjtZrTy
https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MjkzNDkxMTkwNzU3NjkwMTAwMFYxMA%3d%3d&mn_hm=MjkzNDkxMTkwNzU3NjkwMTAwMFYxMA%3d%3d&google_sc=1&google_push=AYg5qPJ4lHXklniQR9zfcfBcNfN4hQN...

170 B
188 B

17ms
16ms

Image
image/png

142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MjkzNDkxMTkwNzU3NjkwMTAwMFYxMA%3d%3d&mn_hm=MjkzNDkxMTkwNzU3NjkwMTAwMFYxMA%3d%3d&google_sc=1&google_push=AYg5qPJ4lHXklniQR9zfcfBcNfN4hQNvGomRvkBB5TrPLKh4UYlDI8ujAbwY4HlcxAjsqiY-nxk9NlIM6d0HjUCGmUdwMjjtZrTy&gdpr=&gdpr_consent=

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:50 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:50 GMT
Server: Apache
P3P: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
Location: https://cm.g.doubleclick.net/pixel?google_nid=media&google_hm=MjkzNDkxMTkwNzU3NjkwMTAwMFYxMA%3d%3d&mn_hm=MjkzNDkxMTkwNzU3NjkwMTAwMFYxMA%3d%3d&google_sc=1&google_push=AYg5qPJ4lHXklniQR9zfcfBcNfN4hQNvGomRvkBB5TrPLKh4UYlDI8ujAbwY4HlcxAjsqiY-nxk9NlIM6d0HjUCGmUdwMjjtZrTy&gdpr=&gdpr_consent=
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html
Content-Length: 154
X-MNET-HL2: E
Expires: Wed, 20 Apr 2022 21:19:50 GMT

GET
H2 204 pub
cs.chocolateplatform.com/ Frame 1D01 0
68 B 363ms
108ms Image
text/plain 159.203.145.121
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cs.chocolateplatform.com/pub?pid=ebda&google_gid=CAESEAYQ3X8J0-E3F25sR0lkypY&google_cver=1&google_push=AYg5qPIwQF0Ov1LFZ4toHTv9HcFzbMtrUvvQnoL8EXNCixPLsTuFQdQE1Z5bOef_R9sV655sWKOMXUC5azi3kJkVT_dgWw8fUG4
Requested by: Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 159.203.145.121 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software: Chocolate Cookie Sync Powered by Vdopia /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:49 GMT
server: Chocolate Cookie Sync Powered by Vdopia

GET
H3 204 attr
cm.g.doubleclick.net/pixel/ Frame 1D01 0
12 B 15ms
14ms Image
text/html 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel/attr?d=AHNF13J7_C6GSvSMyf4Wh_WuL9L4Uw9ldgkj21QcPuMnG_CG7_6M210HupqZIQJd1GiXNtnbAkwD

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pagead2.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:50 GMT
server: HTTP server (unknown)
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H3 200 style.css
s0.2mdn.net/sadbundle/6657181183598343709/ Frame A84B 6 KB
2 KB 7ms
7ms Stylesheet
text/css 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/sadbundle/6657181183598343709/style.css

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6657181183598343709/index.html?e=69&leftOffset=0&topOffset=0&c=rG8LDoX2Hl&t=1&renderingType=2&ev=01_248

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2392bb69de9eb1e9efad1da54204d43b70c52e5b6004b053d1e645fac906ac3f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6657181183598343709/index.html?e=69&leftOffset=0&topOffset=0&c=rG8LDoX2Hl&t=1&renderingType=2&ev=01_248
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 21:52:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 84456
x-dns-prefetch-control: off
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1741
x-xss-protection: 0
last-modified: Wed, 05 May 2021 19:27:44 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 19 Apr 2023 21:52:14 GMT

GET
H3 200 Enabler_01_244.js Show response
s0.2mdn.net/879366/ Frame A84B 109 KB
37 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/879366/Enabler_01_244.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6657181183598343709/index.html?e=69&leftOffset=0&topOffset=0&c=rG8LDoX2Hl&t=1&renderingType=2&ev=01_248

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e7052ee7e4fa3d19fa953957b23d6cd29b2311739ec0932d6e570577d19f2503

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6657181183598343709/index.html?e=69&leftOffset=0&topOffset=0&c=rG8LDoX2Hl&t=1&renderingType=2&ev=01_248
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 11:47:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 34367
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 38072
x-xss-protection: 0
last-modified: Tue, 07 Jul 2020 18:35:15 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=86400
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Thu, 21 Apr 2022 11:47:03 GMT

GET
H2 200 gsap.min.js Show response
cdnjs.cloudflare.com/ajax/libs/gsap/3.4.2/ Frame A84B 59 KB
22 KB 78ms
30ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/gsap/3.4.2/gsap.min.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6657181183598343709/index.html?e=69&leftOffset=0&topOffset=0&c=rG8LDoX2Hl&t=1&renderingType=2&ev=01_248

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a3c5ff7e114ffe32212ee07123f9dc6aa19c09072e44fe64649c9cc747040cab

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 1133
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 21678
timing-allow-origin: *
last-modified: Tue, 21 Jul 2020 23:12:03 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f177643-eca3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mHBLlX7Yw%2B16Q1pN3nq7fSh7IbFQ33fHMOKgBSA92J0iDoaoTNieESHoov8Te9qa7cZsF1YerDzNPQA%2FNIXwf9mwwxFzGmm3A0JfYt9W%2BNgCTruMk7UURspwuE%2B4pjCxGxWS0szg7%2BG5eLOun8y94qik"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6ff0eba4a8f823df-ZRH
expires: Mon, 10 Apr 2023 21:19:50 GMT

GET
H2 206 pre-summer22_h_low.mp4
productsup.melia.com/production/ Frame 532F 34 KB
34 KB 11ms
10ms Media
video/mp4 143.204.98.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://productsup.melia.com/production/pre-summer22_h_low.mp4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.27 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-27.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: b081da29fb0d2b34dd03b08da016d059bca2064de9cc5de2abd86dda92f22805

Request headers

Referer
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Range: bytes=753664-

Response headers

x-amz-version-id: Q6moKFDsjYlyK1W4.RP99wPb7MQNVV3h
via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
etag: "88914c9106e744f92c40234550dec9b6"
last-modified: Mon, 21 Mar 2022 07:56:34 GMT
server: AmazonS3
age: 1027
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: video/mp4
Content-Range: bytes 753664-788348/788349
date: Wed, 20 Apr 2022 21:19:50 GMT
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
Content-Length: 34685
x-amz-cf-id: pFlytDXAIGsSlGXcMNyW3Eo3PwikDonj84onH5cMrAgbTJe2sMC42g==

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 9D0F 0
20 B 43ms
42ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BZ8BT9XhgYtHhLcPd7_UP-aiK-AkAAAAAOAHgBAI&bg=!srGlsfXNAAZvJBiFTyQ7ACkAdvg8WoXypH08-W-ZAshTJFDpnKkr2GUgPD-WJKfCrTH5cj-igSlrNwIAAAEEUgAAAAFoAQeZAvY2KTRTLYYLOOhz6SRZtgY91gk_6KtlPnCRavqcgpUfOfW2PpFd9t8t4Et10LgkWq4Ltr5kApoG9ihMUv18wqFxkzq0oSHOpyLTW02kaRjMl0ZUtTaUJGszhnOXVWFJvqdRV5es7hlSmaAHymVLI3GcQziiWCY4NVhb6c3bJ0zHhdMNwuuJpPgs5mXg2SM81vMHOXhok7hBuL_26cQ_bKHHyoE4H1KIas4okiE23GIHLoqK4dceJ0NwjZRmcKsjVcN_EGWsBZEPFsKMG1JCW4wgOAIylK0-IBXf3IHI1-mIKiRSwZSQzpF54vwgz4rNYwSMMIBEZeZONn5KTPVSrUB3mdbRVCgRlA5sqEsLdJBKDEkLylRE7kQ4q7FiIwXEEhgsubtKuJuMz5VxSWm72tNIPrP9F7R2Fg4mgk61kIUU9YPhS8e16ZR0RciL_ttB6VGxtZIFJcexIbVoClQqG0fc30LRTEJu6LUs9xNjVHcdFmlQ4517gy1t03jp3T-jAzidBSk61ECY4d2uGNkJZ56fJrtPibQCQmGXpRcihbpQPEGlxdzD39BxBaAEuRwlhdd0FbrsPOh8pdtc_QhM-Hrgzpa-EsMj_SYUFA1zlUI2EtxsvChn9N2jirmq1jBoQkbMy_XQMxuZ45pEoea3fZF5UydmH2f_oGunbadj4a730eyHw7YDLqmhZRZg-hLo11KJpCcLlq5j3EBg6yby1DbfO58SBfb764FyNsuxad8Wa-LZLbzwN_D7A6e1Mp8pqOfjqXofMJHMCEmZrx4YgMAtHyQJ0j-fN5Ml-eE2phHNojWpCUUBX1JSyxCnBY-s9ca2fSg_plbyg4IlL5QtSCga3Gn4DrO5AESHlJlvcbA-voy80dEE_EJiYkBq8ANnADXMkBDaXTeL0xNB8MjJTQ7hYhHVuCGTeP9XSmqf0T0SwVXSmG2XggLM8kQaLT94p6rlDMGmOI_6p86kLKhy_RxzKmDdQvC0l4hOazLi8ak8lNhWEF6x0w

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 LJGn0i2Pg8yG-wzimFR5htSsDE5oolsrGkll4HQxngw.js Show response
pagead2.googlesyndication.com/bg/ Frame 1135 35 KB
13 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/LJGn0i2Pg8yG-wzimFR5htSsDE5oolsrGkll4HQxngw.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Enqz_20U.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c91a7d22d8f83cc86fb0ce298547986d4ac0c4e68a25b2b1a4965e074319e0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 14:40:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 110370
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13643
x-xss-protection: 0
last-modified: Mon, 11 Apr 2022 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Apr 2023 14:40:20 GMT

POST
H2 200 59c9120b31ae8f128419d688
c.bannerflow.net/tr/v2/pixel/ Frame 580C 0
162 B 40ms
40ms Ping
text/plain 2606:4700::6810:d40
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.bannerflow.net/tr/v2/pixel/59c9120b31ae8f128419d688
Requested by: Host: c.bannerflow.net
URL: https://c.bannerflow.net/a/6232eccb9663a849c8c24941?did=5ced02fe0fd60d000186f5ac&redirecturl=https%3A%2F%2Fgoogleads.g.doubleclick.net%2Fdbm%2Fclk%3Fsa%3DL%26ai%3DCYuU-9HhgYsCGLvKO7_UP5u2d2A2M1KXCaeHgprDwD5Ok_orXKRABIKqAwyJgldqigrAHoAGTpo--A8gBCakCCmX3rhg1sj6oAwGqBI8CT9BLydD9fG1_aUmHp4khhsVR2szxt-_IZ0jeKFi8sm2Fr-oSAACAr5oYvpU4uFgyQPshdMio3MqPD2-UJC0IOTSxcHzAtUqhS2uhmbBRKSLALdQt1i3ktpLOYtSUiXinbIKmoXHX6BbKRW6SfkX2c3-AjL5qZ2mw3VLVwBWoJctHa8UmoOo0TKVHqORjYwfprPMNAIdRTZg6Kooib48kXBMe-2xLpBoawaa1tGRmJS6ZkesgVCVEHFXFOLZcpybwyLNln62issZhXOXo8koAfJDsUSHDAXTc3HzJFUXa4Fz-uvBJ_OqDp8XJ41tVJWI29PPnwtfBJ6CeBFpZTYtdfn7VYXT0JmxQn3-omh0OncAE_d30tO0D4AQDkAYBoAZNgAfV2fBBqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAf_nrECqAffn7EC2AcA0ggJCIjhgBAQARgd8ggbYWR4LXN1YnN5bi03OTQ0NzI2NzAwNjA0NzAxgAoDmAsByAsBgAwBsBPyxPEO2BMN2BQB0BUB-BYBgBcB%26ae%3D1%26num%3D1%26cid%3DCAQSLQCNIrLMyTyxPyWSFKP3YG2IvXPrDni2ozokT8gfP4EqCPW9_FtfsTMP4d7ukw%26sig%3DAOD64_1GD8XAVq-t3XgVg4nxvHhgbqRu3g%26client%3Dca-pub-5512390705137507%26dbm_c%3DAKAmf-DGJB980y18Yjx98pZH9cHEHCyGOJ2lnWzmh40uLydI2Zep0v4I48pXQGngeBSpXp2DeSEU01bBSx_7RuqikqSUJcN2G5MuJZCR5ZAitqAQXOT3uQW-PzWz5kqXM8dzEMjZdXQzg901FOB53ct84p1QSXCvbQ%26cry%3D1%26dbm_d%3DAKAmf-BuT1eLFpuK-M_vF_zQ3zN8H9qH_CI8Q0zpsHCXymmdxw0vvuVixkd8bckDE0ZdI0dDmF2zR2xjTQR4CI_Y0t5JKMeKUvXboWq0g-ucMF2Z2f_3KQ_4xOrt_GV1hUt68-e4GtOAjqE5SlzizcycrzeFJMtHz1tx9xoITmG5WFnjdmvJOsDDeb_I_r6SdYXERMoRkNrOWPCFSMFkS-3CdxeIkd0CtGnRrmQUjIT9zGxV73vQqcAwlfYL8DbwtowVN4FQWFTR2Txg1quzaNUY148DCohY_APJPVEwnRbe_dFvKHnlBu3CmLX1NzqTUf7og4nTT2xmV2cnVAq0U3QFY30-UO5oShaMrMX12lvIEho14HyEklsnLVvkKVAzkiarU3kB6wThpD7gH9x1m4sJDwmVJru88FeLsPCDDzWRO_nXAE3aa9KkD11txM_gO9CaDy-GA6bv0zWQAwQng7js7xxsToCFLQ%26adurl%3Dhttps%3A%2F%2Fa1.adform.net%2FC%2F%3Fbn%3D54370173%3Badfibeg%3D0%3Bcdata%3DiRC99z5vOMPyVUB3sm7qdD3H6zHyVHqzADbraSVMwddeWA_EDGcbq-vhfINXxkXnhcMRvNZZuUQdBto-OTni43tt2n4OwTFixfgN7wWhehNcPlakbYq96RfFbAlL4jcDepog248PTuUVdH9pxlMXHT15XEr-uFmMQeEimShqzcc1%3B%3BCREFURL%3Dhttps%253a%252f%252fpt.lizspaperloft.com%3BC%3D1&domain=https%3a%2f%2fd5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com%2f&targetwindow=_blank
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:d40 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Wed, 20 Apr 2022 21:19:50 GMT
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 6ff0eba4bcca0211-ZRH
content-length: 0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
request-context: appId=cid-v1:1d9bcaa3-5ddc-4e5d-973c-949d7ceab63e

GET
H3 200 sodar Show response
pagead2.googlesyndication.com/getconfig/ Frame A84B 7 KB
5 KB 17ms
17ms XHR
application/json 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=xfad&tv=01_244&st=int

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_244.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e62d54228fddc3f254f816dd251462b91a84c6c3d9fb0efd3019741e5d2a1d0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 21:19:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 5524
x-xss-protection: 0

GET
H3 200 sodar2.js Show response
tpc.googlesyndication.com/sodar/ Frame A84B 17 KB
6 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:829::2001
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/sodar2.js

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/879366/Enabler_01_244.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:19:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 6386
x-xss-protection: 0
server: sffe
cross-origin-opener-policy: same-origin; report-to="adspam-signals-scs"
etag: "1637097310169751"
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Wed, 20 Apr 2022 21:19:50 GMT

GET
H3 200 blank.png_1621952972643_blank.png
s0.2mdn.net/dynamic/2/10812395/s0.2mdn.net/creatives/assets/3690075/ Frame A84B 95 B
120 B 8ms
7ms Image
image/png 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10812395/s0.2mdn.net/creatives/assets/3690075/blank.png_1621952972643_blank.png

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9df9512d0f2332b34e43e220b6bdc675dc6b663e72406edde64fd96dc9128e1b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6657181183598343709/index.html?e=69&leftOffset=0&topOffset=0&c=rG8LDoX2Hl&t=1&renderingType=2&ev=01_248
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 23:27:00 GMT
x-content-type-options: nosniff
age: 78770
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 95
x-xss-protection: 0
last-modified: Tue, 25 May 2021 14:29:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Apr 2023 23:27:00 GMT

GET
H3 200 DCO_Sky_ist_Wenn_300x250_1.jpg_1634118112701_DCO_Sky_ist_Wenn_300x250_1.jpg
s0.2mdn.net/dynamic/2/10812395/s0.2mdn.net/creatives/assets/3690075/ Frame A84B 15 KB
15 KB 8ms
8ms Image
image/jpeg 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10812395/s0.2mdn.net/creatives/assets/3690075/DCO_Sky_ist_Wenn_300x250_1.jpg_1634118112701_DCO_Sky_ist_Wenn_300x250_1.jpg

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

57e93fdbf1afa598c0761c3729e1fe3ac8f8d3469fcee77e7182b1d7803eb145

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6657181183598343709/index.html?e=69&leftOffset=0&topOffset=0&c=rG8LDoX2Hl&t=1&renderingType=2&ev=01_248
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 20:37:12 GMT
x-content-type-options: nosniff
age: 88958
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15178
x-xss-protection: 0
last-modified: Wed, 13 Oct 2021 09:42:24 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Apr 2023 20:37:12 GMT

GET
H3 200 DCO_Sky_ist_Wenn_SkyGo_V2_300x250_2.jpg_1634118112701_DCO_Sky_ist_Wenn_SkyGo_V2_300x250_2.jpg
s0.2mdn.net/dynamic/2/10812395/s0.2mdn.net/creatives/assets/3690075/ Frame A84B 17 KB
17 KB 9ms
8ms Image
image/jpeg 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10812395/s0.2mdn.net/creatives/assets/3690075/DCO_Sky_ist_Wenn_SkyGo_V2_300x250_2.jpg_1634118112701_DCO_Sky_ist_Wenn_SkyGo_V2_300x250_2.jpg

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3a3ab954663ae472128d91abec0ade61efdebaa344f970409434a7ed63ef9df5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6657181183598343709/index.html?e=69&leftOffset=0&topOffset=0&c=rG8LDoX2Hl&t=1&renderingType=2&ev=01_248
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 05:39:39 GMT
x-content-type-options: nosniff
age: 56411
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17636
x-xss-protection: 0
last-modified: Wed, 13 Oct 2021 09:42:39 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 20 Apr 2023 05:39:39 GMT

GET
H3 200 DCO_Sky_ist_Wenn_SkyGo_V2_300x250_3.jpg_1634538332792_DCO_Sky_ist_Wenn_SkyGo_V2_300x250_3.jpg
s0.2mdn.net/dynamic/2/10812395/s0.2mdn.net/creatives/assets/3690075/ Frame A84B 28 KB
28 KB 12ms
11ms Image
image/jpeg 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://s0.2mdn.net/dynamic/2/10812395/s0.2mdn.net/creatives/assets/3690075/DCO_Sky_ist_Wenn_SkyGo_V2_300x250_3.jpg_1634538332792_DCO_Sky_ist_Wenn_SkyGo_V2_300x250_3.jpg

Requested by

Host: d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
URL: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

374ab94edf42f3fa6b9754f8c40f0475184f16f2742704522fee1f3bee9385ea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://s0.2mdn.net/sadbundle/6657181183598343709/index.html?e=69&leftOffset=0&topOffset=0&c=rG8LDoX2Hl&t=1&renderingType=2&ev=01_248
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 18:59:56 GMT
x-content-type-options: nosniff
age: 94794
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-programmable
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28421
x-xss-protection: 0
last-modified: Mon, 18 Oct 2021 06:25:47 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="ads-programmable"
report-to: {"group":"ads-programmable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-programmable"}]}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Apr 2023 18:59:56 GMT

POST
H3 200 view
googleads4.g.doubleclick.net/pcs/ Frame 8CF2 0
26 B 45ms
45ms Ping
image/gif 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads4.g.doubleclick.net/pcs/view?xai=AKAOjstOTG6wPI1gsX4rOgzQA08vAVWYrFAQNR1I7YOKvwt3INgDSnkB4NsYzOrFH9n0EyXyCNO7pjGkJNopkTuds3Cs-pC1aWAzXDDJ9tRWPzUdkIWnoviAGacx2hah9FhsLNFlDnhZbJo6s9MSovCYzmMT-XguFucrcyWGLkmqB6mb4MpcAjNIc7eOsDL4Qlu4EAUztd5JfShWPS-hgbbHCwk--EA3ewmmDSGXpcQMWQfPOzKwQtrI4JSdStYKbmR45Q6_RTyxDFevqUyReEgN_u6Gidzr5QDH4OqOzFijkN2eA6EkNNBpw905i_isonlSiKPiUt1DTH5feUsVaNo5-syM99c1K6LTbI0vAkVfe9qsmZymBiXmKtv7eyrddXfbsp1Ln8vkkwsxtuAvAyFz8EjLLD-mHnBhNngEix87IK_5fP8wMkTqKDyTbHmSR6KF2NjEGlHy6NxhiQq0zLy7xf5p6ZUq7kDMlJkU-9zeb4GgpL6gogedrvO_ufdOJB4T6JWyW9nsm12ysA7FPQqwtKIFld3U1uV6VvLHvioTUnYjkecAWufVF9QSdIRX9MgnvV53lU2D-05XorggAlHiUfYxas6Zafme2KJpGYs53_RCIykwbgJtyqTyrNkENiW-AK09CN8wcJVivpuUZY9_13HS2pvSsUFXuAwppgmf1qtZLHC3KtyE72UL5eckOC_g2Qo3jZc17rq_-UD7GGX7s2HG-yz1Mx7JI_FPK1yqzNpfl1p6FKpg29U6L8zVodzldbxjiBXk_9wLUTPonHX5SGlK6BV8IAR2bra95f1n9yCsIx_j_3_dmw5qhesx2wabl3dMfYszAy0scwGpABagHpaW9pZ6A7E0Vk9Dp9nI7yNyd8xbGnQRWe9OH1dY7ZIJ1CXxUadFR8U8Pj15PmFB_Ya1u-sZ3NNAP8QdHidtWBKiMQDzAqQYNbv3iap-IJlmCOSkclZydmipl-Zm28f4KQUiw-9lAVTtgBSgvthYXeWYJreZ3D9twi3BHSOizYxwliKtaEdhyNC_0lbdEb-B0lDPFhI9U93-10d-yuSwIt8uiX8A88grL_OsUhHC_X3_XCOxxRY_4nhQY0n1_yZKCoUZjuAMEfwUwhmFWqzgFGaKmMx9QhbEF_JATxCrhSjqr1f1SBCxvlP5_IwUJv9-8xUn2NgnoZiJ9f2x9Wz0usUr2VyMGrZFEduAP5Xh_c6i9XMUuYinibnKb5Pj3PnGt6LhvN3pS5QpK-dzAhgyWCrW0NlpPN0Et28XsN4ikB31lgax4Wy0UG7pG1A9_yX7LwYK4f_qDKgtzlv7RQtlRuz7XtRLl1jWtozYxCDHpHUttYM-icien9GvifilmnOuPzo&sai=AMfl-YQCmVXpQU1MH5SRpzYFG0IzFa_akN1dXTKX4LP_H9RY_ox_Kov_W4W4X7yl2CTTv4v261Ypuk6D1PV1Amn982NfoKjUjuAGeDf11gFR_caHv_FmpbsbbS4bPpja3Wx4NX4vcKhjdkfFxGOV4EGTczTMbnFiwg-gqzp33QTmcJ7tUKFh6YlBAHMNFf-Ad9Gk4t1Tl9nf8Je8LVT7IBE9Bw&sig=Cg0ArKJSzKu1J8JWi7w4EAE&uach_m=[UACH]&cry=1&fbs_aeid=[gw_fbsaeid]&urlfix=1&omid=0&rm=1&ctpt=280&vt=11&dtpt=193&dett=3&cstd=82&cisv=r20220413.90447&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&adurl=

Requested by

Host: pt.lizspaperloft.com
URL: https://pt.lizspaperloft.com/

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

timing-allow-origin: *
date: Wed, 20 Apr 2022 21:19:50 GMT
x-content-type-options: nosniff
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
server: cafe

GET
H3 200 sky_medium.woff
s0.2mdn.net/creatives/assets/3668815/ Frame A84B 27 KB
27 KB 10ms
9ms Font
font/woff 2a00:1450:4001:813::2006
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s0.2mdn.net/creatives/assets/3668815/sky_medium.woff

Requested by

Host: s0.2mdn.net
URL: https://s0.2mdn.net/sadbundle/6657181183598343709/style.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2006 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4373878b9f750698b6a199ebc0eb0e550df208c5a1f9f778a346e271a2b4d733

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://s0.2mdn.net/sadbundle/6657181183598343709/style.css
Origin: https://s0.2mdn.net
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Wed, 20 Apr 2022 21:15:04 GMT
x-content-type-options: nosniff
age: 286
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 27952
x-xss-protection: 0
last-modified: Thu, 20 Feb 2020 12:38:21 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: font/woff
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Wed, 20 Apr 2022 21:30:04 GMT

GET
H3 200 LJGn0i2Pg8yG-wzimFR5htSsDE5oolsrGkll4HQxngw.js Show response
pagead2.googlesyndication.com/bg/ Frame 3168 35 KB
13 KB 8ms
8ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/LJGn0i2Pg8yG-wzimFR5htSsDE5oolsrGkll4HQxngw.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

2c91a7d22d8f83cc86fb0ce298547986d4ac0c4e68a25b2b1a4965e074319e0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

date: Tue, 19 Apr 2022 14:40:20 GMT
content-encoding: br
x-content-type-options: nosniff
age: 110370
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13643
x-xss-protection: 0
last-modified: Mon, 11 Apr 2022 15:48:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 19 Apr 2023 14:40:20 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 1135 0
20 B 42ms
42ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=30&t=2&bgai=BUGgs9nhgYt-9C9zE7_UPkPa48AcAAAAAOAHgBAI&bg=!j4yljMjNAAZvJBiFTyQ7ACkAdvg8WrWzziED-hAzoNyEs4WhzHIKfju6fdZYD1dNADjOcUsAqgcAuAIAAAB_UgAAAAFoAQeZAvhG5Z8f_YzU8oiwsPimv9MmXW0sb5EzXZIInRgDKCdX3xRFUyu1wbPQSGgGE1i62iXOD4iXEQKOHEzpWVOuXwidsUQAHWxU8QWOOT7vZyCXtSSSiVgpnLkNbd6bqpdktI6Bo0dj5MSAIJp-BdgnBiJ1Uu-PQYLkuPyRE0vd7gHOFHR2Uq9zIHqomNGyK4PW2YaKrMFsSlmvihdEV9j8LG-vLk1uG7IO4rbMPo23LGW0U_cdkExsz_e7PUJqV5oi6AErk-sPNpOW0qfnTvm2Rm_vfgZcjUKQiiQsK1LAP9kyxCkbDf-DqU3EmZ2ynNFDvyy-xmeuBqj_FvjAx7uTYBvgJ9UIrbQX7Qsbr0zaBmg5BRNUT_kKmkAJw3xT9X2jmhnKH18FSW5-ajX6jZJr6IHmrTLHNqNvWYyDkZ0j5ZTa8AaT1gGGcjTnZTAzF1ZD5qD53X46V0jwP519rXCnXloLGQ2tAkgWBZRefwyw2h1unZQ9I8G_0ZMCEVIHCGVLzm0KciT81iNp_3p1NEOxx7mCcSE-KytnOn0Nl0Gu4qS34Ypoj_5PozZi9DFE4ChNR_kq6KjmXKChRftwJwTpJ6QJnL2WuCkT6i3etjurgxQLhJuIGJaZJxae35rgc7szY_uxSGAGPqkKI9ixv47a9Gj2KJKFrZFTO_lQdN7tnWiFDfQPk1mORJOczxQGBWUU-ymEByM5Fbq4CIyBAJ-PbXQIWxAXq30WCVX_DsofoqeoPyfxOHKtaSZDvvgh64rXh3RAaQXXQS7S9dQA-kHgDrSz827PzbrBbPiq6bpxUHpaLtqo6fGk86LJHCCumw-9_1EUFxzwlaV1fR4v62pENnKxevzbZABnNhw0WEAWDYo-77y0WwYLIUk7K6eVOJswwm6ijWguos9gZPEmWyxfLTr8hq1K7nlV9NtKF88VsPTlu_edYERRU1ucDOSUoV5IPRi5HNvySuF_XjeBr1Leqc1a_4PwVHyFrasG9LPc7OKZMiqJypvC3baV

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 /
a1.adform.net/serving/unload/ Frame 80F1 35 B
502 B 20ms
20ms Ping
image/gif 37.157.4.24
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://a1.adform.net/serving/unload/?version=15&unload=6718199658697509927@@54370173,1551039507743951491,100|1181|0|0|0|0|0|0|0||40|1|||||1|0|0|wttyaNguiY1cPlakbYq96RfFbAlL4jcDepog248PTuUVdH9pxlMXHfL_QlhaeLlf0|||11||0

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.24 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:51 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

GET
H2 206 pre-summer22_h_low.mp4
productsup.melia.com/production/ Frame 532F 578 KB
579 KB 11ms
10ms Media
video/mp4 143.204.98.27
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://productsup.melia.com/production/pre-summer22_h_low.mp4
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.27 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-27.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 9b4e594b808e6b6b6ca69cc6c7058408d00d2269a8e4fe908b60434c77d2d783

Request headers

Referer
Accept-Encoding: identity;q=1, *;q=0
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Range: bytes=196608-

Response headers

x-amz-version-id: Q6moKFDsjYlyK1W4.RP99wPb7MQNVV3h
via: 1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
etag: "88914c9106e744f92c40234550dec9b6"
last-modified: Mon, 21 Mar 2022 07:56:34 GMT
server: AmazonS3
age: 1028
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
content-type: video/mp4
Content-Range: bytes 196608-788348/788349
date: Wed, 20 Apr 2022 21:19:50 GMT
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
Content-Length: 591741
x-amz-cf-id: IvRN4_3GcXqkmWWPDTqlXKOszWJNqWHXVGdwAGWdNgDE8z1s95Nhog==

GET
H3 200 activeview Show response
pagead2.googlesyndication.com/pcs/ Frame 8CF2 42 B
64 B 47ms
46ms Fetch
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv2zv5N9Ad88osnOO5__fvpMP_N_dH8S1eSSRgXTrwH-OuxDDKOlFXIANvYYVsb4jtNCXmSxazYLB92M9_EhjkeSmya0zKz8kdwSRaHzyuMb6IOcYlzeg&sai=AMfl-YRSf3Ec-3ypo9lRpE_kBgeYmJWSwpbIf7W2QvF9Yyv_7HdTugD-K1o0NL12X6OiOfiz6B1PhXLUyaISDmjMgkJYiikAVwiZ9Yc2xkihc08-hCJc9O2Vz3CEMGU&sig=Cg0ArKJSzHHfe13a4EVNEAE&cid=CAASJORoWlG5a4Yd5eFwl3Ot2IpzOkqblRXxbm1pxsn4s2mej7jE7A&id=lidar2&mcvt=1000&p=575,460,825,760&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220420&bin=7&avms=nio&bs=0,0&mc=1&if=1&vu=1&app=0&itpl=20&adk=3777506267&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1650489590125&rpt=226&isd=0&lsd=0&met=ce&wmsd=0

Requested by

Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:51 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

OPTIONS
H2 200 json
gum.criteo.com/sid/ Frame 0
0 58ms
19ms Preflight
application/json 2a02:2638:1::13
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpt.lizspaperloft.com%2F&domain=pt.lizspaperloft.com&cw=1&lsw=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a02:2638:1::13 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: https://pt.lizspaperloft.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: https://pt.lizspaperloft.com
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Wed, 20 Apr 2022 21:19:50 GMT
expires: 0
pragma: no-cache
server-processing-duration-in-ticks: 1408
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H2

200

sid Show response
mug.criteo.com/
Redirect Chain

https://gum.criteo.com/sid/json?origin=prebid&topUrl=https%3A%2F%2Fpt.lizspaperloft.com%2F&domain=pt.lizspaperloft.com&cw=1&lsw=1
https://mug.criteo.com/sid?cpp=2S0DHnw3b0c4RFlhTjVWVHd1NEp2NEJ0c1VVcXRHTDVKVTVocHFlMk52ZmluT0lsZnVQT2p6TFo5NXd6S1kxRTlPaVFwdGZLd2E5bUlrYjFsaElTbU5iVE1XcVpnekh1TXlSNFQ2YmlXTjJoR1dyeUJXYzR5SitReTFIRm...

360 B
622 B

44ms
17ms

XHR
application/json

178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

https://mug.criteo.com/sid?cpp=2S0DHnw3b0c4RFlhTjVWVHd1NEp2NEJ0c1VVcXRHTDVKVTVocHFlMk52ZmluT0lsZnVQT2p6TFo5NXd6S1kxRTlPaVFwdGZLd2E5bUlrYjFsaElTbU5iVE1XcVpnekh1TXlSNFQ2YmlXTjJoR1dyeUJXYzR5SitReTFIRmhkVlZzeUxrNTJIalRyNTg2V0Fpc0M0Tm1BaVY3UFp3SWxsb1lXbUF6ckRma0JvalJJR0s3QW1TbGtkeGJrNzB5dWs5ZGkyOGhQbHdOeU43R2VkeXBqQjBoRE15OUNScmVLTUtHSzh2WndtWllpWTdER2M5cHBxaUZpWFJiRG5kWTVXdm5udXZzfA&cppv=2

Protocol

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

ebc588aed8b8d247bf7ab72d7f91de1d0be3cfa4ab6046ab32a43e005152f4c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://pt.lizspaperloft.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:50 GMT
content-encoding: gzip
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/json; charset=utf-8
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 2703
strict-transport-security: max-age=31536000; preload;
expires: 0

Redirect headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:50 GMT
location: https://mug.criteo.com/sid?cpp=2S0DHnw3b0c4RFlhTjVWVHd1NEp2NEJ0c1VVcXRHTDVKVTVocHFlMk52ZmluT0lsZnVQT2p6TFo5NXd6S1kxRTlPaVFwdGZLd2E5bUlrYjFsaElTbU5iVE1XcVpnekh1TXlSNFQ2YmlXTjJoR1dyeUJXYzR5SitReTFIRmhkVlZzeUxrNTJIalRyNTg2V0Fpc0M0Tm1BaVY3UFp3SWxsb1lXbUF6ckRma0JvalJJR0s3QW1TbGtkeGJrNzB5dWs5ZGkyOGhQbHdOeU43R2VkeXBqQjBoRE15OUNScmVLTUtHSzh2WndtWllpWTdER2M5cHBxaUZpWFJiRG5kWTVXdm5udXZzfA&cppv=2
strict-transport-security: max-age=31536000; preload;
access-control-allow-methods: GET
content-type: text/html; charset=utf-8
access-control-allow-origin: https://pt.lizspaperloft.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server-processing-duration-in-ticks: 1922
content-length: 509
expires: 0

GET
H2 200 rid Show response
match.adsrvr.org/track/ 109 B
545 B 30ms
30ms XHR
application/json 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://match.adsrvr.org/track/rid?ttd_pid=prebid&fmt=json
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: cb10bc08acd0b1ff67cddb8435e544b350c49b3b9dc433f6cbc7dcda664b7de7

Request headers

Referer: https://pt.lizspaperloft.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain

Response headers

date: Wed, 20 Apr 2022 21:19:51 GMT
x-aspnet-version: 4.0.30319
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://pt.lizspaperloft.com
cache-control: private
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length: 109
expires: Fri, 20 May 2022 21:19:51 GMT

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 1389 52 KB
17 KB 31ms
7ms Document
text/html 151.101.193.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://pt.lizspaperloft.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 57483
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Wed, 20 Apr 2022 21:19:51 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 14 Apr 2022 05:21:37 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 159827, 1020423
X-Served-By: cache-lga21972-LGA, cache-hhn4047-HHN
X-Timer: S1650489592.702647,VS0,VE0

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame AA37 52 KB
17 KB 30ms
7ms Document
text/html 151.101.193.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://pt.lizspaperloft.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 57483
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Wed, 20 Apr 2022 21:19:51 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 14 Apr 2022 05:21:37 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 159827, 1054265
X-Served-By: cache-lga21972-LGA, cache-hhn4021-HHN
X-Timer: S1650489592.702850,VS0,VE0

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 14C5 52 KB
17 KB 35ms
7ms Document
text/html 151.101.193.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://pt.lizspaperloft.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 57482
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Wed, 20 Apr 2022 21:19:51 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 14 Apr 2022 05:21:37 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 159827, 1049883
X-Served-By: cache-lga21972-LGA, cache-hhn4062-HHN
X-Timer: S1650489592.708905,VS0,VE0

GET
H/1.1 200
OK async_usersync.html Show response
acdn.adnxs.com/dmp/ Frame 23B3 52 KB
17 KB 36ms
7ms Document
text/html 151.101.193.108
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://acdn.adnxs.com/dmp/async_usersync.html
Requested by: Host: get.optad360.io
URL: https://get.optad360.io/sf/prebid6.13.0.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.193.108 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: 3d649c0b3e87fd6abcb983656a0a1b3923a2a59885c3a30538641fd4f7126cbd

Request headers

Referer: https://pt.lizspaperloft.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Age: 57483
Cache-Control: max-age=86402
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 17053
Content-Type: text/html
Date: Wed, 20 Apr 2022 21:19:51 GMT
ETag: W/"623de86a-cf34"
Expires: Thu, 14 Apr 2022 05:21:37 GMT
Last-Modified: Fri, 25 Mar 2022 16:06:02 GMT
Server: nginx/1.18.0 (Ubuntu)
Vary: Accept-Encoding
Via: 1.1 varnish, 1.1 varnish
X-Cache: HIT, HIT
X-Cache-Hits: 159827, 1020424
X-Served-By: cache-lga21972-LGA, cache-hhn4047-HHN
X-Timer: S1650489592.711112,VS0,VE0

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 1389 0
741 B 29ms
29ms Script
text/html 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:51 GMT
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: a0f66a19-554b-4e6b-a9ba-6cc71a7857ac
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame AA37 0
741 B 29ms
28ms Script
text/html 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:51 GMT
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 52403a1b-fbfb-402b-b160-c268362e8607
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 14C5 0
741 B 18ms
18ms Script
text/html 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:51 GMT
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 990c9108-639b-4ae9-a954-5f94afc83ca8
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 23B3 0
741 B 18ms
18ms Script
text/html 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:51 GMT
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 6b84c52f-b2dc-4d14-85fb-f39367d5b25e
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

OPTIONS
H2 200 sid
mug.criteo.com/ Frame 0
0 51ms
15ms Preflight
application/json 178.250.2.146
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

178.250.2.146 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload;

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: GET
Origin: null
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: GET
access-control-allow-origin: null
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: application/json; charset=utf-8
date: Wed, 20 Apr 2022 21:19:51 GMT
expires: 0
pragma: no-cache
server-processing-duration-in-ticks: 1045
strict-transport-security: max-age=31536000; preload;
vary: Accept-Encoding

GET
H3 200 dc_oe=ChMI-NXF7cij9wIVRsvVCh3Mogn0EAAYACDPmoBROhoIm9qCkAEQ3_6y1vIDGPX44t8DIMihhLSVEEITCK2Kpe3Io_cCFVOK_Qcd6aAK8A;dc_rmcid=CAASJ-Row093ftuAHf3RTltz17HdDZhuJEoZAl1n_Sr-nY65gW-G63gQ0A;eps=CIjhgBAQARgd...
ade.googlesyndication.com/ddm/activity/ Frame C02A 42 B
63 B 44ms
44ms Image
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI-NXF7cij9wIVRsvVCh3Mogn0EAAYACDPmoBROhoIm9qCkAEQ3_6y1vIDGPX44t8DIMihhLSVEEITCK2Kpe3Io_cCFVOK_Qcd6aAK8A;dc_rmcid=CAASJ-Row093ftuAHf3RTltz17HdDZhuJEoZAl1n_Sr-nY65gW-G63gQ0A;eps=CIjhgBAQARgd;met=1;acvw=sv%3D925%26v%3D20220413%26cb%3Dout%26e%3D9%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D8,232,293,739%26tos%3D2041,0,0,0,0%26mtos%3D2041,2041,2041,2041,2041%26amtos%3D0,0,0,0,0%26mcvt%3D2041%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D2324%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D6%26pst%3D286%26dur%3D20053%26vmtime%3D2334%26dtos%3D2041%26dtoss%3D1%26dvs%3D2041%26dfvs%3D2041%26dvpt%3D2324%26is%3D275%26i0%3D18%26ic%3D16777473%26cs%3D16777491%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D399097614%26psm%3D7%26psv%3D6%26psfv%3D6%26psa%3D0%26pngs%3D9,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,2041;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.07%26t%3D1650489589844;ecn1=1;etm1=0;eid1=200000;

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame C02A 42 B
64 B 43ms
42ms Image
image/gif 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssG2UlWHA7_lAIEdboSiRX5kHu5FhRvxbRq1iLeF8PlaT47X353VlfdDWoig16urLt5RaQCklsdeLJrsMxrWe8q8HOXcRmB2U9Ge7MfkxUycwX_c6Y8xA&sai=AMfl-YT60gCa5PbchMbjQ8DS36_OGyMFqgSmp8VfBL_EOZmBx786t2454ifCTgovM47QLxINzBvNu_elDOVQb2Dj1BUbyS9GL2VTNy12QKN3h9YXmRqDSzRSTlE3v-m_5Ek&sig=Cg0ArKJSzF-xJ-CUIM28EAE&cid=CAASJ-Row093ftuAHf3RTltz17HdDZhuJEoZAl1n_Sr-nY65gW-G63gQ0A&id=lidarv&acvw=sv%3D925%26v%3D20220413%26cb%3Dout%26e%3D9%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D8,232,293,739%26tos%3D2041,0,0,0,0%26mtos%3D2041,2041,2041,2041,2041%26amtos%3D0,0,0,0,0%26mcvt%3D2041%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D2324%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D6%26pst%3D286%26dur%3D20053%26vmtime%3D2334%26dtos%3D2041%26dtoss%3D1%26dvs%3D2041%26dfvs%3D2041%26dvpt%3D2324%26is%3D275%26i0%3D18%26ic%3D16777473%26cs%3D16777491%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D399097614%26psm%3D7%26psv%3D6%26psfv%3D6%26psa%3D0%26pngs%3D9,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,2041&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.07%26t%3D1650489589844

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:52 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 adview
securepubads.g.doubleclick.net/pagead/ Frame C02A 0
0 43ms
43ms Image
text/html 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://securepubads.g.doubleclick.net/pagead/adview?ai=CT3bT9XhgYu27A9OU9u8P6cGqgA_n_cq7acihhLSVEM_mor3AARABIKqAwyJgldqigrAHoAGX_pvwAsgBBakCCmX3rhg1sj6oAwGqBMQCT9BRg2zoiKBo4d6QI9GsxR1-yE8TQOVgHs5h53waaSbA2mripHSby7OkKksPd57Pqqnwmt36Dt5D7IsQyuSSxDp2xG6clz6a2-mHizaOzHbBv2q9w0oOPiI4vcWjGG_SbGTeytuIpkmRtOZP6jfTkaWq-gs-PPiDZPsCA5jBojtjFXRuDnCyh_pvhzmDEdciU66mHhunfUTMkHihmj8B9arNIrtHk91YkODpLjv95i9bnDnhhoSYM1iT01afW4_DkcZmomSKSlD-wxCmUc_j9JriAvfa8e13QQ63W9SpJPe3-nPijNMTAEtEAsQCP_YqxtYsSKuYx8SImLNItByX6tdrPLSLf1xLmrSsK35uaT6x6HgRMgm8pRnGAWnzUpwJIN8k4xad-wlBvnhRK1y3pn-MIwqXmykdqyzHjX7zJD0rIo8ywATf_rLW8gPgBAOIBe_LqL4-kgUGCAMQARgBkgUGCBsQAhgBkgUNCCIQAxgBSI3StwFQAZIFBggdEAQYAZIFBggdEAEYAZIFBggeEAEYAZAGAaAGdoAH0YHkjwGoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G9gHAPIHChDU9xwY28KuyAHSCAkIiOGAEBABGB3yCBthZHgtc3Vic3luLTc5NDQ3MjY3MDA2MDQ3MDGACgPICwGwE-ej6A7IE_X44t8D2BMKiBQC2BQB0BUBgBcBshceChwIABIUcHViLTU1MTIzOTA3MDUxMzc1MDcYku8h&sigh=36ibcxYdIIg&vt=1&uach_m=[UACH]
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s06-in-f2.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 1389 0
741 B 38ms
38ms Script
text/html 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:52 GMT
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: e3a95180-177b-4743-bac3-fca4c793054a
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame AA37 0
741 B 30ms
30ms Script
text/html 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:52 GMT
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: df4772d6-3379-489e-b524-b0ceedceb915
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 14C5 0
741 B 39ms
39ms Script
text/html 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:52 GMT
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 31b5e4c6-0ccb-4162-bfab-643189d72f5c
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK async_usersync Show response
ib.adnxs.com/ Frame 23B3 0
741 B 14ms
14ms Script
text/html 185.33.220.244
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/async_usersync?cbfn=queuePixels

Requested by

Host: acdn.adnxs.com
URL: https://acdn.adnxs.com/dmp/async_usersync.html

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.220.244 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://acdn.adnxs.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 20 Apr 2022 21:19:52 GMT
X-Proxy-Origin: 193.27.14.25; 193.27.14.25; 731.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 951db3b4-ddf8-4d71-a7d4-b2539638eb38
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 /
a1.adform.net/serving/unload/ Frame 80F1 35 B
502 B 20ms
20ms Ping
image/gif 37.157.4.24
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL

https://a1.adform.net/serving/unload/?version=15&unload=6718199658697509927@@54370173,1551039507743951491,100|4681|0|0|0|0|0|0|0||160|1|||||1|0|0|wttyaNguiY1cPlakbYq96RfFbAlL4jcDepog248PTuUVdH9pxlMXHfL_QlhaeLlf0|||01||0

Requested by

Host: s1.adform.net
URL: https://s1.adform.net/stoat/626/s1.adform.net/bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

37.157.4.24 , Denmark, ASN198622 (ADFORM, DK),

Reverse DNS

Software

nginx /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:54 GMT
server: nginx
access-control-max-age: 86400
access-control-allow-methods: GET, POST
p3p: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"
access-control-allow-origin: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
access-control-allow-headers: Content-Type, Cache-Control, Accept-Encoding, X-Requested-With
expires: -1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ade.googlesyndication.com/ddm/activity/dc_oe=ChMI-NXF7cij9wIVRsvVCh3Mogn0EAAYACDPmoBROhoIm9qCkAEQ3_6y1vIDGPX44t8DIMihhLSVEEITCK2Kpe3Io_cCFVOK_Qcd6aAK8A;dc_rmcid=CAASJ-Row093ftuAHf3RTltz17HdDZhuJEoZAl1n_Sr-nY65gW-G63gQ0A;eps=CIjhgBAQARgd;met=1;acvw=sv%3D925%26v%3D20220413%26cb%3Dout%26e%3D1%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D8,232,293,739%26tos%3D4772,0,0,0,0%26mtos%3D4772,4772,4772,4772,4772%26amtos%3D0,0,0,0,0%26mcvt%3D4772%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D5055%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D12%26pst%3D286%26dur%3D20053%26vmtime%3D5071%26dtos%3D2731%26dtoss%3D2%26dvs%3D2731%26dfvs%3D2731%26dvpt%3D2731%26is%3D275%26i0%3D18%26i1%3D275%26ic%3D0%26cs%3D16777491%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26qmt%3D4772,4772,4772,4772,4772%26qnc%3D0%26qmv%3D0%26qnv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D399097614%26psm%3D63%26psv%3D62%26psfv%3D62%26psa%3D0%26pngs%3D9s,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,4772;gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.07%26t%3D1650489589844;ecn1=1;etm1=0;eid1=960584;

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://d5fa0b2c9fcd34ad127755b12ab68a22.safeframe.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Apr 2022 21:19:54 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame C02A 42 B
64 B 19ms
19ms Image
image/gif 142.250.185.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=COpcu9XhgYu27A9OU9u8P6cGqgA_n_cq7acihhLSVEM_mor3AARABIKqAwyJgldqigrAHoAGX_pvwAsgBBakCCmX3rhg1sj6oAwHIA5sEqgTDAk_QUYNs6IigaOHekCPRrMUdfshPE0DlYB7OYed8GmkmwNpq4qR0m8uzpCpLD3eez6qp8Jrd-g7eQ-yLEMrkksQ6dsRunJc-mtvph6s2IAjMxXuoW3Bl4dsn3N5sy5HgkrdY2srb-6FJkV0MpOrzOHSgt_rtMMm7dm97QvabtKE7o-Bzm81wsnD5moA7g-TU11CupusYUn5EzGV5VJk_AwCpOCG6R2berJPg6ds4COUvW2k6FIWEmMZbZtBWn66sC5XHtG9QuygbjPSI6APLw3STnFnWQrMe12wyv1varjT3uPlL4iR5sgFO4Tx0A-_ZJ8YOPHWVeMHfbfol0qOWB-saI-S8ib_V4qYpN7tGVLVz_53JCtV-m6S50P0JlB88NxrvBuMdjgR-Zr_YZQlcu7Kb7ERHN68LHaU6A8AwhpWmsJUlwATf_rLW8gPgBAOQBgGgBnaAB9GB5I8BqAeOzhuoB5PYG6gH7paxAqgH_p6xAqgHpKOxAqgH1ckbqAemvhuoB_PRG6gHltgbqAeqm7ECqAffn7EC2AcA0ggJCIjhgBAQARgd8ggbYWR4LXN1YnN5bi03OTQ0NzI2NzAwNjA0NzAxgAoDyAsB4AsBgAwBsBPno-gOyBP1-OLfA9gTCogUAtgUAdAVAfgWAYAXAQ&sigh=HLT726Hjw58&label=videoplaytime25&ad_mt=5072&acvw=sv%3D925%26v%3D20220413%26cb%3Dout%26e%3D1%26nas%3D1%26if%3D1%26sdk%3Dh%26p%3D8,232,293,739%26tos%3D4772,0,0,0,0%26mtos%3D4772,4772,4772,4772,4772%26amtos%3D0,0,0,0,0%26mcvt%3D4772%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D5055%26gmm%3D4%26efpf%3D2%26nio%3D1%26vmmk%3D52%26nmt%3D0%26tcm%3D1%26bt%3D12%26pst%3D286%26dur%3D20053%26vmtime%3D5071%26dtos%3D2731%26dtoss%3D2%26dvs%3D2731%26dfvs%3D2731%26dvpt%3D2731%26is%3D275%26i0%3D18%26i1%3D275%26ic%3D0%26cs%3D16777491%26c%3D1%26mc%3D1%26nc%3D0%26mv%3D0%26nv%3D0%26qmt%3D4772,4772,4772,4772,4772%26qnc%3D0%26qmv%3D0%26qnv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D399097614%26psm%3D63%26psv%3D62%26psfv%3D62%26psa%3D0%26pngs%3D9s,14,15s%26veid%3Dumt%3A1,xdi%3A0,mvp_lv%3A1%26ssb%3D0,0,0,0,0,0,0,0,0,0,4772&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26dav%3D0%26ss%3D0.07%26t%3D1650489589844

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS