picrok.com Open in urlscan Pro
172.67.187.37 Public Scan

URL: https://wpunativesh.com/in/click/?&cid=742&session_id=5c859725-c5dc-43a2-96dd-d258b0c80035&response_size=0&cryp=eyJhbGciOiJIUzI1NiJ9.eyJhY2NlcHRfbGFuZ3VhZ2UiOiJkZS1ERSxkZTtxPTAuOSIsImFkX3Bvc2l0aW9uIjoxLCJhZF90eXBlIjoibmF0aXZlIiwiYXVjdGlvbl9pZCI6Mzc4NTQ0NDc0OSwiYnJvd3Nlcl9mYW1pbHkiOiJDaHJvbWUiLCJicm93c2VyX25hbWUiOiJDaHJvbWUgOTUiLCJjYW1wYWlnbl9pZCI6NzQyLCJjb3VudHJ5IjoiREUiLCJjcGMiOjAsImNwbSI6MC4wMDcsImNyZWF0aXZlX2lkIjoiODhmNDVkZjU4ZjVjMTI0ZWZkMzZiODMwYmExODNhODgiLCJlY3BtIjowLjAwNjczMzMsImV4dF9jcmVhdGl2ZV9pZCI6IjIyNzcxMjgiLCJmcm9tX3N0b3JhZ2UiOmZhbHNlLCJpYXQiOjE2MzU1MjM5NjEuMDU1NjQyNiwiaXAiOiIyMTYuMTMxLjExNC4xOTgiLCJpc19jcG0iOjEsIm9zX2ZhbWlseSI6IndpbmRvd3MiLCJvc190eXBlIjoiY29tcHV0ZXIiLCJyZXNwb25zZV9zaXplIjowLCJybiI6MSwic2Vzc2lvbl9pZCI6IjVjODU5NzI1LWM1ZGMtNDNhMi05NmRkLWQyNThiMGM4MDAzNSIsInNpdGUiOiJwaWNyb2suY29tIiwic291cmNlX2lkIjoxNzI4OTQzNjcyLCJzcG90X2lkIjo0NzQ3LCJzcG90X3NpemUiOjQsInN1YiI6ImF1Y3Rpb24tbmF0aXZlLXByb2QiLCJ1cmwiOiJodHRwczovL3ItZXUudHN5bmRpY2F0ZS5jb20vZG8yL2NsaWNrP2M9ZTBTRUdVTkhoQTRaTEVUUU9YTlFSSmthTmNUWUdITWpUQXNjTm1UWWFFSERSZzBjR01PUWtkSENqQmt4TmNySW1KR0Rob3d4WVVRb0hPTm16c0VaR3hXR3FUUEc0WXdiT0dyUUlIcURSbzZaSXNTa0lmTXo2TkNpUjVPT3RITXdCZ3djTTJvb2hGTkhqRlVaSG0zc2hBUG5ZRWFkSXViQU1haWpKVm9ZTnhTV3dVUG55OXEySW1nWXZaRjBUQnV6Ym1QY0NMdDFJQmt6QnpVcUZPUEd6VUVaTW03Y2lDRURoOEkyYmhycW9CRWpSd3l1bVRjUGhnRmpySWc2Y3RoQXJtSGpoZzJQQ3V2SWNJaUdEaDA0YzNTOGVFRkh6cGcxTHRLNE1mUG1oWmt3Wm15SU1STkRUQXN4T2NqRTZBZ2piSXNjTU1SUWoyRWpocGtiYjNQTWlFSGpCNWt5ZHRLTUtmT0ZUaDQ0WlhwQUdjS2xUdW1OYi1iMHVES2N6SnM3NWdEaEt2dndXMDRPQU9jb1E0NGVoa0FEd1RiS0tOQTZpc0tRUTQ0MEZ1d0JQUmZzZUlPTTVONXdROEw3S0l3SnNERFNPTU9OTDVqcWdUekNhS2hod28zbVNJT085dERRajQ0ZTZKaWpqckxZeU1PRk1kNW9nMFliaXBPampUQjRkS1BKTk93ZzBjQ1IxbnJEcmljajdNRUpLS1ZFY3FRZWdpQmloaS1lcENQS01xQVQwWTA4a0Z5ampEenVlRU1PTXZaRHNzZzVlSVRCQlJoaXVKT045ZFp3c1FZcmZDempqU3pha0FMUUpXQ3dvNFh5MUdCamlEek9DQ0tJSmRobzRsSWlLQlZURHlxUXVPTlNVb01Rd29reGNnaGlpQ1ctR0tKVVU2VUlRZ3N1a19xdkRZZDhCQklPSVlrMDBpOExENklCQnhwb2F2S2dMU0xyZ3F2ZnJFb1RCc1BlZ0tOWkhXSjQxakRtRHRxek5NUEdnS09OTDZiMVNZZHQ0MUpJRGpzQ213R0d1YnpGbFZ3LVFVT3RqalFjSXFNek1uQVlnNHdjY0RDak5ERmtnSUdHTXZvdExZZC15eGpEREdJbEt5T3BOQUlUUVlidVhJaUJQSXZMczdqZnBPcVFTUWNSbW5oRGp6VFlZQ09NRjJyZ0V3UVUtblBqdndCQmNJS0tBYmZkQVFTWFlic1pEOWhTQUNHSUlNdTRvZ3d4bHJneFphQmNtTUVHbHBkQWdvb21tR0FCQkVEZkJPRUloZGQ0dzJjSElTempoUnhVM3RPakdYQndZU2dRcGtqT3dqU1F2a0ZwR193YVZ3UWlpa2hxemlfR21MdnVwTmpZMjI2RjBMUGpDem5LV0szYUdtNm9JUWFRYUNqdDNCVVB5c0dvd05QN1FndzV6cXA4OERZLWhBeUg4Z0pIMENxRjlCT1cyVGZ3eUFPeXdQTjRUQWZmNmloRG9UblFkUWhCT3BxY3M0VTYzTGl4QmROY0lLTWlXLWRHNzR2aC0xS0lqbmU3MDZxR3NQbzBqSG5hcXJYaC1lZ1pGM2lHbmNnZ3ZJeTF2ampXZXV3ZFozd25NZkpDRDdrNjJEQ0lLNy0xcGVuYndlV0E4ZzNTUlJoak5CajZVQ0FnXHUwMDI2cz0yN2IxNmZhYzNlMTIzODhkMzAyMDg4MmZhYmIxOTJhN2MyMDBkNTQ5ZGNkZWQ1OWRlNzlhOWVhNDU2MjE2OWM3MTYzNTUyNDAxNSIsInVzYWdlX3R5cGUiOiJEQ0giLCJ1c2VyX2lkIjozMDYzMjM1MDQ4LCJ1dG1fY2FtcGFpZ24iOiIiLCJ1dG1fY29udGVudCI6IiIsInV0bV9tZWRpdW0iOiIiLCJ1dG1fc291cmNlIjoiIiwidmVyIjoiNS4xLjEifQ.Rp7VI47FxCmjRFgXsw7p3T3Ajc5c_YeTwcoawhPhd8c
Title: AD Lust? Keinen Steifen? 🍌 Erfahre 1 Trick für einen harten Schwanz

URL: https://wpunativesh.com/in/click/?&cid=1171&session_id=5c859725-c5dc-43a2-96dd-d258b0c80035&response_size=0&cryp=eyJhbGciOiJIUzI1NiJ9.eyJhY2NlcHRfbGFuZ3VhZ2UiOiJkZS1ERSxkZTtxPTAuOSIsImFkX3Bvc2l0aW9uIjoyLCJhZF90eXBlIjoibmF0aXZlIiwiYXVjdGlvbl9pZCI6Mzc4NTQ0NDc0OSwiYnJvd3Nlcl9mYW1pbHkiOiJDaHJvbWUiLCJicm93c2VyX25hbWUiOiJDaHJvbWUgOTUiLCJjYW1wYWlnbl9pZCI6MTE3MSwiY291bnRyeSI6IkRFIiwiY3BjIjowLjAwOCwiY3BtIjowLCJjcmVhdGl2ZV9pZCI6ImRlODc4YTI3YzdhYzI2Zjc5ZjBlZTRjZWMwYzRmZTA1IiwiZWNwbSI6MC4wMDE3OTgzNjM1Nzc3OTQ0ODA4LCJleHRfY3JlYXRpdmVfaWQiOiIiLCJmcm9tX3N0b3JhZ2UiOmZhbHNlLCJpYXQiOjE2MzU1MjM5NjEuMDU2MTIzNSwiaXAiOiIyMTYuMTMxLjExNC4xOTgiLCJpc19jcG0iOjAsIm9zX2ZhbWlseSI6IndpbmRvd3MiLCJvc190eXBlIjoiY29tcHV0ZXIiLCJyZXNwb25zZV9zaXplIjowLCJybiI6MCwic2Vzc2lvbl9pZCI6IjVjODU5NzI1LWM1ZGMtNDNhMi05NmRkLWQyNThiMGM4MDAzNSIsInNpdGUiOiJwaWNyb2suY29tIiwic291cmNlX2lkIjoxNzI4OTQzNjcyLCJzcG90X2lkIjo0NzQ3LCJzcG90X3NpemUiOjQsInN1YiI6ImF1Y3Rpb24tbmF0aXZlLXByb2QiLCJ1cmwiOiJodHRwczovL3BuLml0aWdlci5vbmxpbmUvaW4vbmFfY2xpY2tzLz9jbmFjaT02OTU1XHUwMDI2Y25haT0yOTYzXHUwMDI2dXJsPWh0dHBzJTNBJTJGJTJGZGlydHlib3guZXUlMkZwb3B1JTJGJTNGZHJ0YiUzRDElMjZwMSUzRDIzXHUwMDI2b3V0X25hbWU9NzgyODZ8MjEyODR8Y3BjfDAuMDAyMHwkIDAuMDA4MFx1MDAyNnByaWNlPTAuMDA4MFx1MDAyNnByaWNlYm94X3ByaWNlPTAuMDAyMFx1MDAyNnByaWNpbmdfbW9kZWw9Y3BjXHUwMDI2c3BvdF9pZD00NzQ3XHUwMDI2c3A9MC4wMDM2Nlx1MDAyNmNvdW50cnk9REUiLCJ1c2FnZV90eXBlIjoiRENIIiwidXNlcl9pZCI6MzA2MzIzNTA0OCwidXRtX2NhbXBhaWduIjoiIiwidXRtX2NvbnRlbnQiOiIiLCJ1dG1fbWVkaXVtIjoiIiwidXRtX3NvdXJjZSI6IiIsInZlciI6IjUuMS4xIn0.24Ze7LZbDHddO_gEHZHzE37gVjubbtyB1e6JmzC650w
Title: AD Live Wichsen mit echten Frauen

URL: https://wpunativesh.com/in/click/?&cid=1449&session_id=5c859725-c5dc-43a2-96dd-d258b0c80035&response_size=0&cryp=eyJhbGciOiJIUzI1NiJ9.eyJhY2NlcHRfbGFuZ3VhZ2UiOiJkZS1ERSxkZTtxPTAuOSIsImFkX3Bvc2l0aW9uIjozLCJhZF90eXBlIjoibmF0aXZlIiwiYXVjdGlvbl9pZCI6Mzc4NTQ0NDc0OSwiYnJvd3Nlcl9mYW1pbHkiOiJDaHJvbWUiLCJicm93c2VyX25hbWUiOiJDaHJvbWUgOTUiLCJjYW1wYWlnbl9pZCI6MTQ0OSwiY291bnRyeSI6IkRFIiwiY3BjIjowLjAwMzY2LCJjcG0iOjAsImNyZWF0aXZlX2lkIjoiOGZjNDY2MjllYmQ5ZmJkYzA0YTk0NjJhNzYwN2JkYTgiLCJlY3BtIjowLjAwMDcxNzM1Njg1NjAwNzczMTIsImV4dF9jcmVhdGl2ZV9pZCI6IjE0NDA1NzEzNzYiLCJmcm9tX3N0b3JhZ2UiOmZhbHNlLCJpYXQiOjE2MzU1MjM5NjEuMDU2NDE4LCJpcCI6IjIxNi4xMzEuMTE0LjE5OCIsImlzX2NwbSI6MCwib3NfZmFtaWx5Ijoid2luZG93cyIsIm9zX3R5cGUiOiJjb21wdXRlciIsInJlc3BvbnNlX3NpemUiOjAsInJuIjoxLCJzZXNzaW9uX2lkIjoiNWM4NTk3MjUtYzVkYy00M2EyLTk2ZGQtZDI1OGIwYzgwMDM1Iiwic2l0ZSI6InBpY3Jvay5jb20iLCJzb3VyY2VfaWQiOjE3Mjg5NDM2NzIsInNwb3RfaWQiOjQ3NDcsInNwb3Rfc2l6ZSI6NCwic3ViIjoiYXVjdGlvbi1uYXRpdmUtcHJvZCIsInVybCI6Imh0dHBzOi8va2t6d3ZkLmNvbS9kc3AvbnQvY2xjP2FpZD0xNDkyODIwMzA5NjIwMjgyMjE5NVx1MDAyNm1pZD0wXHUwMDI2dD0xNjM1NTI0MDE1XHUwMDI2cz03MTIyMjhcdTAwMjZzaWQ9OTUyIiwidXNhZ2VfdHlwZSI6IkRDSCIsInVzZXJfaWQiOjMwNjMyMzUwNDgsInV0bV9jYW1wYWlnbiI6IiIsInV0bV9jb250ZW50IjoiIiwidXRtX21lZGl1bSI6IiIsInV0bV9zb3VyY2UiOiIiLCJ2ZXIiOiI1LjEuMSJ9.Ai8Xe8vgMGON83HNo0-UEgwTZ5XTp_acuEjsRYbYyrc
Title: AD Lisa (34 J) 3 km von dir 🟢

URL: https://videotubepornclassic.com/videos/1070649/vintage-family-porn/?promo=21446
Title: AD vintage family porn

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://imghq.xyz/puse5vpg6v98/a13.jpg.html HTTP 302
https://picrok.com/puse5vpg6v98/a13.jpg.html Page URL
https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://imghq.xyz/puse5vpg6v98/a13.jpg.html HTTP 302
https://picrok.com/puse5vpg6v98/a13.jpg.html

Request Chain 48

https://rtbbnr.com/get/?go=1&data=eyJpbXAiOlt7InNlY3VyZSI6MSwiZXh0Ijp7ImlkIjoxNjk1LCJzcGFjZWlkIjoxNjk1LCJpZHpvbmUiOm51bGwsImFkX3RhZ3MiOiIiLCJsYWJlbHMiOiIiLCJ0aXRsZSI6IiIsInN1YmlkIjoiMzk5ODk2NzE3Iiwic3BvdF9pZCI6OTU0OX0sImJhbm5lciI6eyJ3IjoxLCJoIjoxfX1dLCJzaXRlIjp7ImlkIjoiOTU0OSIsInBhZ2UiOiJodHRwczovL3BpY3Jvay5jb20vVWhjVHRPTWItRXVWQTNucXA0OEV2dU1BRjlLbXY2SWJEdy5waHAifSwiZGV2aWNlIjp7InciOjE2MDAsImgiOjEyMDB9LCJ1c2VyIjp7ImlkIjoiNDJhNWYyMzUwNDA2YjViMzRhZmU0OWZmNTE3ZWNiM2IifSwiZXh0Ijp7ImR0IjoxNjM1NTI0MDE0OTk0fX0= HTTP 302
https://tb.baimgfroggd.site/in/1739/?screen_resolution=1600x1200&zone=ssp_cpm&w=1&h=1&spaceid=1695&user_id=42a5f2350406b5b34afe49ff517ecb3b&bid=0.0400&katds_labels=&utm1=&utm2=&utm3=&utm4= HTTP 302
https://stream.vast.wtf/youtube/banner?vi=QTSm63ZwSX8&eu=https%3A%2F%2Fwww.google.com%2Furl%3Fsa%3DD%26q%3Dhttps%3A%2F%2Fwww.youtube.com%2Fembed%2FQTSm63ZwSX8%253Fenablejsapi%253D1%2526origin%253D%2A%2526playsinline%253D1%2526autoplay%253D1%2526mute%253D1&ee=https%3A%2F%2Fvs.videonet.online%2Fsts%2F&pid=43038&p=0.0014&oid=987838&sp=0.0400&spp=1000&se=impression&tcbbi=https%3A%2F%2F12007250.pix-cdn.org%2Fnative%2Ftmp%2Ftbz.jpg&tcbbc=https%3A%2F%2Ftube.biz%2F%3Futm_source%3Dtbz%26utm_medium%3Dbanner%26utm_campaign%3Dasites%26ref%3Dnq1a9fVMKw

Request Chain 57

https://kkzwvd.com/dsp/nt/img?aid=14928203096202822195&mid=0&t=1635524015&sid=952 HTTP 302
https://i.wmgtr.com/cim/tmAU3AIQx0PHzlQrhrEekV30jQHHe1F3.png

Request Chain 74

https://googleads.g.doubleclick.net/pagead/id HTTP 302
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

111 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

a13.jpg.html Show response
picrok.com/puse5vpg6v98/
Redirect Chain

https://imghq.xyz/puse5vpg6v98/a13.jpg.html
https://picrok.com/puse5vpg6v98/a13.jpg.html

18 KB
6 KB

58ms
35ms

Document
text/html

172.67.187.37
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://picrok.com/puse5vpg6v98/a13.jpg.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.187.37 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PHP/5.4.16

Resource Hash

04a469518c5ec719d0d10d9c1f9d8ab7eb62d0fd110612bb253561efbb619604

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Fri, 29 Oct 2021 16:13:33 GMT
content-type: text/html
vary: Accept-Encoding
x-powered-by: PHP/5.4.16
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self';
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uUnxSboDOIk9eW9dw23s%2BN1p0EinhJYvP6USYHOc%2BpiPuAfyQdr1Ky3Brp4j0XwW1AY5EF5uCTAKvAyDK76cUdlBFo9HeYrUW5USXJZupEmF%2FS%2FHHPUxCpUzsOxo"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6a5db11d78e90ea7-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

date: Fri, 29 Oct 2021 16:13:33 GMT
content-type: text/html
location: https://picrok.com/puse5vpg6v98/a13.jpg.html
strict-transport-security: max-age=2592000; preload;
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hbBJik9Yt4TTJxCNt3g7QdgWNPMyrM6h9zX%2Buh%2FTcxJHxEMumGyZPcI%2FOrGgWj5ww6t3AmOD5wyGSwx2ANv%2Bw9qDqdGF%2BedhgA%2FGKrUVlYMLg1ZYYA3ys68XS1I%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6a5db11cde8cc2a9-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 Primary Request UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php Show response
picrok.com/ 111 KB
28 KB 290ms
289ms Document
text/html 172.67.187.37
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php

Requested by

Host: picrok.com
URL: https://picrok.com/puse5vpg6v98/a13.jpg.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.67.187.37 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / PHP/5.4.16

Resource Hash

1a1089c67298e18f7d5ae03d3135484f9b423ab651552c40d9c740de4b984332

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self';
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/puse5vpg6v98/a13.jpg.html

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
content-type: text/html
vary: Accept-Encoding
x-powered-by: PHP/5.4.16
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self';
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=syXbpDSmq7OHsQVLfViQjKpKC6DDlNXWJE8xyFj%2BHRbKLQzbsXZ2NqnQHckLWJyVAIMLbpMcCxQJjjqZ8ZD7trjjM7qzoHcUc1Udq5o%2FIkZz7uS5a1pbhw1zpu1m"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6a5db11e29e90ea7-FRA
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 200 main2.css
picrok.com/css/ 22 KB
6 KB 36ms
35ms Stylesheet
text/css 172.67.187.37
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://picrok.com/css/main2.css?13

Requested by

Host: picrok.com
URL: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.187.37 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ad07cb4c7cfa09ab01d181b97c0f8dc7ca6a77dff706ba6e4b84a8ecdb8046cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1645
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Fri, 29 Oct 2021 15:46:09 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000; preload;
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=88K9t27C4G7TUrqz1f%2F3%2FTDc%2FMRwKNTPLlTVdgAk69xPsS2G%2FimQbikhQjuycAcLbViW8RbA%2BP5W4BeuqdhMHNBXS2sCadi2Sxzw%2BEKcIrKh%2BgRI6V1vV11utrU3"}],"group":"cf-nel","max_age":604800}
content-type: text/css
cache-control: max-age=7200
cf-ray: 6a5db1203b745c50-FRA
expires: Fri, 29 Oct 2021 17:46:09 GMT

GET
H3 200 jquery-1.10.2.min.js Show response
picrok.com/js/ 91 KB
34 KB 29ms
28ms Script
text/javascript 172.67.187.37
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://picrok.com/js/jquery-1.10.2.min.js

Requested by

Host: picrok.com
URL: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.187.37 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1580
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Fri, 29 Oct 2021 15:47:14 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000; preload;
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wJJI8GVCTg9nyGZXj0scmYIkLU3jdcM2fi7iT1jQq8Uzz7U%2BT2EKCYvIrI7j8j5mjxzN%2BfFlf8Dy5ZM9bXRgun5ZeX7mnrBC6nK%2FUodtdt4kgHPjzTy8oK%2Bitt%2BW"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: max-age=7200
cf-ray: 6a5db1203b785c50-FRA
expires: Fri, 29 Oct 2021 17:47:14 GMT

GET
H3 200 xupload.js Show response
picrok.com/js/ 15 KB
5 KB 43ms
41ms Script
text/javascript 172.67.187.37
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://picrok.com/js/xupload.js?

Requested by

Host: picrok.com
URL: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.187.37 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

24b117668baa1c446d21372e6fdc04d3a49387071cd31a267b948b35891cb9f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1551
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Fri, 29 Oct 2021 15:47:43 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000; preload;
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=00HUUtaitGlnVx03crr%2BYfDxur9P0fiEa7tzWHpVeiWwy6pQKfbLj8TI%2BtLCciyB4TukernzRFMGccQ4Q54YIk2L%2Bwriqmnu36lCXdAgOFgFE%2BV7SHNSnL8osS0F"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: max-age=7200
cf-ray: 6a5db1203b7a5c50-FRA
expires: Fri, 29 Oct 2021 17:47:43 GMT

GET
H/1.1 200
OK / Show response
d.smopy.com/d/ 35 KB
12 KB 602ms
152ms Script
text/html 131.153.42.227
SSASN2

General

Check archive.org

Show headers Download Go to

Full URL: https://d.smopy.com/d/?resource=pubJS
Requested by: Host: picrok.com
URL: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 131.153.42.227 Phoenix, United States, ASN20454 (SSASN2, US),
Reverse DNS
Software: nginx / Express
Resource Hash: 3310b9ff8ab3b575d6a2770e14750d5a5842e6289659b429baf446d2ebeff67b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:13:34 GMT
Content-Encoding: gzip
ETag: W/"8ac1-r/S95/SOk1jbfIPW8soe3GWCxhs"
Server: nginx
X-Powered-By: Express
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Credentials: true
Connection: keep-alive

GET
H3 200 jquery.cookie.js Show response
picrok.com/js/ 4 KB
2 KB 43ms
42ms Script
text/javascript 172.67.187.37
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://picrok.com/js/jquery.cookie.js

Requested by

Host: picrok.com
URL: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php

Protocol

Security

QUIC, , AES_128_GCM

Server

172.67.187.37 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8dbe6727aa5a99c8f0b4e25e71829246ad3bcacdc84a13e6b5b12c8ea6fafc78

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; preload;

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
content-encoding: br
vary: Accept-Encoding
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3284
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Fri, 29 Oct 2021 15:18:50 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=2592000; preload;
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HpQLjysUNBf3EIHoyOhf5sx6RZdoZr036Xfl9VgZ0V4UWWHosZUCBOSMfV%2Bdfhg1tUvQSIf9PJFE8sGtoK2XXsi%2FdsKxb2gj7EgWWNCYx3w63UXeaBYyS2ZqXXAC"}],"group":"cf-nel","max_age":604800}
content-type: text/javascript
cache-control: max-age=7200
cf-ray: 6a5db1203b7d5c50-FRA
expires: Fri, 29 Oct 2021 17:18:50 GMT

GET
H2 200 / Show response
d1ev866ubw90c6.cloudfront.net/ 160 KB
52 KB 32ms
8ms Script
text/plain 18.66.121.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1ev866ubw90c6.cloudfront.net/?buved=669323
Requested by: Host: picrok.com
URL: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.121.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: ab54d83f03ea0b4d634abec3fea66d2a5a2b645d234f4a3b62b63c2589933289

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Oct 2021 15:20:20 GMT
content-encoding: gzip
age: 3194
x-cache: Hit from cloudfront
access-control-allow-origin: *
cache-control: no-store, no-cache, proxy-revalidate, must-revalidate, private, no-transform
x-amz-cf-pop: FRA60-P2
content-length: 53120
via: 1.1 1aa52a2a71a599aaf6b3df3a9c53b268.cloudfront.net (CloudFront)
x-amz-cf-id: 874uvS7lK-i9dVjM5gi-R761PvFogD9owISPW0KqmltJHEVSWY8K9A==

GET
H2 200 9056f859.js Show response
dendranthe4edm7um.com/aas/r45d/vki/1823484/ 68 KB
27 KB 72ms
16ms Script
application/javascript 109.206.162.83
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://dendranthe4edm7um.com/aas/r45d/vki/1823484/9056f859.js
Requested by: Host: picrok.com
URL: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 109.206.162.83 , Netherlands, ASN50245 (SERVEREL-AS, NL),
Reverse DNS: 83.162.serverel.net
Software: nginx /
Resource Hash: 6d9a7d6fff73563acdacb5172b6e625a74208aa072acf28eb069e0617f9b3ad1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
content-encoding: gzip
last-modified: Tue, 19 Oct 2021 11:40:30 GMT
server: nginx
etag: W/"616eaeae-111e6"
vary: Accept-Encoding
content-type: application/javascript
timing-allow-origin: *

GET
H2 200 code.js Show response
stagepopkek.com/lv/esnk/1836026/ 137 KB
49 KB 64ms
12ms Script
application/javascript 109.206.162.83
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://stagepopkek.com/lv/esnk/1836026/code.js
Requested by: Host: picrok.com
URL: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 109.206.162.83 , Netherlands, ASN50245 (SERVEREL-AS, NL),
Reverse DNS: 83.162.serverel.net
Software: nginx /
Resource Hash: 1cb8b2702535f8135ff96d3a2606e0b0b93417acd13daf5c2a81afbce5e388a2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
content-encoding: gzip
last-modified: Tue, 26 Oct 2021 09:40:52 GMT
server: nginx
etag: W/"6177cd24-22299"
vary: Accept-Encoding
content-type: application/javascript
timing-allow-origin: *

GET
H2 200 code.js Show response
stagepopkek.com/lv/esnk/1836027/ 137 KB
49 KB 83ms
31ms Script
application/javascript 109.206.162.83
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://stagepopkek.com/lv/esnk/1836027/code.js
Requested by: Host: picrok.com
URL: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 109.206.162.83 , Netherlands, ASN50245 (SERVEREL-AS, NL),
Reverse DNS: 83.162.serverel.net
Software: nginx /
Resource Hash: c2a20e1980149da9c5b1559ce37b1242dee9f3ebe223376a82ae9f56431fddae

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
content-encoding: gzip
last-modified: Tue, 26 Oct 2021 09:40:52 GMT
server: nginx
etag: W/"6177cd24-22299"
vary: Accept-Encoding
content-type: application/javascript
timing-allow-origin: *

GET
H2 204 utx Show response
iesboughts.xyz/ 0
411 B 141ms
95ms XHR
text/plain 143.204.98.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://iesboughts.xyz/utx?cb=RLzdsubFQ2PK&top=picrok.com&tid=669323
Requested by: Host: d1ev866ubw90c6.cloudfront.net
URL: https://d1ev866ubw90c6.cloudfront.net/?buved=669323
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.6 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-6.fra50.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Oct 2021 16:13:34 GMT
via: 1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
server: openresty/1.17.8.2
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
p3p: CP="NID DSP ALL COR"
access-control-allow-origin: https://picrok.com
cache-control: no-store, no-cache, must-revalidate, no-transform
access-control-allow-credentials: true
x-amz-cf-id: iil9laHon4GjfPxSLwndc435IqrxcvSTPVCEEYWpJ6NIujmsu4PHHA==

GET
H2 200 NCszAAUmKT0FDj8fHHEtBRwFJ3omJVtkCA8mJTg Show response
iesboughts.xyz/R3Zza1cmFBAGaCZLEU0iNRpOTmUBU0EtM3YTBVNhcQMRHG53FUVFNCsZBg8xNRkdH3kpEwdOZQEvEQczLyAeIhkIN0scDxUZVlkVBSEHPgAAQyAxEQE/IzkecjIxXiYKJzE4DxURKiouMDQQOQI0NB8lORUMHC8WAzQQCBYkNz0tLykkMlMtBk... Frame 4DC0 3 KB
2 KB 117ms
102ms Document
text/html 143.204.98.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://iesboughts.xyz/R3Zza1cmFBAGaCZLEU0iNRpOTmUBU0EtM3YTBVNhcQMRHG53FUVFNCsZBg8xNRkdH3kpEwdOZQEvEQczLyAeIhkIN0scDxUZVlkVBSEHPgAAQyAxEQE/IzkecjIxXiYKJzE4DxURKiouMDQQOQI0NB8lORUMHC8WAzQQCBYkNz0tLykkMlMtBkQHPAQEOyEkBisiPwwaPTcyHHJ1NDQ4EiU0HS4CCUdLLxgFBVZZEQMROlkFACcYPGQrJBBaFSIQCzJydTA3KjhzMBo9Hx8xEDseLBIQMWYFGyctYj4jGzkfHzEQPAcwDioyZxUaOi4jKyMgXgIQGEYuDQE/IyEvajNFKS8sDzIRZwsxHSEDAjAXDw4CTx89EjMaJjNjDTQaJhoIHRcIEQIkGD4wDlNBKRQtODszECQxPhwSATk2Ay0SMEdbFBQnPSotDTMpKAUfLxhSOhMwAwMCKkM+PGUJMyktHiM4FAhkAjcXEgI/NCszAAUmKT0FDj8fHHEtBRwFJ3omJVtkCA8mJTg
Requested by: Host: d1ev866ubw90c6.cloudfront.net
URL: https://d1ev866ubw90c6.cloudfront.net/?buved=669323
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.6 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-6.fra50.r.cloudfront.net
Software: openresty/1.17.8.2 /
Resource Hash: 89b063165162d2dbd65f1ddeb953a3a94b5384ff01f6a241de60caac7e078181

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/

Response headers

content-type: text/html
content-length: 1224
date: Fri, 29 Oct 2021 16:13:34 GMT
server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 24475cc722041223cf99f56b55432566.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: zrgLai2vOwioXKfWDHncu3fdll0omAC69W1DssLcOpWVz9WgxgR-0A==

GET
H2 200 login.php
www.facebook.com/ 0
0 106ms
82ms Image
text/html 157.240.20.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.facebook.com/login.php?next=https%3A%2F%2Fwww.facebook.com%2Ffavicon.ico%3F_rdr%3Dp
Requested by: Host: picrok.com
URL: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 157.240.20.35 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS: edge-star-mini-shv-02-frt3.facebook.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

GET
H2 200 ServiceLogin
accounts.google.com/ 0
0 130ms
83ms Image
text/html 142.250.185.77
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail
Requested by: Host: picrok.com
URL: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.185.77 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s48-in-f13.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

GET
H2 200 ServiceLogin
accounts.google.com/ 0
0 287ms
240ms Image
text/html 142.250.185.77
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube
Requested by: Host: picrok.com
URL: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 142.250.185.77 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra16s48-in-f13.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

GET
H2 200 popper.min.js Show response
www.visariomedia.com/ 30 KB
9 KB 36ms
12ms Script
application/x-javascript 195.181.175.55
CDN77 ^_^

General

Check archive.org

Show headers Download Go to

Full URL: https://www.visariomedia.com/popper.min.js
Requested by: Host: picrok.com
URL: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 195.181.175.55 Frankfurt am Main, Germany, ASN60068 (CDN77 ^_^, GB),
Reverse DNS: frankfurt-53.cdn77.com
Software: CDN77-Turbo /
Resource Hash: 736763f0f554c88846bcdfd441225537d1a03441f31c0c60e60795265c14347f

Request headers

Referer: https://picrok.com/
Origin: https://picrok.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

x-77-pop: frankfurtDE
date: Fri, 29 Oct 2021 16:13:34 GMT
content-encoding: br
x-77-cache: HIT
x-cache: HIT
x-age: 95960
alt-svc: quic="195.181.175.53:443"; ma=2592000; v="44,43,39"
x-77-nzt: AcO1rzUW0Rfv2HYBAA==
x-accel-expires: @1636032854
server: CDN77-Turbo
x-77-nzt-ray: APbjAw9QdBA=
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: public, max-age=604800
link: <https://visariomedia.com/>;rel=preconnect,<https://c.adsco.re/>;rel=preconnect,<https://adsco.re/>;rel=preconnect
expires: Thu, 04 Nov 2021 13:34:14 GMT

GET
H2 200 3ead1e42c9599cb676b34fca95612c38.js Show response
f00961160c.25391ebf69.com/ 64 KB
25 KB 27ms
6ms Script
application/javascript 213.174.135.24
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://f00961160c.25391ebf69.com/3ead1e42c9599cb676b34fca95612c38.js
Requested by: Host: picrok.com
URL: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.174.135.24 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 99efa94f95887196c5d36a4092fdbcfa58af90696ceca363d4b6f4bff6fa6e8e

Request headers

Referer: https://picrok.com/
Origin: https://picrok.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
content-encoding: gzip
last-modified: Tue, 19 Oct 2021 13:42:02 GMT
server: nginx/1.18.0
etag: W/"616ecb2a-1014d"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Fri, 29 Oct 2021 17:13:34 GMT
cache-control: max-age=3600
x-proxy-cache: HIT

GET
H2 200 / Show response
freychang.fun/ 16 B
711 B 155ms
117ms Fetch
text/plain 172.67.218.221
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://freychang.fun/?f=42a5f2350406b5b34afe49ff517ecb3b
Requested by: Host: d1ev866ubw90c6.cloudfront.net
URL: https://d1ev866ubw90c6.cloudfront.net/?buved=669323
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.218.221 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2e3e535a31d2e0c892cc96748da08fdeec1f70eab586abef34492e55d6e85754

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
content-encoding: br
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-allow-methods: GET
content-type: text/plain
access-control-allow-origin: https://picrok.com
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZwKJRjoWyVewS3rxD2RvN0eI3CKSyyHOm2vN9li9JcKfephDAvQ%2BwzjRHHheDzbnwAwCNjhd%2B6FLtlSjfpdJOXwv0cncpp%2BM4kyoJ75Yhec0m2Q3u8ZGkgLdTTQLSben"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials: true
cf-ray: 6a5db1231a1a2790-PRG
access-control-allow-headers: X-Requested-With, content-type
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 1823484 Show response
dendranthe4edm7um.com/get/ 4 KB
2 KB 14ms
13ms Script
text/javascript 109.206.162.83
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://dendranthe4edm7um.com/get/1823484?zoneid=1823484&jp=_cl5591kyvpgkn7p2hoh0v&nojs=0&ix=0&t=0&x=1600&y=1200&wcks=1&wgl=1&cnvs=1&os=0&md=0&pl=Chrome%20PDF%20Plugin::Chrome%20PDF%20Viewer::Native%20Client&lang=en-US&pf=Linux%20x86_64&cd=24&isRef=0&sp=0
Requested by: Host: dendranthe4edm7um.com
URL: https://dendranthe4edm7um.com/aas/r45d/vki/1823484/9056f859.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 109.206.162.83 , Netherlands, ASN50245 (SERVEREL-AS, NL),
Reverse DNS: 83.162.serverel.net
Software: nginx /
Resource Hash: 7a9dfd08fe05246c1ac76cdd9da2a378630be804185f2bb200c762877b6093f3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
content-encoding: gzip
server: nginx
timing-allow-origin: *
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8

GET
H2 200 1836027 Show response
stagepopkek.com/get/ 2 KB
1 KB 15ms
15ms Script
text/javascript 109.206.162.83
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://stagepopkek.com/get/1836027?zoneid=1836027&jp=_clwe3wpjjt6tcxmd2upj4o&nojs=0&ix=0&t=0&x=1600&y=1200&wcks=1&wgl=1&cnvs=1&os=0&md=undefined&pl=Chrome%20PDF%20Plugin::Chrome%20PDF%20Viewer::Native%20Client&lang=en-US&pf=Linux%20x86_64&cd=24&freq=0
Requested by: Host: stagepopkek.com
URL: https://stagepopkek.com/lv/esnk/1836027/code.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 109.206.162.83 , Netherlands, ASN50245 (SERVEREL-AS, NL),
Reverse DNS: 83.162.serverel.net
Software: nginx /
Resource Hash: ad61ab13be3ea3c1c23aa17995d80cb0981dabed04bcde2cb31b61abd3d27801

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
content-encoding: gzip
server: nginx
timing-allow-origin: *
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8

GET
H2 200 1836026 Show response
stagepopkek.com/get/ 2 KB
989 B 15ms
15ms Script
text/javascript 109.206.162.83
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://stagepopkek.com/get/1836026?zoneid=1836026&jp=_cluyvx66qh9nc54cn0jxjd&nojs=0&ix=0&t=0&x=1600&y=1200&wcks=1&wgl=1&cnvs=1&os=0&md=undefined&pl=Chrome%20PDF%20Plugin::Chrome%20PDF%20Viewer::Native%20Client&lang=en-US&pf=Linux%20x86_64&cd=24&freq=0
Requested by: Host: stagepopkek.com
URL: https://stagepopkek.com/lv/esnk/1836026/code.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 109.206.162.83 , Netherlands, ASN50245 (SERVEREL-AS, NL),
Reverse DNS: 83.162.serverel.net
Software: nginx /
Resource Hash: eb23938c67ceaf3476ef0926e2cc6b50412b5ab43130cf88b3cc7b35fffa984b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
content-encoding: gzip
server: nginx
timing-allow-origin: *
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8

GET
H2 200 3158 Show response
f00961160c.25391ebf69.com/ea4b24ade90600e22a1101cae36c727b/ 2 KB
814 B 6ms
6ms XHR
text/plain 213.174.135.24
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://f00961160c.25391ebf69.com/ea4b24ade90600e22a1101cae36c727b/3158
Requested by: Host: f00961160c.25391ebf69.com
URL: https://f00961160c.25391ebf69.com/3ead1e42c9599cb676b34fca95612c38.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.174.135.24 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 8751bb40a60109e78c17f67fcb6e3e2b6c9bd9ed820002650018d438e3222877

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
content-encoding: gzip
server: nginx/1.18.0
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
expires: Fri, 29 Oct 2021 17:13:34 GMT
cache-control: max-age=3600
x-proxy-cache: HIT

GET
H2 200 wp-banners.js Show response
js.wpadmngr.com/npc/sdk/ 0
239 B 22ms
7ms Script
application/javascript 213.174.135.24
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js.wpadmngr.com/npc/sdk/wp-banners.js
Requested by: Host: f00961160c.25391ebf69.com
URL: https://f00961160c.25391ebf69.com/3ead1e42c9599cb676b34fca95612c38.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.174.135.24 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
last-modified: Fri, 20 Aug 2021 15:14:31 GMT
server: nginx/1.18.0
etag: "611fc6d7-0"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Fri, 29 Oct 2021 17:13:34 GMT
cache-control: max-age=3600
accept-ranges: bytes
content-length: 0
x-proxy-cache: HIT

GET
H2 200 DAo4FiVHXGcPIkdcZ1BmTF5yUhRHXGcWPwxYY0RlIEtlUS5UWn5EZFIPJx-E6BxkyAz0LGnJTEFddYE9lVEtlUX4JBiMMOkdcFERkUgI+CjNHXGcGMwEFOEhzUF40CSQNAzJEZCRXYk9mTFphUm5MW2NEZFIdNgc3EAdyUxBXXWBPZVRIIlw Show response
d1ev866ubw90c6.cloudfront.net/YbldhVmINOA8wXRo+BWtUWG5SZFFIPRI5DB5qMQBSXRgYAywBcRUsBlNnRzoDADBccAcANFxnRA8zA2tWSCMROQlTLgMzAAw+GSEbBnEUN18DOBs/DgI2RGQkW3lRc1BefxY/ Frame 4DC0 761 B
822 B 155ms
155ms Script
text/plain 18.66.121.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1ev866ubw90c6.cloudfront.net/YbldhVmINOA8wXRo+BWtUWG5SZFFIPRI5DB5qMQBSXRgYAywBcRUsBlNnRzoDADBccAcANFxnRA8zA2tWSCMROQlTLgMzAAw+GSEbBnEUN18DOBs/DgI2RGQkW3lRc1BefxY/DAo4FiVHXGcPIkdcZ1BmTF5yUhRHXGcWPwxYY0RlIEtlUS5UWn5EZFIPJx-E6BxkyAz0LGnJTEFddYE9lVEtlUX4JBiMMOkdcFERkUgI+CjNHXGcGMwEFOEhzUF40CSQNAzJEZCRXYk9mTFphUm5MW2NEZFIdNgc3EAdyUxBXXWBPZVRIIlw
Requested by: Host: iesboughts.xyz
URL: https://iesboughts.xyz/R3Zza1cmFBAGaCZLEU0iNRpOTmUBU0EtM3YTBVNhcQMRHG53FUVFNCsZBg8xNRkdH3kpEwdOZQEvEQczLyAeIhkIN0scDxUZVlkVBSEHPgAAQyAxEQE/IzkecjIxXiYKJzE4DxURKiouMDQQOQI0NB8lORUMHC8WAzQQCBYkNz0tLykkMlMtBkQHPAQEOyEkBisiPwwaPTcyHHJ1NDQ4EiU0HS4CCUdLLxgFBVZZEQMROlkFACcYPGQrJBBaFSIQCzJydTA3KjhzMBo9Hx8xEDseLBIQMWYFGyctYj4jGzkfHzEQPAcwDioyZxUaOi4jKyMgXgIQGEYuDQE/IyEvajNFKS8sDzIRZwsxHSEDAjAXDw4CTx89EjMaJjNjDTQaJhoIHRcIEQIkGD4wDlNBKRQtODszECQxPhwSATk2Ay0SMEdbFBQnPSotDTMpKAUfLxhSOhMwAwMCKkM+PGUJMyktHiM4FAhkAjcXEgI/NCszAAUmKT0FDj8fHHEtBRwFJ3omJVtkCA8mJTg
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.121.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: bfebb71324514033596be1e5efbec0f929d186b510edb52a511d707a08e5958f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://iesboughts.xyz/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
content-encoding: gzip
x-amz-cf-pop: FRA60-P2
x-cache: Miss from cloudfront
access-control-allow-origin: *
cache-control: max-age=31556926
content-length: 544
via: 1.1 1aa52a2a71a599aaf6b3df3a9c53b268.cloudfront.net (CloudFront)
x-amz-cf-id: eM2vNTjrxWECJd40u3ZWfLNApJrzZCg5jII05NOR4Jvi02zwuAyYlw==

GET
H2 200 / Show response
c.adsco.re/ 62 KB
22 KB 67ms
29ms Script
text/html 104.17.166.186
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.adsco.re/
Requested by: Host: www.visariomedia.com
URL: https://www.visariomedia.com/popper.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.166.186 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9aaaac87a4cddb7db367764a7080fd31491c36ae256ba81391c270f8c4b2d0f8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 11397380
etag: W/"2Ma3006J78KgzL0RD+7gUg=="
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html
link: <//6.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//4.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//adsco.re/>;rel=dns-prefetch
cache-control: public, max-age=2678400
cf-ray: 6a5db1240e212784-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Mon, 29 Nov 2021 16:13:34 GMT

GET
H2 200 5c763a492225ad61f153f519aef868e4606be6fc.gif
cdn.bncloudfl.com/bn/5c7/63a/492/ Frame 4EE9 37 KB
38 KB 62ms
23ms Image
image/gif 104.22.15.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bncloudfl.com/bn/5c7/63a/492/5c763a492225ad61f153f519aef868e4606be6fc.gif
Requested by: Host: picrok.com
URL: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.15.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85b2de298314e0616811998d963d8ca09e5e07d92c94dbfc132744f5fbdc7772

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
x-openstack-request-id: tx3272f48270ce4772afa38-0060cb507b
cf-cache-status: HIT
age: 38110
cf-polished: status=not_needed
access-control-expose-headers: X-Container-Meta-Temp-Url-Key,X-Container-Bytes-Used,Last-Modified,X-Timestamp
cf-bgj: imgq:100,h2pri
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-trans-id: tx3272f48270ce4772afa38-0060cb507b
accept-ranges: bytes
last-modified: Fri, 14 May 2021 15:10:12 GMT
server: cloudflare
etag: 40819607f574be5112ca684a25a0b4f0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: HEAD,GET,POST,PUT,PATCH,DELETE,OPTIONS
content-type: image/gif
access-control-allow-origin: *
x-timestamp: 1621005011.96338
cache-control: max-age=432000
content-length: 37900
cf-ray: 6a5db1245c4127b8-PRG
access-control-allow-headers: Content-Type,X-Requested-With,X-Auth-Token,X-Openstack-Request-Id,X-Container-Meta-type,X-Container-Meta-Temp-URL-Key,Authorization
x-proxy-cache: HIT
expires: Sun, 31 Oct 2021 05:38:24 GMT

GET
H2 200 / Show response
ilusors.com/ssp/req/1823484/ 7 B
190 B 49ms
20ms Script
text/javascript 109.206.162.83
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://ilusors.com/ssp/req/1823484/?pb=216b6f4e8df7dbf7b15dafeaf63c825a1635531214&psp=vcY8-2oouE9FMsAtM3nxVuyoZ2C74i-J69WVW0PXAXjB2mhJqs1E3SZggeceu3Qqk4KKlKBzGsBEJlgtNukRaY51kVC3w2iRVfvX8rXL59zHoDGmv3oOAl2jMlT_fC7jihrsovba6Oo2mBV8T5MEO7ZMKvS4F_RXAG0RTx-zxRwe9amqqhtgz1tda41dXWDRPttsKbagxRLfyZGlcQuqizq26r3jiJKKube6Ae2WiuL0N0nSrjDbgisYHY4c3EpbOC6XXOdLSDoa7rcK-g53WjhD4w4UL8_TNGkhXM0p7yxQzNtn2ZaZsqmJEkVFsCW8sJ5o_tnNqf0T4tl-T6aPEQAzFgYxEfbakqsDOnTOnWyKzxA8zziwZN92QUuP1FtoyHjOMn6_NAg8Wukd72ezGZtgf3lFqxHlu7e-HMDUnDoN2uFCYjzNbODOsC6ZVyKFQw32iNaE_Vpk7JFnVx2IE21qk2cFnw9kjLagacf23kQSgq86asC9l74f5saC5Hgv-tOwHirEPkKfv170w0RtLFCX2z3gaNaxHDz3k5DVw9SpEv4O7x4mbEZFlhh3TkBzpZjFC_kbE7BGoMgpn7pP3ntodwbGQijUpmNxH9sAG6nXuP5ylHZjzDJGgUJZSeQGQt3ulIWEii_oqLh_LDkn0UwFKThIgy6M3ywb_RIoikFG3h_8xiPmIY86uCRj7YHUjvrI5cuM4gKgJskAFG56PmU=&cb=_cl2um47u3xi3strvulxeh9&nojs=0&ix=0&t=0&x=1600&y=1200&wcks=1&wgl=1&cnvs=1&os=0&md=0&pl=Chrome%20PDF%20Plugin::Chrome%20PDF%20Viewer::Native%20Client&lang=en-US&pf=Linux%20x86_64&cd=24
Requested by: Host: dendranthe4edm7um.com
URL: https://dendranthe4edm7um.com/aas/r45d/vki/1823484/9056f859.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 109.206.162.83 , Netherlands, ASN50245 (SERVEREL-AS, NL),
Reverse DNS: 83.162.serverel.net
Software: nginx /
Resource Hash: a04bf061f53e0011fd2f43bdf081526344f003c50146c88c42c2d95ef22c1821

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
server: nginx
timing-allow-origin: *
content-length: 7
content-type: text/javascript

GET
H2 200 /
6.adsco.re/ 0
384 B 54ms
20ms Other
text/plain 104.17.166.186
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://6.adsco.re/
Requested by: Host: picrok.com
URL: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.166.186 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://picrok.com/
Origin: https://picrok.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
server: cloudflare
access-control-allow-headers: Content-Type
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: text/plain;charset=UTF-8
access-control-allow-origin: https://picrok.com
access-control-max-age: 2592000
cache-control: private, max-age=10
cf-ray: 6a5db1249835411a-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 0

GET
H/1.1 200
OK /
4.adsco.re/ 0
457 B 85ms
25ms Other
text/html 162.252.214.5
TUT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://4.adsco.re/
Requested by: Host: picrok.com
URL: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 162.252.214.5 , United States, ASN53334 (TUT-AS, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://picrok.com/
Origin: https://picrok.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:13:34 GMT
Content-Encoding: gzip
Access-Control-Max-Age: 2592000
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: https://picrok.com
Cache-Control: private, max-age=5
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Headers: Content-Type

GET
H2 200 5c763a492225ad61f153f519aef868e4606be6fc.gif
cdn.bncloudfl.com/bn/5c7/63a/492/ Frame 202D 37 KB
37 KB 22ms
22ms Image
image/gif 104.22.15.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bncloudfl.com/bn/5c7/63a/492/5c763a492225ad61f153f519aef868e4606be6fc.gif
Requested by: Host: stagepopkek.com
URL: https://stagepopkek.com/lv/esnk/1836026/code.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.22.15.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85b2de298314e0616811998d963d8ca09e5e07d92c94dbfc132744f5fbdc7772

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
x-openstack-request-id: tx3272f48270ce4772afa38-0060cb507b
cf-cache-status: HIT
age: 38110
cf-polished: status=not_needed
access-control-expose-headers: X-Container-Meta-Temp-Url-Key,X-Container-Bytes-Used,Last-Modified,X-Timestamp
cf-bgj: imgq:100,h2pri
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-trans-id: tx3272f48270ce4772afa38-0060cb507b
accept-ranges: bytes
last-modified: Fri, 14 May 2021 15:10:12 GMT
server: cloudflare
etag: 40819607f574be5112ca684a25a0b4f0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: HEAD,GET,POST,PUT,PATCH,DELETE,OPTIONS
content-type: image/gif
access-control-allow-origin: *
x-timestamp: 1621005011.96338
cache-control: max-age=432000
content-length: 37900
cf-ray: 6a5db1246c5f27b8-PRG
access-control-allow-headers: Content-Type,X-Requested-With,X-Auth-Token,X-Openstack-Request-Id,X-Container-Meta-type,X-Container-Meta-Temp-URL-Key,Authorization
x-proxy-cache: HIT
expires: Sun, 31 Oct 2021 05:38:24 GMT

POST
H/1.1 200
OK p Show response
adsco.re/ 0
419 B 79ms
25ms XHR
text/html 162.252.214.5
TUT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://adsco.re/p
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 162.252.214.5 , United States, ASN53334 (TUT-AS, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://picrok.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Fri, 29 Oct 2021 16:13:34 GMT
Content-Encoding: gzip
Content-Type: text/html; charset=UTF-8
AS-P-4: OK
Transfer-Encoding: chunked
AS-P-1: OK lon223
Access-Control-Allow-Origin: https://picrok.com
Access-Control-Max-Age: 2592000
Cache-Control: no-transform
Access-Control-Allow-Credentials: true
Connection: keep-alive
AS-E: ND
AS-P-2: OK
AS-P-3: OK

GET
H/1.1 200
OK / Show response
4.adsco.re/ 48 B
457 B 60ms
24ms XHR
text/html 162.252.214.5
TUT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://4.adsco.re/
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 162.252.214.5 , United States, ASN53334 (TUT-AS, US),
Reverse DNS
Software: /
Resource Hash: 52b6422d2e5d9a0bbe5ac3c5a72fcb7f649dd20ca36403b25880b25cbe5aa71c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:13:34 GMT
Content-Encoding: gzip
Access-Control-Max-Age: 2592000
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: https://picrok.com
Cache-Control: private, max-age=5
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Headers: Content-Type

GET
H2 200 / Show response
6.adsco.re/ 0
40 B 39ms
22ms XHR
text/plain 104.17.166.186
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://6.adsco.re/
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.17.166.186 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
server: cloudflare
access-control-allow-headers: Content-Type
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: text/plain;charset=UTF-8
access-control-allow-origin: https://picrok.com
access-control-max-age: 2592000
cache-control: private, max-age=10
cf-ray: 6a5db1249834411a-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 0

POST
H/1.1 200
OK /
d4zmsef4e15l.l4.adsco.re/ 0
464 B 74ms
17ms Ping
text/html 185.200.118.90
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://d4zmsef4e15l.l4.adsco.re/
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 185.200.118.90 London, United Kingdom, ASN9009 (M247, GB),
Reverse DNS: adscore.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://picrok.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Fri, 29 Oct 2021 16:13:34 GMT
Last-Modified: Tue, 31 Jul 2018 22:16:15 GMT
ETag: "5b60dfaf-0"
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/html
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Range
Connection: close
Accept-Ranges: bytes
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Content-Length: 0

POST
H/1.1 200
OK /
d4zmsef4e15l.n4.adsco.re/ 0
464 B 349ms
86ms Ping
text/html 38.132.109.186
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://d4zmsef4e15l.n4.adsco.re/
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 38.132.109.186 New York, United States, ASN9009 (M247, GB),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://picrok.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Fri, 29 Oct 2021 16:13:35 GMT
Last-Modified: Mon, 30 Jul 2018 15:32:42 GMT
ETag: "5b5f2f9a-0"
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/html
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Range
Connection: close
Accept-Ranges: bytes
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Content-Length: 0

POST
H/1.1 200
OK /
d4zmsef4e15l.s4.adsco.re/ 0
464 B 1251ms
254ms Ping
text/html 185.200.116.90
M247

General

Check archive.org

Show headers Download Go to

Full URL: https://d4zmsef4e15l.s4.adsco.re/
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 185.200.116.90 Singapore, Singapore, ASN9009 (M247, GB),
Reverse DNS: no-mans-land.m247.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://picrok.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Fri, 29 Oct 2021 16:13:35 GMT
Last-Modified: Mon, 30 Jul 2018 15:38:01 GMT
ETag: "5b5f30d9-0"
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/html
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length,Content-Range
Connection: close
Accept-Ranges: bytes
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
Content-Length: 0

GET
H3 200 / Show response
c.adsco.re/ Frame 08EC 62 KB
22 KB 65ms
27ms Document
text/html 104.17.166.186
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.adsco.re/
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.166.186 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9aaaac87a4cddb7db367764a7080fd31491c36ae256ba81391c270f8c4b2d0f8

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
content-type: text/html
cache-control: public, max-age=2678400
link: <//6.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//4.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//adsco.re/>;rel=dns-prefetch
expires: Mon, 29 Nov 2021 16:13:34 GMT
etag: W/"2Ma3006J78KgzL0RD+7gUg=="
cf-cache-status: HIT
age: 11397380
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 6a5db124c8aef9e2-PRG
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H3 200 /
6.adsco.re/ Frame 08EC 0
363 B 54ms
18ms Other
text/plain 104.17.166.186
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://6.adsco.re/
Requested by: Host: picrok.com
URL: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.166.186 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://c.adsco.re/
Origin: https://c.adsco.re
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:35 GMT
server: cloudflare
access-control-allow-headers: Content-Type
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD, OPTIONS
content-type: text/plain;charset=UTF-8
access-control-allow-origin: https://c.adsco.re
access-control-max-age: 2592000
cache-control: private, max-age=10
cf-ray: 6a5db1263c664114-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 0

GET
H/1.1 200
OK /
4.adsco.re/ Frame 08EC 0
457 B 23ms
23ms Other
text/html 162.252.214.5
TUT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://4.adsco.re/
Requested by: Host: picrok.com
URL: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 162.252.214.5 , United States, ASN53334 (TUT-AS, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://c.adsco.re/
Origin: https://c.adsco.re
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:13:35 GMT
Content-Encoding: gzip
Access-Control-Max-Age: 2592000
Access-Control-Allow-Methods: GET, HEAD, OPTIONS
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: https://c.adsco.re
Cache-Control: private, max-age=5
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Headers: Content-Type

GET
H3 200 5c763a492225ad61f153f519aef868e4606be6fc.gif
cdn.bncloudfl.com/bn/5c7/63a/492/ Frame 202D 37 KB
38 KB 52ms
31ms Image
image/gif 104.22.15.198
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bncloudfl.com/bn/5c7/63a/492/5c763a492225ad61f153f519aef868e4606be6fc.gif
Requested by: Host: stagepopkek.com
URL: https://stagepopkek.com/lv/esnk/1836026/code.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.22.15.198 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 85b2de298314e0616811998d963d8ca09e5e07d92c94dbfc132744f5fbdc7772

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:35 GMT
x-openstack-request-id: tx3272f48270ce4772afa38-0060cb507b
cf-cache-status: HIT
age: 38111
cf-polished: status=not_needed
access-control-expose-headers: X-Container-Meta-Temp-Url-Key,X-Container-Bytes-Used,Last-Modified,X-Timestamp
cf-bgj: imgq:100,h2pri
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-trans-id: tx3272f48270ce4772afa38-0060cb507b
accept-ranges: bytes
last-modified: Fri, 14 May 2021 15:10:12 GMT
server: cloudflare
etag: 40819607f574be5112ca684a25a0b4f0
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: HEAD,GET,POST,PUT,PATCH,DELETE,OPTIONS
content-type: image/gif
access-control-allow-origin: *
x-timestamp: 1621005011.96338
cache-control: max-age=432000
content-length: 37900
cf-ray: 6a5db1266b502788-PRG
access-control-allow-headers: Content-Type,X-Requested-With,X-Auth-Token,X-Openstack-Request-Id,X-Container-Meta-type,X-Container-Meta-Temp-URL-Key,Authorization
x-proxy-cache: HIT
expires: Sun, 31 Oct 2021 05:38:24 GMT

GET
H2 200 chicken.gif
stagepopkek.com/ Frame 4EE9 43 B
357 B 13ms
13ms Image
image/gif 109.206.162.83
SERVEREL-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stagepopkek.com/chicken.gif?z=1836027&pb=216b6f4e8df7dbf7b15dafeaf63c825a1635531214&psp=ux_fYNIoXPZELnIGUFWvqHvzIlmYJmR7GA-qFiu1zcI16_Dar0B7b2yZamraqStfhAif_-XdpsBjF7FHT06gq73_sqXyJsULXPlqh4mbaOoXeSyCOZtrgW3ToAma6_uom74JSvZhmLlyUtefB_yinVY9rz80zbF_ojASKnbrl_vpmlclbumDHZeQHvMvxTGBTgH4ToYHuxHOxruJf1jCO7JPKEIICiaTndhjjKGAkh4aynkHOK5re3wfS3Ln5jFoEiRZs7Y2_6xNiOtYVVKGlm2CLHN8jNDVhS0IEkAb7h8qJo9AvpHq375stNSycd3ttGsc87rbi-9CxMp0r_EIyy2TaRpzFtHqztItqGd1NdBntrqiJEwzXqK8nfgF73ndD2v_ds1rH85c3fplwSntG7MfnNjj3RL-bI1r8XEAFuX2PJKDmP-StVkBTN4bgzYKv1TfqqrMPVfzMaemGAgInxmZEEKGrBE8uyw2_V2U
Requested by: Host: picrok.com
URL: https://picrok.com/UhcTtOMb-EuVA3nqp48EvuMAF9Kmv6IbDw.php
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 109.206.162.83 , Netherlands, ASN50245 (SERVEREL-AS, NL),
Reverse DNS: 83.162.serverel.net
Software: nginx /
Resource Hash: 44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:35 GMT
server: nginx
timing-allow-origin: *
content-length: 43
content-type: image/gif

GET
H3 200 / Show response
c.adsco.re/ Frame 08EC 62 KB
22 KB 25ms
25ms XHR
text/html 104.17.166.186
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://c.adsco.re/
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.17.166.186 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9aaaac87a4cddb7db367764a7080fd31491c36ae256ba81391c270f8c4b2d0f8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://c.adsco.re/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:35 GMT
content-encoding: br
cf-cache-status: HIT
server: cloudflare
age: 11397381
etag: W/"2Ma3006J78KgzL0RD+7gUg=="
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/html
link: <//6.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//4.adsco.re/>;rel=prefetch;crossorigin;as=fetch,<//adsco.re/>;rel=dns-prefetch
cache-control: public, max-age=2678400
cf-ray: 6a5db1267ad6f9e2-PRG
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
expires: Mon, 29 Nov 2021 16:13:35 GMT

GET
H2 200 ec6233b68df27e79b369dfe653b6ab65.js Show response
f00961160c.25391ebf69.com/ 30 KB
11 KB 7ms
7ms Script
application/javascript 213.174.135.24
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://f00961160c.25391ebf69.com/ec6233b68df27e79b369dfe653b6ab65.js
Requested by: Host: f00961160c.25391ebf69.com
URL: https://f00961160c.25391ebf69.com/3ead1e42c9599cb676b34fca95612c38.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.174.135.24 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: d821e26847d8c47a1d3238dbdd2c1dfd5794b72c10c29365f34730eec688be9a

Request headers

Referer: https://picrok.com/
Origin: https://picrok.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:35 GMT
content-encoding: gzip
last-modified: Mon, 11 Oct 2021 15:02:55 GMT
server: nginx/1.18.0
etag: W/"6164521f-78ea"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Fri, 29 Oct 2021 17:13:35 GMT
cache-control: max-age=3600
x-proxy-cache: HIT

GET
H2 200 build.js Show response
js.cabnnr.com/banner-admanager/ 43 KB
16 KB 24ms
6ms Script
application/javascript 213.174.135.25
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://js.cabnnr.com/banner-admanager/build.js
Requested by: Host: f00961160c.25391ebf69.com
URL: https://f00961160c.25391ebf69.com/3ead1e42c9599cb676b34fca95612c38.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.174.135.25 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: cb69ebef736d09eb8e46d48b3ffb05ac7b1223085825f4159ce62a8d68770021

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:35 GMT
content-encoding: gzip
last-modified: Thu, 14 Oct 2021 08:56:00 GMT
server: nginx/1.18.0
etag: W/"6167f0a0-adb5"
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
expires: Fri, 29 Oct 2021 17:13:35 GMT
cache-control: max-age=3600
x-proxy-cache: HIT

GET /
6.adsco.re/ Frame 08EC 0
0

GET /
4.adsco.re/ Frame 08EC 0
0

GET
H2 200 chicken.gif
stagepopkek.com/ Frame 202D 43 B
357 B 14ms
13ms Image
image/gif 109.206.162.83
SERVEREL-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stagepopkek.com/chicken.gif?z=1836026&pb=216b6f4e8df7dbf7b15dafeaf63c825a1635531214&psp=PFVHXKbBRaLfpkfATozKEaWbmtOkFGV3l0OdRiLaISqG07sdpJKa7Bd4Mmtd2FgKUYMClR0X_ByCkboFYqErPO_VIrZRJjJ8u79_5scRgUVdXoU0-huh_BsnQzwZu-Iz3W1nOnNnXrccsdZE36QFB8_mdjws3xO2BKvcUKN8_UIRDI8aBeUtJJW2SneET1tFdBDWMNJu6DV513f-QmtAFNNb5vaWXoTCsYal9fT0MslOj72sjlKX8EhNa38JXqsuhlCWysMLEb-AagIUMopuAeVGUvB94sSIs-IhwrZJvIHMV3v4HeBaI6bW9RtLiZwygTTRIpGPsLrFLwGJVJqVOX5OG6-U427rWXp9yfniaYvvGX0_L8AIb3YF8iQAQ-hkdf2qi9N6B-5RrHV32on6GOwiaXRXfVsDwGV3b3Gfh2MleiX2dcdy9pddz3aV81nMXzI2ZmzfKEARqrWFIdfnVNGyw_uauoO9OnFfqKIc
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 109.206.162.83 , Netherlands, ASN50245 (SERVEREL-AS, NL),
Reverse DNS: 83.162.serverel.net
Software: nginx /
Resource Hash: 44251f61629e2bfeead421241a917f43ad047af351659f01cd8fd937f0417f84

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:35 GMT
server: nginx
timing-allow-origin: *
content-length: 43
content-type: image/gif

GET
H2 200 multy Show response
wpunativesh.com/in/ 12 KB
12 KB 136ms
116ms XHR
application/json 213.133.127.134
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://wpunativesh.com/in/multy?spot_size=4&spot_id=4747&subid=1728943672&label=1&session_id=5c859725-c5dc-43a2-96dd-d258b0c80035&cpa=c264489b-04df-4edc-afdd-7dc6f1d8dd11&ver=5.1.1&adblock=0&ad_type=native&iw=241&ih=241
Requested by: Host: f00961160c.25391ebf69.com
URL: https://f00961160c.25391ebf69.com/ec6233b68df27e79b369dfe653b6ab65.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.133.127.134 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.213-133-127-134.clients.your-server.de
Software: nginx/1.16.0 /
Resource Hash: 986b71c6584de78559e22a0a88a2cbd6132115d662199a31a4f3af760118e454

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

access-control-allow-origin: *
pragma: no-cache
date: Fri, 29 Oct 2021 16:12:41 GMT
cache-control: no-cache, no-store, must-revalidate, no-transform
server: nginx/1.16.0
content-length: 11907
content-type: application/json; charset=utf-8

GET
H2

200

banner Show response
stream.vast.wtf/youtube/ Frame 487E
Redirect Chain

https://rtbbnr.com/get/?go=1&data=eyJpbXAiOlt7InNlY3VyZSI6MSwiZXh0Ijp7ImlkIjoxNjk1LCJzcGFjZWlkIjoxNjk1LCJpZHpvbmUiOm51bGwsImFkX3RhZ3MiOiIiLCJsYWJlbHMiOiIiLCJ0aXRsZSI6IiIsInN1YmlkIjoiMzk5ODk2NzE3Iiw...
https://tb.baimgfroggd.site/in/1739/?screen_resolution=1600x1200&zone=ssp_cpm&w=1&h=1&spaceid=1695&user_id=42a5f2350406b5b34afe49ff517ecb3b&bid=0.0400&katds_labels=&utm1=&utm2=&utm3=&utm4=
https://stream.vast.wtf/youtube/banner?vi=QTSm63ZwSX8&eu=https%3A%2F%2Fwww.google.com%2Furl%3Fsa%3DD%26q%3Dhttps%3A%2F%2Fwww.youtube.com%2Fembed%2FQTSm63ZwSX8%253Fenablejsapi%253D1%2526origin%253D%...

3 KB
2 KB

92ms
41ms

Document
text/html

104.21.34.6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://stream.vast.wtf/youtube/banner?vi=QTSm63ZwSX8&eu=https%3A%2F%2Fwww.google.com%2Furl%3Fsa%3DD%26q%3Dhttps%3A%2F%2Fwww.youtube.com%2Fembed%2FQTSm63ZwSX8%253Fenablejsapi%253D1%2526origin%253D%2A%2526playsinline%253D1%2526autoplay%253D1%2526mute%253D1&ee=https%3A%2F%2Fvs.videonet.online%2Fsts%2F&pid=43038&p=0.0014&oid=987838&sp=0.0400&spp=1000&se=impression&tcbbi=https%3A%2F%2F12007250.pix-cdn.org%2Fnative%2Ftmp%2Ftbz.jpg&tcbbc=https%3A%2F%2Ftube.biz%2F%3Futm_source%3Dtbz%26utm_medium%3Dbanner%26utm_campaign%3Dasites%26ref%3Dnq1a9fVMKw
Requested by: Host: js.cabnnr.com
URL: https://js.cabnnr.com/banner-admanager/build.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.21.34.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f13379172c60a7404c999e922d6a14b4b7f0e44abbc752d3922d8576eaa63a5c

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/

Response headers

date: Fri, 29 Oct 2021 16:13:35 GMT
content-type: text/html; charset=utf-8
access-control-allow-credentials: true
access-control-allow-origin: *
via: 1.1 google
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZwEvImVrKbCAp9lpynMIupzPkgw5z2ZRaIO4hE9t3UGGj9Y3i2DAvf0iB8rcc2OLjwlAKMIZz7BchGbQ2LxhLLrwfxHIdZ0qGVSvg19OYOhJ1TzWz6e%2BisBP%2BD6ufW1UzU8%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 6a5db12868a82780-PRG
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

Redirect headers

server: nginx/1.17.2
date: Fri, 29 Oct 2021 16:13:35 GMT
content-type: text/html; charset=UTF-8
content-length: 0
location: https://stream.vast.wtf/youtube/banner?vi=QTSm63ZwSX8&eu=https%3A%2F%2Fwww.google.com%2Furl%3Fsa%3DD%26q%3Dhttps%3A%2F%2Fwww.youtube.com%2Fembed%2FQTSm63ZwSX8%253Fenablejsapi%253D1%2526origin%253D%2A%2526playsinline%253D1%2526autoplay%253D1%2526mute%253D1&ee=https%3A%2F%2Fvs.videonet.online%2Fsts%2F&pid=43038&p=0.0014&oid=987838&sp=0.0400&spp=1000&se=impression&tcbbi=https%3A%2F%2F12007250.pix-cdn.org%2Fnative%2Ftmp%2Ftbz.jpg&tcbbc=https%3A%2F%2Ftube.biz%2F%3Futm_source%3Dtbz%26utm_medium%3Dbanner%26utm_campaign%3Dasites%26ref%3Dnq1a9fVMKw
pragma: no-cache
vary: *
cache-control: no-cache, no-store, must-revalidate

GET
H2 200 popunder.gif
pleastindustress.xyz/ 35 B
368 B 117ms
98ms Image
image/gif 143.204.215.89
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pleastindustress.xyz/popunder.gif
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.89 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-89.fra53.r.cloudfront.net
Software: /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: public
date: Fri, 29 Oct 2021 16:13:35 GMT
content-encoding: gzip
x-amz-cf-pop: FRA53-C1
x-cache: Miss from cloudfront
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=604800, immutable
content-length: 58
via: 1.1 0cbb1ca51bf146be48b40804581e4466.cloudfront.net (CloudFront)
x-amz-cf-id: cNoGXdA5Z4b_4ogvQNGPCYrRGBh6SndSx9t3nYfdLtpOOHxXgVtd-w==

GET
H2 201 /
wpunativesh.com/in/show/ 0
53 B 28ms
9ms Image
text/plain 213.133.127.134
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wpunativesh.com/in/show/?&cid=742&session_id=5c859725-c5dc-43a2-96dd-d258b0c80035&response_size=0&cryp=eyJhbGciOiJIUzI1NiJ9.eyJhY2NlcHRfbGFuZ3VhZ2UiOiJkZS1ERSxkZTtxPTAuOSIsImFkX3Bvc2l0aW9uIjoxLCJhZF90eXBlIjoibmF0aXZlIiwiYXVjdGlvbl9pZCI6Mzc4NTQ0NDc0OSwiYnJvd3Nlcl9mYW1pbHkiOiJDaHJvbWUiLCJicm93c2VyX25hbWUiOiJDaHJvbWUgOTUiLCJjYW1wYWlnbl9pZCI6NzQyLCJjb3VudHJ5IjoiREUiLCJjcGMiOjAsImNwbSI6MC4wMDcsImNyZWF0aXZlX2lkIjoiODhmNDVkZjU4ZjVjMTI0ZWZkMzZiODMwYmExODNhODgiLCJlY3BtIjowLjAwNjczMzMsImV4dF9jcmVhdGl2ZV9pZCI6IjIyNzcxMjgiLCJmcm9tX3N0b3JhZ2UiOmZhbHNlLCJpYXQiOjE2MzU1MjM5NjEuMDU1OTUwNCwiaXAiOiIyMTYuMTMxLjExNC4xOTgiLCJpc19jcG0iOjEsIm9zX2ZhbWlseSI6IndpbmRvd3MiLCJvc190eXBlIjoiY29tcHV0ZXIiLCJyZXNwb25zZV9zaXplIjowLCJybiI6MSwic2Vzc2lvbl9pZCI6IjVjODU5NzI1LWM1ZGMtNDNhMi05NmRkLWQyNThiMGM4MDAzNSIsInNpdGUiOiJwaWNyb2suY29tIiwic291cmNlX2lkIjoxNzI4OTQzNjcyLCJzcG90X2lkIjo0NzQ3LCJzcG90X3NpemUiOjQsInN1YiI6ImF1Y3Rpb24tbmF0aXZlLXByb2QiLCJ1cmwiOiIiLCJ1c2FnZV90eXBlIjoiRENIIiwidXNlcl9pZCI6MzA2MzIzNTA0OCwidXRtX2NhbXBhaWduIjoiIiwidXRtX2NvbnRlbnQiOiIiLCJ1dG1fbWVkaXVtIjoiIiwidXRtX3NvdXJjZSI6IiIsInZlciI6IjUuMS4xIn0.3awNj8Si6Id1hNIO63bp6WtS-scQvmj4gBKiUdBcXWE
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.133.127.134 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.213-133-127-134.clients.your-server.de
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:12:41 GMT
content-length: 0
server: nginx/1.16.0

GET
H2 200 p.gif
pxl.tsyndicate.com/api/v1/p/ 35 B
133 B 37ms
12ms Image
image/gif 78.46.40.103
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pxl.tsyndicate.com/api/v1/p/p.gif?p=e0SEGUNHhI4YLETQOXNQRJkaNcTYGHMjTAscNmTYaEHDRg0cGMOQkdHCjBkxNcrImJGDhowxYUQoHONmzsEZGxWGqTPG4YwbOGrQIHqDRo6ZIsSkIfMz6NCiR5OOtHMwBgwcM2oohFNHjFUZHm3shAPnYEadIubAMaijJVoYNxSWwUPny9q2ImgYvZF0TBuzbmPcCLt1IBkzBzUqFOPGzUEZMm7ciCEDh8I2bhrqoBEjR0IRcDJvHgwDxlgRdeSwgVzDxg0bHhXWkeEQDR06cOboePGCjpwxa1ykcWPmzQszYczYEGMmhpgWYnKQidERRtgWOWCIqR7DRgwzN97mmBGDxg8yZeykGVPmC508cMr0gDKESx3TG9_M6XGFOJk37pgDhKvuy485OQKcoww5ehgCjQTbKMPA6ygKQw450mCwh_RcsOMNMpR7w40J8aswJsDCSOMMN75gqofyCKOhBgo3miMNOtxDYz86eqBjjjrKYiMPF8Z4o40abTBOjjbC6NENJ9Owo8QDR1rrDbuglLAHJ6KcMsmRegiCiBm-gJIOKcuIbkQ38khyjTLyuOMNOcjgL0kj5-gRBhdgiAFPNthb48UarPixjDeyaEOKQJeAwY4WzFODjSHyOCOIIJZgowlMiah0TD2oQOIOTEsNQggnxsghiCGW-GIIU0-VIggtukwKwDYc-jFIOIYs8ki_LjyIBhxooMnJg7aIrAuugLNKTRgMewMOZxGC1rDmDuLTNMPGEO0Lan3SYdu4FJLDjsBmgGEub3Mdt0_Q6qgjDYfI6IwMHMYgIwcczDBNDBlgoKEMfk3Lgd8yxjCjWMnKSCqNwESQwTsXYiivYvMq5jepOmTSQYQm3tAjDTbYCOOFGvoEAQX_3ABQQBCcoILAbXcAoeXYbMYjthRACELIMq4oQ4wlcEQZKBdmsGHlJZCgogkmWAAhUDhBOCLhNd7o-cEIy3ghh5T59GgGHFwYCoQplLswjaNvSNoGv8QVgYgikqLzizHkpjspNvSuW6H07PhCjjJYQ6iGG2qIASQaTDOXxYNyMApw9b4QQ46zKBe8DRAhw8E8wBO0SqH9hm32DTzygAzwPB7T4bc6ylBojnMdSpAOJ-lsoQ43cGzhNBfIqOhWudP7Qvi-FKLDXe-0qiEsPw1bvjaEbHAe-sUDnmEnMgYvY60vkK3--sYX30mMvNJLrg42DOKqb21pEk1wOaJ8Y3QRxiANhj4UCAg%3D&r=1&s=39945a6a3576562dafd146974f8c369b162336bbe0c4dfaabe27658a2e511cf41635524015&w=t
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 78.46.40.103 Nuremberg, Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.103.40.46.78.clients.your-server.de
Software: nginx /
Resource Hash: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:35 GMT
server: nginx
x-robots-tag: noindex, nofollow
content-length: 35
content-type: image/gif; charset=utf-8

GET
H2 201 /
wpunativesh.com/in/show/ 0
52 B 29ms
10ms Image
text/plain 213.133.127.134
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wpunativesh.com/in/show/?&cid=1171&session_id=5c859725-c5dc-43a2-96dd-d258b0c80035&response_size=0&cryp=eyJhbGciOiJIUzI1NiJ9.eyJhY2NlcHRfbGFuZ3VhZ2UiOiJkZS1ERSxkZTtxPTAuOSIsImFkX3Bvc2l0aW9uIjoyLCJhZF90eXBlIjoibmF0aXZlIiwiYXVjdGlvbl9pZCI6Mzc4NTQ0NDc0OSwiYnJvd3Nlcl9mYW1pbHkiOiJDaHJvbWUiLCJicm93c2VyX25hbWUiOiJDaHJvbWUgOTUiLCJjYW1wYWlnbl9pZCI6MTE3MSwiY291bnRyeSI6IkRFIiwiY3BjIjowLjAwOCwiY3BtIjowLCJjcmVhdGl2ZV9pZCI6ImRlODc4YTI3YzdhYzI2Zjc5ZjBlZTRjZWMwYzRmZTA1IiwiZWNwbSI6MC4wMDE3OTgzNjM1Nzc3OTQ0ODA4LCJleHRfY3JlYXRpdmVfaWQiOiIiLCJmcm9tX3N0b3JhZ2UiOmZhbHNlLCJpYXQiOjE2MzU1MjM5NjEuMDU2Mjc4NywiaXAiOiIyMTYuMTMxLjExNC4xOTgiLCJpc19jcG0iOjAsIm9zX2ZhbWlseSI6IndpbmRvd3MiLCJvc190eXBlIjoiY29tcHV0ZXIiLCJyZXNwb25zZV9zaXplIjowLCJybiI6MCwic2Vzc2lvbl9pZCI6IjVjODU5NzI1LWM1ZGMtNDNhMi05NmRkLWQyNThiMGM4MDAzNSIsInNpdGUiOiJwaWNyb2suY29tIiwic291cmNlX2lkIjoxNzI4OTQzNjcyLCJzcG90X2lkIjo0NzQ3LCJzcG90X3NpemUiOjQsInN1YiI6ImF1Y3Rpb24tbmF0aXZlLXByb2QiLCJ1cmwiOiIiLCJ1c2FnZV90eXBlIjoiRENIIiwidXNlcl9pZCI6MzA2MzIzNTA0OCwidXRtX2NhbXBhaWduIjoiIiwidXRtX2NvbnRlbnQiOiIiLCJ1dG1fbWVkaXVtIjoiIiwidXRtX3NvdXJjZSI6IiIsInZlciI6IjUuMS4xIn0.NvLAWcYbjt7uC7upe-dGRwEhfTFrP8UmrEVxGnr1Ay4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.133.127.134 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.213-133-127-134.clients.your-server.de
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:12:41 GMT
content-length: 0
server: nginx/1.16.0

GET
H2 201 /
pn.itiger.online/in/na_shows/ 0
157 B 46ms
16ms Image
text/plain 109.206.182.51
SERVEREL-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pn.itiger.online/in/na_shows/?cnaci=6955&cnai=2963&out_name=78286|21284|cpc|0.0020|$%200.0080&price=0.0080&pricebox_price=0.0020&pricing_model=cpc&spot_id=4747&sp=0.00366&country=DE
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 109.206.182.51 , Netherlands, ASN50245 (SERVEREL-AS, NL),
Reverse DNS: 109.206.182.51.serverel.net
Software: nginx/1.16.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:34 GMT
cache-control: no-cache, no-store, must-revalidate
server: nginx/1.16.1
content-length: 0

GET
H2 201 /
wpunativesh.com/in/show/ 0
52 B 28ms
9ms Image
text/plain 213.133.127.134
HETZNER-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://wpunativesh.com/in/show/?&cid=1449&session_id=5c859725-c5dc-43a2-96dd-d258b0c80035&response_size=0&cryp=eyJhbGciOiJIUzI1NiJ9.eyJhY2NlcHRfbGFuZ3VhZ2UiOiJkZS1ERSxkZTtxPTAuOSIsImFkX3Bvc2l0aW9uIjozLCJhZF90eXBlIjoibmF0aXZlIiwiYXVjdGlvbl9pZCI6Mzc4NTQ0NDc0OSwiYnJvd3Nlcl9mYW1pbHkiOiJDaHJvbWUiLCJicm93c2VyX25hbWUiOiJDaHJvbWUgOTUiLCJjYW1wYWlnbl9pZCI6MTQ0OSwiY291bnRyeSI6IkRFIiwiY3BjIjowLjAwMzY2LCJjcG0iOjAsImNyZWF0aXZlX2lkIjoiOGZjNDY2MjllYmQ5ZmJkYzA0YTk0NjJhNzYwN2JkYTgiLCJlY3BtIjowLjAwMDcxNzM1Njg1NjAwNzczMTIsImV4dF9jcmVhdGl2ZV9pZCI6IjE0NDA1NzEzNzYiLCJmcm9tX3N0b3JhZ2UiOmZhbHNlLCJpYXQiOjE2MzU1MjM5NjEuMDU2NTgsImlwIjoiMjE2LjEzMS4xMTQuMTk4IiwiaXNfY3BtIjowLCJvc19mYW1pbHkiOiJ3aW5kb3dzIiwib3NfdHlwZSI6ImNvbXB1dGVyIiwicmVzcG9uc2Vfc2l6ZSI6MCwicm4iOjEsInNlc3Npb25faWQiOiI1Yzg1OTcyNS1jNWRjLTQzYTItOTZkZC1kMjU4YjBjODAwMzUiLCJzaXRlIjoicGljcm9rLmNvbSIsInNvdXJjZV9pZCI6MTcyODk0MzY3Miwic3BvdF9pZCI6NDc0Nywic3BvdF9zaXplIjo0LCJzdWIiOiJhdWN0aW9uLW5hdGl2ZS1wcm9kIiwidXJsIjoiIiwidXNhZ2VfdHlwZSI6IkRDSCIsInVzZXJfaWQiOjMwNjMyMzUwNDgsInV0bV9jYW1wYWlnbiI6IiIsInV0bV9jb250ZW50IjoiIiwidXRtX21lZGl1bSI6IiIsInV0bV9zb3VyY2UiOiIiLCJ2ZXIiOiI1LjEuMSJ9.8wodzpjbugzQELmUuG7sCpqGdadeTa2FZOAU7vbLQWk
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 213.133.127.134 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.213-133-127-134.clients.your-server.de
Software: nginx/1.16.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:12:41 GMT
content-length: 0
server: nginx/1.16.0

GET
H2 200 main.jpg
lcdn.tsyndicate.com/images/3/7/ca7655b47673da6dbfdf2eaa89f96c535dd7bd/ 66 KB
66 KB 30ms
7ms Image
image/jpeg 8.241.90.121
LEVEL3

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://lcdn.tsyndicate.com/images/3/7/ca7655b47673da6dbfdf2eaa89f96c535dd7bd/main.jpg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 8.241.90.121 , United States, ASN3356 (LEVEL3, US),
Reverse DNS
Software: nginx /
Resource Hash: 81adf41f79d5df9e92755efb2c3666f2d68b2e5b0d07bb94c6b6105d912e4be4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:35 GMT
last-modified: Tue, 13 Oct 2020 14:39:03 GMT
server: nginx
age: 25565682
etag: "5f85bc07-10813"
content-type: image/jpeg
accept-ranges: bytes
x-robots-tag: noindex, nofollow
content-length: 67603

GET
H2 200 bdvmU5SV-minify.jpg
12112336.pix-cdn.org/m/p/0/220/220922/conversions/ 14 KB
14 KB 26ms
10ms Image
image/jpeg 213.174.135.24
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://12112336.pix-cdn.org/m/p/0/220/220922/conversions/bdvmU5SV-minify.jpg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.174.135.24 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.18.0 /
Resource Hash: 0ecbbec142ecfe0ed6890587a84180f11681ef5f6996dd37f1ebfc5cfc8723bf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Oct 2021 16:13:35 GMT
last-modified: Fri, 29 Oct 2021 14:37:08 GMT
server: nginx/1.18.0
etag: "617c0714-363d"
content-type: image/jpeg
expires: 0
cache-control: no-cache, no-store, must-revalidate
accept-ranges: bytes
content-length: 13885
x-proxy-cache: HIT

GET
H2

200

tmAU3AIQx0PHzlQrhrEekV30jQHHe1F3.png
i.wmgtr.com/cim/
Redirect Chain

https://kkzwvd.com/dsp/nt/img?aid=14928203096202822195&mid=0&t=1635524015&sid=952
https://i.wmgtr.com/cim/tmAU3AIQx0PHzlQrhrEekV30jQHHe1F3.png

63 KB
64 KB

29ms
12ms

Image
image/png

213.174.135.33
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.wmgtr.com/cim/tmAU3AIQx0PHzlQrhrEekV30jQHHe1F3.png

Protocol

Server

213.174.135.33 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

2c3e165b030fc11fdea9972a08061ce4447c0b7ea6092d39ef8c3995e4ade487

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:35 GMT
content-encoding: gzip
server: nginx/1.18.0
content-type: image/png
access-control-allow-origin: *
expires: Sat, 30 Oct 2021 04:13:35 GMT
cache-control: max-age=43200
x-content-type-option: nosniff
x-xss-protection: 1; mode=block
x-proxy-cache: HIT

Redirect headers

access-control-allow-origin: *
date: Fri, 29 Oct 2021 16:13:35 GMT
server: nginx/1.18.0
content-length: 0
location: https://i.wmgtr.com/cim/tmAU3AIQx0PHzlQrhrEekV30jQHHe1F3.png

GET
H2 200 1.jpg
tn.tubepornclassic.com/contents/videos_screenshots/1070000/1070649/240x180/ 15 KB
15 KB 40ms
7ms Image
image/jpeg 213.174.135.24
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tn.tubepornclassic.com/contents/videos_screenshots/1070000/1070649/240x180/1.jpg
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 213.174.135.24 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),
Reverse DNS
Software: nginx/1.16.1 /
Resource Hash: 52f02cd725d2b541b6023ac5d2ab989c61dff71dd16524cab1cf389f5bdfe77e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:35 GMT
last-modified: Tue, 01 Oct 2019 03:40:07 GMT
server: nginx/1.16.1
etag: "5d92ca97-3bb6"
content-type: image/jpeg
access-control-allow-origin: *
expires: Thu, 27 Jan 2022 16:13:35 GMT
cache-control: max-age=7776000
accept-ranges: bytes
content-length: 15286
x-proxy-cache: HIT

POST
H/1.1 200
OK p Show response
adsco.re/ 166 B
715 B 43ms
42ms XHR
text/html 162.252.214.5
TUT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://adsco.re/p
Requested by: Host: c.adsco.re
URL: https://c.adsco.re/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 162.252.214.5 , United States, ASN53334 (TUT-AS, US),
Reverse DNS
Software: /
Resource Hash: 0f50610af654c9e7d242e637fa56db48aa099d4de5be2393cf389ac0b3d5e77b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

AS-P-G: OK
Date: Fri, 29 Oct 2021 16:13:35 GMT
AS-P-7: OK
AS-P-9: OK
AS-P-C: OK
Transfer-Encoding: chunked
AS-P-5: OK
AS-P-F: OK
Connection: keep-alive
Content-Encoding: gzip
AS-P-2: OK
AS-P-D: OK
AS-P-6: OK
AS-P-B: OK
AS-P-H: OK
AS-P-4: OK
AS-P-A: OK
Access-Control-Max-Age: 2592000
AS-P-1: OK lon223
Access-Control-Allow-Origin: https://picrok.com
Cache-Control: no-transform
Access-Control-Allow-Credentials: true
AS-P-8: OK
Content-Type: text/html; charset=UTF-8
AS-P-E: OK
AS-P-3: OK

GET
H2 200 vast-player.min.js Show response
cdn.jsdelivr.net/npm/vast-player@latest/dist/ Frame 487E 64 KB
21 KB 59ms
25ms Script
application/javascript 104.16.88.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/vast-player@latest/dist/vast-player.min.js

Requested by

Host: stream.vast.wtf
URL: https://stream.vast.wtf/youtube/banner?vi=QTSm63ZwSX8&eu=https%3A%2F%2Fwww.google.com%2Furl%3Fsa%3DD%26q%3Dhttps%3A%2F%2Fwww.youtube.com%2Fembed%2FQTSm63ZwSX8%253Fenablejsapi%253D1%2526origin%253D%2A%2526playsinline%253D1%2526autoplay%253D1%2526mute%253D1&ee=https%3A%2F%2Fvs.videonet.online%2Fsts%2F&pid=43038&p=0.0014&oid=987838&sp=0.0400&spp=1000&se=impression&tcbbi=https%3A%2F%2F12007250.pix-cdn.org%2Fnative%2Ftmp%2Ftbz.jpg&tcbbc=https%3A%2F%2Ftube.biz%2F%3Futm_source%3Dtbz%26utm_medium%3Dbanner%26utm_campaign%3Dasites%26ref%3Dnq1a9fVMKw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.88.20 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7c97607147b09e31e70026e23eb61dc4917b5655e4b03ee103cb50d62f6616a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://stream.vast.wtf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:35 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 26774
x-jsd-version: 0.2.10
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
x-served-by: cache-fra19144-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"101a3-kqflBbwdvbQ4APoFNu3h5vzUaKQ"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 6a5db128ebb2410e-PRG

GET
H2 200 Zxk.asp Show response
visariomedia.com/ 44 B
140 B 173ms
131ms Script
text/javascript 216.21.12.16
TUT-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://visariomedia.com/Zxk.asp?_=BAYAYXwdrwFhfB2vgAGBAsAAIBGG1xJAt-09CroUFqtiuFj441dHLy80GFo7zjLtxSqfwQBGMEQCIGBnw8Ouac9J8OCCDbNoV8fKwCDXN7h70tywENUm6TCOAiBbVWrFCoZR6pMSrtHSwe3JgeXo8NrBRzAPH5aWi9NUNg&v=4&KGsitOVN=4360211&minBid=&UYLjpaqn=0,0&BLJlIDqO=&umelyrAg=https%3A%2F%2Fpicrok.com%2Fpuse5vpg6v98%2Fa13.jpg.html&s=1600,1200,1,1600,1200,0
Requested by: Host: www.visariomedia.com
URL: https://www.visariomedia.com/popper.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.21.12.16 , United States, ASN53334 (TUT-AS, US),
Reverse DNS: 216-21-12-16.customer.totaluptime.net
Software: /
Resource Hash: 9d781128a8ece413b003d5612b8398bf9340ef7f5b751d12bd125ba523d3ceb5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 29 Oct 2021 16:13:35 GMT
popads-ec: ASB
asf: 9
content-length: 44
content-type: text/javascript;charset=UTF-8

GET
H2 200 / Show response
vs.videonet.online/sts/ Frame 487E 2 B
229 B 51ms
14ms XHR
application/json 109.206.161.77
SERVEREL-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://vs.videonet.online/sts/?vi=QTSm63ZwSX8&eu=https%3A%2F%2Fwww.google.com%2Furl%3Fsa%3DD%26q%3Dhttps%3A%2F%2Fwww.youtube.com%2Fembed%2FQTSm63ZwSX8%253Fenablejsapi%253D1%2526origin%253D%2A%2526playsinline%253D1%2526autoplay%253D1%2526mute%253D1&ee=https%3A%2F%2Fvs.videonet.online%2Fsts%2F&pid=43038&p=0.0014&oid=987838&sp=0.0400&spp=1000&se=impression&tcbbi=https%3A%2F%2F12007250.pix-cdn.org%2Fnative%2Ftmp%2Ftbz.jpg&tcbbc=https%3A%2F%2Ftube.biz%2F%3Futm_source%3Dtbz%26utm_medium%3Dbanner%26utm_campaign%3Dasites%26ref%3Dnq1a9fVMKw&type=impression
Requested by: Host: stream.vast.wtf
URL: https://stream.vast.wtf/youtube/banner?vi=QTSm63ZwSX8&eu=https%3A%2F%2Fwww.google.com%2Furl%3Fsa%3DD%26q%3Dhttps%3A%2F%2Fwww.youtube.com%2Fembed%2FQTSm63ZwSX8%253Fenablejsapi%253D1%2526origin%253D%2A%2526playsinline%253D1%2526autoplay%253D1%2526mute%253D1&ee=https%3A%2F%2Fvs.videonet.online%2Fsts%2F&pid=43038&p=0.0014&oid=987838&sp=0.0400&spp=1000&se=impression&tcbbi=https%3A%2F%2F12007250.pix-cdn.org%2Fnative%2Ftmp%2Ftbz.jpg&tcbbc=https%3A%2F%2Ftube.biz%2F%3Futm_source%3Dtbz%26utm_medium%3Dbanner%26utm_campaign%3Dasites%26ref%3Dnq1a9fVMKw
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 109.206.161.77 , Netherlands, ASN50245 (SERVEREL-AS, NL),
Reverse DNS: 109.206.161.77.serverel.net
Software: nginx/1.20.1 /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://stream.vast.wtf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

access-control-allow-origin: *
date: Fri, 29 Oct 2021 16:13:35 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
server: nginx/1.20.1
content-length: 2
content-type: application/json

GET
H3 200 vast Show response
stream.vast.wtf/youtube/ Frame 487E 2 KB
1 KB 75ms
56ms XHR
text/xml 104.21.34.6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://stream.vast.wtf/youtube/vast?vi=QTSm63ZwSX8&eu=https%3A%2F%2Fwww.google.com%2Furl%3Fsa%3DD%26q%3Dhttps%3A%2F%2Fwww.youtube.com%2Fembed%2FQTSm63ZwSX8%253Fenablejsapi%253D1%2526origin%253D%2A%2526playsinline%253D1%2526autoplay%253D1%2526mute%253D1&ee=https%3A%2F%2Fvs.videonet.online%2Fsts%2F&pid=43038&p=0.0014&oid=987838&sp=0.0400&spp=1000&se=impression&tcbbi=https%3A%2F%2F12007250.pix-cdn.org%2Fnative%2Ftmp%2Ftbz.jpg&tcbbc=https%3A%2F%2Ftube.biz%2F%3Futm_source%3Dtbz%26utm_medium%3Dbanner%26utm_campaign%3Dasites%26ref%3Dnq1a9fVMKw
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/vast-player@latest/dist/vast-player.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.34.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9498d070401cd9d4bada137474b5b6535f7746e7e314d5a85d3fb8b2b718c3b8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://stream.vast.wtf/youtube/banner?vi=QTSm63ZwSX8&eu=https%3A%2F%2Fwww.google.com%2Furl%3Fsa%3DD%26q%3Dhttps%3A%2F%2Fwww.youtube.com%2Fembed%2FQTSm63ZwSX8%253Fenablejsapi%253D1%2526origin%253D%2A%2526playsinline%253D1%2526autoplay%253D1%2526mute%253D1&ee=https%3A%2F%2Fvs.videonet.online%2Fsts%2F&pid=43038&p=0.0014&oid=987838&sp=0.0400&spp=1000&se=impression&tcbbi=https%3A%2F%2F12007250.pix-cdn.org%2Fnative%2Ftmp%2Ftbz.jpg&tcbbc=https%3A%2F%2Ftube.biz%2F%3Futm_source%3Dtbz%26utm_medium%3Dbanner%26utm_campaign%3Dasites%26ref%3Dnq1a9fVMKw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:35 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6a5db1299ea64131-PRG
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X9mg2dIZutxkkkT77zeL2Ap1CECVsfhMTcYx%2FsQTRh1fkMuIdQLyMG%2B4zVcuXoKwBSkcWt13fj87Tp13J1frHmKF%2BL8qbXxo6UhTnuCJi6pmWGfadCUw6C%2FHnhUeFrtmrbw%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/xml
access-control-allow-origin: *
access-control-allow-credentials: true
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400

GET
H2 200 tbz.jpg
12007250.pix-cdn.org/native/tmp/ Frame 487E 20 KB
21 KB 23ms
7ms Image
image/jpeg 213.174.135.24
ADVANCEDHOSTERS-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://12007250.pix-cdn.org/native/tmp/tbz.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

213.174.135.24 Ashburn, United States, ASN39572 (ADVANCEDHOSTERS-AS, NL),

Reverse DNS

Software

nginx/1.18.0 /

Resource Hash

0a500f83955139786d6ad6b9c95cbe603dceb315cf5c87005cfcf3fe2b199c2e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://stream.vast.wtf/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:35 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2429949
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
content-length: 20782
last-modified: Thu, 30 Sep 2021 13:59:58 GMT
server: nginx/1.18.0
etag: "6155c2de-512e"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lLWTWje2%2BTSTMo5q2hyGiQU3oJ9mhZill6JPtQ10%2BNsaXF%2BSUCTyCtnydWtId1FyqGl1g6RxW1Li5PUvvUwswFQLPxH3tTfXeqvUYH09WhghLTNhFZNbIzz2BLx6"}],"group":"cf-nel","max_age":604800}
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
cf-ray: 6a58dc22d9d36d7d-MUC
x-proxy-cache: HIT
expires: Fri, 29 Oct 2021 17:13:35 GMT

GET
H3 200 vpaid.js Show response
stream.vast.wtf/files/youtube/ Frame B9B2 20 KB
6 KB 19ms
18ms Script
application/javascript 104.21.34.6
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://stream.vast.wtf/files/youtube/vpaid.js
Requested by: Host: cdn.jsdelivr.net
URL: https://cdn.jsdelivr.net/npm/vast-player@latest/dist/vast-player.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 104.21.34.6 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6004cbbdfd65a4a6059250ea0595c41799d38cc264a567f22db8e90e87915b26

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://stream.vast.wtf/youtube/banner?vi=QTSm63ZwSX8&eu=https%3A%2F%2Fwww.google.com%2Furl%3Fsa%3DD%26q%3Dhttps%3A%2F%2Fwww.youtube.com%2Fembed%2FQTSm63ZwSX8%253Fenablejsapi%253D1%2526origin%253D%2A%2526playsinline%253D1%2526autoplay%253D1%2526mute%253D1&ee=https%3A%2F%2Fvs.videonet.online%2Fsts%2F&pid=43038&p=0.0014&oid=987838&sp=0.0400&spp=1000&se=impression&tcbbi=https%3A%2F%2F12007250.pix-cdn.org%2Fnative%2Ftmp%2Ftbz.jpg&tcbbc=https%3A%2F%2Ftube.biz%2F%3Futm_source%3Dtbz%26utm_medium%3Dbanner%26utm_campaign%3Dasites%26ref%3Dnq1a9fVMKw
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:35 GMT
via: 1.1 google
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 1145
cf-polished: origSize=24046
content-encoding: br
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
last-modified: Thu, 21 Oct 2021 14:31:27 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YWMj9amvrUO8iOE1hR2jaWOvsULyPN4CA3vCwx2roUXs%2FIw8iX9kHr8n3dKfKM%2B86Q1tz5H8Gq%2BLYK0iu2S7Kig%2FX4UiQ3lSrVbPBeUpprmtJRBdcJ43e%2B713ZdHfTP6Rsw%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
cache-control: max-age=14400
cf-ray: 6a5db12a0f914131-PRG
cf-bgj: minify

GET
H2 200 url Show response
www.google.com/ Frame A3D9 603 B
1 KB 62ms
38ms Document
text/html 142.250.181.228
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/url?sa=D&q=https://www.youtube.com/embed/QTSm63ZwSX8%3Fenablejsapi%3D1%26origin%3D*%26playsinline%3D1%26autoplay%3D1%26mute%3D1

Requested by

Host: stream.vast.wtf
URL: https://stream.vast.wtf/files/youtube/vpaid.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.228 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f4.1e100.net

Software

gws /

Resource Hash

da082b9ab511d3398d689b5d8fd130bd253e115150e33aa63cbf8c07c723e43d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://stream.vast.wtf/

Response headers

location: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1
cache-control: private
content-type: text/html; charset=UTF-8
strict-transport-security: max-age=31536000
bfcache-opt-in: unload
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
date: Fri, 29 Oct 2021 16:13:36 GMT
server: gws
content-length: 603
x-xss-protection: 0
expires: Fri, 29 Oct 2021 16:13:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 QTSm63ZwSX8 Show response
www.youtube.com/embed/ Frame A3D9 59 KB
25 KB 107ms
68ms Document
text/html 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1

Requested by

Host: www.google.com
URL: https://www.google.com/url?sa=D&q=https://www.youtube.com/embed/QTSm63ZwSX8%3Fenablejsapi%3D1%26origin%3D*%26playsinline%3D1%26autoplay%3D1%26mute%3D1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b68bf013026f098b9355b4b4bd9bf7ab6d20ed3d967fecbbab798358d2fe2bc2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.google.com/

Response headers

content-type: text/html; charset=utf-8
x-content-type-options: nosniff
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Fri, 29 Oct 2021 16:13:36 GMT
strict-transport-security: max-age=31536000
report-to: {"group":"AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/encsid_AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA"}]}
cross-origin-opener-policy-report-only: same-origin; report-to="AXrpQdexiF0ssZ_nH8Dr-M3QgbdVRvO77RECMA"
permissions-policy: ch-ua-full-version=*, ch-ua-platform=*, ch-ua-platform-version=*, ch-ua-arch=*, ch-ua-model=*
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=de for more info."
content-encoding: br
server: ESF
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H/1.1 200
OK t.php
d.maldini.xyz/ 0
413 B 593ms
147ms Image
text/html 23.235.244.212
SSASN2

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.maldini.xyz/t.php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.235.244.212 Phoenix, United States, ASN20454 (SSASN2, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://picrok.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Fri, 29 Oct 2021 16:13:36 GMT
Content-Encoding: gzip
Server: nginx
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H3 200 www-player-webp.css
www.youtube.com/s/player/9216d1f7/ Frame A3D9 334 KB
46 KB 22ms
7ms Stylesheet
text/css 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/9216d1f7/www-player-webp.css

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4031dea4a8a48b0efd5836f07da70d2f72a3fcd76d50f2d411b3ccec4e980b28

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 16:48:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 170702
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 46958
x-xss-protection: 0
last-modified: Wed, 27 Oct 2021 00:15:40 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 27 Oct 2022 16:48:34 GMT

GET
H3 200 www-embed-player.js Show response
www.youtube.com/s/player/9216d1f7/www-embed-player.vflset/ Frame A3D9 208 KB
68 KB 28ms
14ms Script
text/javascript 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/9216d1f7/www-embed-player.vflset/www-embed-player.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

831b502b7f9c15c2cd3ee726d68d5e1b0a7637b2fd1c01f190af2cf43c56d902

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 16:48:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 170702
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 69750
x-xss-protection: 0
last-modified: Wed, 27 Oct 2021 00:15:40 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 27 Oct 2022 16:48:34 GMT

GET
H3 200 base.js Show response
www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/ Frame A3D9 2 MB
513 KB 32ms
18ms Script
text/javascript 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/base.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c797355fdbc5008cb1c2db5648cd47acc0c8f6f92dfac3e6a8e903667761c0f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 16:50:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 170609
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 525254
x-xss-protection: 0
last-modified: Wed, 27 Oct 2021 00:15:40 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 27 Oct 2022 16:50:07 GMT

GET
H3 200 fetch-polyfill.js Show response
www.youtube.com/s/player/9216d1f7/fetch-polyfill.vflset/ Frame A3D9 8 KB
3 KB 31ms
17ms Script
text/javascript 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/9216d1f7/fetch-polyfill.vflset/fetch-polyfill.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

de6c4ffa2bd9fd283610e28d0db2ec48607aab39d213a51aef248673a0a7e980

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 16:48:34 GMT
content-encoding: br
x-content-type-options: nosniff
age: 170702
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2830
x-xss-protection: 0
last-modified: Wed, 27 Oct 2021 00:15:40 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 27 Oct 2022 16:48:34 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame A3D9 15 KB
16 KB 58ms
15ms Font
font/woff2 216.58.212.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.212.163 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

ams15s22-in-f3.1e100.net

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/
Origin: https://www.youtube.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 06:41:55 GMT
x-content-type-options: nosniff
age: 120701
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="apps-themes"
expires: Fri, 28 Oct 2022 06:41:55 GMT

GET
H3

200

id Show response
googleads.g.doubleclick.net/pagead/ Frame A3D9
Redirect Chain

https://googleads.g.doubleclick.net/pagead/id
https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

113 B
161 B

89ms
73ms

XHR
application/json

142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1

Protocol

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

2883601d733d6f6a8c80021b3d440c63cbabf2e3761538607fb70975b46c8728

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 133
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date: Fri, 29 Oct 2021 16:13:36 GMT
x-content-type-options: nosniff
access-control-allow-origin: https://www.youtube.com
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
pragma: no-cache
server: cafe
content-type: text/html; charset=UTF-8
location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ad_status.js Show response
static.doubleclick.net/instream/ Frame A3D9 29 B
587 B 49ms
13ms Script
text/javascript 142.250.184.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://static.doubleclick.net/instream/ad_status.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/9216d1f7/www-embed-player.vflset/www-embed-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f6.1e100.net

Software

sffe /

Resource Hash

eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:00 GMT
x-content-type-options: nosniff
age: 36
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29
x-xss-protection: 0
last-modified: Thu, 12 Dec 2013 23:40:16 GMT
server: sffe
report-to: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=900
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="ads-doubleclick-media"
expires: Fri, 29 Oct 2021 16:28:00 GMT

GET
H3 200 qyJQO4Qb9Jkfd50q3TR7-uCotD5hxe5ATFzR7CPnEOE.js Show response
www.google.com/js/th/ Frame A3D9 35 KB
13 KB 28ms
8ms Script
text/javascript 142.250.181.228
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/th/qyJQO4Qb9Jkfd50q3TR7-uCotD5hxe5ATFzR7CPnEOE.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.228 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f4.1e100.net

Software

sffe /

Resource Hash

ab22503b841bf4991f779d2add347bfae0a8b43e61c5ee404c5cd1ec23e710e1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 11:05:30 GMT
content-encoding: br
x-content-type-options: nosniff
age: 191286
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13512
x-xss-protection: 0
last-modified: Tue, 19 Oct 2021 13:00:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Thu, 27 Oct 2022 11:05:30 GMT

GET
H3 200 embed.js Show response
www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/ Frame A3D9 24 KB
7 KB 8ms
8ms Script
text/javascript 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/embed.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

38fd2fa1c9bb4724854dc55617ab234182eeca455e3b72fdc9f1e6ddca9ffd1a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 16:51:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 170524
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7348
x-xss-protection: 0
last-modified: Wed, 27 Oct 2021 00:15:40 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 27 Oct 2022 16:51:32 GMT

POST
H3 200 player Show response
www.youtube.com/youtubei/v1/ Frame A3D9 237 KB
56 KB 629ms
628ms XHR
application/json 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/youtubei/v1/player?key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

dbff6fbfc40496a53dbd4d639a3229632334e2ee3632bd863f8c82ac3f8691b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1
X-Youtube-Client-Name: 56
X-Youtube-Client-Version: 1.20211026.01.00
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
X-Goog-Visitor-Id: CgstNk9Va2d3eFUzVSiwu_CLBg%3D%3D
Content-Type: application/json

Response headers

date: Fri, 29 Oct 2021 16:13:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: Origin, X-Origin, Referer
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 57788
x-xss-protection: 0

GET
DATA 200
OK truncated
/ Frame A3D9 175 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 67ea46bc3d15351067faccb3613bd833dd3f15137a4b4a09f2e873fd41d024d2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 1TExQ5NsDBTPLw--bK7danFEvnIvQI_OkErrsAjxbG4BHw-PczXwHvW2Yosr9okFKb8XAvxKPQ=s68-c-k-c0x00ffffff-no-rj
yt3.ggpht.com/ Frame A3D9 1 KB
2 KB 35ms
7ms Image
image/jpeg 142.250.185.193
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://yt3.ggpht.com/1TExQ5NsDBTPLw--bK7danFEvnIvQI_OkErrsAjxbG4BHw-PczXwHvW2Yosr9okFKb8XAvxKPQ=s68-c-k-c0x00ffffff-no-rj

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.193 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f1.1e100.net

Software

fife /

Resource Hash

be77c8f257a78b6d7cda0fea97f176184cdd4693c0f6ced4e0b41b0d95dbaca5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 15:16:39 GMT
x-content-type-options: nosniff
age: 3417
content-disposition: inline;filename="channels4_profile.jpg"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1484
x-xss-protection: 0
server: fife
etag: "v1"
vary: Origin
content-type: image/jpeg
access-control-allow-origin: *
access-control-expose-headers: Content-Length
cache-control: public, max-age=86400, no-transform
timing-allow-origin: *
expires: Sat, 30 Oct 2021 15:16:39 GMT

GET
DATA 200
OK truncated
/ Frame A3D9 181 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f0308b66cb2b979ed7a606b4523d62a3a56342906cd69bbaa17490b69cfdd738

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Content-Type: image/png

GET
H3 204 generate_204
www.youtube.com/ Frame A3D9 0
9 B 7ms
7ms Image
text/plain 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.youtube.com/generate_204?5Khneg
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s01-in-f14.1e100.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:36 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0

POST
H3 204 qoe
www.youtube.com/api/stats/ Frame A3D9 0
19 B 15ms
15ms Ping
text/html 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/api/stats/qoe?event=streamingstats&fmt=243&afmt=140&cpn=v2ER1muDXcpBeaj3&ei=sB18YeGGJta_xN8PzN26wAY&el=embedded&docid=QTSm63ZwSX8&ns=yt&fexp=23983296%2C24001373%2C24002022%2C24002025%2C24002922%2C24004644%2C24007246%2C24027701%2C24061216%2C24064555%2C24080738%2C24082662%2C24101841%2C24108401%2C24115509%2C24116772&cl=405751832&live=live&seq=1&cbr=Chrome&cbrver=95.0.4638.54&c=WEB_EMBEDDED_PLAYER&cver=1.20211026.01.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&vps=0.000:N,0.013:B,0.732:S,0.741:S,0.741:S&cmt=0.013:0.000,0.732:0.000,0.741:0.000&afs=0.740:140::i&vfs=0.741:243:243::r&view=0.741:1:1&bwe=0.741:130000&bat=0.741:1:1&vis=0.741:0&bh=0.741:0.000

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Video Stats Server /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 29 Oct 2021 16:13:37 GMT
x-content-type-options: nosniff
server: Video Stats Server
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 remote.js Show response
www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/ Frame A3D9 93 KB
29 KB 7ms
7ms Script
text/javascript 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/remote.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ffb35efd480af56d9f533db9624e16256a9ffe66621e6d34fb8689510d70381a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 16:50:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 170610
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29616
x-xss-protection: 0
last-modified: Wed, 27 Oct 2021 00:15:40 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 27 Oct 2022 16:50:07 GMT

GET
H3 200 endscreen.js Show response
www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/ Frame A3D9 26 KB
7 KB 8ms
8ms Script
text/javascript 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/endscreen.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

62aa72673edf214afa30a41de2055d1973084395fbd809fc84490140ac286cb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 16:50:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 170610
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7227
x-xss-protection: 0
last-modified: Wed, 27 Oct 2021 00:15:40 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 27 Oct 2022 16:50:07 GMT

GET
H3 200 heartbeat.js Show response
www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/ Frame A3D9 27 KB
9 KB 8ms
8ms Script
text/javascript 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/heartbeat.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7e1030b6b9919efdf0a19b5a3cb9a307b426366addcd6bbf77a4bcf7b88f1d85

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 17:47:32 GMT
content-encoding: br
x-content-type-options: nosniff
age: 167165
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9137
x-xss-protection: 0
last-modified: Wed, 27 Oct 2021 00:15:40 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 27 Oct 2022 17:47:32 GMT

GET
H2 200 Oy6hyfNY.js Show response
tpc.googlesyndication.com/sodar/ Frame A3D9 41 KB
16 KB 314ms
14ms Script
text/javascript 172.217.23.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/Oy6hyfNY.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f1.1e100.net

Software

sffe /

Resource Hash

3b2ea1c9f3587781b58285cf64279e67f6329a3924fb93f81529f1826e2f4d16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Thu, 28 Oct 2021 10:11:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 108154
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15406
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
expires: Fri, 28 Oct 2022 10:11:03 GMT

POST
H3 204 qoe
www.youtube.com/api/stats/ Frame A3D9 0
19 B 16ms
15ms Ping
text/html 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/api/stats/qoe?event=streamingstats&fmt=243&afmt=251&cpn=uqKcKDzw1T7qmoXq&ei=sR18YaHnAta_xN8PzN26wAY&el=adunit&docid=HGNoCYOAfgw&content_v=QTSm63ZwSX8&ns=yt&fexp=23983296%2C24001373%2C24002022%2C24002025%2C24002922%2C24004644%2C24007246%2C24027701%2C24061216%2C24064555%2C24080738%2C24082662%2C24101841%2C24108401%2C24115509%2C24116772&cl=405751832&adformat=2_2_1&seq=1&cbr=Chrome&cbrver=95.0.4638.54&c=WEB_EMBEDDED_PLAYER&cver=1.20211026.01.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&vps=0.000:N,0.003:N&afs=0.003:251::i&vfs=0.003:243:243::r&view=0.003:1:1&bwe=0.003:130000&vis=0.003:0&cmt=0.003:0.000&bh=0.003:0.000

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Video Stats Server /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Fri, 29 Oct 2021 16:13:37 GMT
x-content-type-options: nosniff
server: Video Stats Server
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://www.youtube.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK videoplayback Show response
r4---sn-4g5e6nsz.googlevideo.com/ Frame A3D9 83 KB
84 KB 798ms
514ms XHR
video/webm 173.194.182.233
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r4---sn-4g5e6nsz.googlevideo.com/videoplayback?expire=1635545617&ei=sB18YeGGJta_xN8PzN26wAY&ip=216.131.114.198&id=o-AFKKWvgVOA9yXGbwGquHx__h-YvG5NE0mMDuNYaSW2mT&itag=243&aitags=133%2C134%2C135%2C136%2C137%2C160%2C242%2C243%2C244%2C247%2C248%2C278&source=youtube&requiressl=yes&mh=EE&mm=31%2C29&mn=sn-4g5e6nsz%2Csn-4g5ednld&ms=au%2Crdu&mv=m&mvi=4&pl=24&ctier=L&initcwndbps=292500&vprv=1&mime=video%2Fwebm&ns=sxLBPIVHPVtnjixRg477U7wG&gir=yes&clen=2918624&dur=105.499&lmt=1635521824359953&mt=1635523737&fvip=4&keepalive=yes&fexp=24001373%2C24007246&c=WEB_EMBEDDED_PLAYER&txp=5316224&n=beQqzw5h4_iTrA&sparams=expire%2Cei%2Cip%2Cid%2Caitags%2Csource%2Crequiressl%2Cctier%2Cvprv%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRAIgJuGI31MraZytUtyKMFf7RI2m30PkjRD7i3VfpS4xMkACIB6xuUf14XQPGwinYLC-Pus6DMhUC5XR6kFSNhg2l5to&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRQIhAJ_t0xgc_svXz5E_8y675rZ7SITRS8A89aR_17NB9WvjAiAm3d5KU9UxScdT7CGvwSImP4MK5fGQxTHzwxhD_r3c2Q%3D%3D&alr=yes&cpn=uqKcKDzw1T7qmoXq&cver=1.20211026.01.00&range=0-84746&rn=1&rbuf=0

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/base.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

173.194.182.233 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

080c9308453d47bf7a648f4812030004f740b6d160fac1fb16a687e25240f53f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:13:38 GMT
X-Restrict-Formats-Hint: None
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 84747
Last-Modified: Fri, 29 Oct 2021 15:37:04 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: video/webm
Access-Control-Allow-Origin: https://www.youtube.com
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=21299
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: https://www.youtube.com
X-Content-Type-Options: nosniff
Expires: Fri, 29 Oct 2021 16:13:38 GMT

GET
H/1.1 200
OK videoplayback Show response
r4---sn-4g5e6nsz.googlevideo.com/ Frame A3D9 64 KB
65 KB 1149ms
867ms XHR
audio/webm 173.194.182.233
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r4---sn-4g5e6nsz.googlevideo.com/videoplayback?expire=1635545617&ei=sB18YeGGJta_xN8PzN26wAY&ip=216.131.114.198&id=o-AFKKWvgVOA9yXGbwGquHx__h-YvG5NE0mMDuNYaSW2mT&itag=251&source=youtube&requiressl=yes&mh=EE&mm=31%2C29&mn=sn-4g5e6nsz%2Csn-4g5ednld&ms=au%2Crdu&mv=m&mvi=4&pl=24&ctier=L&initcwndbps=292500&vprv=1&mime=audio%2Fwebm&ns=sxLBPIVHPVtnjixRg477U7wG&gir=yes&clen=1834028&dur=105.521&lmt=1635521795700804&mt=1635523737&fvip=4&keepalive=yes&fexp=24001373%2C24007246&c=WEB_EMBEDDED_PLAYER&txp=5311224&n=beQqzw5h4_iTrA&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Cctier%2Cvprv%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRAIgEQvxmFfDG3uKxhqp7kdMoaHkCmDztwi2WjVEZflBztgCIGewl4uVWwy_-ZCudywcW2hZNzoj1XGQTPsEYkEphIMo&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRQIhAJ_t0xgc_svXz5E_8y675rZ7SITRS8A89aR_17NB9WvjAiAm3d5KU9UxScdT7CGvwSImP4MK5fGQxTHzwxhD_r3c2Q%3D%3D&alr=yes&cpn=uqKcKDzw1T7qmoXq&cver=1.20211026.01.00&range=0-65978&rn=2&rbuf=0

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/base.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

173.194.182.233 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

c39db553a3852fb47d39e9446060655fcc3e992a8d3575915303ea2528ff2eb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

Date: Fri, 29 Oct 2021 16:13:38 GMT
X-Content-Type-Options: nosniff
Cross-Origin-Resource-Policy: cross-origin
Connection: keep-alive
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
Content-Length: 65979
Last-Modified: Fri, 29 Oct 2021 15:36:35 GMT
Server: gvs 1.0
Vary: Origin
Content-Type: audio/webm
Access-Control-Allow-Origin: https://www.youtube.com
Access-Control-Expose-Headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
Cache-Control: private, max-age=21299
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Timing-Allow-Origin: https://www.youtube.com
Expires: Fri, 29 Oct 2021 16:13:38 GMT

GET
H3 200 captions.js Show response
www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/ Frame A3D9 63 KB
24 KB 9ms
9ms Script
text/javascript 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/captions.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a72420c33001675997382d9b310d923fe5b24bfd1946b603058c46d012c9a8ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 16:50:07 GMT
content-encoding: br
x-content-type-options: nosniff
age: 170610
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 24457
x-xss-protection: 0
last-modified: Wed, 27 Oct 2021 00:15:40 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Thu, 27 Oct 2022 16:50:07 GMT

POST
H3 200 next Show response
www.youtube.com/youtubei/v1/ Frame A3D9 64 KB
6 KB 208ms
207ms XHR
application/json 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/youtubei/v1/next?key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

926c587251603d10d54748b3312a88a08e6cba52a0fa03dc6d4ca7da9961c93b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1
X-Youtube-Client-Name: 56
X-Youtube-Client-Version: 1.20211026.01.00
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
X-Goog-Visitor-Id: CgstNk9Va2d3eFUzVSiwu_CLBg%3D%3D
Content-Type: application/json

Response headers

date: Fri, 29 Oct 2021 16:13:37 GMT
content-encoding: br
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: Origin, X-Origin, Referer
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 5713
x-xss-protection: 0

GET
H2 200 cast_sender.js Show response
www.gstatic.com/cv/js/sender/v1/ Frame A3D9 4 KB
3 KB 37ms
15ms Script
text/javascript 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/base.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

ee147e859ad0f09aa50367974e38ab53e7c7054c4a51d400a7f45b0eb251454f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2007
x-xss-protection: 0
last-modified: Tue, 16 Feb 2021 23:57:06 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="cloudview"
vary: Accept-Encoding
report-to: {"group":"cloudview","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview"}]}
content-type: text/javascript
cache-control: private, max-age=3000
accept-ranges: bytes
expires: Fri, 29 Oct 2021 16:13:37 GMT

GET
H3 200 hhrtBw21.html Show response
tpc.googlesyndication.com/sodar/ Frame 4A08 23 KB
9 KB 22ms
7ms Document
text/html 172.217.23.97
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://tpc.googlesyndication.com/sodar/hhrtBw21.html

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/Oy6hyfNY.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.23.97 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s45-in-f1.1e100.net

Software

sffe /

Resource Hash

861aed070db50ce0da9928455deff784c115b44540b09450f225ff7cff0c7429

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/

Response headers

accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
content-type: text/html
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy-report-only: same-origin; report-to="adspam-signals-scs"
report-to: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
timing-allow-origin: *
content-length: 8727
date: Tue, 26 Oct 2021 12:49:36 GMT
expires: Wed, 26 Oct 2022 12:49:36 GMT
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
age: 271441
cache-control: public, max-age=31536000
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3 200 cast_sender.js Show response
www.gstatic.com/eureka/clank/95/ Frame A3D9 52 KB
15 KB 22ms
7ms Script
text/javascript 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/eureka/clank/95/cast_sender.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

sffe /

Resource Hash

c9ca9fbe90c932d2954e1c8cb18dea47e37035aea6157e8e10a97e70f09402fe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 10:44:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19727
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cloudview-release
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15249
x-xss-protection: 0
last-modified: Wed, 22 Sep 2021 23:31:09 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"cloudview-release","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cloudview-release"}]}
content-type: text/javascript
cache-control: public, max-age=86400
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="cloudview-release"
expires: Sat, 30 Oct 2021 10:44:50 GMT

GET
H2 200 LnuN3C34rR70L3hG8w6Spma0p50xn6UkBXRbbJn0q6o.js Show response
pagead2.googlesyndication.com/bg/ Frame 4A08 35 KB
14 KB 28ms
6ms Script
text/javascript 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://pagead2.googlesyndication.com/bg/LnuN3C34rR70L3hG8w6Spma0p50xn6UkBXRbbJn0q6o.js

Requested by

Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/hhrtBw21.html

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

sffe /

Resource Hash

2e7b8ddc2df8ad1ef42f7846f30e92a666b4a79d319fa52405745b6c99f4abaa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Wed, 27 Oct 2021 21:18:47 GMT
content-encoding: br
x-content-type-options: nosniff
age: 154490
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13394
x-xss-protection: 0
last-modified: Tue, 26 Oct 2021 18:58:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="botguard-scs"
expires: Thu, 27 Oct 2022 21:18:47 GMT

GET
H3 204 gen_204
pagead2.googlesyndication.com/pagead/ Frame 4A08 0
20 B 73ms
49ms Image
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar&v=36&t=2&li=v_h.3.0.0.0&bgai=BkLJGsB18YdGHK8W_bubehbgPAAAAADgBugUTCPidpeCB8PMCFRGCJwIdtQkJvw&bg=!lJell9PNAAZzbWp4c207ACkAdvg8WoW1eGkMwYGrN2pKSxJzPGCSuoQhI2p5iB_2jyxOLp2VySPmngIAAABtUgAAAAdoAQcKAH8b8KT4M7-2UCC7W0kyHsksCvCr_ayApp235jrne_E_qFvs-JV3nMw12X0GgLKa-MaahY0l2I2brZhLdO_c-O1R7fY1AV8sgUxSimFkyLzfa6klHUUwBjA7PY4OcYtteUtwlQCTcBXMqdha_uQQkyb0H1LS2EaFGu0pQmeCNKSPmQKv56lwkxhzFlz0haCflcaM9YJQ3ofYH8T1FgrhNLoGWJ5n50UbCSbOn9pdt0gXvMct5CyYSxhWcaGu8j9Q0S8j5eT9W6OoiN_ya6B8leiiLfW-bF3s2kMMw3uiPDajYXWbH9Sk8alVoYfehuqBF-27Xj51RwBNWvpIy314jKRzm_2s_2o7FEDLuRVlXBHG99eoiuiIphVgIp9xbh0e11wOKN6U6HpULJ8K_Qu9llmjeaOoVh0GHFaD3eg5R90qNOukS04rJdWeaURtWlJPqJywfFKU-QFv9NW4G_CaHVsAH-CiPoIDteRu-bKatGOhbIEgIqeeBRYXorrNPFiappaMpFsn6-yYDWd5xy1ToEH3IfZM-2sOEGrnJjjfIleZPFfbuXTLYV4A9w4dSI_ZMA_40z0FZp1Y9a6o2_Il1zK4dvcR7w58J0y54mpY5xKT5CIO9GMPRcXgo8Bx6T_i_12-wHUKrf12WWks1ufYePPjJGWaSG93wsQBgksoI2ldc7rWrjFbB_bCjDI0NpD9mcXxHTIuHlc9_EM2ftCbPjM7lAOFOlMAwNh2IHDkbo9cJcGM4J-Jcp1ZPcGfl9FpT8Dq6wRiMCyeaFJRbPyzQvh_Bbi3gQVDzAKfSDFaAOfhIPbn02PdKbCsgUrRDimFxug6A0ZqcgCwgPnP4p-hnCAwnHfhFPf3vbiq3IX9UW7Bdn_1cH3tlwkgq5Cu7r11X8dW5l4XxNuQzx9QXV-w5eyF1yGnZnHxBxq9WmgGPzW7khhFkdWcAODhZ7VBmNYJGK1qNiWr9RWDyCXtoQ9PfbWuJzb6gCbQo3Ufuc26QWx44VLrLb3DXlP3NDisR8XuKq0Wiqhc9wqgkvsdT9qGuqWFtByEOSaH5eqW6rvjbjT-vwLG3cU89AslCv39FHQEnC6y

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://tpc.googlesyndication.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Oct 2021 16:13:37 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 videoplayback Show response
r4---sn-4g5e6nsz.googlevideo.com/ Frame A3D9 64 KB
64 KB 21ms
9ms XHR
audio/webm 173.194.182.233
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r4---sn-4g5e6nsz.googlevideo.com/videoplayback?expire=1635545617&ei=sB18YeGGJta_xN8PzN26wAY&ip=216.131.114.198&id=o-AFKKWvgVOA9yXGbwGquHx__h-YvG5NE0mMDuNYaSW2mT&itag=251&source=youtube&requiressl=yes&mh=EE&mm=31%2C29&mn=sn-4g5e6nsz%2Csn-4g5ednld&ms=au%2Crdu&mv=m&mvi=4&pl=24&ctier=L&initcwndbps=292500&vprv=1&mime=audio%2Fwebm&ns=sxLBPIVHPVtnjixRg477U7wG&gir=yes&clen=1834028&dur=105.521&lmt=1635521795700804&mt=1635523737&fvip=4&keepalive=yes&fexp=24001373%2C24007246&c=WEB_EMBEDDED_PLAYER&txp=5311224&n=beQqzw5h4_iTrA&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Cctier%2Cvprv%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRAIgEQvxmFfDG3uKxhqp7kdMoaHkCmDztwi2WjVEZflBztgCIGewl4uVWwy_-ZCudywcW2hZNzoj1XGQTPsEYkEphIMo&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRQIhAJ_t0xgc_svXz5E_8y675rZ7SITRS8A89aR_17NB9WvjAiAm3d5KU9UxScdT7CGvwSImP4MK5fGQxTHzwxhD_r3c2Q%3D%3D&alr=yes&cpn=uqKcKDzw1T7qmoXq&cver=1.20211026.01.00&range=65979-131668&rn=3&rbuf=3466

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

173.194.182.233 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

6122b4adfee6e30b6a720f1100d64e2c28ddc5b6837884e06877fd5c304a1546

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:38 GMT
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 65690
client-protocol: quic
last-modified: Fri, 29 Oct 2021 15:36:35 GMT
server: gvs 1.0
vary: Origin
content-type: audio/webm
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=21299
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: https://www.youtube.com
expires: Fri, 29 Oct 2021 16:13:38 GMT

POST
H3 200 log_event Show response
www.youtube.com/youtubei/v1/ Frame A3D9 28 B
50 B 24ms
23ms XHR
application/json 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/9216d1f7/www-embed-player.vflset/www-embed-player.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d7d5e54ad1e33d7ab49c664323ced79cb9723ff15e9764cd0edc3e15208e8336

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36
Content-Type: application/json
X-YouTube-Utc-Offset: 0
X-YouTube-Client-Name: 56
Referer: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1
X-YouTube-Client-Version: 1.20211026.01.00
X-YouTube-Time-Zone: Etc/Unknown
X-Goog-Visitor-Id: CgstNk9Va2d3eFUzVSiwu_CLBg%3D%3D
X-YouTube-Ad-Signals: dt=1635524016070&flash=0&frm=2&u_tz&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&bc=31&bih=-12245933&biw=-12245933&brdim=0%2C0%2C0%2C0%2C1600%2C0%2C1600%2C1200%2C1%2C1&vis=1&wgl=true&ca_type=image&bid=ANyPxKpYO55A-jM9XoqzKjBbivM_DavPI1ptA-ER08erVqbmbBOBeSXv1U2rkYKe2dnZDMLZgq2pFtkpFZVxI7Pm2R3hpBneww

Response headers

date: Fri, 29 Oct 2021 16:13:38 GMT
content-encoding: br
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
vary: Origin, X-Origin, Referer
content-type: application/json; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 31
x-xss-protection: 0

GET
H3 200 videoplayback Show response
r4---sn-4g5e6nsz.googlevideo.com/ Frame A3D9 129 KB
129 KB 9ms
7ms XHR
video/webm 173.194.182.233
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

173.194.182.233 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

f1a6078067d867778a2045b0042f14cb6ead594d2da361f74356be4ade0604d9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:38 GMT
x-restrict-formats-hint: None
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 132330
client-protocol: quic
last-modified: Fri, 29 Oct 2021 15:37:04 GMT
server: gvs 1.0
vary: Origin
content-type: video/webm
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=21299
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: https://www.youtube.com
x-content-type-options: nosniff
expires: Fri, 29 Oct 2021 16:13:38 GMT

GET
H3 200 adview
googleads.g.doubleclick.net/pagead/ Frame A3D9 0
0 50ms
50ms Image
text/html 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://googleads.g.doubleclick.net/pagead/adview?ai=Cq5uXsB18YdGHK8W_bubehbgP-NjMj2bE0ITgwA6wkB8QASDj-5MDYJUCoAG79PSgAsgBBakCxTyjJZWKsz6oAwGYBAWqBNoBT9BYA4nkVwKGYmpYwSuAgeEMAz47EyYPVyCwmc3hDAHkzNkS4dmKb8Mvk_Sy7sIR6YuLdy9khKY4Ysn_kJWSTLDB2-gxADc87tD6EMgRdsZOlDn4YAaTay4OhpWnJCGWVEX7G3Zp13zluIfuBBK-CdW_XAcqg6zJNDa8CHjES5cU87m3KsPs8ZTzNsDvMvZAnaxDZTzZnzprcKKGidVLqQkRjUNcN4CT5cKZV48due_jWvvibcyE9vEBqx1QMKm4hZFchSYHlEZQ7T-rPeLFquh1Nh7okKn1qHLABKWdvZDfA5IFBggEEAUYD5IFBggEEAEYAZIFBggTEAUYD5IFBggTEAEYAaAGVIAHrYuL3wGoB_DZG6gH8tkbqAeOzhuoB5PYG6gHnNwbqAfulrECqAf-nrECqAfVyRuoB6a-G9gHAfIHBBDHq3moCAHSCAkIgOGAUBABGF_yCB9jYS15dC1ob3N0LXB1Yi05NTQzNTM5OTY3ODkxNjEzgAoBoQs7OU4bXEOxOMgLAsITBhi79PSgAtgTAtAVAYAXAaAXAbIXHAoaCAASFHB1Yi02MjE5ODExNzQ3MDQ5MzcxGAA&sigh=y2I5SOuH1PE&uach_m=[UACH]
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 142.250.184.226 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: fra24s12-in-f2.1e100.net
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

GET
H3 200 paralleladview
www.youtube.com/pagead/ Frame A3D9 0
17 B 19ms
18ms Image
text/html 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.youtube.com/pagead/paralleladview?ai=C0a1rsB18YYz8J5bCmLAPvfiXgAQAxNCE4MAOABABIABglQKCARdjYS1wdWItNjIxOTgxMTc0NzA0OTM3MagDBKoEHE_QlcDCP0fWJdPa6yhT762XxMCSVrD42FCfqIfSCAIQAbALAboLNAgBEAEYBiABKAQwAUA4SAFYLGAAaAFwAXgBiAEAmAEBogERCgAYASAASAFYAGABcACYAgGgFwE&sigh=a7jtWxCoIJk&cid=CAASFeRopM1Xr1FhuYB8E7wG2cHeY_Y0ng&vt=0&ad_mt=1&ad_cpn=uqKcKDzw1T7qmoXq

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

timing-allow-origin: *
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
date: Fri, 29 Oct 2021 16:13:39 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H3 204 ads
www.youtube.com/api/stats/ Frame A3D9 0
17 B 16ms
16ms Image
text/html 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.youtube.com/api/stats/ads?ver=2&ns=1&event=2&device=56&content_v=QTSm63ZwSX8&el=embedded&ei=sB18YeGGJta_xN8PzN26wAY&devicever=1.20211026.01.00&cplayer=2&bti=16047577&format=2_2_1&break_type=1&conn=0&cpn=v2ER1muDXcpBeaj3&lact=2530&m_pos=0&mt=0&p_h=1&p_w=1&rwt=[RWT]&sdkv=h.3.0.0&slot_pos=0&vis=0&vol=0&wt=1635524018750&ad_cpn=uqKcKDzw1T7qmoXq&ad_id=%2C498417608772&ad_len=105000&ad_mt=1&ad_sys=YT%3AAdSense%2CAdSense&ad_v=HGNoCYOAfgw&aqi=sB18YYz8J5bCmLAPvfiXgAQ&live=1&ad_rmp=1&sli=1&slfs=1&loginael=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Video Stats Server /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Oct 2021 16:13:39 GMT
x-content-type-options: nosniff
server: Video Stats Server
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 activeview
pagead2.googlesyndication.com/pcs/ Frame A3D9 42 B
64 B 51ms
50ms Image
image/gif 142.250.185.66
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssxqZSfTx2A2hYt43xmDxWYDImgX_srCVDdPGgXdZIx4uTWysqQJlyZHlqJAgTAENFcDFEflUCyIpUGucePuN_WGbqmNKZgnPH13ERPj_K4WDxOJ9kYRA&sai=AMfl-YRSQ03v6Q5B-mkKfhlaPYA0nGNNmOP0tMBjZ6tVV5daRmW6mCns9aUQsPzjfPPKKjIYFnirk8VJSek5URkQWg8uHVQdAj3ycv6owk8F&sig=Cg0ArKJSzCtbzassr1XaEAE&id=lidarv&acvw=sv%3D20211026%26cb%3Dyw%26e%3D15%26nas%3D1%26if%3D1%26sdk%3Db%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D105000%26vmtime%3D0%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26ic%3D18%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D400875651%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26ptlt%3D2589%26pngs%3D9,14,15%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1635524018738&avm=1

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.66 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s48-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Oct 2021 16:13:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame A3D9 42 B
64 B 20ms
19ms Image
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CK9dYsB18YdGHK8W_bubehbgP-NjMj2bE0ITgwA6wkB8QASDj-5MDYJUCoAG79PSgAsgBBakCxTyjJZWKsz6oAwGYBAWqBNoBT9BYA4nkVwKGYmpYwSuAgeEMAz47EyYPVyCwmc3hDAHkzNkS4dmKb8Mvk_Sy7sIR6YuLdy9khKY4Ysn_kJWSTLDB2-gxADc87tD6EMgRdsZOlDn4YAaTay4OhpWnJCGWVEX7G3Zp13zluIfuBBK-CdW_XAcqg6zJNDa8CHjES5cU87m3KsPs8ZTzNsDvMvZAnaxDZTzZnzprcKKGidVLqQkRjUNcN4CT5cKZV48due_jWvvibcyE9vEBqx1QMKm4hZFchSYHlEZQ7T-rPeLFquh1Nh7okKn1qHLABKWdvZDfA6AGVIAHrYuL3wGoB_DZG6gH8tkbqAeOzhuoB5PYG6gHnNwbqAfulrECqAf-nrECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwGoCAHSCAkIgOGAUBABGF_yCB9jYS15dC1ob3N0LXB1Yi05NTQzNTM5OTY3ODkxNjEzgAoBoQs7OU4bXEOxOMgLAtgTAtAVAYAXAaAXAQ&sigh=P1CaLub2gw4&label=part2viewed&ad_mt=1&acvw=sv%3D20211026%26cb%3Dyw%26e%3D0%26nas%3D1%26if%3D1%26sdk%3Db%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26nmt%3D0%26tcm%3D1%26bt%3D0%26pst%3D-1%26dur%3D105000%26vmtime%3D0%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26i0%3D18%26ic%3D0%26cs%3D18%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D400875651%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26ptlt%3D2590%26pngs%3D9,14,15s%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1635524018738

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Oct 2021 16:13:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
googleads.g.doubleclick.net/pagead/interaction/ Frame A3D9 42 B
64 B 19ms
18ms Image
image/gif 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://googleads.g.doubleclick.net/pagead/interaction/?ai=CK9dYsB18YdGHK8W_bubehbgP-NjMj2bE0ITgwA6wkB8QASDj-5MDYJUCoAG79PSgAsgBBakCxTyjJZWKsz6oAwGYBAWqBNoBT9BYA4nkVwKGYmpYwSuAgeEMAz47EyYPVyCwmc3hDAHkzNkS4dmKb8Mvk_Sy7sIR6YuLdy9khKY4Ysn_kJWSTLDB2-gxADc87tD6EMgRdsZOlDn4YAaTay4OhpWnJCGWVEX7G3Zp13zluIfuBBK-CdW_XAcqg6zJNDa8CHjES5cU87m3KsPs8ZTzNsDvMvZAnaxDZTzZnzprcKKGidVLqQkRjUNcN4CT5cKZV48due_jWvvibcyE9vEBqx1QMKm4hZFchSYHlEZQ7T-rPeLFquh1Nh7okKn1qHLABKWdvZDfA6AGVIAHrYuL3wGoB_DZG6gH8tkbqAeOzhuoB5PYG6gHnNwbqAfulrECqAf-nrECqAfVyRuoB6a-G6gH89EbqAeW2BuoB6qbsQKoB9-fsQLYBwGoCAHSCAkIgOGAUBABGF_yCB9jYS15dC1ob3N0LXB1Yi05NTQzNTM5OTY3ODkxNjEzgAoBoQs7OU4bXEOxOMgLAtgTAtAVAYAXAaAXAQ&sigh=P1CaLub2gw4&label=admute&ad_mt=1&acvw=sv%3D20211026%26cb%3Dyw%26e%3D10%26nas%3D1%26if%3D1%26sdk%3Db%26p%3D0,0,0,0%26tos%3D0,0,0,0,0%26mtos%3D0,0,0,0,0%26amtos%3D0,0,0,0,0%26mcvt%3D0%26ps%3D-12245933,-12245933%26scs%3D1600,1200%26bs%3D0,0%26vht%3D0%26mut%3D0%26a%3D0%26ft%3D0%26dft%3D0%26at%3D0%26dat%3D0%26as%3D0%26vpt%3D0%26gmm%3D4%26efpf%3D2%26nio%3D1%26nmt%3D0%26tcm%3D1%26bt%3D5%26pst%3D-1%26dur%3D105000%26vmtime%3D0%26dvs%3D0%26dfvs%3D0%26dvpt%3D0%26is%3D18%26i0%3D18%26ic%3D4096%26cs%3D4114%26c%3D0%26mc%3D0%26nc%3D0%26mv%3D0%26nv%3D0%26lte%3D-1%26ces%26avms%3Dnio%26qi%3D400875651%26psm%3D1%26psv%3D0%26psfv%3D0%26psa%3D0%26ptlt%3D2592%26pngs%3D9,14,15s%26ssb%3D0,0,0,0,0,0,0,0,0,0,0&gv=atos%3D0,0,0,0,0%26avt%3D0%26davs%3D0%26dafvs%3D0%26ss%3D0%26t%3D1635524018738

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Oct 2021 16:13:39 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 mqdefault_live.jpg
i.ytimg.com/vi/QTSm63ZwSX8/ Frame A3D9 13 KB
14 KB 54ms
15ms Image
image/jpeg 142.250.184.214

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://i.ytimg.com/vi/QTSm63ZwSX8/mqdefault_live.jpg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.214 -, , ASN (),

Reverse DNS

Software

sffe /

Resource Hash

470552abd98b9ab7588ba776690e497b89ce54d952b6579d6e8806d090913ae8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:12:30 GMT
x-content-type-options: nosniff
age: 69
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 13553
x-xss-protection: 0
server: sffe
etag: "1635521849"
vary: Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: image/jpeg
cache-control: public, max-age=300
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Fri, 29 Oct 2021 16:17:30 GMT

GET
H3 204 playback
www.youtube.com/api/stats/ Frame A3D9 0
17 B 17ms
16ms Image
text/html 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.youtube.com/api/stats/playback?ns=yt&el=adunit&cpn=uqKcKDzw1T7qmoXq&docid=HGNoCYOAfgw&ver=2&referrer=https%3A%2F%2Fwww.youtube.com%2Fembed%2FQTSm63ZwSX8%3Fenablejsapi%3D1%26origin%3D*%26playsinline%3D1%26autoplay%3D1%26mute%3D1&cmt=0.012&ei=sR18YaHnAta_xN8PzN26wAY&fmt=243&fs=0&rt=1.738&of=-_xhI4eL4MjOL53E0nwGhA&adformat=2_2_1&content_v=QTSm63ZwSX8&euri=https%3A%2F%2Fwww.google.com%2F&lact=2566&cl=405751832&mos=1&vm=CAEQABgEOjJBS1JhaHdBVmJhVnZRSl96eVdXYUhrNWZkSkw3bXYwQnJlMnFNUWlfcHV3eVBZOXBQZ2JLQVBta0tESml4VW05T0Y3Wl9tdWZDN2syMkpCYjVvLTBhRjlrS0F0SDlfeDNRcUZWbVJvSEFQa0ktcTA1UGtveDdwc0dzdmFzME1n&volume=100&aqi=sB18YYz8J5bCmLAPvfiXgAQ&cbr=Chrome&cbrver=95.0.4638.54&c=WEB_EMBEDDED_PLAYER&cver=1.20211026.01.00&cplayer=UNIPLAYER&cos=Windows&cosver=10.0&cplatform=DESKTOP&autoplay=1&delay=28&hl=de_DE&cr=DE&len=105.521&fexp=23983296%2C24001373%2C24002022%2C24002025%2C24002922%2C24004644%2C24007246%2C24027701%2C24061216%2C24064555%2C24080738%2C24082662%2C24101841%2C24108401%2C24115509%2C24116772&rtn=10&afmt=251&size=1%3A1&inview=0&muted=1

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Video Stats Server /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Oct 2021 16:13:39 GMT
x-content-type-options: nosniff
server: Video Stats Server
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 204 ptracking
www.youtube.com/ Frame A3D9 0
17 B 17ms
16ms Image
text/html 216.58.212.174
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.youtube.com/ptracking?html5=1&video_id=HGNoCYOAfgw&cpn=uqKcKDzw1T7qmoXq&ei=sR18YaHnAta_xN8PzN26wAY&ptk=youtube_host&ptchn=youtube_host&pltype=adhost&content_v=QTSm63ZwSX8

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.212.174 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Video Stats Server /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/embed/QTSm63ZwSX8?enablejsapi=1&origin=*&playsinline=1&autoplay=1&mute=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 29 Oct 2021 16:13:39 GMT
x-content-type-options: nosniff
server: Video Stats Server
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 videoplayback Show response
r4---sn-4g5e6nsz.googlevideo.com/ Frame A3D9 128 KB
128 KB 8ms
8ms XHR
audio/webm 173.194.182.233
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://r4---sn-4g5e6nsz.googlevideo.com/videoplayback?expire=1635545617&ei=sB18YeGGJta_xN8PzN26wAY&ip=216.131.114.198&id=o-AFKKWvgVOA9yXGbwGquHx__h-YvG5NE0mMDuNYaSW2mT&itag=251&source=youtube&requiressl=yes&mh=EE&mm=31%2C29&mn=sn-4g5e6nsz%2Csn-4g5ednld&ms=au%2Crdu&mv=m&mvi=4&pl=24&ctier=L&initcwndbps=292500&vprv=1&mime=audio%2Fwebm&ns=sxLBPIVHPVtnjixRg477U7wG&gir=yes&clen=1834028&dur=105.521&lmt=1635521795700804&mt=1635523737&fvip=4&keepalive=yes&fexp=24001373%2C24007246&c=WEB_EMBEDDED_PLAYER&txp=5311224&n=beQqzw5h4_iTrA&sparams=expire%2Cei%2Cip%2Cid%2Citag%2Csource%2Crequiressl%2Cctier%2Cvprv%2Cmime%2Cns%2Cgir%2Cclen%2Cdur%2Clmt&sig=AOq0QJ8wRAIgEQvxmFfDG3uKxhqp7kdMoaHkCmDztwi2WjVEZflBztgCIGewl4uVWwy_-ZCudywcW2hZNzoj1XGQTPsEYkEphIMo&lsparams=mh%2Cmm%2Cmn%2Cms%2Cmv%2Cmvi%2Cpl%2Cinitcwndbps&lsig=AG3C_xAwRQIhAJ_t0xgc_svXz5E_8y675rZ7SITRS8A89aR_17NB9WvjAiAm3d5KU9UxScdT7CGvwSImP4MK5fGQxTHzwxhD_r3c2Q%3D%3D&alr=yes&cpn=uqKcKDzw1T7qmoXq&cver=1.20211026.01.00&range=131669-262890&rn=5&rbuf=6923

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

173.194.182.233 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gvs 1.0 /

Resource Hash

d52d92a2a7e152f754dcf2a6b2f3d652dbd178be4626bc616cd87f810f660c30

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://www.youtube.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Response headers

date: Fri, 29 Oct 2021 16:13:39 GMT
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 131222
client-protocol: quic
last-modified: Fri, 29 Oct 2021 15:36:35 GMT
server: gvs 1.0
vary: Origin
content-type: audio/webm
access-control-allow-origin: https://www.youtube.com
access-control-expose-headers: Client-Protocol, Content-Length, Content-Type, X-Bandwidth-Est, X-Bandwidth-Est2, X-Bandwidth-Est3, X-Bandwidth-App-Limited, X-Bandwidth-Est-App-Limited, X-Bandwidth-Est-Comp, X-Bandwidth-Avg, X-Head-Time-Millis, X-Head-Time-Sec, X-Head-Seqnum, X-Response-Itag, X-Restrict-Formats-Hint, X-Sequence-Num, X-Segment-Lmt, X-Walltime-Ms
cache-control: private, max-age=21298
access-control-allow-credentials: true
accept-ranges: bytes
timing-allow-origin: https://www.youtube.com
expires: Fri, 29 Oct 2021 16:13:39 GMT

GET
H3 200 videoplayback Show response
r4---sn-4g5e6nsz.googlevideo.com/ Frame A3D9 274 KB
274 KB 10ms
9ms XHR
video/webm 173.194.182.233
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/s/player/9216d1f7/player_ias.vflset/de_DE/base.js

Protocol

Security

QUIC, , AES_128_GCM

Server

173.194.182.233 , United States, ASN15169 (GOOGLE, US),

Reverse DNS